November 2016 - tor-project - lists.torproject.org

Many obfs4 bridges with similar nicknames and characteristics
by David Fifield 13 Dec '16

13 Dec '16

There are many bridges in Onionoo that seem to follow a common naming convention: two dictionary words concatentated, then truncated to 16 characters. That, plus the fact that many of them run on the same platform, run only the obfs4 transport, and have related last_restarted times, makes me think they are somehow related and perhaps malicious. In a sample of 200 Onionoo bridges, 19% followed the convention. I noticed this by accident and I'm not planning to look into it more, so I'm dropping notes here. I downloaded https://onionoo.thecthulhu.com/details?type=bridge ("bridges_published":"2016-11-28 21:41:02") and manually looked at the first 200 entries (of ~2500). I picked out the ones that followed the naming convention: two dictionary words concatenated and truncated to 16 characters; the 40 matches are appended to this message. Of those, only 2 (mapletalon and coffledtileries) don't match the others with respect to transports. The words look like they are randomly chosen from a dictionary and some of them are esoteric or proper names. For example, cubicsrepugned = cubics + repugned instinctivevital = instinctive + vital stegosaurscontin = stegosaurs + contin(ue?) famishmentbarrac = famishment + barrac(ks?) Trobriandersbacc = Trobrianders + bacc(hannal?) friablerecitativ = friable + recitativ(e?) Ruidosospostcopu = Ruidosos + postcopu(latory?) introspectpacifi = introspect + pacifi(c?) cosponsorsangula = cosponsors + angula(r?) Here's the list of 40 bridges I selected manually out of the 200. Notice that 17 of them have a last_restarted time withing 10 minutes of 2016-11-11 00:00:00. $ ./nodeinfo < suspicious-bridges.json hashed_fingerprint nickname first_seen last_seen last_restarted platform transports BD2B73AE5F68276BE4E01534F97A28E992B24894 mapletalon 2015-05-01 22:57:41 2016-11-28 21:41:02 2016-10-18 17:48:08 Tor 0.2.8.9 on Linux obfs3,scramblesuit,obfs4,fte 89BD7F3C63464D389B73914FAA818EBF61EE6B46 coffledtileries 2015-12-30 16:52:56 2016-11-28 21:41:02 2016-11-07 12:20:31 Tor 0.2.8.9 on Linux obfs3 D6EC04069E89F08CAE4CBA0E2BE44FFD282BAB07 Trobriandersbacc 2016-09-04 05:38:16 2016-11-28 21:41:02 2016-11-10 00:05:41 Tor 0.2.8.9 on Linux obfs4 5ECF6C485B3DD05EDB9F95073257B8C33C755EE2 ElchoCanarian 2016-11-09 03:41:02 2016-11-28 21:41:02 2016-11-10 11:07:26 Tor 0.2.8.9 on Linux obfs4 FCA481C317E434590CFA06E77A4AE7F5E2E371A3 sailboaterecthym 2016-09-22 15:38:16 2016-11-28 21:41:02 2016-11-11 00:01:10 Tor 0.2.8.9 on Linux obfs4 8A1D76B37B8BB17C35454454E19C729C1AC47E8A orbitalprogymnas 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-11 00:01:15 Tor 0.2.8.9 on Linux obfs4 4B9C80E3798BAB6B21D7256EE47EA20BF8F4576C Davossoutdroppin 2016-10-18 16:41:01 2016-11-28 21:41:02 2016-11-11 00:01:18 Tor 0.2.8.9 on Linux obfs4 EFEB18D156E1E14837E417113B3971C04F4F5FBB Ruidosospostcopu 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-11 00:01:21 Tor 0.2.8.9 on Linux obfs4 79C6F406B3D3927ABB881EB54323B29DF400F9E2 hypospadiasesdum 2016-10-03 03:38:17 2016-11-28 21:41:02 2016-11-11 00:02:30 Tor 0.2.8.9 on Linux obfs4 B3B7B975DCD1D7E59D65202DB8E6E2D75655B358 stegosaurscontin 2016-10-23 17:41:01 2016-11-28 21:41:02 2016-11-11 00:02:48 Tor 0.2.8.9 on Linux obfs4 43CBD641F40EE1563BB1AF7736175512A5B559A2 famishmentbarrac 2016-10-22 12:41:01 2016-11-28 21:41:02 2016-11-11 00:03:48 Tor 0.2.8.9 on Linux obfs4 1931388E3C53689BED98E0BEFA7052F07BCC7F70 instinctivevital 2016-10-27 20:41:01 2016-11-28 21:41:02 2016-11-11 00:04:48 Tor 0.2.8.9 on Linux obfs4 914CF5540F8B92672CA6C9AA270DA88928B6CA78 cubicsrepugned 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-11 00:05:02 Tor 0.2.8.9 on Linux obfs4 F791DD628CA38C402E2126DAD106EA19C67252F4 wheelsolla 2016-10-08 10:38:17 2016-11-28 21:41:02 2016-11-11 00:05:04 Tor 0.2.8.9 on Linux obfs4 E5BA71654F739B20AA807362EBA4FE91B57331EC IQsmediator 2016-11-09 18:41:02 2016-11-28 21:41:02 2016-11-11 00:05:16 Tor 0.2.8.9 on Linux obfs4 C8A129620B9ACA9708EBF40F54536A4DB644260F impulsivenesssle 2016-10-17 05:38:17 2016-11-28 21:41:02 2016-11-11 00:05:31 Tor 0.2.8.9 on Linux obfs4 500F068CBA07D0E0CEB0343D1DFF2CB32AD77080 friablerecitativ 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-11 00:05:37 Tor 0.2.8.9 on Linux obfs4 71A74F4F94606B455B3CCE0AE4A21D57D557B489 imaginarysoverco 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-11 00:05:49 Tor 0.2.8.9 on Linux obfs4 E7A4C66517035A309C6D448070B964023D150A5F aidedarticularly 2016-09-06 04:38:16 2016-11-28 21:41:02 2016-11-11 00:06:08 Tor 0.2.8.9 on Linux obfs4 66B41CF3878A37254511C5E3F76F513F74075464 blessedergrisled 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-11 00:06:31 Tor 0.2.8.9 on Linux obfs4 C724E07A07E2C820208CD22D19A3B1B1FD40B7F3 whensquincentena 2016-11-03 05:41:02 2016-11-28 21:41:02 2016-11-11 05:02:03 Tor 0.2.8.9 on Linux obfs4 6567256AC5857A83D57F6D3256FBAC5D8030803B pipagelengthwise 2016-09-24 21:38:16 2016-11-28 21:41:02 2016-11-12 05:01:58 Tor 0.2.8.9 on Linux obfs4 3168BC247CA693DF2871AD547F74DD93D9A8CB4E recessionalsFols 2016-11-13 00:41:02 2016-11-28 21:41:02 2016-11-14 00:01:12 Tor 0.2.8.9 on Linux obfs4 A9EE320C9BF3E5505C08CBB26135A9342435414B amasseracrimonio 2016-11-14 23:41:02 2016-11-28 21:41:02 2016-11-16 00:01:13 Tor 0.2.8.9 on Linux obfs4 666AAC1C83DC928E2E72F69A40B3DF31F008FCF0 harmonizeLorinda 2016-11-08 18:41:02 2016-11-28 21:41:02 2016-11-16 18:47:25 Tor 0.2.8.9 on Linux obfs4 5D0BE64E6C00322D31B9CE83E5117F9D8860D291 supernaturesPoto 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-17 00:01:03 Tor 0.2.8.9 on Linux obfs4 C319A27A6B749518F8B5ABA508676E3A0307B5CE pitchwomanPetrar 2016-11-18 16:41:02 2016-11-28 21:41:02 2016-11-18 16:23:52 Tor 0.2.8.9 on Linux obfs4 8F366D5100DC5806D03839434D20EE6508C3C6D5 xenogeniescondon 2016-11-22 01:41:02 2016-11-23 00:41:02 2016-11-22 01:21:38 Tor 0.2.8.9 on Linux obfs4 280608EF66099BC4DFE651E540B34EE2BAD53E0F Hofmannscrimply 2016-11-24 17:41:02 2016-11-25 16:41:02 2016-11-24 17:15:04 Tor 0.2.8.9 on Linux obfs4 75B88A93670C87243BEA433598B582BFA1FA38D5 otitisArchaeorni 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-24 17:59:06 Tor 0.2.8.9 on Linux obfs4 8C585AA14CA728E03892BEC51284DFE39CD52641 streetyNavaratra 2016-10-22 18:41:01 2016-11-28 21:41:02 2016-11-24 23:01:07 Tor 0.2.8.9 on Linux obfs4 8475B61417F33A345F03A8939AAB8D011510A256 biffoximes 2016-11-26 05:41:02 2016-11-28 21:41:02 2016-11-26 05:22:06 Tor 0.2.8.9 on Linux obfs4 B296B50F26467B9BF85553C53AC9C4BA8B7D54E6 ephorscranberry 2016-11-26 15:41:02 2016-11-27 14:41:02 2016-11-26 15:05:01 Tor 0.2.8.9 on Linux obfs3 8292BA88B705EB5BC73EFBC49310FC2C57722AB7 memoirgores 2016-11-26 16:41:02 2016-11-27 22:41:02 2016-11-26 16:20:04 Tor 0.2.8.9 on Linux obfs4 48B85C391D285184D25F7F9C80CD1400BC361F30 cosponsorsangula 2016-11-27 06:41:02 2016-11-28 05:41:02 2016-11-27 06:12:34 Tor 0.2.8.9 on Linux obfs4 AD2FC88D84A85069D850011533A3ACA2F77A622C forequotedferric 2016-11-27 20:41:02 2016-11-28 21:41:02 2016-11-27 20:22:42 Tor 0.2.8.9 on Linux obfs4 3191235187A95599A4831D5B1891713A30B75110 dennetsreeder 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-27 21:08:00 Tor 0.2.8.9 on Linux obfs4 3D6B08D309B3080697B74DEAE724E41FFC89B6BC introspectpacifi 2016-11-28 07:41:02 2016-11-28 21:41:02 2016-11-28 07:11:54 Tor 0.2.8.9 on Linux obfs4 1F4CAB0568389C049623E41FA8ECD546F4821C53 pamphletaryDille 2016-11-25 20:41:02 2016-11-28 21:41:02 2016-11-28 08:01:58 Tor 0.2.8.9 on Linux obfs4 1C3F2CC53203756A12A3E2AFB587CD535920767E schlierenasympto 2016-11-28 10:41:02 2016-11-28 21:41:02 2016-11-28 11:33:41 Tor 0.2.8.9 on Linux obfs4

1 1

Tor Browser User Manual review
by Colin Childs 10 Dec '16

10 Dec '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi everyone, As some of you may be aware (if you attend the community team meetings), Alison and I have been working on updating the Tor Browser User Manual and getting it ready for an official release. The community team has now had an opportunity to review the manual, and now we would like to request feedback from the larger community! You can view the manual at https://tb-manual.torproject.org/linux/en-US/ . If you find something that needs changing, please open a ticket on Trac[1] and set the component to "Community", and the "owner" to "phoul" . Thanks, and I hope everyone had a nice weekend! [1]: https://trac.torproject.org/ - -- Colin Childs Tor Project https://www.torproject.org Twitter: @Phoul -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJXls5GAAoJEJWQHABkmqq5mz0P/30P28JS3LrYUxSLYElKkWUC JbxQNcHRpnDX5kt1t2Gl0oz/xXisXT/9NF68HFjxbQiWaXiKV19Z9homwc3KiWu2 RfkL/xqI62y1QJpp/EpCGPa7IwsVBdiUfyC7/DwxF9dY5CToWeeJDEcWu5rQrKFE F6gbCGpKBirGva8b9n/PdPFHZbyOqKDFO6ZZm/UjCQ5Ga7NFJvDyPEom0dYuw0cW OweSXH+Qjxn1i5OCtra1b6JayQ03z7msI99fOPqzBREtBGPJt2+50jcnXddWnPQv rMbnuLO1KhLqZ9gGYbTi1+kIjEOu5ZwX7qyQLBDo2HMww79EuyUtDkHOR2hZxC72 N//Aj5M4myGodjYUsdb/QNRKJSy2Z69eco4eKsRonn0U8/JOO0dh82AkfzVzRS7A MPmYivw0zFuTjn9C5e1QiHWJEwmPsbpDuwBU4mj0EZ5H4evMDsncDqW9yE/Lgqpq Jw6v7GP5arZlbJ+3vZgznAVATAuY2O2+ytu2Z8vetpFFCoaSsvZD7bqT1c1c1LdM oWT0yPXJWeKcdm16ow7/Bjh5yO4NBXahnoAAVTLQG7TjpTSiyMw7nHxMRmMVk84u 5jR7GLOPgQCSqTBonnpxCOnt5phg38OV4TQarxUE+zcov/7GKMrvY/uSj5aRly/c xlxlSP9tGaLMaK/PmYvl =HTUt -----END PGP SIGNATURE-----

5 4

(FWD) TODAY: 7:30pm 5-134: Reproducible Builds
by Roger Dingledine 30 Nov '16

30 Nov '16

A shout-out to Tor, from a totally different world. I've added the phrase 'reproducible builds' to our 'projects that are succeeding at their goals because of Tor' riseup pad. :) --Roger ----- Forwarded message from Lenny Foner <foner(a)media.mit.edu> ----- Date: Wed, 30 Nov 2016 10:55:26 -0500 From: Lenny Foner <foner(a)media.mit.edu> To: cluedump-announce(a)mit.edu Subject: TODAY: 7:30pm 5-134: Reproducible Builds Please join us today, at 7:30pm in 5-134, for a Cluedump by Valerie Young on Reproducible Builds: We trust FOSS software because we can read the source code. Or, at least, we trust FOSS software because we trust the community who reads and writes the source code. But users do not download source code and compile programs themselves; they download binaries. Binaries can be exploited in many ways, from a compromised developer to a compromised compiler, and without reproducible builds, we are not capable of independently verifying that a given binary came from the publicly available source code. "'Reproducible builds?'" you might ask in confusion, "Are you implying the compilation of software is not deterministic?" Turns out, yes! "Reproducible Builds" is the umbrella term for the wide FOSS effort to make the build chain of all software deterministic and transparent. In this talk, I will give a brief history of the reproducible builds effort from Tor's original success to the ongoing work of the Debian community to create an entirely reproducible operating system. You will leave with a clear understanding of the nuances and challenges of achieving reproducible builds and a clear vision for the exciting future where reproducible builds are the norm. Bio: Valerie Young is a Debian contributor and secretary for the board of directors of Software in the Public Interest. She studied physics and computer science at Boston University, worked at athenahealth for a few years, and is presently on vacation between paying jobs to chill and write free software. Snacks will be served! For more information, or if you'd like to give a Cluedump, please contact us at cluedumps(a)mit.edu. Anyone can give a Cluedump: undergraduates, graduate students, researchers, faculty, alumni, or those from outside MIT. To see prior Cluedumps, some of which have supplementary information, see http://cluedumps.mit.edu/. Add Cluedumps to your calendar at https://sipb.mit.edu/calendar/. (bcc'd to dorm lists; NaN for bc-talk) --------------------------------------------------------------------------- SIPB Cluedumps are one-to-two hour informal technical talks about any topic of interest to the MIT computer community. To receive future SIPB Cluedump announcements, be sure to subscribe to the cluedump-announce mailing list. What is SIPB? More so than a traditional computer club, SIPB is a student group with deep roots in the culture and implementation of computer technology at MIT. SIPB is a community---a group of computer enthusiasts working together to learn and create. As a group, SIPB develops and maintains many technologies in official use at MIT, such as the operating system you use at Athena clusters. But, more than anything, SIPB is an opportunity for people of any major or background to come together, learn new skills, and make ideas come to life. Come learn more, get involved with one of many projects, or create your own! http://sipb.mit.edu/ ----- End forwarded message -----

1 0

identifying fellow travelers
by Shari Steele 30 Nov '16

30 Nov '16

Hey all. As part of our end-of-year campaign, we’re going to highlight some projects that rely on or build on Tor, emphasizing how Tor is at the heart of Internet freedom while at the same time highlighting some of the cool things others are working on. I’d like to highlight one project per day for the month of December. I’ve started to collect some projects on this pad: https://pad.riseup.net/p/q0iJkHTMLBkF But I know I’m missing some—probably some good ones. So my apologies in advance if I missed something important that you’re working on—please know that it’s my ignorance and nothing personal. I’d appreciate it if people here could fill in the missing projects. Also, is one of your projects highlighted here? I would be delighted if you’d be willing to share a couple of paragraphs on why Tor is important to your project, along with a link to whatever page you’d like us to send people to when they read the blog post. If you can’t supply anything, I’ll come up with something, but I bet it would be better if you wrote it yourself! Thanks in advance for your help with this! Shari

7 6

Belated thanks to George and David
by Allen Gunn 30 Nov '16

30 Nov '16

Hello all, With both general gratitude and a spirit of shouting out folks who do great ambassador work for Tor, I wanted to thank George R and David F for contributing so much about two weeks back at our Nonprofit Software Development Summit. George explained Tor architecture to a bunch of participants who say they are now inspired to run relays and set up onion sites, and also had a number of how-to side conversations. David explained pluggable transports and a number of other Tor features during our demo fest and contributed richly to other sessions. We are grateful to have this type of super-valuable sharing take place at the Dev Summit, and I just wanted to state that publicly. Thanks you two, you both rock. peace, gunner -- Allen Gunn Executive Director, Aspiration +1.415.216.7252 www.aspirationtech.org Aspiration: "Better Tools for a Better World" Read our Manifesto: http://aspirationtech.org/publications/manifesto Follow us: Facebook: www.facebook.com/aspirationtech Twitter: www.twitter.com/aspirationtech --

1 0

Turning on timing obfuscation (iat-mode=1) for some default bridges
by David Fifield 30 Nov '16

30 Nov '16

I propose that we turn on the obfs4's optional packet size and timing obfuscation on some of the default Tor Browser bridges. The packet size and timing obfuscation can be off (iat-mode=0) or on (iat-mode=1). Currently, all of the default bridges, and probably ≈100% of BridgeDB bridges, have it turned off (iat-mode=0). As far as I know, iat-mode=1 has never really been tried in practice. The reason I propose trying it is the current blocking situation in Kazakhstan. According to reports, obfs4 (along with meek and vanilla Tor) are blocked there--not only the built-in default bridges, but also secret bridges from BridgeDB. A user on IRC has been experimenting with the Kazakh firewall; the blocking seems to be some sort of probabilistic traffic analysis--it doesn't always block and the rate of blocking depends on the network load. That user would like to have iat-mode=1 set on some of the default bridges to see if it gets through the firewall. Here are details on the Kazakhstan situation: https://bugs.torproject.org/20348 So I'm thinking it's a good idea to turn on iat-mode=1 on, say, 20% of the default bridges. That'll also be a good hedge against potential future blocking, as we can see if the bridges that use size and timing obfuscation are more resistant. It is safe for the server to turn on iat-mode=1 while the client still has iat-mode=0; the obfuscation will only apply in one direction but the connection will still work. ---- Addendum on how to activate iat-mode=1 on the server If you built obfs4proxy from source, and you are using commit a7a2575cab or later, you just need to add one line to your torrc: ServerTransportOptions obfs4 iat-mode=1 Unfortunately this commit is not yet in a released version. If you are using a released version, such as obfs4proxy-0.0.6, then you need to specify every other possible parameter in addition to iat-mode. Find the file <datadir>/pt_state/obfs4_state.json, and convert the JSON syntax into key=value syntax in a ServerTransportOptions, for example if obfs4_state.json contains {"node-id":"0af6c84b644856255dd858b2b189725db6ded51a","private-key":"d04e61ea38757ef67131a3032709e26bbf77a370aadf3950180fbf797973b365","public-key":"fedde584dc36265f9071ab6f7d845a9ae9e3cea5b9c956b252c1c7849aa2d006","drbg-seed":"5bb4dd59f507a89660c4d313f598ed56f4e9e0a620e129af","iat-mode":0} then add this to torrc: ServerTransportOptions obfs4 node-id=0af6c84b644856255dd858b2b189725db6ded51a private-key=d04e61ea38757ef67131a3032709e26bbf77a370aadf3950180fbf797973b365 public-key=fedde584dc36265f9071ab6f7d845a9ae9e3cea5b9c956b252c1c7849aa2d006 drbg-seed=5bb4dd59f507a89660c4d313f598ed56f4e9e0a620e129af iat-mode=1 You will know you need to do this if, when you try to set iat-mode=1 by itself, you get the tor.log error: [warn] Server managed proxy encountered a method error. (obfs4 missing argument 'private-key')

4 6

Cross-team OONI and Tor Browser project: default bridge checking
by Roger Dingledine 29 Nov '16

29 Nov '16

Hi folks, It looks like two of the default obfs3 bridges in Tor Browser have been broken for a while -- maybe for many months. I only noticed by accident today. I was about to open a ticket for the Tor Browser team to automate checking them, so they can proactively notice and fix things if they break. But then I thought, hey, OONI should be doing that testing from all over the world, right? There are these tickets from the past: https://trac.torproject.org/projects/tor/ticket/12544 https://trac.torproject.org/projects/tor/ticket/6414 Maybe this is a great collaboration point between the Tor Browser team and the OONI team? (For best collaboration, we might want to find a way to have it be more than the tor browser team saying "hey ooni, can you do this for us, thanks". :) --Roger

6 10

Fwd: [Netfreedom] IFF Call for Proposals--final submission deadline Nov. 28!
by Shari Steele 25 Nov '16

25 Nov '16

> Begin forwarded message: > > From: Sarah Bushman <sbushman(a)irex.org> > Subject: [Netfreedom] IFF Call for Proposals--final submission deadline Nov. 28! > Date: November 17, 2016 at 7:54:15 AM PST > To: netfreedom(a)lists.cymru.com > > Dear colleagues, > > *IFF Call for Proposals - Final Stretch until November 28th!* > > We're just TWO WEEKS out from the November 28th deadline to submit your session and workshop proposals for the 2017 IFF. > > IFF is by you and for you, so we need your voices in the agenda. Diverse and inclusive discussion means stronger support and solutions for the challenges we, as a community, face. Submit your ideas here: https://internetfreedomfestival.org/host-a-session/ <https://internetfreedomfestival.org/host-a-session/> > > Contact us at team(a)internetfreedomfestival.org <mailto:team@internetfreedomfestival.org> for questions. We look forward to seeing you in Valencia in March! > -- > > > Sarah E. Bushman > > Program Officer > > IREX/USA > > 1275 K Street, NW, Ste. 600 > > Washington, DC 20005 > > 202-628-8188 <tel:202-628-8188> x129 > > Skype: sarahbushman > > > > _______________________________________________ > Netfreedom mailing list > Netfreedom(a)lists.cymru.com > https://lists.cymru.com/mailman/listinfo/netfreedom

2 1

Tor Project Job Opening - Core Developer
by Erin Wyatt 23 Nov '16

23 Nov '16

Hello Everyone, We are looking to hire a Core Developer for the network team. We did recently hire a core developer who will start in February, this opening is in addition to that position. This is an open call and the application deadline is December 31, 2016. Please help us spread the word! If you have someone in mind, refer them to the job posting link on our website (below). If not, you can still help by posting, forwarding, and/or retweeting links to the position! Tor Project website: https://www.torproject.org/about/jobs-coredev.html.en <https://www.torproject.org/about/jobs-coredev.html.en> Twitter: https://twitter.com/torproject/status/801515058131931136 <https://twitter.com/torproject/status/801515058131931136> Thank you! Have a great week. Cheers, Erin Wyatt HR Manager ewyatt(a)torproject.org GPG Fingerprint: 35E7 2A9F 6655 45F9 2CB6 6624 BA0C 9400 F80F 91CE ricochet:65mmrt6kp6qgvpgm

1 0

Blog spam hygiene and a plan for the future
by Roger Dingledine 22 Nov '16

22 Nov '16

tl;dr: if you do a blog post and you enable comments (great), please disable comments when you're done paying attention to your post. Hi folks, If you do blog posts, please help us figure out a better plan going forward. My hobby this past weekend was cleaning up spam comments from the blog. The spam is now gone, and there remain approximately 740 (!) non-spam comments that are in the 'unpublished' state, across dozens of blog posts. In the medium to long term, our infrastructure for handling spam comments will get better, since Mike's friends are working on migrating the blog to a newer Drupal and hosting it in a place that will get updates more consistently. In the mean time though: (and probably these plans will serve us well post-migration too) A) I think our #1 problem is when people do a blog post, allow comments, maybe process and respond to comments for a while, but then forget about the post and let the spam comments pile up. The spam comments then make it harder for other people to find real comments, and things spiral out of control. A2) So if you're doing a blog post, and you want to interact with users, please do enable comments! Just be sure to deal with comments as they show up, and switch the post back to 'read only' when you're no longer planning to deal with them. A3) I don't want to force all people who write blog posts to be the ones who will handle the comments. What a great role for our teams! Maybe each team should self-organize to have a plan for responding to comments on their posts? The small teams can ask the larger ones for help; it will work best if people (1) communicate and (2) give advance warning for posts that will need extra attention. B) During this spam purge I turned off new comments on posts from: ailanthus alison arma art asn boklm gk isabela isis karsten mikeperry nickm phoul sukhbir weasel Most of those posts still have unapproved comments though. If you want, you could go back to your posts and approve some old comments, to help put a dent in that 740 figure. C) Who is still handling blog comments? I think it's down to just Georg, with Mikeperry temporarily on it because he just did a post? Once upon a time it was just me, and then Yawning took a shift for some months, and then for a while we had a "if you do a blog post, you need to either disable comments, or handle the comments for your blog post" policy -- and then I fear it's falling back to just Georg. D) To be clear, I'm not saying we should approve all of the non spam posts. Some of them are crazy distracting multi page rants, for example, and if our goal is to have a focused discussion of the topic of that blog post, it makes no sense to approve everything that isn't selling shoes. I think Georg and I feel strongly that it's valuable to have a way of interacting with our users that doesn't require them to sign up for the full modern cloud identity infrastructure in order to participate. In summary: If you want to help, please do! --Roger

2 1