July 2016 - tor-project - lists.torproject.org

Tor Browser User Manual review
by Colin Childs 10 Dec '16

10 Dec '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi everyone, As some of you may be aware (if you attend the community team meetings), Alison and I have been working on updating the Tor Browser User Manual and getting it ready for an official release. The community team has now had an opportunity to review the manual, and now we would like to request feedback from the larger community! You can view the manual at https://tb-manual.torproject.org/linux/en-US/ . If you find something that needs changing, please open a ticket on Trac[1] and set the component to "Community", and the "owner" to "phoul" . Thanks, and I hope everyone had a nice weekend! [1]: https://trac.torproject.org/ - -- Colin Childs Tor Project https://www.torproject.org Twitter: @Phoul -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJXls5GAAoJEJWQHABkmqq5mz0P/30P28JS3LrYUxSLYElKkWUC JbxQNcHRpnDX5kt1t2Gl0oz/xXisXT/9NF68HFjxbQiWaXiKV19Z9homwc3KiWu2 RfkL/xqI62y1QJpp/EpCGPa7IwsVBdiUfyC7/DwxF9dY5CToWeeJDEcWu5rQrKFE F6gbCGpKBirGva8b9n/PdPFHZbyOqKDFO6ZZm/UjCQ5Ga7NFJvDyPEom0dYuw0cW OweSXH+Qjxn1i5OCtra1b6JayQ03z7msI99fOPqzBREtBGPJt2+50jcnXddWnPQv rMbnuLO1KhLqZ9gGYbTi1+kIjEOu5ZwX7qyQLBDo2HMww79EuyUtDkHOR2hZxC72 N//Aj5M4myGodjYUsdb/QNRKJSy2Z69eco4eKsRonn0U8/JOO0dh82AkfzVzRS7A MPmYivw0zFuTjn9C5e1QiHWJEwmPsbpDuwBU4mj0EZ5H4evMDsncDqW9yE/Lgqpq Jw6v7GP5arZlbJ+3vZgznAVATAuY2O2+ytu2Z8vetpFFCoaSsvZD7bqT1c1c1LdM oWT0yPXJWeKcdm16ow7/Bjh5yO4NBXahnoAAVTLQG7TjpTSiyMw7nHxMRmMVk84u 5jR7GLOPgQCSqTBonnpxCOnt5phg38OV4TQarxUE+zcov/7GKMrvY/uSj5aRly/c xlxlSP9tGaLMaK/PmYvl =HTUt -----END PGP SIGNATURE-----

5 4

Remove mercurius4 obfs4 bridge from Tor Browser?
by David Fifield 05 Aug '16

05 Aug '16

According to my and Lynn Tsai's bridge reachability measurements, the default obfs4 bridge mercurius4 has not been running for a few months. It was refusing connections in March and April, and more recently has just been timing out. Time to remove it? pref("extensions.torlauncher.default_bridge.obfs4.6", "obfs4 104.131.108.182:56880 EF577C30B9F788B0E1801CF7E433B3B77792B77A cert=0SFhfDQrKjUJP8Qq6wrwSICEPf3Vl/nJRsYxWbg3QRoSqhl2EB78MPS2lQxbXY4EW1wwXA iat-mode=0");

5 8

Amazon Smile
by Tom Ritter 02 Aug '16

02 Aug '16

Hi all, I noticed that Amazon Smile[0] has Tor Project as a recipient; been using it lately when I order from them. Has anyone collected the money? Is it significant in any way? (I mean anything is helpful of course, I'm just not sure if it's "a couple of tens of dollars" or "a few hundred".) Might be worth tweeting about also, there are firefox/chrome extensions that automatically redirect you so you remember to go through smile.amazon.com -tom [0] https://smile.amazon.com/gp/chpf/about/ref=smi_se_abtpo_r_about_smi

5 4

The Tor Project Social Contract
by Alison 30 Jul '16

30 Jul '16

Hello good people of tor-project@! I'm excited to present to you something that a number of us core members have been working on for some time now: the Tor Project Social Contract 1.0 [1]. Modeled after the Debian Social Contract [2], the Tor Project Social Contract is a set of promises to our community about what Tor stands for and why we create it. I'm sharing it with all of you today so that we can work on ratification. I think that the best way to do this is as follows: By 6 August at 00:00 UTC, please respond to me or to the list if you accept or object to this social contract so that we can ratify this through rough consensus [3]. If objecting: Please be specific about your objections so that we can discuss changes as needed. If you respond directly to me, I will assume that you don't want your name shared with the group, but please specify if you don't want your comments shared either. NB: THIS IS NOT AN INVITATION TO EDIT BY COMMITTEE. I'm interested in feedback like "this does not represent the Tor that I know" not "I'd like this sentence reworded". Please also be kind, because this was written by humans. If accepting: your florid prose about why you love it and think it's an astonishing work of art that reflects the diligence and care exercised by the authors is quite welcome. A show of hands (writing an email that says +1) is also fine. Questions are welcome. If this is successfully ratified, I will publish it on the Tor blog and in some other places: probably the "About Tor" section of the website and on the Community Team wiki. If you have great ideas for other places this should live, let me know! Thank you for your feedback, and thank you to all of the Tor folks who worked on this, especially Lunar and Roger, who got it started. Alison [1] https://storm.torproject.org/shared/UleWiALOvWDnWxEqPcAfr49tkHaM-h7PlSmoHlR… [2] https://www.debian.org/social_contract [3] https://en.wikipedia.org/wiki/Rough_consensus

18 43

questions about new community safety documents and practices...
by stderr＠riseup.net 30 Jul '16

30 Jul '16

Hi all, I have a question about the Harassment Prevention Policy, available here: A non-text attachment was scrubbed... Name: Harassment Prevention Policy (final).pdf Type: application/pdf Size: 98932 bytes Desc: not available URL: <http://lists.torproject.org/pipermail/tor-project/attachments/20160729/c0fd…> The policy seems to conflate harassment and discrimination, specifically in this clause: "Both the Company and U.S. law also prohibit unlawful workplace harassment. Unlawful harassment is unwelcome conduct, based on a Protected Characteristic, that is sufficiently severe and pervasive to alter the terms and conditions of employment or create an intimidating, offensive, or abusive working environment. Prohibited harassment can take many forms, including, but not limited to the following, when based on a Protected Characteristic: •Making or using derogatory comments, emails, letters, epithets, slurs, or explicit jokes. •Derogatory gestures, posters, photographs, cartoons, drawings, websites, emails, text messages, or other physical or electronic media. •Touching, assaulting, impeding, or blocking normal movements." Earlier in the document, a "protected characteristic" is defined as: "It is against U.S. law and strictly against our policy for any employee or non-employee to discriminate against or harass any Company employee, contractor or volunteer on the basis of race, color, religion, national origin, ancestry, disability, medical condition, genetic information, marital status, sex, gender, gender identity, gender expression, sexual orientation, age, military or veteran status, or any other protected status (each a “Protected Characteristic”)..." Anti-discrimination statutes and policies are commonly defined around "protected classes" or "protected characteristics," since discrimination based upon other characteristics is both clearly allowed and beneficial (performance, fitness for the advertised job opening, etc.), but harassment statues and policies typically don't include references to protected classes or characteristics, since harassment is always negative and thus characteristic agnostic. Simply put: the plain language of the Tor Project's new policy would seem to allow harassment, provided that it is not *based upon* a protected characteristic. This would also seem to allow the harassment of anyone, including women, racial minorities, or other people whose rights such a policy would presumably be designed to protect, as long as that harassment is not "based upon" those characteristics. I would strongly prefer if the Tor Project would separately define harassment and discrimination. If someone is turned down for a job on the basis of their race or veteran status, that is discrimination, but not harassment. If someone receives extensive unwanted communications from a co-worker, for example including persistent late night phone calls that are unrelated to work, or extensive unwanted visits from the co-worker at one's home, etc, then this would clearly constitute harassment, provided that the complainant made it clear that these communications/visits were unwanted. However, this behavior need not be based on a "protected characteristic" and it may not necessarily take the form of sexual harassment, either. This is why harassment is typically defined as a persistent, unwanted, pattern of behavior that would cause a reasonable person to experience fear or emotional distress. Best, stderr

1 0

questions about new community safety documents and practices...
by Lane Rasberry 29 Jul '16

29 Jul '16

Hello, I just subscribed to this list hoping that this was a general discussion list for the Tor community. I think I am in the correct place, but if not, would someone redirect me? I see that there is another recent thread called, "The Tor Project Social Contract". Having text like this seems like a great idea! I subscribed to this list after reading a recent blog from headquarters at <https://blog.torproject.org/blog/statement-0> Part of the post said, "the Tor Project has created an anti-harassment policy, a conflicts of interest policy, procedures for submitting complaints, and an internal complaint review process. They were recently approved by Tor’s board of directors, and they will be rolled out internally this week." I am writing to ask if anyone can share copies of all these policies and any supporting documentation. Beyond that, I am writing to ask if they can all have free / open licenses that would be compatible for reuse in Wikipedia and Wikimedia projects. It seems like this is already routine, but sometimes it is nice to clearly indicate a licensing scheme. In Wikipedia, the community has faced similar conduct issues over the past few years. If the Tor community has a good start in developing text, policies, and processes for these things, then I might like to bring whatever insights are here into Wikipedia. Right now, Wikipedia does not have a code of conduct, and some people like me are exploring options for introducing one. Perhaps the Tor community would also find it useful to get community comments and critique for whatever equivalent documents are developed in Wikipedia. Thanks for discussing community issues in a public way. It is nice when various online communities can share ideas and best practices. yours, -- Lane Rasberry user:bluerasberry on Wikipedia 206.801.0814 lane(a)bluerasberry.com

3 3

Ethics Guidelines; crawling .onion
by Virgil Griffith 28 Jul '16

28 Jul '16

Hello all. I am preparing a longer response to the issues Isis et al mentioned. Most are interrelated, but this one is not. And I wanted to get clarification on it. Isis expressed a concern about making a list of bitcoin addresses from .onion, citing, "Consent is not the absence of saying 'no' — it is explicitly saying 'yes'." For what it's worth, ahmia.fi actually supports regex searching right out of the box. In fact, a single line of JSON spits out all known bitcoin addresses ahmia knows about. For example, here's an anonymized list going .onion -> BTC which I mined from Ahmia, * http://virgil.gr/wp-content/uploads/2016/05/btc-on-dot-onion.html [6MB] And here's the same information going BTC -> .onion * http://virgil.gr/wp-content/uploads/2016/05/btc2domains.v2.txt [2mb] If you want to check the results you can ask Juha for the JSON query to do this. Lets go out on a limb and assume that regexs are okay. Is the issue then .onion search-engines? I understand Isis's preference for there to always be affirmative consent but does that mean that until such a standard exists all search engines from onion.link, ahmia.fi, MEMEX, NotEvil, and Grams are violating official Tor community policy? ---- Here's how I currently see this. I put on my amateur legal hat and say, "Well, the Internet/world-wide-web is considered a public space. Onion-sites are like the web, but with masked speakers." * https://www.hks.harvard.edu/m-rcbg/research/j.camp_acm.computer_internet.as… * http://aims.muohio.edu/2011/02/01/is-the-internet-a-public-space/ Ergo, I would argue that, by default, content on .onion is public the same way everything else on the web is. If you don't want to be "indexed", for physical spaces you go in-doors, or for the web you put up a login. As an aside, the web-standard is actually *kinder* than physical public spaces because on the web one can have an unobstrusive /robots.txt saying, "please don't index me". Which is a great thing. Whereas some would say Tor users are "anonymous", others would instead say any and everything Tor is "private". I believe this needs to be clarified. I once proposed to Roger that he delineate the sub-types of privacy in the same way Stallman delineated his "Four Freedoms". Roger replied that he preferred using the broad catch-all term "Privacy". These confusions may be a caveat of using a broad catch-all term. Interpreting broadly, Isis is correct. However, this conclusion has a lot of unpleasant ramifications. Comments appreciated, -V P.S. Mildly related, I saw this today involving DARPA, and Tor. http://thehackernews.com/2016/05/darpa-trace-hacker.html """ The aim of Enhanced Attribution program is to track personas continuously and create “algorithms for developing predictive behavioral profiles.” """ I hope you all are aware this flows directly from MEMEX. Right? This, and MEMEX, seems a much more appropriate target for outrage. A lot of this work that numerous community members have worked on gives even me pause.

5 22

Re: [tor-project] Who is attending the OTF summit?
by Nathan Freitas 28 Jul '16

28 Jul '16

No sleep til Baltimore... I'll be there. Fri, Jul 22, 2016, at 06:12 PM, Roger Dingledine wrote: > Who here is going to the OTF summit? I hear it is mid October in > Baltimore. > > I spoke to Dan Meredith today about whether I should go -- last year he > was really sad that I wasn't there, and I told him I wasn't invited, and > he declared I was always invited to everything, so I reminded him about > it > today. > > I know they're very limited in space. I figure step zero is to learn > who else here is already signed up, so I can figure out how important > it is for me to be there. > > (And if for some reason you aren't comfortable answering on-list, you > can always answer me off-list.) > > Woo, > --Roger > > _______________________________________________ > tor-project mailing list > tor-project(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-project

3 2

Great article privacy tools workshops in DC Public Library
by Kate 26 Jul '16

26 Jul '16

Hi, This is a terrific article about the DC Public Library's privacy tools workshops; we gave a workshop there in January, 2015. This is just the kind of friendliness coupled with skillsbuilding that can help us in the long run in DC--I know that Alison is planning something there soon. https://technical.ly/dc/2016/07/26/dc-public-library-internet-privacy/ Fun fact: The reporter's twitter handle is @howisthatlegal Cheers, Katie

1 0

Fwd: Official invitation to Overdrive hacking conference, Girona
by Shari Steele 25 Jul '16

25 Jul '16

> Begin forwarded message: > > From: talks(a)overdriveconference.com > Subject: Official invitation to Overdrive hacking conference, Girona > Date: July 24, 2016 at 10:54:45 AM PDT > To: execdir(a)torproject.org > > Greetings TorProject, > > We mail from overdriveconference.com a hacking conference based in the university of Girona(Spain). We would like to invite you to our hacking conference. > > Overdriveconference is a computer security conference that will take place in the spanish city of Girona on days 25 to 27 of november 2016. The conference will focus on connecting the diferent members of the "hacker community" to share ideas, values and technical information and also think about what the hacker community is and our future. > > The conference is organized by volunteer students and teachers of the engineering department of the university of Girona currently setting up a defcon group(DC17003). > > As we admire the great work that tor project has done to help free thinkers and opressed people arround the world, we would love to have you in our conference, you are invited to join us to perform a talk about what tor project is, its present and its future goals. > > If you decide to join us to perform a talk about the project. we'll pay all the travel and stay expenses. We'll be waiting for your answer, if you agree to join we'll keep talking about the details. > > City details; http://overdriveconference.com/?page_id=509 > > Travel details: http://overdriveconference.com/?page_id=504 > > > Thank you for your attention. > > Pau, general coordinator overdrive conference. > > overdriveconference.com > udg.edu

1 0