March 2016 - tor-project - lists.torproject.org

catching up on the support situation and what's next
by isabela 04 Apr '16

04 Apr '16

Hello! There has been a lot of discussion around user support. During Valencia's Dev Meeting and later in email threads. I have been talking with Colin and I want to help organize a way so everyone can collaborate in building what's next for support. We want to start with and IRCmeeting, for that please submit your vote for a meeting date/time here: http://doodle.com/poll/5dv2mtuiicebecr2 As a preparation to that meeting we would like to ask everyone to read a short report we put together: https://storm.torproject.org/shared/NfLl9mFD0_xZxxz64UEjn0xNhHPw2CpR5snRX6q… First, you will find information aboutuser support during SponsorO. We have also laid out the plan we created once that grant ended and we lost the resources we had, along with a description of what happened with each step of the plan. Finally, forthe'what's next' part of the discussion, there are links to two brain-storming documents. These are not necessarily the plan(s) we will end up going with, but may be a good starting point for determining what the plan should be. We thought that a summary of what hashappenedin the past year or so with user support would be helpful for the discussion. Let us know when is a good time to meet and continue this conversation! Cheers, Isabela& Colin -- PM at TorProject.org gpg fingerprint = 8F2A F9B6 D4A1 4D03 FDF1 B298 3224 4994 1506 4C7B @isa

3 4

Plan to shut down Tor Weather
by Karsten Loesing 04 Apr '16

04 Apr '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi everyone, I'm planning to shut down Tor Weather. For those of you who have not used Tor Weather in the past, here's what it does: Tor Weather is an email notification service that lets users subscribe for notifications related to one or more relays. These notifications can be configured to be sent out when the relay unexpectedly goes down or when it pushes enough traffic to earn its operator a Tor t-shirt. Unfortunately, Tor Weather is broken: - It is not actively maintained, nor is there an active operator running the main instance on weather.torproject.org. If it breaks, we don't have a good plan for fixing it. But since it's not broken yet, nobody is actively working on developing a better Weather. - The t-shirt notifications are misleading. Weather is promising t-shirts for relays that have not been around long enough or that provide too little bandwidth to be useful to the network, and it's almost impossible to deny a t-shirt after Weather has promised it. Also, Weather is likely not offering t-shirts to people who have long earned it, thereby confusing them. - An unreliable notification system is worse than not having a system at all. Relay operators shouldn't rely on Weather to notify them when their relay fails. They should rather set up their own system instead. There are a few possible alternatives to Weather: - We started rewriting Weather using Onionoo as data back-end in 2014 [0]. That project didn't produce working code, but somebody could pick up these efforts and finish the rewrite. - The Roster developers said that they're planning to include an email notification function in Roster [1]. - We developed a simple Python script that provides information about a relay operator's eligibility for acquiring a t-shirt [2]. None of these alternatives is a full replacement of Weather, and I don't think that we should work towards deploying an alternative anytime soon. The best scenario that I can imagine here is that, once Weather is shut down and people realize they really want to have something like it back, the relay operator community gets together and develops a thing or two. Those alternatives wouldn't run on torproject.org, but that seems secondary. I'm thinking about the following timing for shutting down Weather: - By end of month, March 31, we disable Weather's email notification functionality and place a big warning on the homepage that it will be shut down 2 months later. We also blog about this like we did when we shut down Tor Cloud [3]. - By June 30, we take the Weather host offline. Please respond to this list by March 23, which is in 1 week from now, if you strongly object to this plan. All the best, Karsten [0] https://trac.torproject.org/projects/tor/wiki/doc/weather-in-2014 [1] http://www.tor-roster.org/ [2] https://gitweb.torproject.org/metrics-tasks.git/tree/task-9889/tshirt.py [3] https://blog.torproject.org/blog/tor-cloud-service-ending-many-ways-remain-… -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJW6Z0OAAoJEC3ESO/4X7XBn5YIALAyJc+RZH/QWhqvOu3+kHqD D6+iOUxW5/fMfw0PaT1HmZcrpOT6tFU1ActS6k7BkoiJFj3nG4jmL4q63hONn8jk fbjhKxNPJx8fCo0LL7tkliviQWVCOPl9xvj5YmRX0CRTv3vs/gOvoXRwZ8HPR4vK jaSH6LT5nsgbv/9/p3mMCvDlxy8wOMuoxy1hcZPJEPYiB+7ZDXjmO3lR3tTBJUls s4GUfuvl6CkFUmz9TG2S8O7kZl8XnvY0F4/5gk8NcwegouFgdpcTOBCfcVkeBJgD fVW4Uk8f0FQOXWZbA77v4RoUbc91tAGe7H7q01Pja9Ibk6a0icmCceHG/RyFNhI= =9KGV -----END PGP SIGNATURE-----

4 7

Messages for Twitter about Tor blocking?
by David Fifield 30 Mar '16

30 Mar '16

I was invited to go to Twitter and talk about Sheharbano's, Sadia's, Mobin's, Srikanth's, Vern's, Steven's, Damon's, and my research about web sites blocking Tor users: https://www.benthamsgaze.org/2016/02/23/do-you-see-what-i-see/ I'm not a Twitter user, beyond sometimes reading the web interface, so I haven't experienced blocking myself. But I've heard of Tor users being blocked by Twitter. Is there anything you'd like me to say to or ask of them? I know about the #dontblocktor hashtag (which is more often directed at CloudFlare than Twitter); I know that Leif was off Twitter for a while; I know about Marie's survey of users at https://pad.systemli.org/p/twitterdontblocktor. Anything else?

6 6

Technical Innovation grants for the Asia Pacific
by Virgil Griffith 30 Mar '16

30 Mar '16

If you're based in the Asia Pacific, I have some nice grants for you: * http://isif.asia/Grants_TechnicalInnovation * http://isif.asia/ISOC_CybersecGrant * http://www.isif.asia/researchgrant In particular, I think any research about BGP routing in Tor, or otherwise increasing security of BGP or Tor would be lovely research project that I suspect they'd accept. It would also have the side benefit of bringing Asian funders more into the Tor community. -V

1 0

Fwd: Deadline - Call for Papers Toronto - March 31
by Kate Krauss 29 Mar '16

29 Mar '16

FYI-- -------- Forwarded Message -------- Subject: Deadline - Call for Papers Toronto - March 31 Date: Tue, 29 Mar 2016 16:41:56 +0000 (GMT) From: Illena Armstrong | SC Magazine | VP Editorial <info(a)mail.scmagazineus.com> Reply-To: info(a)mail.scmagazineus.com To: kate(a)torproject.org Deadline- March 31 June 1 – 2, 2016 8:15 am - 6:00 pm ** CALL FOR PAPERS Open: January 25, 2016 Closed: March 31, 2016 ------------------------------------------------------------ Are you interested in participating as a presenter/speaker this June at SC Congress Toronto 2016? Do you have any unique insights you can share with the IT security community? After many highly successful years of SC Congress across seven cities (www.sccongress.com ( http://www.sccongress.com/, SC Congress Toronto 2016 – our fifth installment - will feature cutting-edge sessions and must-hear dialogue coming from North America’s thought leaders in IT security – with an audience consisting of up to 1,200 information security and technology professionals and business decision makers from the country’s private and public sectors. SC Congress is an ideal platform for industry luminaries to share their perspectives and experiences with the IT security community around the globe through our live Congress events in seven cities and via webcasts available for download following our events. We love new ideas, or even new ways at looking at old ideas, but what we are not interested in are submissions advocating your organization, product or service. It is also worth noting that we have a finite number of sessions, so willingness to be part of a panel and/or suggestions for the creation of panels greatly improve one’s likelihood of being chosen. The team at SC Congress is seeking practical solutions, advice and suggestions that our delegates can take back and put to work inside their businesses immediately. Only submissions that meet this mission will be considered. Please also be advised that we will not consider standalone vendor sessions for this or any Congress program. If you are a vendor sending in papers, think of a customer, a vendor-neutral analyst or another kind of vendor-neutral practitioner to be a part of your recommended session. Unique, out of the box thinking makes for great content. For ideas on topics that have gained traction in the past, please see SC Congress Toronto 2015’s agenda ( http://www.sccongress.com/toronto/agenda/section/4501/ . Please click this link and fill out the online form to enter a submission. SC CONGRESS TORONTO CALL FOR PAPERS FORM ( https://scmagazineus.wufoo.com/forms/sc-congress-toronto-call-for-papers/ Submission deadline is March 31, 2016 As well, please take care to fill out all fields in your submission. Thank you for your interest in SC Congress Toronto 2016. http://www.scmagazine.com/ ------------------------------------------------------- You are subscribed as kate(a)torproject.org To unsubscribe from promotional messages please click here http://www.pages05.net/haymarketus-scmagazineus/Forms/SCunsubscribe?spMaili… For unsubscribe problems, please reply to this e-mail All SC Magazine promotional emails are sent from the domain "mail.scmagazineus.com". When configuring e-mail or spam filter rules, please use this domain name. © 2016 Haymarket Media Inc 114 West 26th St 4th floor New York, NY 10001

1 0

Future of media and archive.tpo
by Peter Palfrader 28 Mar '16

28 Mar '16

Hey you in the To: line! You are a member of the torarchive or the tormedia unix group. Yet https://trac.torproject.org/projects/tor/wiki/org/operations/Infrastructure lists no maintainer for either archive.torproject.org or media.torproject.org. We will soon have to change the master host for both of these from aroides to some place else. This needs a person or persons who is responsible for the service. If this turns out to be nobody, this will probably mean we have to shut down these services. Please let me know if you think you are the owner of that service. Cheers, -- | .''`. ** Debian ** Peter Palfrader | : :' : The universal https://www.palfrader.org/ | `. `' Operating System | `- https://www.debian.org/

2 1

Summary of meek's costs, February 2016
by David Fifield 28 Mar '16

28 Mar '16

Here's the summary of meek's CDN fees for February 2016. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 January 2015 $464.37 + $669.02 + $0.00 = $1133.39 February 2015 $650.53 + $604.83 + $0.00 = $1255.36 March 2015 $690.29 + $815.68 + $0.00 = $1505.97 April 2015 $886.43 + $785.37 + $0.00 = $1671.80 May 2015 $871.64 + $896.39 + $0.00 = $1768.03 June 2015 $601.83 + $820.00 + $0.00 = $1421.83 July 2015 $732.01 + $837.08 + $0.00 = $1569.09 August 2015 $656.76 + $819.59 + $154.89 = $1631.24 September 2015 $617.08 + $710.75 + $490.58 = $1818.41 October 2015 $672.01 + $110.72 + $300.64 = $1083.37 November 2015 $602.35 + $474.13 + $174.18 = $1250.66 December 2015 $561.29 + $603.27 + $172.60 = $1337.16 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 February 2016 $986.39 + $977.85 + $445.83 = $2410.07 -- total by CDN $10364.78 + $11624.45 + $2067.82 = $24057.05 grand total https://metrics.torproject.org/userstats-bridge-transport.html?graph=userst… In February 2016, meek reached its highest heights ever in terms of number of users--15,000 concurrent--before settling back down to about 10,000, where it started the month. For a few days, when obfs3 was on the way down and obfs4 was on the way up, meek was the #1 most used pluggable transport. obfs4 is a story of its own: it exploded from 3,000 to 15,000 users, probably aided by the many new default high-bandwidth bridges added to Tor Browser recently. It's possible that the increased capacity of obfs4 has taken some of the pressure off meek. We moved over 13 TB of traffic over all three services combined. Reminder that if you configure your own CDN or App Engine account and point it at https://meek.bamsoftware.com/, you will be using a completely unlimited bridge, which will go faster and help save money. == App Engine a.k.a. meek-google == Here is how the Google costs broke down: 5829 GB $699.50 5737 instance hours $286.89 Compared to the previous month: 4274 GB $512.86 5166 instance hours $258.31 https://globe.torproject.org/#/bridge/88F745840F47CE0C6A4FE61D827950B06F9E4… == Amazon a.k.a. meek-amazon == We didn't have the unusually high charge for HTTPS requests this month that we had last month. December had 142M requests in the EU (Ireland) region; January had 805M; and February is back to 156M. I set up additional pricing alarms. Apparently I crossed some kind of threshold for number of alarms, because they started charging for them, for the first time. The alarms cost $0.50. Asia Pacific (Singapore) 247M requests $296.50 952 GB $141.52 Asia Pacific (Sydney) 1M requests $1.95 6 GB $0.91 Asia Pacific (Tokyo) 29M requests $35.42 225 GB $29.68 EU (Ireland) 156M requests $188.05 1222 GB $96.31 South America (Sao Paulo) 9M requests $20.47 77 GB $18.33 US East (Northern Virginia) 94M requests $94.06 687 GB $54.13 -- total 538M requests $636.45 3171 GB $340.88 charge for alarms $0.50 https://globe.torproject.org/#/bridge/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == Zone 1 4103 GB $357.00 Zone 2 644 GB $ 88.83 -- total 4747 GB $445.83 https://globe.torproject.org/#/bridge/AA033EEB61601B2B7312D89B62AAA23DC3ED8… Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

2 2

Re: [tor-project] BWAuth Relay Count Declining
by starlight.2016q1＠binnacle.cx 27 Mar '16

27 Mar '16

At 16:58 3/27/2016 +0000, nusenu wrote: >Hi, > >> For the past several days the number of relays >> measured by my bwuath (whose data is given my >> maatuska) have been slowly declining. Originally >> I had an alert when it was below 8800, a few days >> I noticed it going below that. By today it's >> decreased to below 8700 to 8664. >> >> It's not the lowest bwauth measuring, but I don't >> see anything obviously wrong with my bwauth to >> indicate the decline. (The number I mentioned is >> number of lines in the bwscan.V3BandwidthsFile >> file, not the measured relays that make it into >> the consensus - but the comparison I just made did >> use the consensus count.) > > >If "past several days" matches with "since >2016-03-24", then I would not be surprised if the >Global Frag Networks group [1] caused this - at >least partially. > >Many of the unmeasured relays are from the global >frag group (since they just joined the network) > >https://github.com/ornetstats/stats#stats-on-measured-and-recommended-flag > >Many new relays means a rise in unmeasured relays >and if at the same time a few relays leave then >that would explain the decline even for absolute >values. > > >[1] http://article.gmane.org/gmane.network.onion-routing.ornetradar/1135 > http://article.gmane.org/gmane.network.onion-routing.ornetradar/1132 Interesting. Perhaps the arrival of bunches of new relays is a trigger for or exacerbates the bug where BWauths skip measurements, scanner/band #1 esp.

1 0

Re: [tor-project] BWAuth Relay Count Declining
by starlight.2016q1＠binnacle.cx 27 Mar '16

27 Mar '16

At 09:12 3/27/2016 -0500, you wrote: >For the past several days the number of relays >measured by my bwuath ... have been slowly declining. . . I've noticed the problem as one of my relays has been radically overrated for eight days and is clearly not being measured. The relay currently has consensus of 200% of normal and the link limit is saturated at all times. I might have to shut it down for a couple of days to avoid going over the ISP traffic allocation. Yesterday Faravahar measured it at close to zero (typical after overrating), but the four other BWauths haven't budged. I still plan on launching a project to run a passive BWauth and to fix bugs, eventually restructuring the scanning scheme. But life has not cooperated and I haven't been able to make time for it yet. With luck I should be able to get it underway by May.

1 0

BWAuth Relay Count Declining
by Tom Ritter 27 Mar '16

27 Mar '16

For the past several days the number of relays measured by my bwuath (whose data is given my maatuska) have been slowly declining. Originally I had an alert when it was below 8800, a few days I noticed it going below that. By today it's decreased to below 8700 to 8664. It's not the lowest bwauth measuring, but I don't see anything obviously wrong with my bwauth to indicate the decline. (The number I mentioned is number of lines in the bwscan.V3BandwidthsFile file, not the measured relays that make it into the consensus - but the comparison I just made did use the consensus count.) I wanted to send this email as a potential advance notice; but also ask if there had been any discussion of the bwauth system in Valencia, and if there is any current planned improvements in it. -tom

1 0