- tor-dev - lists.torproject.org

Building Tor on OS X with brew fails
by Bernard Tyers - ei8fdb 11 Apr '13

11 Apr '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi there, I just tried building Tor with brew on OS X (10.6.8) using the instructions available on the TP website ( ). It fails at the last few steps complaining of a 404: Homebrew. If formula fail to build uninstall Macports/Fink and reinstall any affected formula. Also installing dependencies: libevent ==> Downloading http://monkey.org/~provos/libevent-2.0.12-stable.tar.gz ######################################################################## 100.0% ==> ./configure --prefix=/usr/local/Cellar/libevent/2.0.12 ==> make install /usr/local/Cellar/libevent/2.0.12: 47 files, 2.0M, built in 66 seconds ==> Downloading https://www.torproject.org/dist/tor-0.2.1.30.tar.gz curl: (22) The requested URL returned error: 404 Error: Failure while executing: /usr/bin/curl -f#LA Homebrew\ 0.8\ (Ruby\ 1.8.7-358;\ Mac\ OS\ X\ 10.6.8) https://www.torproject.org/dist/tor-0.2.1.30.tar.gz -o /Library/Caches/Homebrew/tor-0.2.1.30.tar.gz I can confirm that https://www.torproject.org/dist/tor-0.2.1.30.tar.gz is (to me) a 404. I know I can install TBB but I was curious if this approach also worked. Has the location moved? Thanks. Bernard - -------------------------------------- Bernard / bluboxthief / ei8fdb IO91XM / www.ei8fdb.org -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJRZw0rAAoJENsz1IO7MIrrI+oH/jE6hxAeTb9SD3orihGZ0Hn4 wVxf9MkagvH4aS2Hl33FUycr0liy6JqHxxXa16NjZqAfiuUstvQiEiMWAXah1Oa9 A0qNjNOfnmi0BsxJES4E30e3+MvmGzNw4fLjos6iPk2B/+s5orqSv2cba5iVEwXp 3VsqhFOlugVatI592201K9+tQgl/a1aCXfZnW1t4GFqAIf2ApdoX89cV1l3jqMDP NYOZRaX79FGB7iF+/3SrTKtEwVifjAh/IoCx4cEuVOpGFjFt0Jmkgbd1ThlKYqwn TYLFUdKWhebl1N9v4fjow0sXrXh71g3oBuavX2XA+YFqG/ChBDSFPKzps2JyWIQ= =BiEt -----END PGP SIGNATURE-----

3 3

Fwd: Fwd: Orbot feature for GSoC 2013
by Nathan Freitas 11 Apr '13

11 Apr '13

Is there room for an Orbot developer under Tor's GSoC? I know that I was completely awol during this process, and not a mentor, but this is a worthwhile effort! -------- Original Message -------- Subject: Fwd: Orbot feature for GSoC 2013 Date: Thu, 11 Apr 2013 17:50:26 +0200 From: Pavlos <onexemailx(a)gmail.com> To: nathan(a)guardianproject.info CC: abel(a)guardianproject.info Hello, I talked in #tor-dev and asked about a feature I could implement for Orbot as part of Google summer of code 2013 and abel suggested the implementation of the android 4.x's VPN Service as a way to get rootless transparent torification. I understand this was created https://github.com/guardianproject/OrbotVPN but for some reason couldn't be finished? Is it plausible to implement it? If not maybe there is something else I could make? Some words about me: I'm a CS student at my 5th year. I finished with my courses a year ago and I'm just enrolled because I'm an intern at CERN and have to be a student. My github is here: https://github.com/uberspot/ I have worked previously on two android apps (OpenWifiStatistics that coorelates gps with wifi scan data and AnagramSolver for solving anagrams) and I have another one almost complete (a lan multiplayer trivia game). Kindly awaiting your responce, Paul

3 3

Help me test Tor Browser Launcher
by Micah Lee 10 Apr '13

10 Apr '13

I posted a little over a month ago about Tor Browser Launcher, a project I've been working on to make it easier for GNU/Linux users to securely download, install, keep updated, and launch TBB: https://github.com/micahflee/torbrowser-launcher I think it's about ready for a first release! I wrote a blog post all about it (including screenshots), where I ask for help testing it: https://micahflee.com/2013/04/sudo-apt-get-install-torbrowser/ Please give me feedback, and post any bugs you find on the GitHub issue tracker. Also, at Tom's suggestion I posted this ticket to get Tor Browser Launcher in deb.torproject.org: https://trac.torproject.org/projects/tor/ticket/8648 Can someone respond to get the ball rolling? Thanks! -- Micah Lee https://twitter.com/micahflee

2 4

Tor in Google Summer of Code 2013
by Damian Johnson 10 Apr '13

10 Apr '13

Interested in coding on Tor and getting paid for it by Google? If you are a student, we have good news for you: We have been accepted as a mentoring organization for Google Summer of Code 2013! https://www.google-melange.com/gsoc/homepage/google/gsoc2013 https://www.google-melange.com/gsoc/org/google/gsoc2013/tor Here are the facts: The summer of code gives you the opportunity to work on your own Tor-related coding project with one of the Tor developers as your mentor. You can apply for a coding project related to Tor itself or to one of its many supplemental projects... https://www.torproject.org/getinvolved/volunteer.html.en#Projects Your mentor will help you when you're stuck with your project and guide you in becoming part of the Tor community. Google pays you 5,000 USD for the three months of your project, so that you can focus on coding and don't have to worry about how to pay your bills. Did we catch your attention? These are your next steps: Go look at the Google Summer of Code FAQ [1] to make sure you are eligible to participate. Have a look at our ideas list [2] to see if one of those projects matches your interests. If there is no project on that list that you'd want to work on, read the documentation on our website [3] and make up your own project idea! Come to #tor-dev on OFTC [4] and let us know about your project idea. Communication is essential to success in the summer of code, and we're unlikely to accept students we haven't heard from before reading their application. So really, come to the IRC channel and talk to us! Finally, write down your project idea using our template [5] and submit your application to Google until May 3, 2013 [6]. We are looking forward to discussing your project idea with you! [1] https://www.google-melange.com/gsoc/document/show/gsoc_program/google/gsoc2… [2] https://www.torproject.org/about/gsoc.html.en#Ideas [3] https://www.torproject.org/docs/documentation.html.en#UpToSpeed [4] https://www.torproject.org/about/contact.html.en#irc [5] https://www.torproject.org/about/gsoc.html.en#Template [6] https://www.google-melange.com/gsoc/document/show/gsoc_program/google/gsoc2…

1 0

Hidden service access without TOR
by Jesus Cea 09 Apr '13

09 Apr '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Somebody pointed to me "Using Tor as a library" <https://lists.torproject.org/pipermail/tor-dev/2013-March/004564.html>. I am thinking about writing a proxy service to install in your local machine to be able to access TOR Hidden Services without having to install the full TOR in your machine. Client anonimity here is not an issue, but being able to access to "onion" hidden services easily and faster than providing mutual anonimity. All documentation I see describes the hidden services from a high level view, but I would like to be able to connect to them without involving TOR. And without reading TOR sourcecode :-) Is this current? <https://gitweb.torproject.org/torspec.git?a=blob_plain;hb=HEAD;f=rend-spec.…> The client needing to open her own rendezvous incoming port is a problem :). What if the client doesn't need anonimity?. Any suggestion? Is the recomended/only way, to simply compile as library and call "tor_main()"?. No other choice?. Thanks! - -- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - http://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQCVAwUBUWOaLplgi5GaxT1NAQKfvAP/fKYx4jVTNfzD1ZYGC1xVIFy/P6jFclWr kW95YDavZ7LHNhIgd/LlQ1mS0QViN6p7zOi7OOie8bhdIa6POVdsE8sYplUKEL4d vnx/XEH5rgVrLC9es4MQMLu4dqxpaN/mTmKpRGvCi4stPJ+S5dQqa+8U5m8eu5un RpjNbClG50g= =Y+RA -----END PGP SIGNATURE-----

2 1

Moving our website to git and splitting it in two
by Peter Palfrader 08 Apr '13

08 Apr '13

Hi, Tom asked what was needed to get our website moved to git. Probably not much. And while we're at it we could split the repository into two parts: - things that are copied over verbatim, and - things that build stuff that make our website. Splitting this makes it easier to publish something more clean to our webservers - there is little point in putting build scripts and sources into the webroot right along the finished html files. https://people.torproject.org/~weasel/tor-web-underlay/ and https://people.torproject.org/~weasel/tor-web-web/ (add .git to clone) Should we move to this? Something different? Cheers, weasel -- | .''`. ** Debian ** Peter Palfrader | : :' : The universal http://www.palfrader.org/ | `. `' Operating System | `- http://www.debian.org/

7 13

Re: [tor-dev] Embedding tor in an application and using tor without opening a port
by wac 06 Apr '13

06 Apr '13

Hi Navin: Some versions of zlib can be built with the IDE but for the one I used (oldest bugfree because of gzip support) I used nmake. Just open Visual Studio command prompt. Or if you don't locate it, (but recommend you to do it) just run vcvars32.bat (is in bin directory) to set up the environment. For libevent: open the Visual Studio Command Prompt, then cd \where\you\put\it nmake -f makefile.nmake for zlib something similar. for openssl you need to do more steps and install perl for configuration (they recommend activestateperl) at INSTALL.W32 file just read "Visual C++" section. I just used dynamic library but there is a way to do it static library if you want. when you open the solution left click at the project. Select properties. Then go to Configuration properties -> C/C++ -> General See there "Additional include directories". You need to change those as they are not relative. Then go to Configuration properties -> Linker -> General See there "Additional Library Directories". You need to change those too to point to your directory. I then dropped the openssl dlls next to Tor executable. I want you to know I changed the runtime to be non debug version as I don't needed to debug there so if you want to do it you need to somehow build them with debug symbols and take back debug build of tor to use debug runtime otherwise it won't link as the linker would find duplicated symbols. Maybe the tree is unnecessary but ok there it goes. Regards Waldo ------------------------------ On Thu, Apr 4, 2013 20:56 EDT Navin Francis wrote: >Hi Waldo, > >I tried to build using your project and I think most of the Tor code works >but I am not sure how to add all the libraries. Can they be built from the >IDE? > >Can you also run "tree /f >files.txt" in your source folder and attach the >file. That way, I can make sure I have the same files as you. > >thanks, >Navin > > >On Tue, Apr 2, 2013 at 10:49 PM, wac <waldoalvarez00(a)yahoo.com> wrote: > > > ------------------------------ > On Wed, Apr 3, 2013 00:38 EDT Navin Francis wrote: > > Hi Nick: > > >It seems like like we are trying to do almost exactly the same thing :) > > > >You also mentioned that you got Tor working as a visual studio project. I > >was trying to do this myself, but its really a PITA since the Tor > >configuration does not generate a visual studio project and the VC++ > >libraries don't play well with the cygwin libraries (I thought that Tor > >only supports cygwin on windows). If your code compiles, I would really > >appreciate it if you can upload it somewhere. > > Sure. I did it with visual studio 2010 since cygwin weights a lot and I am > over dialup. So just used resources available ;). The solutions + project + > instructions will serve to you? I attached the solutions + project. I am > looking to upload the rest once I am done. I tested writing and works like > a charm but I am using the same thread. Requested www.torproject.orgwebpage using Tor :). Still gotta make things reentrant. Maybe someone > wants to join. > > You need to place the files inside the folder win32 and drop the files > there. I named it tor-windows-vs2010 but you likely can choose whatever you > want for the name. > > You will have to change libraries location and header files since I didn't > set them relative. > > I built all the libraries from source. OpenSSL, libevent and zlib with > visual studio as well with nmake using the visual studio console. For > OpenSSL you need Perl. Not sure if zlib is ok since I had to try several > for gzip support and picked an old one. > > If you need help building the libraries just let me know. > > Ahh and I had to move some files around. At least curve25519-donna.c I > placed it in win 32 directory for Tor 0.2.4. > > That should do, but if you hit something just let me know. > > Regards > Waldo > > > _______________________________________________ > tor-dev mailing list > tor-dev(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev > >

1 0

Re: [tor-dev] Embedding tor in an application and using tor without opening a port
by wac 05 Apr '13

05 Apr '13

------------------------------ On Wed, Apr 3, 2013 00:38 EDT Navin Francis wrote: Hi Nick: >It seems like like we are trying to do almost exactly the same thing :) > >You also mentioned that you got Tor working as a visual studio project. I >was trying to do this myself, but its really a PITA since the Tor >configuration does not generate a visual studio project and the VC++ >libraries don't play well with the cygwin libraries (I thought that Tor >only supports cygwin on windows). If your code compiles, I would really >appreciate it if you can upload it somewhere. Sure. I did it with visual studio 2010 since cygwin weights a lot and I am over dialup. So just used resources available ;). The solutions + project + instructions will serve to you? I attached the solutions + project. I am looking to upload the rest once I am done. I tested writing and works like a charm but I am using the same thread. Requested www.torproject.org webpage using Tor :). Still gotta make things reentrant. Maybe someone wants to join. You need to place the files inside the folder win32 and drop the files there. I named it tor-windows-vs2010 but you likely can choose whatever you want for the name. You will have to change libraries location and header files since I didn't set them relative. I built all the libraries from source. OpenSSL, libevent and zlib with visual studio as well with nmake using the visual studio console. For OpenSSL you need Perl. Not sure if zlib is ok since I had to try several for gzip support and picked an old one. If you need help building the libraries just let me know. Ahh and I had to move some files around. At least curve25519-donna.c I placed it in win 32 directory for Tor 0.2.4. That should do, but if you hit something just let me know. Regards Waldo > >Regards, >Navin > > >On Mon, Apr 1, 2013 at 9:20 PM, wac <waldoalvarez00(a)yahoo.com> wrote: > > > Hi Nick: > > > * Using process isolation to isolate Tor from its controllers makes it > > easier to tell Tor bugs from controller bugs.... > > > * Using process isolation to isolate Tor from its controllers can also > > make it easier to secure each of the two domains properly against bugs > > in the other, especially if you're using OS or VM sandboxing features. > > This is a point I think is valid to consider. Thanks for pointing it. > However a library is not equal to lack of process isolation. I could have > the application (for instance the browser) launch a process being a thin > layer around the library and exchange data using some IPC mechanism. That > could be a future step. > > >plus maybe another library that would find a running Tor or launch one as > needed. > > Is there a standard way of doing this? If not maybe would be good idea to > define it. A way to know if Tor is running and the listening > interfaces/ports. Authenticating it if possible, I would not like to have > malware pretending to be Tor and have it easily steal all my network > traffic because of this. Perhaps finding the binary somehow and check the > hash? And avoid malware using Tor as a presentation key to then shut it > down and replace it. Good questions I think. Maybe this should be just > configurable by end user instead of doing it automatically until they are > answered. > > If platform dependent I think could be defined for each platform. > > > That way we wouldn't have a huge pile of apps all stuck downloading > their own directory > >information > > I have no intentions to drop cached information, I actually pretend to > share it as much as possible. Ok is not a perfect world, some will happen. > Maybe this could be defined as well to allow diverging implementations > filling other niches than Tor, share already downloaded data or refresh it > in a cooperative way. > > > Nonetheless, people keep wanting to do it the way you suggest, and it's > free software, so do what you like. > > Correct, freedom of choice ;). Other ppl is not able to decide what's best > for me! Anyways recommendations are always welcome. > > Regards > Waldo > > _______________________________________________ > tor-dev mailing list > tor-dev(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev >

2 1

default value of CookieAuthentication is wrong inthe documentation
by Tomáš Hnyk 04 Apr '13

04 Apr '13

Hello, I am using tor on Ubuntu 12.10, version of tor: v0.2.3.22-rc (git-4a0c70a817797420) The documentation https://www.torproject.org/docs/tor-manual.html.en says that default value of CookieAuthentication is 0. However, until I set it 0 in my torrc, tor wanted a cookie ("host 9051 515 Authentication failed: Wrong length on authentication cookie.") My torrc is this: FascistFirewall 1 ControlPort 9051 CookieAuthentication 0 I guess the documentation (on the web and the man page and comments in torrc file) should ve mended to reflect this. Or am I missing something? Regards, Tomas Hnyk P.S.: I know I should use some form of authentication, but I just wanted to get tor running first and see what it can do.

4 8

Re: [tor-dev] Embedding tor in an application and using tor without opening a port
by wac 03 Apr '13

03 Apr '13

Hi Nick: > * Using process isolation to isolate Tor from its controllers makes it > easier to tell Tor bugs from controller bugs.... > * Using process isolation to isolate Tor from its controllers can also > make it easier to secure each of the two domains properly against bugs > in the other, especially if you're using OS or VM sandboxing features. This is a point I think is valid to consider. Thanks for pointing it. However a library is not equal to lack of process isolation. I could have the application (for instance the browser) launch a process being a thin layer around the library and exchange data using some IPC mechanism. That could be a future step. >plus maybe another library that would find a running Tor or launch one as needed. Is there a standard way of doing this? If not maybe would be good idea to define it. A way to know if Tor is running and the listening interfaces/ports. Authenticating it if possible, I would not like to have malware pretending to be Tor and have it easily steal all my network traffic because of this. Perhaps finding the binary somehow and check the hash? And avoid malware using Tor as a presentation key to then shut it down and replace it. Good questions I think. Maybe this should be just configurable by end user instead of doing it automatically until they are answered. If platform dependent I think could be defined for each platform. > That way we wouldn't have a huge pile of apps all stuck downloading their own directory >information I have no intentions to drop cached information, I actually pretend to share it as much as possible. Ok is not a perfect world, some will happen. Maybe this could be defined as well to allow diverging implementations filling other niches than Tor, share already downloaded data or refresh it in a cooperative way. > Nonetheless, people keep wanting to do it the way you suggest, and it's free software, so do what you like. Correct, freedom of choice ;). Other ppl is not able to decide what's best for me! Anyways recommendations are always welcome. Regards Waldo

2 1