July 2016 - tor-project - lists.torproject.org

Tor Browser User Manual review
by Colin Childs 10 Dec '16

10 Dec '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi everyone, As some of you may be aware (if you attend the community team meetings), Alison and I have been working on updating the Tor Browser User Manual and getting it ready for an official release. The community team has now had an opportunity to review the manual, and now we would like to request feedback from the larger community! You can view the manual at https://tb-manual.torproject.org/linux/en-US/ . If you find something that needs … [View More]

5 4

Remove mercurius4 obfs4 bridge from Tor Browser?
by David Fifield 05 Aug '16

05 Aug '16

According to my and Lynn Tsai's bridge reachability measurements, the default obfs4 bridge mercurius4 has not been running for a few months. It was refusing connections in March and April, and more recently has just been timing out. Time to remove it? pref("extensions.torlauncher.default_bridge.obfs4.6", "obfs4 104.131.108.182:56880 EF577C30B9F788B0E1801CF7E433B3B77792B77A cert=0SFhfDQrKjUJP8Qq6wrwSICEPf3Vl/nJRsYxWbg3QRoSqhl2EB78MPS2lQxbXY4EW1wwXA iat-mode=0");

5 8

Amazon Smile
by Tom Ritter 01 Aug '16

01 Aug '16

Hi all, I noticed that Amazon Smile[0] has Tor Project as a recipient; been using it lately when I order from them. Has anyone collected the money? Is it significant in any way? (I mean anything is helpful of course, I'm just not sure if it's "a couple of tens of dollars" or "a few hundred".) Might be worth tweeting about also, there are firefox/chrome extensions that automatically redirect you so you remember to go through smile.amazon.com -tom [0] https://smile.amazon.com/gp/chpf/about/ref=smi_se_abtpo_r_about_smi

5 4

The Tor Project Social Contract
by Alison 30 Jul '16

30 Jul '16

Hello good people of tor-project@! I'm excited to present to you something that a number of us core members have been working on for some time now: the Tor Project Social Contract 1.0 [1]. Modeled after the Debian Social Contract [2], the Tor Project Social Contract is a set of promises to our community about what Tor stands for and why we create it. I'm sharing it with all of you today so that we can work on ratification. I think that the best way to do this is as follows: By 6 August at 00:… [View More]

18 43

questions about new community safety documents and practices...
by stderr＠riseup.net 30 Jul '16

30 Jul '16

Hi all, I have a question about the Harassment Prevention Policy, available here: A non-text attachment was scrubbed... Name: Harassment Prevention Policy (final).pdf Type: application/pdf Size: 98932 bytes Desc: not available URL: <http://lists.torproject.org/pipermail/tor-project/attachments/20160729/c0fd…> The policy seems to conflate harassment and discrimination, specifically in this clause: "Both the Company and U.S. law also prohibit unlawful workplace harassment. Unlawful … [View More]harassment is unwelcome conduct, based on a Protected Characteristic, that is sufficiently severe and pervasive to alter the terms and conditions of employment or create an intimidating, offensive, or abusive working environment. Prohibited harassment can take many forms, including, but not limited to the following, when based on a Protected Characteristic: •Making or using derogatory comments, emails, letters, epithets, slurs, or explicit jokes. •Derogatory gestures, posters, photographs, cartoons, drawings, websites, emails, text messages, or other physical or electronic media. •Touching, assaulting, impeding, or blocking normal movements." Earlier in the document, a "protected characteristic" is defined as: "It is against U.S. law and strictly against our policy for any employee or non-employee to discriminate against or harass any Company employee, contractor or volunteer on the basis of race, color, religion, national origin, ancestry, disability, medical condition, genetic information, marital status, sex, gender, gender identity, gender expression, sexual orientation, age, military or veteran status, or any other protected status (each a “Protected Characteristic”)..." Anti-discrimination statutes and policies are commonly defined around "protected classes" or "protected characteristics," since discrimination based upon other characteristics is both clearly allowed and beneficial (performance, fitness for the advertised job opening, etc.), but harassment statues and policies typically don't include references to protected classes or characteristics, since harassment is always negative and thus characteristic agnostic. Simply put: the plain language of the Tor Project's new policy would seem to allow harassment, provided that it is not *based upon* a protected characteristic. This would also seem to allow the harassment of anyone, including women, racial minorities, or other people whose rights such a policy would presumably be designed to protect, as long as that harassment is not "based upon" those characteristics. I would strongly prefer if the Tor Project would separately define harassment and discrimination. If someone is turned down for a job on the basis of their race or veteran status, that is discrimination, but not harassment. If someone receives extensive unwanted communications from a co-worker, for example including persistent late night phone calls that are unrelated to work, or extensive unwanted visits from the co-worker at one's home, etc, then this would clearly constitute harassment, provided that the complainant made it clear that these communications/visits were unwanted. However, this behavior need not be based on a "protected characteristic" and it may not necessarily take the form of sexual harassment, either. This is why harassment is typically defined as a persistent, unwanted, pattern of behavior that would cause a reasonable person to experience fear or emotional distress. Best, stderr [View Less]

1 0

questions about new community safety documents and practices...
by Lane Rasberry 29 Jul '16

29 Jul '16

Hello, I just subscribed to this list hoping that this was a general discussion list for the Tor community. I think I am in the correct place, but if not, would someone redirect me? I see that there is another recent thread called, "The Tor Project Social Contract". Having text like this seems like a great idea! I subscribed to this list after reading a recent blog from headquarters at <https://blog.torproject.org/blog/statement-0> Part of the post said, "the Tor Project has created an … [View More]

3 3

Ethics Guidelines; crawling .onion
by Virgil Griffith 28 Jul '16

28 Jul '16

Hello all. I am preparing a longer response to the issues Isis et al mentioned. Most are interrelated, but this one is not. And I wanted to get clarification on it. Isis expressed a concern about making a list of bitcoin addresses from .onion, citing, "Consent is not the absence of saying 'no' — it is explicitly saying 'yes'." For what it's worth, ahmia.fi actually supports regex searching right out of the box. In fact, a single line of JSON spits out all known bitcoin addresses ahmia … [View More]knows about. For example, here's an anonymized list going .onion -> BTC which I mined from Ahmia, * http://virgil.gr/wp-content/uploads/2016/05/btc-on-dot-onion.html [6MB] And here's the same information going BTC -> .onion * http://virgil.gr/wp-content/uploads/2016/05/btc2domains.v2.txt [2mb] If you want to check the results you can ask Juha for the JSON query to do this. Lets go out on a limb and assume that regexs are okay. Is the issue then .onion search-engines? I understand Isis's preference for there to always be affirmative consent but does that mean that until such a standard exists all search engines from onion.link, ahmia.fi, MEMEX, NotEvil, and Grams are violating official Tor community policy? ---- Here's how I currently see this. I put on my amateur legal hat and say, "Well, the Internet/world-wide-web is considered a public space. Onion-sites are like the web, but with masked speakers." * https://www.hks.harvard.edu/m-rcbg/research/j.camp_acm.computer_internet.as… * http://aims.muohio.edu/2011/02/01/is-the-internet-a-public-space/ Ergo, I would argue that, by default, content on .onion is public the same way everything else on the web is. If you don't want to be "indexed", for physical spaces you go in-doors, or for the web you put up a login. As an aside, the web-standard is actually *kinder* than physical public spaces because on the web one can have an unobstrusive /robots.txt saying, "please don't index me". Which is a great thing. Whereas some would say Tor users are "anonymous", others would instead say any and everything Tor is "private". I believe this needs to be clarified. I once proposed to Roger that he delineate the sub-types of privacy in the same way Stallman delineated his "Four Freedoms". Roger replied that he preferred using the broad catch-all term "Privacy". These confusions may be a caveat of using a broad catch-all term. Interpreting broadly, Isis is correct. However, this conclusion has a lot of unpleasant ramifications. Comments appreciated, -V P.S. Mildly related, I saw this today involving DARPA, and Tor. http://thehackernews.com/2016/05/darpa-trace-hacker.html """ The aim of Enhanced Attribution program is to track personas continuously and create “algorithms for developing predictive behavioral profiles.” """ I hope you all are aware this flows directly from MEMEX. Right? This, and MEMEX, seems a much more appropriate target for outrage. A lot of this work that numerous community members have worked on gives even me pause. [View Less]

5 22

Re: [tor-project] Who is attending the OTF summit?
by Nathan Freitas 28 Jul '16

28 Jul '16

No sleep til Baltimore... I'll be there. Fri, Jul 22, 2016, at 06:12 PM, Roger Dingledine wrote: > Who here is going to the OTF summit? I hear it is mid October in > Baltimore. > > I spoke to Dan Meredith today about whether I should go -- last year he > was really sad that I wasn't there, and I told him I wasn't invited, and > he declared I was always invited to everything, so I reminded him about > it > today. > > I know they're very limited in space. I … [View More]

3 2

Great article privacy tools workshops in DC Public Library
by Kate 26 Jul '16

26 Jul '16

Hi, This is a terrific article about the DC Public Library's privacy tools workshops; we gave a workshop there in January, 2015. This is just the kind of friendliness coupled with skillsbuilding that can help us in the long run in DC--I know that Alison is planning something there soon. https://technical.ly/dc/2016/07/26/dc-public-library-internet-privacy/ Fun fact: The reporter's twitter handle is @howisthatlegal Cheers, Katie

1 0

Fwd: Official invitation to Overdrive hacking conference, Girona
by Shari Steele 25 Jul '16

25 Jul '16

> Begin forwarded message: > > From: talks(a)overdriveconference.com > Subject: Official invitation to Overdrive hacking conference, Girona > Date: July 24, 2016 at 10:54:45 AM PDT > To: execdir(a)torproject.org > > Greetings TorProject, > > We mail from overdriveconference.com a hacking conference based in the university of Girona(Spain). We would like to invite you to our hacking conference. > > Overdriveconference is a computer security conference that … [View More]

1 0