December 2016 - tor-project - lists.torproject.org

Tor arm tattoo pic
by Roger Dingledine 13 Dec '16

13 Dec '16

Hi Shari, I've been hunting for this one for a while, and Juris came up with the URL finally: https://imgur.com/sZUKADG I am cc'ing tor-project for posterity. It seems like we should be able to make use of this in our advertising in some way. Right? Surely? :) (As far as I know, we do not know whose arm this is.) --Roger

2 1

Notes from December 8 2016 Vegas team meeting
by Karsten Loesing 12 Dec '16

12 Dec '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for December 8 2016 meeting: Isabela: 1) trying to help organize the blog posts for fundraising campaign 2) trying to answer as many Cass questions for DRL proposal as I can 3) coordinating with Sue Abt and Adam from OTF to close sponsorU 4) synced with Hiro and she will take the stuff Sebastian wants to pass on - she replied to his email on internal and will coordinate with him 5) Linda is doing a lot of work with the Metrics team new site project as well as with OONI usability improvements project - ux methodology is evolving every project she takes (she is also doing a lot of work on documenting things) - we want to ping OTF and DRL about this because I believe sponsors will be glad to see Tor's implementing usability into it's development processes. 6) working with folks on Orfox ISC project to make sure we meet new deadlines - Linda is preparing the user testing methodology we will use on Q1 2017 to test the security slider on Orfox Alison: 0) The Tor Browser manual is now up on Transifex! Thanks Phoul!! The community team continues to work on stuff related to the support portal too. 1) Update on funding needs for Global South Tor trainers 2) I have a draft blog post on training people about Tor, which will include some of my slides, some of Isa's, and info about tor-teachers mailing list and wiki. I can hold onto this until whenever. 3) LFP update Nick: 1) December seems likely to be a tidying-up month for pending work, etc. Not sure what else I should be working on. That's not a cry for more work though. Kate: 1) Answering various press queries--we're being blocked in Belarus! 2) Press release for crowdfunding campaign 3) Various loose ends as well. Mike: 1) I'm in a similar place as Nick - picking up loose ends. In general, I'm trying to decide which is the most useful thing I can be doing this month. Any guidance would be helpful. Here's the things I am aware of that I could do, but am not sure exactly how to rank them: * Sink more effort into the Tor Copperhead Prototype, or just let it coast for a while by merging other people's patches. Leaning towards the latter, but people are contacting me about stuff (including funding) * Work on tor-core traffic analysis things (ie NSF and Netflow patch) * Help with the DRL proposal. * Try to interface more with Mozilla * Work on gathering the "Tor at the Heart" projects into Tor Labs. * Work on a blog post arguing that the technology industry should do more to protect its users (may not be a good thing to mix in with the fundraising campaign?) * Work on another blog post for our fundraising campaign. * Help with the tor-core hiring process. * review of #18022 (and #15056, and other tickets?) * update tor browser design doc section about website traffic fingerprinting if needed Georg: 1) We were working on SponsorU wrap up and made preliminary plans for the coming weeks and months working towards the ESR 52 transition 2) I helped with the DRL proposal Arturo: 1) Pushed out a new release of ooniprobe that includes IM tests as well as testing of reachability of Tor bridges and Directory authorities enabled by default. 2) Published a blog post about blocking of Tor in Belarus: https://ooni.torproject.org/post/belarus-fries-onion/ 3) Improvements to our continuous integration and testing for ooniprobe (demo.probe.ooni.io is now automatically redeployed on merge to master and we have a daily tests to ensure debian and ubuntu packages are working) 4) Writing a report on the internet shutdown in Gambia 5) Design work for the OONI UX is continuing and it's going very well (see: https://trac.torproject.org/projects/tor/wiki/doc/UX/OoniUiDesign) 6) We have a blog post with an overview on OONI for the Tor at the heart of campaign: https://docs.google.com/document/d/1xPA0ak8m5bKOKrNQdedC_zCIV2w25B3gGklnuiY…. Karsten: 1) Made good progress on Tor Metrics website redesign project together with linda, isabela, iwakeh, hiro, and RaBe (contracted web designer). Latest prototype is at http://metrics.cc-ltd.net/. 2) Helped a bit with the mobile Tor Browser proposal for DRL. Shari: 1) Wrangling end-of-year blog post contributors. Thanks for everyone's help with this. 2) Editing and budgeting for DRL proposal. 3) Brainstorming ideas on how to shake things up and create a Twitter storm to bring in more donations. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBCAAGBQJYTmCEAAoJEC3ESO/4X7XBO9kIAL74z6Op01u9CjDt4/mr/knK yzXyWAO8WSJDRP46gxkDono3UnnmiRq/fQY7I61ndn4PNU4zH/eEqcOnIT4R8yrh hhM7iQdr+8N1uXJeMT27gFe/QV8SSzvbErU/2BDtTNSWVDYXsOv5127JSFZJPxLn qQoNf4mfHURQTt1eA6HDKM8mDRL1xfxbWO1D6Tsh3b/Ze51tOs9svQghlVVthpSf OnpTtCwVk5vaytdDKnElD32AbR9glhlRaumyXxppCbHfMdv0qrExmndlk3nsbMeP ntiNlunUjTMVsGuzrMwl7IlF0RJBru8VlIbpzWGVgY4rulvnzZ4bsDGgvJw4g0w= =KjEY -----END PGP SIGNATURE-----

1 0

Fwd: Android on Chromebooks
by Nathan Freitas 12 Dec '16

12 Dec '16

Some Chromebooks now run Android apps, and Orbot and Orfox work great on at least one of them (ARM-based ASUS Flip). Chromebooks have become increasingly popular in schools, some workplaces, and even for activists and journalists. Having an easily installable option for using the Tor is great news. ----- Original message ----- From: Nathan of Guardian <nathan(a)guardianproject.info> To: guardian-internal(a)lists.mayfirst.org Subject: Android on Chromebooks Date: Sun, 11 Dec 2016 19:29:18 -0800 I picked up an ASUS Chromebook Flip with the Rockport ARM chip, and enabled it to run the new "beta" channel that includes full support for Android apps. I have to say I am quite impressed. It is a really great combination to have the full Chrome desktop browser, with a solid keyboard and trackpad, along with access to Android apps and Google Play. The Flip itself is a 2-and-1, and having the Android apps really makes it useful as a tablet. It also seems to actually get 9-10 hours of battery life, and only cost about $250 USD. The best news is that Orbot and Orfox run very well, allowing you to have a real Tor capability on a stock Chromebook for the first time. All of the intent launches work, and the VPN mode, too, though I think only for Android apps and not the ChromeOS itself. I am a little confused about that part. I also tried a number of our other apps, and they all seem to be working more or less. Some apps, like StoryMaker 2, don't appear in the Play Store when I search, so they must be requiring some feature that Chromebooks aren't offering. I guess we just have to mark that as optional. All in all, I am excited how well this works, both for our users and for myself. +n -- Nathan of Guardian nathan(a)guardianproject.info

1 0

Tor Browser User Manual review
by Colin Childs 11 Dec '16

11 Dec '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi everyone, As some of you may be aware (if you attend the community team meetings), Alison and I have been working on updating the Tor Browser User Manual and getting it ready for an official release. The community team has now had an opportunity to review the manual, and now we would like to request feedback from the larger community! You can view the manual at https://tb-manual.torproject.org/linux/en-US/ . If you find something that needs changing, please open a ticket on Trac[1] and set the component to "Community", and the "owner" to "phoul" . Thanks, and I hope everyone had a nice weekend! [1]: https://trac.torproject.org/ - -- Colin Childs Tor Project https://www.torproject.org Twitter: @Phoul -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJXls5GAAoJEJWQHABkmqq5mz0P/30P28JS3LrYUxSLYElKkWUC JbxQNcHRpnDX5kt1t2Gl0oz/xXisXT/9NF68HFjxbQiWaXiKV19Z9homwc3KiWu2 RfkL/xqI62y1QJpp/EpCGPa7IwsVBdiUfyC7/DwxF9dY5CToWeeJDEcWu5rQrKFE F6gbCGpKBirGva8b9n/PdPFHZbyOqKDFO6ZZm/UjCQ5Ga7NFJvDyPEom0dYuw0cW OweSXH+Qjxn1i5OCtra1b6JayQ03z7msI99fOPqzBREtBGPJt2+50jcnXddWnPQv rMbnuLO1KhLqZ9gGYbTi1+kIjEOu5ZwX7qyQLBDo2HMww79EuyUtDkHOR2hZxC72 N//Aj5M4myGodjYUsdb/QNRKJSy2Z69eco4eKsRonn0U8/JOO0dh82AkfzVzRS7A MPmYivw0zFuTjn9C5e1QiHWJEwmPsbpDuwBU4mj0EZ5H4evMDsncDqW9yE/Lgqpq Jw6v7GP5arZlbJ+3vZgznAVATAuY2O2+ytu2Z8vetpFFCoaSsvZD7bqT1c1c1LdM oWT0yPXJWeKcdm16ow7/Bjh5yO4NBXahnoAAVTLQG7TjpTSiyMw7nHxMRmMVk84u 5jR7GLOPgQCSqTBonnpxCOnt5phg38OV4TQarxUE+zcov/7GKMrvY/uSj5aRly/c xlxlSP9tGaLMaK/PmYvl =HTUt -----END PGP SIGNATURE-----

5 4

Fwd: Volunteer Work
by Shari Steele 09 Dec '16

09 Dec '16

Hey all. Anyone have ideas for Kyle (who is apparently a high school student)? Feel free to respond to him directly, and let me know if you do. Shari > Begin forwarded message: > > From: Kyle Ahern <kyleeahern(a)gmail.com> > Subject: Volunteer Work > Date: December 7, 2016 at 2:20:52 PM PST > To: execdir(a)torproject.org > > Hello, I have to do 24 hours community service with a nonprofit organization. I need a signed letter with the official letterhead of the organization on it and the number of hours I worked. > > I know there is a lot of ways to support the tor project, but I was wondering if there are any ways I can volunteer where the hours can be reasonably proven by you and that you guys would sign off on. > > I live in St. Louis, MO (United States). I have been considering running a tor relay for some time. I have dabbled in Linux with some terminal commands. After having a tor relay up and running on my ip address (maybe some google search history and screenshots or a desktop recording) would this be something you would be willing to sign off on for some number of hours? > > Thanks for the freedom you guys provide! > Kyle Ahern >

2 1

CFP Cryptorave 2017
by ilv＠torproject.org 08 Dec '16

08 Dec '16

The event will be on May 5-6, 2017. It would be good to have Tor people there (last year they had live translation from english to portuguese). ----- Forwarded message from CryptoRave <contato(a)cryptorave.org> ----- Date: Mon, 05 Dec 2016 20:38:04 +0000 From: CryptoRave <contato(a)cryptorave.org> To: cryptorave-boletim(a)lists.riseup.net Subject: [cryptorave-boletim] A CryptoRave inicia hoje a chamada de trabalhos para sua 4ª edição, em 2017! A CryptoRave é o maior evento de segurança e privacidade do Brasil. Organizada voluntariamente, aberta e gratuita, o evento anual tem o objetivo de disseminar a criptografia, o direito à privacidade, a cultura de segurança, noções de anonimato e os perigos da vigilância por Estados e empresas. O início das inscrições de propostas de atividade será dia 05 de dezembro de 2016 com prazo final de 31 de março de 2017, à meia-noite. Não deixe para a última hora! A abertura de inscrições para trabalho voluntário durante o evento - uma nobre e fundamental atividade com a qual temos muito orgulho de contar - será em abril de 2017. A realização de atividades em grande número, como fazemos na CryptoRave, requer recursos. Estimule a sua comunidade a colaborar com o financiamento coletivo do evento. Para mais informações sobre o Chamado Para Atividades (CPA), acesse: https://cpa.cryptorave.org/pt-BR/CR2017/cfp/session/new * * * Proposição de atividades ------------------------ A CryptoRave aceita e estimula a inscrição de atividades em diversos formatos: apresentação musical, literatura, exibição de filme ou instalação artística, palestra, debate, oficina, jogo, mão-na-massa, colaboração em projeto FOSS (free/libre/open software/source), exposição. A CryptoRave desde sua primeira edição tem uma explícita política anti-assédio e o compromisso de manter um espaço seguro para mulheres, pessoas LGBTQ e quaisquer outras minorias sociais. Incentivamos que estas pessoas enviem atividades e se envolvam nos trabalhos voluntários do evento. Para submeter a sua proposta, você deve primeiro criar uma conta neste site (ver abaixo) e depois criar um evento.O preenchimento de dados pessoais como nome, sobrenome e sexo é opcional. É necessário um e-mail válido. Todas as propostas serão avaliadas considerando: - Adequação aos temas: privacidade, segurança e criptografia - Diversidade de gênero, geográfica e de formato - Inovação da proposta - Atualidade da proposta - As atividades que forem merchandising de produtos serão automaticamente desclassificadas. - Não há compensação financeira ou contrapartida da CryptoRave para a realização de atividades. - Não serão aceitas propostas enviadas por outros meios como twitter e facebook ou fora do prazo estipulado. - Dúvidas devem ser encaminhadas para o e-mail: contato ARROBA cryptorave.org. Sugestões de temas e tópicos para as atividades ----------------------------------------------- - Criptografia: do básico ao avançado. Teoria e implementações. - Segurança para ativistas e defensores de direitos humanos. - Segurança para cidadãos e consumidores na era da Informação. - Gênero e Privacidade: diversidade na segurança digital. - Violações do direito a privacidade e liberdade de expressão. - Como governos violam a privacidade: espionagem e vigilância no Brasil e no mundo. - Como empresas violam a privacidade: coleta de dados, lucro e direito do consumidor. - A contra ofensiva cidadã: hacking, hacktivismo, hacking das coisas, fuzzing, exploits e segurança ofensiva. - Hardware, cripto dispositivos e open hardware. - Ciberguerra e ativismo cibernético na rede. - Hardening de sistemas operacionais. - Soberania computacional, descentralização e federação de redes. - Dissidentes políticos, denunciantes e vazamentos de informações – sistemas tecnológicos e éticos. - Sistemas eletrônicos de governos e vulnerabilidades. Registre a sua atividade: https://cpa.cryptorave.org/pt-BR/CR2017/cfp/session/new -- https://cryptorave.org/ https://twitter.com/cryptoravebr https://facebook.com/cryptorave ----- End forwarded message -----

1 0

Help with 'Tor at the heart' blog posts
by isabela 07 Dec '16

07 Dec '16

Hi there, As you've probably noticed, we've been doing a series of blog posts in December on projects that are able to accomplish their mission better because Tor exists. You can see the previous daily blog posts for the donation drive here: https://blog.torproject.org/category/tags/heart-internet-freedom I am reaching out to this list to ask for help. You can: * pick a project and write a draft of a blog post about it * email a POC (point of contact) of a project and ask if they have time to write a draft themselves - or if not, they can always send to us the main points we should be sure to include in the post so we can write it ourselves * take the information a project POC sent us and put together a blog post about it Or anything else you can help with! We created this spreadsheet where we are trying to keep track of the status of each blog post. The dates suggested for each post are not fixed in stone, so we can move things around. In fact, the earlier we can get write-ups the better, so we have flexibility to make sure every day is covered. We are also open to other topic suggestions if you think of anything we missed. https://docs.google.com/spreadsheets/d/17Rh0CATwCH1du64pcOyAYSXmSN9Ft7Mt2Lg… If you can help us by working on any of these posts or helping to coordinate things, just do it ;) but please keep this spreadsheet updated. Also if you have specific questions, you can send them to this thread or email directly to the task force working on our fundraising campaign: donation-drivers(a)torproject.org Thanks in advance for your help! Isabela

2 2

Notes from December 1 2016 Vegas team meeting
by Karsten Loesing 05 Dec '16

05 Dec '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for December 1 2016 meeting: Nick: 1) The team has done well with me totally distracted by finishing the Guard stuff for Sponsor U. I finished it yesterday, and I think it went well. 2) Not too much to add. Coding is a fun and rewarding activity. 3) I think we should put out 0.2.8/0.2.9 releases some time soon-ish? 4) I want a roadmap. I should make one. Georg: 1) We wrapped up SponsorU items; it seems we get all required things into the next alpha release. 2) I've been distracted by the chemspill releases for the SVG 0-day exploit. 3) I provided feedback for the DRL proposal. 4) I started with planning for the coming weeks (post-SponsorU-time). Alison: 1) Global South outreach: South America, India, getting funding for the folks who want to do this 2) Support desk: TB manual is up on transifex, Colin is steadily chipping away at tasks for support.torproject.org 3) I will have a blog post ready soon to promote some of our training materials 4) November was an incredibly busy month for me with LFP stuff, but now that it's December I can focus more on Tor, especially working on community docs, building outreach capacity, working on Rapid Response and OONI connection, and building the support portal. 5) Do you want full LFP updates on here too? Looks like the answer is yes! I will start adding LFP updates for the next meeting. Kate: 1) Counseling Tor people about media interactions 2) SVG 0-day exploit press coordination - Thanks for everyone's responsiveness! 3) Isabela and Erin are tweeting now from @torproject--hope others will be able to soon. 4) Excited that at least some Tor press clips will appear in press room of Tor website soon--we have many many, including lots of non-English ones. 5) Participated in Mozilla's MOSS tweet chat, which Mozilla was pleased by :) 6) Dealing with various other reporter requests 7) Edited multiple blog posts (Mission Improbable, etc.) 8) Wrote and distributed short press release about Mission Improbable Android Tor phone prototype; made some press calls; garnered some media attention (didn't go full-force because it's an early prototype and there was concern about overpromising) Ars Technica, CNNews.ru, Портал Naked Science, CURVED (Germany), FredZone (France), Programmez! (France), Next INpact (France), Svět Androida, Numerama (French), TooLinix (French), etc. (I should list this stuff more often--oh well) Roger: 1) We need to have a shared vision for handling blog post comments in December 2) I'm going to Seattle on Wednesday 3) I talked to our NSF program manager 4) I'm buried in logistics stuff still 5) I'm mostly back from my surgery Mike: 1) Finished up the mission improbable post with help from Katie - talked to some reporters; fixed bugs, merged patches (yay!) * The plan seems to have more or less worked in terms of getting developer attention 2) Working on "Technology in the Darkest Timeline" post for guidance for tech companies * Struggling a bit with structure. Have 9-10 General Principles, and an outline of specific suggestions for Google, Apple, and Mozilla * Not sure if this should be one post, two posts, or four * Could use some review of the general principals * Our mail situation makes me sad. Many places think my mail is spam when I use @torproject.org (but not my personal mail). * (SPF and DKIM on my own domains has fixed my problems for them, but not for @torproject.org) * I may have to stop using @torproject.org as my email address. Isabela: 1) Did: 2016 summary of Metric Team work for MOSS 2) Did: ISC orfox security slider work report 3) Doing: random donation campaign stuff 4) Did: prep for MOSS chat 5) Doing: closing sponsorU contract - report of all deliverables finished and prep for final invoice 6) Update: hiro tasks are now organized here (she is also in touch with qbi for tasks from him): https://storm.torproject.org/shared/tKdKao9GZx50q8chdnsa1p2DP46lUNyDxE2s8U8… * website press page has been updated * next is the people's page 7) Update: linda is working with metrics team and ooni on their respective ux projects / projects are documented on ux wiki page and we are creating a kanban board on storm to keep track of all projects the ux team are or will work on 8) Did: got headcounts for ux and network team for 2017 budget 9) Doing: helping with drl full proposal review 10) Doing: Global south: vinicius has been doing great outreach in Brazil and got a bunch of people to run bsd tor relays / i am in touch with noisebridge bc they have a fund for relays in Brazil - plan is to connect them with vinicius and a couple of other people / also need to: 1. follow up with other folks who wants to help 2. build wiki page 11) I will be on vacation from December 8th till 12th / then again on the first week of January Shari: 1) Been working on end-of-year blog posts. 2) Sending emails to former donors and TWN subscribers to tell them about our end-of-year campaign. 3) There's a board meeting on Monday. Arturo: 1) Hired a designer to do the UX work and collected some of the design assets for them here: https://github.com/openobservatory/design 2) Made a release candidate for ooniprobe 2.1.0 that includes IM tests and support for checking reachability of Tor Bridges (only via tcp_connect at the moment) 3) ooniprobe 2.0.2 is not packaged for debian and ubuntu. Announcement for it coming out soon. 4) We published the notes for the OONI meeting in berlin. You can find them here: https://github.com/OpenObservatory/gatherings/tree/master/internal/2016-11-… -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBCAAGBQJYRSCsAAoJEC3ESO/4X7XBr+sH+wVZdRLpT3rcSoxM5bQYJXBe 14EYlnbJb0nC4M2+01DPBpukZmEbZUtIX+C/tEvpvIw1W2KNmEYMwJrUteqDsO5A +T1xkp+UknNxFQQWMvDL28bXXY5+dh/0Yt3eFBT6JY43Yam+Xz7zpmYexsPR28m1 0lPI3klrdc1zqgrnsoBZrkP21XoOg8qCySyvIwlkzk/XDcHblJ5f9PdraGWgdEnO rhgUDOUkt5JEFQ/KATsPqMS1DidWrAj83XnLF1AS4S5BhMVIyWHXG93hdFsvquzX yBM5WmtLyE++VO4Kj6zkIwK2JnTXqKAH3bRft9+zSIVu9Skaf4aUZJBYaVqJ59M= =/HQH -----END PGP SIGNATURE-----

1 0

Help curate December blog comments during donations drive
by Roger Dingledine 05 Dec '16

05 Dec '16

Hi everybody, If you haven't noticed our 30-posts-in-30-days December blog donation drive extravaganza, check out https://blog.torproject.org/category/tags/heart-internet-freedom All these blog posts are generating a lot of attention, including many more users interacting with us via the blog comments. That's great! But we need your help keeping up -- making sure the questions there have useful answers, and the comments there have thoughtful responses. There are three especially useful ways you (yes you, please please please) can help: A) Look through each of the recent blog posts periodically, and find things that you can answer or things that you can be helpful on. Don't be shy! The more variety of Tor people we have the smoother everything will go. B) Notice useful comments/questions that need particular expertise, and bring them to the attention of the team that can answer them. A great example is https://blog.torproject.org/blog/tor-02810-released#comment-223817 where it looks like maybe Tor Browser is using an OpenSSL version that is about to go unsupported, and if so we should open a ticket about that. Maybe each team should designate a point person for questions related to their topic? Blog comments move more in reddit-time or twitter-time, so batching the answers once a week won't be as good as we can be. C) Go through and approve non-spam comments so they go live on the blog (and delete the spam ones). Our current blog system is old and klunky, and we've opted not to tie in third-party spy sites for distinguishing spam, but the tradeoff is that we handle comment approval manually for now. The glorious future will bring us a newer Drupal with more ways to streamline comments, but we're not there quite yet. If you don't have a blog account, and you need one, let me know and I'll hook you up. Special thanks to everybody who has been helping out so far! --Roger

2 1

Some emails asking for donations had a wrong link
by Sebastian Hahn 03 Dec '16

03 Dec '16

Hey, unfortunately there was a small issue with sending out some of our donation drive emails. If you or someone you know is confused about an email with a link that asks for username/login information, please disregard that mail and wait for a second one that should have the corrected link. If you don't get a second mail, please get in touch! Thanks and sorry for the trouble Sebastian

1 0