April 2016 - tor-project - lists.torproject.org

Re: [tor-project] Notes from April 7 2016 Vegas team meeting
by Nathan Freitas 15 Apr '16

15 Apr '16

On Fri, Apr 15, 2016, at 03:16 AM, Karsten Loesing wrote: > Isabela: > 1) meeting Laura w/ Shari this Friday. Hope to hear better news from > her. I emailed DRL requesting the follow up phone call they offered in > the rejection email. I also pinged Dan to see if he is around, should > be good to check in with him as well. ... > 4) Next week on implementers meetings at DRL till the 20th (Wed). 20th > is also the soft deadline for OTF full proposal and deadline for > sponsorT report. >From my perspective in hindsight, I think neither of the SoIs emphasized mobile enough, based on the previous excitement and interest DRL seemed to express earlier in that area. I think writing a "Funding All Things Mobile Tor" SoI would likely be funded by DRL and/or OTF. We would need to go very big in the vision of supporting both Android and iOS as first tier platforms, including support for community projects like OnionShare and Ricochet. All of the core work on little t-tor, infrastructure, metrics, etc would be supported by this funding, but it is just that instead of starting with those things as end results or outputs, they become highly funded critical dependencies. If Tor Project as an organization isn't prepared to propose such a thing directly, then I am happy to, either as Guardian Project or through a partner like Internews who is currently funding our work on pluggable transports and mobile browsers. All the best, Nathan

2 1

CCP Grey on the Crypto Backdoor
by Tom Ritter 14 Apr '16

14 Apr '16

https://www.youtube.com/watch?v=VPBH1eW28mo CCP Grey makes awesome youtube videos, this one is particularly relevant to us. Might be worth tweeting =) -tom

1 0

Starting a Ph.D. in September
by isis 14 Apr '16

14 Apr '16

Hello, I'm very happy to announce I'll be starting a position as a Ph.D. researcher in Applied Cryptography at the Institute for Computing and Information Sciences of Radboud Universiteit in Nijmegen, starting in September this year. I'll be working with Lejla Batina as my supervisor, and Joan Daemen and Peter Schwabe as advisors. My topic is broadly "make tor's crypto better". More specifically, it's "make tor post-quantum"; beyond that, it could reasonably include working with other cryptographers to design some of the weirder constructions which tor needs, e.g. the 509-byte chained wide-block cipher that Nick's been going on about. The position lasts for four years, but covers only 50% of my time, because my supervisor and I are in full agreement that it would be more beneficial — both to Tor and to my thesis — if the other 50% of my time is spent doing development for Tor. As a non-academic, I feel that this is a somewhat unique opportunity. I've no desire to publish papers just for the sake of publishing something with my name on it — I care about improving Tor. My hope is that this Ph.D. results in the design and implementation of things that we've needed for a while. Best Regards, -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://fyb.patternsinthevoid.net/isis.txt

13 12

Re: [tor-project] Starting a Ph.D. in September
by Nathan Freitas 13 Apr '16

13 Apr '16

On Wed, Apr 13, 2016, at 03:48 PM, isis wrote: > I'm very happy to announce I'll be starting a position as a Ph.D. > researcher > in Applied Cryptography at the Institute for Computing and Information > ♥Ⓐ isis agora lovecruft doctor lovecruft has a nice sound and look to it. Thanks for working to protect the future.

1 0

Funding sources for developers in Latin America / Africa
by Virgil Griffith 13 Apr '16

13 Apr '16

Latin America * http://programafrida.net/en/grants * 20-40k USD grants Africa * http://www.fireafrica.org/grant-2016 * 25-30k USD grants -V

1 0

Fwd: Equipment Donation: Servers?
by Shari Steele 12 Apr '16

12 Apr '16

Hey all. This seems like a very generous offer. Anyone interested in running these 50 to 60 servers? Shari Begin forwarded message: > From: "Don Hejna" <donhejna(a)alumni.stanfordgsb.org> > Subject: Equipment Donation: Servers? > Date: April 8, 2016 at 1:10:01 PM PDT > To: <execdir(a)torproject.org> > > Hi I am hoping to reach someone regarding a potential donation of a 50 to 60 Servers for use as relays or exit nodes. Servers are mostly Del 1950’s with several gigabit ports each. Currently located in Silicon valley. > > I will be in Cambridge on Monday if meeting in person is appropriate, otherwise, phone is preferred. > > -Don > > Don Hejna > Stanford Graduate School of Business > Sloan Fellow 2007 > donhejna(a)alumni.gsb.stanford.edu > (650) 279-0187 >

2 2

Pro tip: Comment on media articles (at the bottom of the article)
by Kate Krauss 11 Apr '16

11 Apr '16

Hi, One small but useful thing that people can do to help Tor's image is to make a comment at the bottom of articles about Tor (especially negative ones). I'm not trying to add more work to people's TODO lists, but if you do wonder if it's helpful to comment, the answer is Yes, it's helpful. This is advice you could share with friends who want to help Tor--anyone can use it. I wouldn't necessarily post it to a list besides this one, because it's advice about strategy. As an example, I'm not loving this Christian Science Monitor Article (http://www.csmonitor.com/World/Passcode/2016/0408/Tor-aims-to-grow-amid-nat…) which was then re-posted on Drudge.com. We don't want to generate lots of interest or controversy on Drudge.com, or Matt Drudge will start posting more negative articles about us--which he has mostly stayed away from over the years (interesting). But a couple positive comments would be useful. As a general rule, it's better to post the comment right after the article ends, or close to that, so you know more people see it (my bad this time). Our strategy here is to educate people, rally our supporters, and convert people who are neutral or unknowledgeable about Tor into supporters. Anyway, as an example for a general or conservative audience, here's what I posted at the end of the article on drudge.com--it focuses on researching health information and keeping the Man out of your business: "Tor is used by people who don't want either the government or companies like Google to know that they are trying to research sensitive health information--like about breast cancer--or about politics--or anything that they think is no one's business but theirs. It's super safe and private to use--that's the point. It's developed by a nonprofit organization and you can download it for free on torproject.org." Lots of people understand wanting to research breast cancer or birth control or drug treatment centers without having Google or your government spying on you. So those are good starting points. Health information, especially, resonates with older people and/or conservative people. Here are some basic talking points about Tor for comments after articles: Use a few; you don't have to use all of them. 1. We help human rights activists in countries like China hop over the Great Fire Wall (LOTS of people care about this from across the political spectrum in many countries) 2. We help people research health information privately (ditto) 3. We support the right to read and write freely 4. We support the right to privacy 5. We are safe to use--safer than what they are using now; very safe. 6. I often contrast our browser with onion services for people who have never used Tor by saying: With a web browser you are like a fish swimming in the ocean visiting different places. If you use the Tor browser, you are an anonymous fish. A web site or service you visit is like a coral reef. When the coral reef is also anonymous, that's an onion service. After people understand the difference between the fish and the coral reef, you can get into finer distinctions (Facebook, NAT punching, etc.). But fish vs. coral reef is a good start. 7. Tor is like hanging curtains on your window. Never get in to a flame war--one comment per person is fine. Your temperature should be cool, friendly, and educational--not angry. If you can't keep the temperature cool, it's good to skip doing this particular thing. (I'll be thinking of things you can do when you are mad.) Commenting is also a good thing to do on reddit, slash/dot, etc. You can use more sophisticated talking points for these audiences. It seems like a small thing but it really does help; it adds up--we want to rally and educate potential supporters, like the people on reddit, and we want to nicely educate people who read magazines like PC Magazine or CIO Magazine who might not know much about Tor. The key is to be the nice, reasonable person--I try to channel Roger :) Cheers, -Katie A list of places that could often use Tor-friendly comments: https://www.reddit.com/r/tor https://www.reddit.com/r/onions/ https://slashdot.org/tag/tor What else should be on this list? -- Kate Krauss Director of Communications and Public Policy kate(a)torproject.org @TorProject 1-718-864-6647 (works for Signal also) PGP: CC0D 9B42 DE89 D4D0 619B A606 DDEB 3937 7D18 973B

1 0

Re: [tor-project] [tor-assistants] Lets have a sponsorT meeting!
by Isabela 10 Apr '16

10 Apr '16

I am moving this from tor assistants to tor-project (sorry for the spam + cross posting + breaking all rules) Our meeting is on Monday, April 11th at 8PM UTC and me and Nima had a call with sponsorT today where they told us what they would like to see on our report to them (which is due on April 20th). So it would be cool to chat about it, they are: 1. Report on the work Nick did from the DC meeting and presented at Valencia (I think it was the updated version of the spec and Yawning also helped with that) 2. Report on our take from the Valencia meeting and what we will be doing next (maybe nick and roger can give an update from the meeting - and we all should figure out what's next together) 3. Stats for wiki and website pages 4. Report on other organizations and projects we met outside the implementers meeting ( I think Nima has some updates on this) On 04/06/2016 08:31 AM, Isabela wrote: > Hi, > > Thank you for filling up the pool. I am picking Monday April 11 at 8pm UTC. > This time works for everyone who answered doodle and for Yawning as well > (asked on IRC). > We can meet at #tor-project. > > Cheers, > Isabela > > > > On 04/05/2016 09:13 AM, isabela wrote: >> Hello there, >> >> I would like to set up a quick sync on irc about sponsorT work. We >> signed the contract with them and I would like to chat with those who >> attended the PT implementers meetings (in Dec in DC, and in Feb in >> Valencia) to learn more about what was discussed on those meetings so we >> can layout some of the work we will be doing as a follow up from it. >> >> As you can see below great part of our deliverables are to support the >> community and be this liaison for them. Nima will be focus on doing this >> part of the contract and this meeting will be helpful for him as well as >> he is looking for ideas and input on a strategy from Tor for it. >> >> I am copying Tor assistants because others might be interest in joining >> as well. >> >> Nima, Nick, Roger and Yawning - since you are direct related to these >> topics mentioned above, your participation is super important, please >> let me know what time this week you are available - here is a doodle: >> >> http://doodle.com/poll/sn88mwksdbb2di2f >> >> Thanks! >> Isabela >> >> >> Deliverables: >> >> “Tor will also accomplish: >> • Completion/ongoing support of APT Y1 activities >> • Attend the Pluggable Transports Implementer's Meeting (PTIM) (to be >> scheduled in coordination >> with partners, budgeted under IN) >> • Additional items as informed by the PTIM and with further budget/scope >> modifications >> • Additional 2 PT reviews >> • Improved PT documentation and spec, with a focus on non-Tor >> implementations; plus updating >> Tor's website and wiki to reflect recent work on documentation: >> Evaluation Criteria, Guidelines to >> deploy PTs, PT evaluations, and changes to the PT spec” >> > > > _______________________________________________ > tor-assistants mailing list > tor-assistants(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-assistants -- PM at TorProject.org gpg fingerprint = 8F2A F9B6 D4A1 4D03 FDF1 B298 3224 4994 1506 4C7B @isa

1 1

Notes from April 7 2016 Vegas team meeting
by Karsten Loesing 08 Apr '16

08 Apr '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this previous posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes from Apr 7 2016 meeting: Shari: 1) We had a board meeting. It was pretty uneventful. The board set up stuff they want me to accomplish by the end of June (I assisted). Nothing too hard. 2) Job descriptions have been distributed and posted. Lots of applicants for the administrative job. A few great applicants for the writer job. Slim pickings for HR. So I posted it on LinkedIn. #action: Roger will try to rope some people into a quick blog post pointing to our three job spots. 3) Got great comments from Nick and Isa on a personnel thing, and I should be able to incorporate them later today and send back for more. 4) Isa and I head to DC next week for DRL meetings. Nick: 1) I wrapped sponsor S q1 stuff, with help from Yawning and Sebastian. +1, would hack again. I had to re-scope my own view of some deliverables to do so, but what I did is consistent with what we promised, so... good. 2) We need to restructure the network team so that we don't have a situation where everybody else's job is "the problem I'm most interested in!" and Nick's job is "whatever nobody else was excited to do." It will take a while; ***Isabela is helping. 3) We've got most of triage done for 0.2.9; waiting on the next steps from **Isabela, which she's going to get done really soon now, so no worries there. 4) New meeting times seem to work well. Need to get a couple of developers to be more regular about it, though. 5) I'm waiting on the ***TBB team to put Tor 0.2.8.2-alpha into an alpha TorBrowser, so I can see some testing on it before putting out an 0.2.8.3-rc. Georg says the next Tor Browser release is pushed back a week because Mozilla is delayed. Maybe we need to do a separate "for testing" alpha release in the meantime? Or maybe we can just point people to a nightly? Linus still builds those right? #action: Nick started a thread about this on #tor-dev. Karsten is helping. Alison: 1) Membership in the community team is currently an issue. People don't respond to mail on the list and don't really come to the meetings. This makes me think that maybe the team needs a total overhaul. I've been asking for feedback, but I don't want to be dictatorial about it. I'll keep reaching out to people. 2) Lunar and I are banging out the membership doc and social contract. We'll be sure to be inclusive at the right stages. Advice solicited. 3) Colin and I (and I hope others) have just started working on support stuff, starting with the Tor Browser manual. This is an ideal thing for the community team to work on together. Isabela: 1) DRL rejected both SOIs - I will email Laura to know if we should schedule the call they suggest on their rejection email. 2) Main goal this week is to have 029 / deliverables organized. 3) Helped Sue Abt yesterday answering her questions so she can answer audit questions. 4) Organizing sponsorT work/report since we signed the contract with them. 5) OTF full proposal is due on April 20th (not a hard deadline, they are flexible) - so for the coming weeks I will be working on that, working on a presentation for DRL in DC and on DRL quarterly report. 6) And I think all of the above will hurt a little bit what I am doing with the ux team and the www team in April / because it takes priority over these things. 7) I talked to Marcin from SIDA last week, who said we should bug him to followup to our SIDA proposal. I'll do that. Roger: 1) I submitted the NSF-Dutch proposal last Friday. Success rate is 10%, so don't hold your breath. But even if we don't get it, we can reuse the text and team for a future one. 2) PETS reviews are due tomorrow, and this month I need to prepare for the SponsorR quarterly mtg at end of April. I've been unearthing myself from having family visit. If there's anything you need from me that I've forgotten, please let me know. 3) I had a good chat with Isa about support. IMO we need to decide our goals/vision for support, and get a consensus on what our first full-time support person will do, and then get one. I'm hoping Shari will help lead us in that. 4) FBI allegedly has a Tor Browser exploit? It would be wise to know if they're bluffing, or if it's obsolete, or if it's for reals. How should we proceed? Kate says "there's an upcoming court hearing in Washington State, perhaps we should act and rally support." #action: Alison will lead the coordination of this topic for (among) the people in the Vegas team. First steps, talk to Kate and Mike and Georg. 5) Tor Messenger sure needs secure update to work. It's the single biggest problem with using Tor Messenger now. Arlo said it would be $12k or less -- less with help from Pearl Crescent and Nicolas. This ties into our global priorities question, so we don't need to decide today. #action: Shari approves $12k, and Roger will move it forward. 6) I hear there's a hidden service hackfest being planned in Montreal in May. Now you know. 7) In Valencia I talked to OTF about them funding an audit on little-t-tor. They're now excited to do it, and they keep wanting to do phone calls. Who can I pass this to? #action: Isabela is excited for it but not now. Roger will reply telling them May is a better timeframe. 8) Retrospective on this Vegas team format: is IRC working? Is this Vegas thing in general working? Consensus is that people are surprised but yes, irc seems to be working well for the meeting. Mike: 1) I met with funders last Friday at RightsCon and gave Shari those notes. 2) Emailing with CloudFlare; Our "Good Cop/Bad Cop" strategy with us being the Good Cop and our users+community being the Bad Cop seems to be working. They are moving on some things. I am still pushing for Tor read whitelisting and way simpler captchas. I am also collecting issues from people who report them. #action: Alison will help to gather more user stories. 3) Talking with Google Project Shield to try to see if they would talk publicly about how they handle Tor (they said they don't compete directly with CloudFlare - not the same services, so they didn't want to make noise about it). 4) Talking with Google Search about unblocking Tor; They flagged that disconnect.me (our Tor Browser search engine) is not using an API key and this may violate their terms of service. I said we'd be happy to go back to them if they unblocked us. Otherwise, I think the fight is between disconnect.me and Google, and we stay out of it. 5) Gave Kate some suggestions to say to Chris about the FBI 0-day and gathering more info. I have been dropping: 1) The Blog upgrade contract #needs-attention: We should move forward the thread with Kevin re contract details, and also move forward the pantheon hosting decision thread. 2) Firefox network code review (I promised GeKo I would write up what I had, but then the CloudFlare emails started. Will do that write-up today, now). 3) tor-core release planning details and related work. For next week: I'll continue to gather user stories about the cloudflare issue, and email them. I'm also going to meet with Isabela about release planning, and probably also sketch an outline of the OTF proposal. Georg: 1) We are moving slower to esr45 than I hoped but we got another week (from Mozilla's delay), and that should be fine. 2) OS X signing works. But we have the wrong cert (app store cert vs gatekeeper cert). #action: Mike is going to get us a new cert. Karsten: 1) iwakeh started working on collector and (to some smaller extent) on metrics-lib. We had a first team meeting with iwakeh today which went great. All in all, yay. 2) When writing my monthly report for March, I noticed that not many people are still writing those these days. I looked at tor-reports@ archives and found that there's roughly a dozen people and teams who write monthly reports, which includes people here (GeKo, isabela, myself), other people paid by Tor (asn, dgoulet, Pearl Crescent, Leiah, Colin), very dedicated volunteers (atagar), and teams (SponsorR, Core Tor, Tor Browser Team, OONI team). And there are a few people and teams who occasionally write monthly reports (isis, Sebastian, Tails). But where are the monthly reports from other people here and from other people paid by Tor? IMHO we should either decide that it's not a requirement anymore to write monthly reports, or we should lead by example and ask paid team members to write reports. #needs-attention: we should figure out a sustainable plan for keeping everybody informed of everything. Mike pointed out that the Vegas team structure could play a role here. 3) should we clean up and send out notes after every meeting or once per month? #conclusion: we should send them after every meeting -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXB2VSAAoJEC3ESO/4X7XBdJMH/ApBaNkJunCMxpFzGBK2LKwW jTMmKc88ZODDODXOuAoOtdbPOfr/f6eLg25E4itob6/bnXCW+G6emuCYeVm13sZi muLCYp5nSOGTdPVth2ydHkplyIIfoXEdCKHjA/OFeYvUqRx1rGenIL7UPwtJ+d5q rq/epA3YbiA8+HqQWJM+4Bx0QFeMpraHdANlMI1ArVuIMXxQdBuDSvA1VTB/Dyg8 y0who/xZfuKXloRVA8389OW9Ekq2n/nKd1aGcdsLLaAyKusHcJwIeVautayHSx/E VDYDXJxnONqy8Onq13s+mY/tA/2cOUbNnlCKVq2UvFA8ad6Td9fO8t9FrT1nVXA= =lq3S -----END PGP SIGNATURE-----

2 2

Fwd: decentralized web summit
by Shari Steele 07 Apr '16

07 Apr '16

Hey all. Brewster Kahle at the Internet Archive is holding a summit about a decentralized web infrastructure. I told him I’d pass this along, in case anyone out there is interested. Shari Begin forwarded message: > From: Brewster Kahle <brewster(a)archive.org> > Subject: decentralized web summit > Date: April 4, 2016 at 10:02:25 PM PDT > To: Shari Steele <shari(a)steeleforest.com> > Cc: Wendy Hanamura <wendy(a)archive.org> > > > shari-- > > we are pulling together a decentralized web summit on June 8th. I am > writing because the idea of building in reader privacy is key, but it is > difficult. > > I wonder if there is a way to build in a tor or tor-like capability into > a decentralized web infrastructure. > > Would you or yours be up for participating? the gathering is just > gaining shape, but it is 2 months away. > > http://www.decentralizedweb.net/ > > -brewster > >

2 1