- tor-dev - lists.torproject.org

txtorcon 'all_routers' issue
by meejah 23 Feb '17

23 Feb '17

As per https://github.com/meejah/txtorcon/issues/203 all released versions of txtorcon that have TorState.all_routers will, upon a NEWCONSENSUS event, make this set empty. There is already a fix on master for the real issue and it will be in the next release. For users of released versions there is a workaround, pointed out by evilaliv3: simply use TorState.routers.values() instead. Cheers, meejah

1 0

List of Tor Exit IP address: Is this available from Tor Control Port
by Fabio Pietrosanti (naif) - lists 22 Feb '17

22 Feb '17

Hi all, is the list of Tor Exit IP addresses available from Tor Control Port or only from https://check.torproject.org/exit-addresses via TorDNSEL ? -naif

2 1

announcing: txmix, a twisted python mixnet library
by dawuud 19 Feb '17

19 Feb '17

Hi. I'd like to announce txmix, a library for writing mixnets in python. https://github.com/applied-mixnetworks/txmix txmix is GPL3 licensed and currently depends on: sphinxmixcrypto, Twisted, txtorcon, attrs, eliot and Tor Project's chutney (for integration tests). txmix allows you to write mixnets with reduced code complexity and transport agnosticism... however I've choosen to focus my development efforts on the Tor onion transport for several reasons, the onion transport has some properties which the UDP transport does not: - reliability - forward secrecy - NAT penetration Additionally the Tor anonymity properties are a welcome bonus since they aren't really overlapping with those of the mixnet, they are vulnerable to different types of attacks and accomodate for totally different threat models. Currently txmix has some integration tests that use chutney to spin up a local 25 relay tor network; builds a mixnet using onion services as the transport and then tests functionality by sending and receiving messages on the mixnet. future development ------------------ - txmix could certainly be used to write various kinds of mixnets, however, we are missing a PKI. Without some kind of public key infrastructure how will mix clients learn about mix public keys? - sphixmixcrypto library needs improvements that would allow us to specify more message types such as dummy/cover traffic message and heartbeat messages. These of course are essential for the defense against certain known active attacks against some mix types. questions, code review and pull requests welcome. David Stainton

1 0

Netflow padding
by grarpamp 19 Feb '17

19 Feb '17

Are these the current / recommended paper refs for eyeballing things on this to date? torspec/proposals/251-netflow-padding.txt torspec/proposals/254-padding-negotiation.txt

2 1

Re: [tor-dev] GAEuploader (Adam Fisk)
by Katherine Li 19 Feb '17

19 Feb '17

Hi Adam, my experience is also that GAE is blocked in China. It is possible to find unblocked IPs. XXnet, for example, has a built-in scanne <https://github.com/XX-net/XX-Net/wiki/%E2%80%9C%E6%89%AB%E6%8F%8FIP%E2%80%9…>r for Google's unblocked IPs. GAEuploader currently does not have built-in scanning for unblocked IP addresses. We definitely want to incorporate this feature in the future, and any contribution on this would be much appreciated. On Wed, Feb 1, 2017 at 9:40 AM, Adam Fisk <afisk(a)getlantern.org> wrote: > In our experience GAE is basically blocked in China at least. Is that > your experience as well? I believe it's possible to find IPs that are > unblocked, but you'd have to embed those IPs somehow into the client > or integrate the scanning. Katherine Li https://github.com/katherinelitor/GAEuploader

1 0

Tor Browser and Mozilla addon verification
by bancfc＠openmailbox.org 18 Feb '17

18 Feb '17

Hi, does Tor Browser check addon code for tampering for addons from the Mozilla server?

2 2

[release] metrics-lib/DescripTor 1.6.0
by iwakeh 17 Feb '17

17 Feb '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi there! Another release of metrics-lib/DescripTor is available: https://dist.torproject.org/descriptor/1.6.0/ - From the change-log: * Major changes - Deprecate DescriptorDownloader in favor of the much more widely used DescriptorCollector. * Medium changes - Parse "proto" lines in server descriptors, "pr" lines in status entries, and "(recommended|required)-(client|relay)-protocols" lines in consensuses and votes. - Parse "shared-rand-.*" lines in consensuses and votes. ... and quite a bit more see [0]. Please direct comments and questions to the metrics-team mailing list [1]. Cheers, iwakeh [0] https://gitweb.torproject.org/metrics-lib.git/plain/CHANGELOG.md?id=10042d3… [1] https://lists.torproject.org/cgi-bin/mailman/listinfo/metrics-team -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJYpyhdAAoJEPeEx9Sa/gvikq0QAKKhd2v04WGwokOGD+j7HNJC ylEamW7BSxMHCecgkMULy7RvTkmUmw/OJ66Ob2chdqVd6di8/fej3Sra+mpxcx9f mibg7UTLtMPgmoKMOp2qL7++HYuhWOowU+6e5rF1Ps0vVBZHWAD2iRCMX+jU2J+p XzYcVJ4YyV7ovfITDi1hDMvOXqDRrvhbH5bFDgXM0b5mWyKfjb/p35Y5wivEFPxp DYfVQ231IhDaN8ews3jXpuU8MILUBxzybOK+xtnAfYI4SXxMrJ16LmEpuP5lL2j8 9FfdG2U9MTdxnfEEYVPV/NrBRxZ9r+6d6pTtySmJ8D2s1hnwF3higTYm1DPCfU5U /m1AtLJsFvGVd/qJ4TNmWww8r1WgZlPzggVHgsHL28lpGK3L8ryQrbA0Nr6AVuFO sHDG4Fq5iegoWPsgGIcD8ThJlgvi5a6nS0l79OL+DUv4is2zQeI+zOgiaVeu/CmE JlRkMaA3U2AxayqBSJCwHKdFOu75cHCErTYEQt8Oy+h3rhrw2ucfUe/fKyMOVWps g156i/PsroggHMZWackXBv9tPJyK57ipTEr84ljg2jsZYTUsrYzN13+v/bkrOWXe jTOiicdFJ8Kfyj9Ng5afbLmt24W7BYQSqp4BM4MdEmZ2sY4Zq3iTPMqzBGai3OV4 8EJ5gsOCP7WEmSJcMNyg =EBek -----END PGP SIGNATURE-----

1 0

Prop224 oppurtunity: keygen, crypt, sign, encoding tools
by grarpamp 17 Feb '17

17 Feb '17

Tor could ship with a tool to offline generate all the various keys, encrypt and sign with them, for debug, test, and use with other apps that tie to tor. And a tool to translate strings between different encodings in use. Or at least provide howto and links in the docs to third party tools that users could use for key ops and translation. Since those howto topics appear on the lists now and then. We here might code up openssl, python functions, etc on the fly. However beginning users are typically looking for simple purpose dedicated tools, or example docs using prebuilt tools off the net. This tends to apply to budding application development in onionland, developing things that look at and use tor, etc.

5 4

GSoC 2017 - my name is Marcin
by Marcin Czarnecki 13 Feb '17

13 Feb '17

Hello all, tl;dr can go on about Tor and anonymity and privacy related things for hours, give me a chance I am studying Computer Science at the University of Brighton (in the UK). I am interested in participating in Google Summer of Code 2017 with the Tor project. I am a web security and anonymity enthusiast, tried to work with the Tor Project for GSoC 2016 but it did not work out. I have not contributed to the Tor's code base but have been an active, semi advanced user for past 3 years. Have been experimented with setting up exit-nodes (ended up with my box being considered the #1 most evil machine in the world :)), creating Tor-clearnet gateways, hosting own HS, trying to exploit other HSes, playing with encryption etc. I think that gave a me a lot of insight of how Tor works (still amazed and finding new things when reading docs). I am planning to base my proposal on the idea on a easier way of hosting HS so it would become more accessible to non tech savvy Tor users plus enforcing good security practices when hosting a HS (got some experience and cool ideas [citation needed]). My main skills are in Linux and back-end web development but I am also interested in scripting and automation as well as encryption. Can talk about Bitcoin for hours (security, anonymity, etc.), thinking about using that as my other project proposal as this should be the currency of Tor and more integrated into Tor (Tor Browser extension?). When it comes to programming I feel confident with PHP, Python and HTML, CSS, JS stuff, and know a bit of other languages but I am a fast learner! When it comes to tor related projects, two years ago I did this small crawler with web interface for searching (#2 most evil machine) in Python: https://github.com/marncz/torcrawler Cool feature on which I stopped working was HTTP headers fingerprinting which could led to grouping Hidden Services by hosts providers. Feel free to contact me: email: marnczarnecki[at]gmail.com IRC at OFTC: marncz Many thanks, Marcin

2 1

Issue regarding IRC channel
by Jaskaran Singh 12 Feb '17

12 Feb '17

Hi, As of writing this mail, I can't access the Tor-Dev channel on OFTC neither using my registered nick on desktop client nor through the web interface. Looks like the channel has turned invite only. Would be great if someone could look into this. Regards, Jaskaran Veer Singh

3 2