June 2016 - tor-project - lists.torproject.org

Notes from June 23 2016 Vegas team meeting
by Karsten Loesing 27 Jun '16

27 Jun '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for June 23 2016 meeting: Georg: 1) GSoC workload is starting to increase for the Panopticlick project 2) Helped with press related things around the Selfrando paper Karsten: 1) Met with metrics team members in Berlin to talk about the new Mozilla award and to start making some plans. Roger: 0) My next several weeks are going to continue to be messes, logistics-wise. So if there is something concrete that you need from me, please let me know early and often. Sorry in advance. :( 1) We got permission to have spent the rest of our SponsorR Year2 money. That means soon I will need to sit down and map out the Year3 milestones that we will want to use. 2) We wrote a "rebuttal" for the reviews on our NSF-Eindhoven proposal. Things are looking promising but who knows. 3) I helped Shari with a first round of Seattle invite brainstorming. It's with her now, to make some decisions how much travel to fund. Also we should be sure to send the draft invite list to some sufficiently large set of people (tor-internal?) so we can learn about potential problems early. 4) Shari asked me to help move forward the donations platform thing. I need a person who can lead it, because I'm going to flake if it's just me. 5) I'm considering doing a panel the Monday before PETS in exchange for them paying for my flight (yay making money by saving money). Nick: 1) No updates, actually. Mainly doing software, trying to be helpful to Isa and my team, trying to stay focused. 2) Could use some triage help from Isabela, but it's less urgent than all the other stuff Isa is doing. 3) Hoping to discuss many of the things Roger raised above. 4) Never enough hours in the day or days in the month. Kate: 0) My request for good news about Tor work is going well. Had planned to just do blog posts (as media bombs were exploding all around) but will now to try to pitch some of this to journalists. Will also resume newsletter going forward. It was a little difficult to elicit good news from the group. People, don’t be shy! We’re doing so much interesting work! Also, if you are doing a software release, let me know if there are particular features that users (or info sec folks) will think it’s important or useful. I may not be able to figure this out without you :) Good news blog posts: Tone: Fun, interesting, friendly (which is true to these projects!) Karsten —Karsten’s Mozilla award blog post is published - yay! https://blog.torproject.org/blog/tors-innovative-metrics-program-receives-a… GeKo—I interviewed him on Selfrando; https://blog.torproject.org/blog/selfrando-q-and-georg-koppen Serene -Q and A about Snowflake is drafted and I am editing it Nick—Writing a blog post on history of Tor’s cryptography! 1) EFF/Tor Day of Action on Rule 41 (First Tor advocacy campaign ever?) Funny and pointed tweets by flexlibris and Isis to support it :) (loved them both so much) 300,000 Twitter impressions 1,000 retweets We tweeted, participated in EFF's mainstream media (a judicious amount); helped provide quotable quotes, blogged, Facebooked. Helped signal boost the proposed bill “Stop Mass Hacking Act” that would undo changes to Rule 41 Despite intentionally keeping a low profile on mainstream media (as we are a hot potato at the moment), we were quoted in BoingBoing and SC Magazine Listed as a supporter of the campaign in very good Hill article, Christian Science Monitor (also The Register TechTarget, and TechWorm Media was overwhelmingly positive; Twitter response was very positive (so--no backlash against Tor or campaign) The Hill: http://thehill.com/policy/cybersecurity/284278-google-paypal-push-back-on-c… (barely there but in a useful context in a useful article) CSM: http://www.csmonitor.com/World/Passcode/2016/0622/Google-privacy-groups-urg… SC Magazine: http://www.scmagazine.com/justices-caldwell-lauds-rule-41-changes-eff-other… Great working relationship with Rainey; we communicated in real time for two days straight; tried to set this up for tech people but no dice Planning a twitter survey to see if people learned more about Rule 41 during Day of Action (interested in any advice from Isabela) Banner for our website was super tricky—I think EFF expected us to be able to just paste it onto our website, but in the future—we should have a Tor-EFF policy and tech meeting ahead of time to discuss any issues—and especially—be able to communicate in real time with EFF tech people to ask questions. Thanks to Roger and Sebastian, who worked on it. 2) Fenton Communications: Shari, Sue, and I met with them; had a useful discussion with them about crisis communications, realized that we are already on the right track and decided not to use them. Will reserve the right to re-engage with them if all heck breaks loose or looks like it’s going to. :) 3) Funders need to help us resist FBI exploits! That is all. I hope they do. Smart people are working on it. :) Relevant: “As quietly as possible, the government is renewing its assault on your privacy” https://www.theguardian.com/commentisfree/2016/jun/22/government-privacy-fb… Alison: 1) Social contract progress 2) Getting a professional facilitator to help us talk about consent, abuse, etc at Tor-dev 3) OTF proposal for Torservers got another extension Isabela: 1) DRL - visit moved to first week of August (yay) - we (me, shari and sue) are actually going to DC for this audit thing (that is a lot of work on this front for me this month and in July) 2) DRL - next round of proposals August 26! We need to coordinate what we will do, Mobile is definite one but we should try two proposals 3) SIDA - Marcin reached out with a list of things for us to do in the process of submitting a final proposal for them by August 1st 4) Internews - so painful :( trying to get Nima to sign his contract and to invoice us. I need to start gathering the deliverables because it ends next week.. very painful but I think I will survive this project 5) Network team - catch up on 029 state of things and start working on follow ups from our last retrospective and prep our next one (we said mid July) -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXcOCrAAoJEC3ESO/4X7XB4TsH+gIMjowp+d9jjGUjjwzxhj1m DE3paDnJDSubRCD8iNB7TGc/bSrmcqmV/1VitRFkmoGBVXRNIrzJiXFGFMfmltal DPWx5CGVbqM+pUAARhUAte+kgLC2sKysWJIv+Jywbqlk638pmCAZkah5+qOQCFTj WBvkq7wVBWIWb1vxkSjzfe3cRJI0rmg/NEf6otDC/j25zf58jr/8oh/woyOwmi+z QLSHNXRXy2Wk7IUjo4Htg08DWGwyEh8CWZ4bbsa0+pYS27Ch0bImjVINcBbaQKv/ xa3r8v/8rYTlCrmjOk7d7omfGpEJV6CfK8OgPyFRzPjMHQ8xp8lVhsKnSM9U+DI= =qRhK -----END PGP SIGNATURE-----

1 0

Translation process meeting
by Colin Childs 22 Jun '16

22 Jun '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi everyone, I'd like to try something that we haven't (to the best of my knowledge) done before: I'd like to hold a general "translation process" meeting, and invite members from any of the projects currently hosted on our Transifex to attend. I'd like to learn from you how to make the translation process work better for your individual projects. I'd also like to hear if there are any issues you are encountering that may be solvable either by myself, or by working with the Transifex developers. Below is a Doodle to plan the meeting, all times are UTC: http://doodle.com/poll/9mmzsppm8cdvaeir I hope you all have a nice weekend! - -- Colin Childs Tor Project https://www.torproject.org Twitter: @Phoul -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJXW5K3AAoJEJWQHABkmqq5bxgP/R+Iuqq+V5+ZfmJBPeR8NhXi qcX9Mj3i+4c1uDzWmVqh/oj0H0H4FKD6PrFKkavxHw5To7imocvJmdZzbnQqWg9c VQBe3TMDKYNz6OtLGMGulE/LL+CYGWW2WlvM8kUy/+iGxpBk5UjTMo4Co8mZiyXr Ih407VeLL9s3FIJjIunbiZwjBf0JNjXcCSOfB4iSBE5qOltonq1gIj3uYuCbNn0c nKh4uoeTzo05EsL6WgK0Rbh6KK4KdGAJg9A0O0RudcrJKE/wfZfULaQ3v54YOr4L jnLt8iEBrFbaJj8eCaVWqHuIzDRWbEtOvw7swxMdGfOQmJaD1iK4574GzmeBnCJt 8z63Q/6UDxsBaxaceXjReypIg4GdDZZmXNVWFNhbU4tSBqg0hlq10aYYFZGJn5Op m3V1SlLONnktCkzPFOLtctws51uVQPQ8mzMSPxKfIxzWstHC4ppQmi91xDOEYtWQ G+4hX16yvHto0cjbzrcSnGL8JN61bnF4I4yi24p3jwX2cquvd849qJiGG7DAlxQQ 8WK0QOSA73Kv28cNaV24oDipq7UChA79eacZTU1q4gsqp+ukWxrOAlwXowO0XThB 7UmrxAJNEHRZVq98R29vczisSeEwW5AGi7OBIDlF6ZhzO5EzdKX1IebqznQuG1my 84Y+S+rmN4WQbQa8pDYC =/mZx -----END PGP SIGNATURE-----

1 1

Create tor-users and bringt it to live
by Jens Kubieziel 22 Jun '16

22 Jun '16

Hi, following up our discussion about tor-talk and tor-users I created the ticket <URL:https://trac.torproject.org/projects/tor/ticket/19477> as well as the list itself <URL:https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-users>. As a next step I suggest we make an announcement about the existence and purpose of tor-users as well as the planned fading out of tor-talk. IMHO this should then be sent to tor-talk and tor-dev. Could someone of you phrase a nice announcement? Thanks, -- Jens Kubieziel http://www.kubieziel.de There's no point in being grown up if you can't be childish sometimes. -- Dr. Who

1 0

Fwd: Russian bill requires encryption backdoors in all messenger apps
by Kate 21 Jun '16

21 Jun '16

FYI-- -------- Forwarded Message -------- Subject: Russian bill requires encryption backdoors in all messenger apps Date: Tue, 21 Jun 2016 15:59:16 -0400 From: Nathan White <nathan(a)accessnow.org> Russian bill requires encryption backdoors in all messenger apps By Patrick Howell O'Neill <http://www.dailydot.com/authors/patrick-howell-oneill/> Backdoors into encrypted communications may soon be mandatory in Russia <http://dailydot.com/tags/russia>. A new bill in the Russian Duma, the country's lower legislative house, proposes to make cryptographic backdoors mandatory in all messaging apps in the country so the Federal Security Service—the successor to the KGB—can obtain special access to all communications within the country. Apps like WhatsApp <http://www.dailydot.com/tags/whatsapp>, Viber <http://www.dailydot.com/tags/viber>, and Telegram <http://www.dailydot.com/tags/telegram>, all of which offer varying levels of encrypted security for messages, are specifically targeted in the "anti-terrorism" bill, according to Russian-language media <http://www.currenttime.tv/a/27809255.html>. Fines for offending companies could reach 1 million rubles or about $15,000. The new Russian legislation, which has already been approved by the Committee on Security, is just the latest such flare up in a global debate over encryption <http://dailydot.com/tags/encryption/> that earned a bright spotlight in the U.S. earlier this year, particularly after the San Bernardino terrorist attack <http://www.dailydot.com/tags/san-bernardino-shooting/> led the FBI <http://dailydot.com/tags/fbi>to pl <http://www.dailydot.com/politics/fbi-san-bernardino-iphone-exploit-no-vulne…>ead for access to one of the shooter's encrypted iPhones <http://www.dailydot.com/politics/fbi-san-bernardino-iphone-exploit-no-vulne…> . Russian Senator Yelena Mizulina argued that the new bill ought to become law because, she said, teens are brainwashed in closed groups on the internet to murder police officers, a practice protected by encryption. Mizulina then went further. "Maybe we should revisit the idea of pre-filtering [messages]," she said. "We cannot look silently on this." Encryption uses advanced mathematics to protect data so that even the world's most powerful computers cannot unlock data they are not meant to have access to. The technology is used in various ways to protect everything from credit card transactions on the internet to your emails and internet traffic. Government focus on encryption intensified in recent months after Apple <http://www.dailydot.com/tags/apple> andGoogle <http://www.dailydot.com/tags/google> offered encryption options on their smartphones. WhatsApp, with over 1 billion users around the world, offers encryption on messaging. The technology is seen as a fundamental cornerstone of cybersecurity <http://dailydot.com/tags/cybersecurity/>, such that if a business is not using encryption to protect sensitive data, it's often deemed irresponsible by experts. But just as encryption keeps out crooks, it keeps out governments, law enforcement, and intelligence agency spying. That's led to high-level debates around the globe about the rising popularity of encryption. While government authorities around the world argue in favor of special access backdoors, a vast consensus of technologists argue such backdoors will undermine cybersecurity and create an internet more dangerous and volatile than ever before. --

1 0

Tomorrow: EFF/Tor Worldwide Day of Action to stop changes to Rule 41
by Kate 21 Jun '16

21 Jun '16

Hi, The EFF/Tor Worldwide Day of Action to stop the Rule 41 changes is happening tomorrow; already many people can view the banner on the Tor website and click through. Basically, these changes (which EFF calls "catastrophic") will let judges allow the Department of Justice (and FBI) to legally hack computers using Tor all over the world by obtaining a search warrant--starting December 1, 2016. The search warrants allowable under these rule changes are very broad and could affect thousands of innocent Tor users. The purpose of this Day of Action is to educate people and mobilize them to act--either by signing a petition or contacting Congress (you can do one of these from the banner on the Tor website). Then, members of US Congress will use that public pressure to try to pass the #SMHAct, which would undo these rule changes. It is an uphill battle. Please tweet and retweet about this situation--all day if you can. Email your lists. Alison got us started: https://twitter.com/flexlibris/status/744301855614787584 And I quote: HI IF YOU USE TOR OR A VPN RULE 41 WOULD GIVE THE DOJ EXPANSIVE POWERS TO HACK YOUR SHIT NO MATTER WHERE YOU LIVE That is the gist. Please spread the word. Cheers, Katie ps: The US Department of Justice has jurisdiction over immigrants, native americans, and many different groups and projects: https://www.justice.gov/agencies --I am trying to find out whether these Rule 41 changes might impact any of these groups. pps: For more policy information about this bill, see https://cdt.org/insight/issue-brief-proposed-changes-to-rule-41/ (but remember the changes are no longer proposed and will happen automatically unless Congress passes SMHAct) or https://www.eff.org/deeplinks/2016/04/rule-41-little-known-committee-propos…

3 2

Notes from June 16 2016 Vegas team meeting
by Karsten Loesing 21 Jun '16

21 Jun '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for June 16 2016 meeting: Georg: 1) Slowly working on SponsorU items (https://trac.torproject.org/projects/tor/query?status=!closed&sponsor=Spons…) 2) Tor Browser 6.x issues kept us busy (above all: https://bugs.torproject.org/19400 and related items) Alison: 1) I've done pretty much nothing this week except deal with the Jake situation, which I move to stop calling the Jake situation and call the "community truth and reconciliation" or something like that. 2) I've started collecting a lot of resources on transformative justice and talking to people who understand how to work through things like this. I suggest that we hire a professional to help us work through these things at Tor dev. 3) This week I'll get back to work on all the things that this situation has caused me to neglect: community docs, SIDA and OTF proposals, community team work, support team stuff, and so on. 4) Library Freedom Project is going great though! Kate: 1) Rule 41: Campaign: We are partnering with EFF to launch a campaign to support a law that would 2) Kate: Lots of time spent strategizing around the media regarding the Jake Situation. 3) Working to promote good news about Tor: Working on blog posts with Serene and others. Really interesting! Shari: 1) Lots of time spent talking with our lawyer, helping the investigator, checking in with people with stories, explaining things to our funders, talking with others. Will be looking next week to ways to move things forward and start rebuilding trust and safety in the organization. 2) Met all week with Roger, Isa, Sue Abt and Cass to map our grants and figure out how to keep better track of them where lots of us know all of the things, as opposed to the current situation where many of us know some of the things. 3) Getting ready for DRL site visit on June 27-28. 4) In San Francisco for three days next week: meeting face-to-face with lawyer, hopefully meeting with Alison, ED Club meeting, and some EFF stuff, including an EFF board meeting. Nick: 1) Working on triage 2) Sponsor allocation email that Roger sent. Isabela: 1) Worked in Seattle with Shari, Sue and Roger 2) Now in Detroit - plan to work with Nick on triage today and tomorrow 3) Plan on be between this conference and work till Monday when I fly back to SF -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXaOfgAAoJEC3ESO/4X7XBUkIH/0cC2Eu1vMx8lesbCCvsjQGy rtnulJW3tFLtmIAcfW7zvInHSAJ3xAEBcWmQ/kKmIWZFO1JoJpTMf2A7/lz4eXHw zQsNC9ODW3qwxqOgdPX9OvPqwXrhZtzANE+zvoCG0f9dcKOctX4d04xTDiFIDisF wg1Sjwi2cn0aPODkn8djvr0WCNUOdWoHXfFxwfsbE02ZANA4vJDYCDnDkewW6JjB oOBJxH0e7R5e+7uJhWfCa5NJE48EH76YDPBVns4dF7G/Ck/U/mIBQ+fKkwwP/ZYa VeLnu4cC7xmc1JRLvfJvx3czmX6b/BHj+MQUWlcdz+wUfvp9/UMC40UoyV5G68w= =VBwO -----END PGP SIGNATURE-----

1 0

regarding tor relay shirts
by Jon Selon 13 Jun '16

13 Jun '16

Hey all! Shari forwarded me the string of emails concerning the tor relay shirts. I would love to take this project on. We do have a small surplus of the relay shirts here at the Seattle office, so if someone could just point me in the right direction I will knock all this out. Where is this list of requests? Is this something I need to subscribe to? Let me know and I'll get this done. Any information you could provide would be greatly appreciated. Thanks, Jon Selon Admin Assist

1 0

Notes from June 9 2016 Vegas team meeting
by Karsten Loesing 13 Jun '16

13 Jun '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for June 9 2016 meeting: Georg: 1) We finished the Tor Browser transition to ESR 45 by releasing 6.0.1, 6.5a1 and 6.5a1-hardened 2) Our focus goes back to the remaining SponsorU items (not all are there yet): https://trac.torproject.org/projects/tor/query?status=!closed&sponsor=Spons… Isabela: 1) working with core team to make 029 smaller - make sure everyone has tasks assigned to them, and that those tasks are associated with our deliverables. 2) Working on DRL docs for their visit at the end of the month (with Shari and Sue) 3) Working on OTF application (had a call yesterday) 4) Next week I will be in Seattle for to work on organizing sponsor stuff then I will be in Detroit - probably not available for this meeting Kate: 1) Update on Rule 41 2) Media strategy Shari: 1) talked with various funders addressing their general questions about our needs and proposals 2) trying to finish evaluating grant management software in preparation for our retreat next week 3) getting Erin up to speed on hr matters; we met with a health benefits broker yesterday about health insurance for employees; we will start covering people August 1 Karsten: 1) People are angry that they don't get their t-shirts, see recent postings in thread "Tor Weather has been discontinued" on tor-relays@. Nick: 1) See Isabela wrt deliverables, triage. 2) Misc coding Roger: 1) I am in Croatia until Saturday (with a talk on Friday), then working my way to Seattle for next week. I will write up a todo list for what I want to get out of next week. 2) Also I will read and review 5 foci papers this weekend. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXXnUoAAoJEC3ESO/4X7XBRCIH/0TSpvPmXLiIyrvAjPYs2ihB ZLFi72INdAS2pX75Wh0HYyommTwpI50ReOQNzzbTM5D/lXtxmAE79hzUTZRq7GDQ 9DxkE1V73/rP6kvTvniWyNU3XfYgMdYAabO6vNFL7f79cs45LPCWRBF0Joy8tlyw bf/yXKzG3qU8J3xZTRlBhWS8WognEW8z4cy9Qqg0Sqr9d3tCxLaDjMShzls4DNjx RC4Pf/se3TZW7dN1TZmc9IM536KXsnhYOU/JibPPxmk8FMvvzs3LfVcl2FepcP8a KKBFDOB9PsEkPLTrSwEKGCQI+DTOLniJ7g0M7vaSWHQzLcg/L4wAY1tr9CmFGxg= =jUmU -----END PGP SIGNATURE-----

1 0

State of tshirts for volunteers running Tor relays
by Sebastian Hahn 13 Jun '16

13 Jun '16

Hi, is there anyone who can shed some light on who is currently sending out shirts for volunteers, what their status is, etc? It seems this has completely grinded to a halt with the fundraising campaign, which is a real shame. Should we stop promising shirts to people who run relays? Is there a shortage? People on tor-relays have claimed that they're now waiting 7 months for their shirt. It's totally understandable if people are buried with work, but there's just no information about whether we even have anyone who is supposed to be doing the work right now. Thanks for any kind of feedback on this Sebastian

4 3

Infographic about Pluggable Transports
by Nima Fatemi 11 Jun '16

11 Jun '16

Attention: Metrics, UX and PT teams =================================== I'm working on an infographic about Pluggable Transport, that is ideally going to help educating both end-users and bridge operators (including potential bridge operators). I've prepared a list of things we could cover on this. Please review and let me know if there's anything I've missed that should be added to the list. This infographic is going to have two sections, the first part is more of a how-to. Showing 6-8 steps, demonstrating how to download Tor Browser and configuring it to use a PT to connect to Tor network. The second part, is the actual infographic part: - List of PTs included in Tor Browser with a one-line summary and significance of each - List of PTs under development - Stats + Total number of PT bridges + Average number of PT clients per day + Maybe compare the numbers with direct connections? - Links to PT page (on website and wiki) What are other interesting numbers about PT world? Is there anything else I should add to this? I was thinking about adding average traffic the default bridges are getting per mounth, since it's very significant. 'Azadi' alone has transferred more than 103 TBytes since Feb: month rx | tx | total | avg. rate ------------------------+-------------+-------------+--------------- Feb '16 12.07 TiB | 13.48 TiB | 25.56 TiB | 87.62 Mbit/s Mar '16 16.81 TiB | 18.84 TiB | 35.64 TiB | 114.31 Mbit/s Apr '16 11.17 TiB | 12.59 TiB | 23.76 TiB | 78.74 Mbit/s May '16 7.16 TiB | 8.07 TiB | 15.23 TiB | 48.84 Mbit/s Jun '16 1.55 TiB | 1.73 TiB | 3.28 TiB | 57.62 Mbit/s Best, -- Nima 0XC009DB191C92A77B | @mrphs "I disapprove of what you say, but I will defend to the death your right to say it" --Evelyn Beatrice Hall

4 4