February 2016 - tor-project - lists.torproject.org

Moar Project Ideas!!
by Damian Johnson 25 Mar '16

25 Mar '16

Hopefully the exclamation marks work. Thanks Sebastian for kicking us off! We have just twelve project ideas at present and many of those will go poof due to being outdated. We need moar!!! Please, please give thought to if there's something you'd care to mentor this summer. This is a great opportunity to kickstart development and get a new community member at the same time! We're a bit behind the eight ball right now since Google is evaluating our proposal as we speak, and if selected students will be checking us out on Monday (2/29). Got something? Then just shoot us text like the following and Sebastian or I would be happy to add it... https://www.torproject.org/getinvolved/volunteer.html.en#Coding Cheers! -Damian

12 23

Our Jabber Server
by David Goulet 03 Mar '16

03 Mar '16

Greetings Everyone! Thanks to weasel for bringing Debian Jessie to the server, we now have a working usable Jabber server. Woot! Here is our XMPP score: c2s: https://xmpp.net/result.php?domain=torproject.org&type=client s2s: https://xmpp.net/result.php?domain=torproject.org&type=server Everyone with an LDAP account can connect to the server. Else, you can't. Before you can do that, you need to set your "rtc" password. Here is how: 1) Enter your user and ldap password at https://db.torproject.org/login.html and press "Update my info". 2) At the very bottom, you should see this https://people.torproject.org/~dgoulet/volatile/rtc-pass.png, the "Change rtc password" field. Put your password in there. Unfortunately, it silent fails if you enter a "too big of a password" and we are unsure of the maximum length so I think 16 characters (based on my experiment) is the maximum possible. 3) Wait a couple of minutes so the database sync up and reaches the jabber server. When you connect, if it fails, wait a bit more. Usually after 5 to 10 minutes it should work so report the issue if it still fails. Useful informations about the server now and how to use it. Your account is <ldap-user>@torproject.org. You have to enable TLS of course. We also have a hidden service! It's: k2r67kry5haud25b.onion. To use it, set the server of your account with it but the user must be your LDAP one that is <ldap-user>@torproject.org. It's federating that means you can add contact that are OUTSIDE of this server such as riseup users or any workable jabber server supporting TLS. Our TLS certificate is from Let's Encrypt and checksum is below. Remember that in 3 months that fingerprint will change: SHA256 Fingerprint=56:4B:0B:AC:7A:55:1D:8F:52:29:E0:A6:61:D7:0F:B6:EC:41:FC:59:FE:2B:B3:39:FA:14:23:65:38:13:26:A0 Finally, this server has a special quirk. It will _tell_ you when you are NOT using OTR. I've put it in "optional" mode but we can also put it in "mandatory" mode if needed which will force all messages going through to be OTR encrypted. I don't expect any big issues to arise once this server gets more users but at first we might need to tweak some stuff thus restart it. Enjoy! David

13 15

Fwd: The Tor Project has been accepted as a GSoC 2016 mentor organization!
by Damian Johnson 29 Feb '16

29 Feb '16

---------- Forwarded message ---------- From: Google Summer of Code <summerofcode-noreply(a)google.com> Date: Mon, Feb 29, 2016 at 12:32 PM Subject: The Tor Project has been accepted as a GSoC 2016 mentor organization! To: atagar1(a)gmail.com [image: Google Summer of Code] Congratulations! The Tor Project has been selected as a Google Summer of Code 2016 mentor organization. Please click here to visit your organization profile and start adding mentors: https://summerofcode.withgoogle.com/dashboard/org-profile/ You are receiving this email because of your participation in Google Summer of Code 2016. https://summerofcode.withgoogle.com To leave the program and stop receiving all emails, you can go to your profile <https://summerofcode.withgoogle.com/dashboard/profile/> and request deletion of your program profile. For any questions, please contact gsoc-support(a)google.com. Replies to this message go to an unmonitored mailbox. © 2016 Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

4 3

Summary of meek's costs, January 2016
by David Fifield 29 Feb '16

29 Feb '16

Here's the summary of meek's CDN fees for January 2016. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 January 2015 $464.37 + $669.02 + $0.00 = $1133.39 February 2015 $650.53 + $604.83 + $0.00 = $1255.36 March 2015 $690.29 + $815.68 + $0.00 = $1505.97 April 2015 $886.43 + $785.37 + $0.00 = $1671.80 May 2015 $871.64 + $896.39 + $0.00 = $1768.03 June 2015 $601.83 + $820.00 + $0.00 = $1421.83 July 2015 $732.01 + $837.08 + $0.00 = $1569.09 August 2015 $656.76 + $819.59 + $154.89 = $1631.24 September 2015 $617.08 + $710.75 + $490.58 = $1818.41 October 2015 $672.01 + $110.72 + $300.64 = $1083.37 November 2015 $602.35 + $474.13 + $174.18 = $1250.66 December 2015 $561.29 + $603.27 + $172.60 = $1337.16 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 -- total by CDN $9378.39 + $10646.60 + $1621.99 = $21646.98 grand total https://metrics.torproject.org/userstats-bridge-transport.html?graph=userst… Halfway through January 2016 we were able to relax the rate limits on the meek backing bridges, and it showed in the number of users, which increased from 6,000 to just over 10,000 simultaneous users. The cost for meek-amazon was markedly higher this month, which I don't think is entirely due to the relaxed rate limits. The number of HTTPS requests (which cost money on their own) was increased without a matching increase in data transfered. There was a week or so in January when the meek-amazon bridge was having trouble and dropping some connections, so that might have been the cause. Reminder that if you configure your own CDN or App Engine account and point it at https://meek.bamsoftware.com/, you will be using a completely unlimited bridge, which will go faster and help save money. == App Engine a.k.a. meek-google == Here is how the Google costs broke down: 4274 GB $512.86 5166 instance hours $258.31 Compared to the previous month: 2528 GB $303.39 5158 instance hours $257.90 https://globe.torproject.org/#/bridge/88F745840F47CE0C6A4FE61D827950B06F9E4… == Amazon a.k.a. meek-amazon == The number of HTTPS requests is strangely high in the EU (Ireland) region. Last month was 142M, this month is 805M. However the amount of data transfered in that region did not increase (968 GB to 957 GB). I don't have an explanation for that. Asia Pacific (Singapore) 220M requests $264.97 569 GB $78.58 Asia Pacific (Sydney) 1M requests $1.86 5 GB $0.68 Asia Pacific (Tokyo) 21M requests $25.59 161 GB $21.08 EU (Ireland) 805M requests $966.45 957 GB $76.72 South America (Sao Paulo) 6M requests $13.65 38 GB $9.17 US East (Northern Virginia) 79M requests $79.16 559 GB $43.99 -- total 1134M requests $1351.68 2291 GB $230.22 https://globe.torproject.org/#/bridge/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == Zone 1 3000 GB $261.02 Zone 2 493 GB $ 68.08 -- total 3494 GB $329.10 https://globe.torproject.org/#/bridge/AA033EEB61601B2B7312D89B62AAA23DC3ED8… Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

2 1

silliness
by Shari Steele 29 Feb '16

29 Feb '16

Hey all. A friend sent me this picture. Note the missing letters on the sign. :) Shari This is where I go for safe 'Net surfing and an oil change. Sent from an iOS device.

2 2

Research paper on differential treatment of anonymous users
by Griffin Boyce 27 Feb '16

27 Feb '16

Hey all, Just wanted to point to Sadia Afroz / David Fifield et al's research on differential treatment of anonymous users -- such as CloudFlare's blocking of Tor users. Unfortunately, it's not "just" CloudFlare (which holds substantial market share) and it's not "just" Tor users who are impacted by these things. It's a good read: http://www.eecs.berkeley.edu/~sa499/papers/ndss2016.pdf One curious finding is that some sites only block large exits. I'd be curious if an intended side effect were the ability to say "Oh we only block 15% of Tor exits" rather than saying "We block [>>15%] of Tor connections". Thoughts? ~Griffin -- “We have to create; it is the only thing louder than destruction.” ~ Andrea Gibson

1 0

Your gsoc project idea listing
by Sebastian Hahn 25 Feb '16

25 Feb '16

Hello! You are listed on our projects[0] page as likely mentors for students participating in a possible google summer of code 2016 for at least one of the following projects: - Ahmia - Hidden Service Search - Help improve Tor hidden services Please review these entries and let me know if you think these are still good ideas and you're willing to mentor this summer. If I do not receive a reply until the dev meeting, I will remove the above projects from the website until I hear otherwise. Please also suggest more project ideas and either submit them as website patches or let me know here and I'll make them appear on the website! Thanks Sebastian [0]: https://www.torproject.org/getinvolved/volunteer.html.en#Projects

2 1

Re: [tor-project] Moar Project Ideas!!
by Damian Johnson 24 Feb '16

24 Feb '16

> I guess the specific things I'd be interested in would be: > > - Is this tor node still up and running Hi Tom. Do you mean for individual relay operators? This sounds like Weather. > - The various checks Karsten outlined in my link for CollecTor (which > looks like 7-10 checks) Not sure how meaty this is. Checks sound pretty simple. > - 3-4 checks for a BWAuth (have the scanners looped in the last N > days; are the number of measured relays in the correct quantity > threshold; have an obscene percentage of relays not been measured in a > while) DocTor already includes checks around unmeasured relays though no doubt there's room for expansion. This reminds me though that we've wanted to overhaul the BWAuths for a long, long time. If that's feasible and something we have a mentor for that would be sweet! > - Both of the above would involve changes to CollecTor/Torflow to > nicely output better status information > > In fact - a whole different project would be a consensus-health-like > site specifically for bandwidth authorities. I don't know what's > going on with the bwauth stuff though... I'd suggest talking with > people in Valencia and seeing if I'm the only person interested in > this (either individually or as a whole). I won't be there but Mr. Sebastian will be prompting folks to give more thought to project ideas. Cheers! -Damian

1 0

Your gsoc project idea listing
by Sebastian Hahn 23 Feb '16

23 Feb '16

Hello! You are listed on our projects[0] page as likely mentors for students participating in a possible google summer of code 2016 for at least one of the following projects: - Profile UDP transport protocols Please review these entries and let me know if you think these are still good ideas and you're willing to mentor this summer. If I do not receive a reply until the dev meeting, I will remove the above projects from the website until I hear otherwise. Please also suggest more project ideas and either submit them as website patches or let me know here and I'll make them appear on the website! Thanks Sebastian [0]: https://www.torproject.org/getinvolved/volunteer.html.en#Projects

2 1

Your gsoc project idea listing
by Sebastian Hahn 22 Feb '16

22 Feb '16

Hello! You are listed on our projects[0] page as likely mentors for students participating in a possible google summer of code 2016 for at least one of the following projects: - Txtorcon/Stem Integration Please review these entries and let me know if you think these are still good ideas and you're willing to mentor this summer. If I do not receive a reply until the dev meeting, I will remove the above projects from the website until I hear otherwise. Please also suggest more project ideas and either submit them as website patches or let me know here and I'll make them appear on the website! Thanks Sebastian [0]: https://www.torproject.org/getinvolved/volunteer.html.en#Projects

3 2