August 2016 - tor-project - lists.torproject.org

Tor Browser User Manual review
by Colin Childs 10 Dec '16

10 Dec '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi everyone, As some of you may be aware (if you attend the community team meetings), Alison and I have been working on updating the Tor Browser User Manual and getting it ready for an official release. The community team has now had an opportunity to review the manual, and now we would like to request feedback from the larger community! You can view the manual at https://tb-manual.torproject.org/linux/en-US/ . If you find something that needs changing, please open a ticket on Trac[1] and set the component to "Community", and the "owner" to "phoul" . Thanks, and I hope everyone had a nice weekend! [1]: https://trac.torproject.org/ - -- Colin Childs Tor Project https://www.torproject.org Twitter: @Phoul -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJXls5GAAoJEJWQHABkmqq5mz0P/30P28JS3LrYUxSLYElKkWUC JbxQNcHRpnDX5kt1t2Gl0oz/xXisXT/9NF68HFjxbQiWaXiKV19Z9homwc3KiWu2 RfkL/xqI62y1QJpp/EpCGPa7IwsVBdiUfyC7/DwxF9dY5CToWeeJDEcWu5rQrKFE F6gbCGpKBirGva8b9n/PdPFHZbyOqKDFO6ZZm/UjCQ5Ga7NFJvDyPEom0dYuw0cW OweSXH+Qjxn1i5OCtra1b6JayQ03z7msI99fOPqzBREtBGPJt2+50jcnXddWnPQv rMbnuLO1KhLqZ9gGYbTi1+kIjEOu5ZwX7qyQLBDo2HMww79EuyUtDkHOR2hZxC72 N//Aj5M4myGodjYUsdb/QNRKJSy2Z69eco4eKsRonn0U8/JOO0dh82AkfzVzRS7A MPmYivw0zFuTjn9C5e1QiHWJEwmPsbpDuwBU4mj0EZ5H4evMDsncDqW9yE/Lgqpq Jw6v7GP5arZlbJ+3vZgznAVATAuY2O2+ytu2Z8vetpFFCoaSsvZD7bqT1c1c1LdM oWT0yPXJWeKcdm16ow7/Bjh5yO4NBXahnoAAVTLQG7TjpTSiyMw7nHxMRmMVk84u 5jR7GLOPgQCSqTBonnpxCOnt5phg38OV4TQarxUE+zcov/7GKMrvY/uSj5aRly/c xlxlSP9tGaLMaK/PmYvl =HTUt -----END PGP SIGNATURE-----

5 4

Tor at Aaron Swartz Day in SF
by Alison 13 Sep '16

13 Sep '16

Hello, good people of Torlandia, The organizers of Aaron Swartz Day [1] would like to give Tor folks a dedicated space during their Sunday hackfest on November 6. The possibilities for this space are pretty open-ended -- we could do Tor tutorials, exciting new things coming up in the Tor world, hacking, presentations of Your Exciting Project That Uses Tor, whatever we want really. We can take up whatever amount of time we want during the day. I will be doing some kind of LFP presentation on Saturday, and am willing to organize the Sunday Tor stuff with whoever else wants to participate. If you are a Bay Area Tor person, or you'll be there the weekend of November 5-6, let's start organizing. I am in favor of organizing onlist because maybe people who can't be there in person have ideas about what we should do. This is a special event honoring Aaron's life and legacy, and I had a great time participating last year. Also, Chelsea Manning is heavily involved in this year's planning. I highly recommend participating if you are able. Alison [1] http://www.aaronswartzday.org/

2 3

Proposal: rotate default bridge ports each release
by David Fifield 06 Sep '16

06 Sep '16

Lynn Tsai and I just published a report on the blocking of Tor Browser's default obfs4 bridges. https://www.bamsoftware.com/proxy-probe/ https://www.usenix.org/system/files/conference/foci16/foci16-paper-fifield.… One of the things we found is that the Great Firewall of China blocks the default bridges--but it takes a little while after release for them to do it. We saw delays as short as 2 days and as long as 36 days. We also found that when they block a bridge, they don't block the whole IP address; they just block a single port and other ports on the same IP remain accessible. We can take advantage of these peculiarities by opening additional obfs4 ports on the default bridges, and changing the port numbers on each release. We'd keep the old ports open for people who haven't upgraded yet, but those who upgrade will start using the new ports. This way, we can make the bridges temporarily reachable after each new release--at least until the censors figure out what we're doing and start blocking more aggressively. This is pretty easy to do on the bridge operators' part. They just need to forward a range of ports to their existing obfs4 port, something like this: iptables -A PREROUTING -t nat -i eth0 -p tcp --match multiport --dports 50000:50009 -j REDIRECT --to-port <obfs4port> Then, the Tor Browser developers can choose a fresh port in each new release.

5 7

Metrics to help relay operators?
by Karsten Loesing 31 Aug '16

31 Aug '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Alison, moving this thread from the metrics-team@ moderation queue to this list with your permission: > Hi Metrics team, > > I was talking to Roger on IRC about how great it is that he sent > those checkin mails to everyone who runs a fast relay, and he had > an idea for the metrics and community teams to work together to > get useful lists that we could use to help give better support to > our network of relay operators. For example, a weekly mail of all > the relays that just passed the "earned a tshirt" threshold, or > some other threshold about how much bandwidth they've pushed over > a period of time, etc. The community team could then contact the > relay operator(s) and congratulate them, thank them for their > service, see if we can offer them help in any other ways, and so > forth. > > I've copied the community team here. Let's chat if you guys are > interested! > > Alison Sure, let's do this. I might not be able to hack much on this myself in the next weeks, but I'm happy to speculate how such a tool could be designed. Is there anybody in the community team (or another friendly volunteer on this list) who'd be comfortable writing a small Python script that fetches Onionoo data [1] and filters out contact information of relays matching given criteria? That's how Compass [2] was started before it became a website, and it's how the t-shirt script [3] came to life (shortly before it was forgotten). I could imagine that we start with a simple Python script that can be run whenever somebody from the community team is ready to reach out to new relay operators. We could later automate that process by letting cron run that script once per week and have it send the output to some mailing list. But that could be step two. Hope that helps as a start. All the best, Karsten [1] https://onionoo.torproject.org/ [2] https://compass.torproject.org/ [3] https://gitweb.torproject.org/metrics-tasks.git/tree/task-9889/tshirt.py -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXxT3zAAoJEC3ESO/4X7XBilwH/21JJ6HS8Nr1gfIrOWGurAQl qJBSref2NoPsXJuwG1Z038Zq6JysTRNkzZoqgmZTbILwnMAoXM8rXRZuUQnCGgxN jP5V0xjtSM6d7VRLr34JXt8pbo1Cqd1/tGzEHzsS2muUA80vZK9klv/M6O5CS0wE nqjApwD2OHRBVPq4D+MX2DxV705DJTCgCF3caA8z2nocs0oKDzC8078Wy4usc4KB l9Yf/WLyv24Ny2Uq7m8C/WkyAYEOBAQwze9/Z7leTASUaF9EtSxJKbdx1dIUexgv tTCr7mEBRqdAeKfUNUmrQxBkJdZxLUAnHGjuJrmj+GHrXawmsLkguu4dNf23sKc= =i5Pp -----END PGP SIGNATURE-----

3 4

Summary of meek's costs, July 2016
by David Fifield 30 Aug '16

30 Aug '16

Here's the summary of meek's CDN fees for July 2016. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 January 2015 $464.37 + $669.02 + $0.00 = $1133.39 February 2015 $650.53 + $604.83 + $0.00 = $1255.36 March 2015 $690.29 + $815.68 + $0.00 = $1505.97 April 2015 $886.43 + $785.37 + $0.00 = $1671.80 May 2015 $871.64 + $896.39 + $0.00 = $1768.03 June 2015 $601.83 + $820.00 + $0.00 = $1421.83 July 2015 $732.01 + $837.08 + $0.00 = $1569.09 August 2015 $656.76 + $819.59 + $154.89 = $1631.24 September 2015 $617.08 + $710.75 + $490.58 = $1818.41 October 2015 $672.01 + $110.72 + $300.64 = $1083.37 November 2015 $602.35 + $474.13 + $174.18 = $1250.66 December 2015 $561.29 + $603.27 + $172.60 = $1337.16 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 February 2016 $986.39 + $977.85 + $445.83 = $2410.07 March 2016 $1079.49 + $865.06 + $534.71 = $2479.26 April 2016 $1169.23 + $1074.25 + $508.93 = $2752.41 May 2016 $525.46 + $1097.46 + $513.56 = $2136.48 June 2016 $0.00 $1117.67 + $575.50 = $1693.17 July 2016 $0.00 $1121.71 + $592.47 = $1714.18 -- total by CDN $13138.96 + $16900.60 + $4792.99 = $34832.55 grand total https://metrics.torproject.org/userstats-bridge-transport.html?start=2016-0… The number of users recovered somewhat since the beginning of July, rising to about 7,500. It seems to be former meek-google users who are being absorbed into meek-azure and meek-amazon. If you are one of the users affected by the meek-google shutdown, see here for a workaround: https://lists.torproject.org/pipermail/tor-talk/2016-June/041699.html == App Engine a.k.a. meek-google == 0 GB $0.00 0 instance hours $0.00 https://atlas.torproject.org/#details/88F745840F47CE0C6A4FE61D827950B06F9E4… == Amazon a.k.a. meek-amazon == Asia Pacific (Singapore) 285M requests $342.71 628 GB $84.78 Asia Pacific (Sydney) 7M requests $9.27 38 GB $5.20 Asia Pacific (Tokyo) 1M requests $1.85 6 GB $0.81 EU (Ireland) 256M requests $307.53 1032 GB $79.86 South America (Sao Paulo) 18M requests $40.32 170 GB $40.51 US East (Northern Virginia) 144M requests $144.71 811 GB $63.68 -- total 713M requests $846.39 2687 GB $274.84 charge for alarms $0.50 https://atlas.torproject.org/#details/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == Zone 1 6103 GB $530.99 Zone 2 445 GB $ 61.48 -- total 6549 GB $592.47 https://atlas.torproject.org/#details/AA033EEB61601B2B7312D89B62AAA23DC3ED8… Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

1 0

Notes from August 25 2016 Vegas team meeting
by Karsten Loesing 29 Aug '16

29 Aug '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for August 18 2016 meeting: Shari: 1) Working with Gunner and Alison on the semi-annual Tor meeting agenda. 2) Working with our lawyer on his presentation for the meeting. 3) Reviewing DRL grant proposals. Nick: 0) Vacation was lovely, got a bit of programming done. 1) Trying to program 1a) Distracted by need to put out two releases 1b) Distracted by grants stuff Kate: 1) Fact sheets--organizing their finishing; hoping to hire artist/web designer for a bit of freelance design 2) Blog posts from GSoC student and HOPE 3) Had stomach bug Tuesday and Wednesday 4) Seeking new good news to promote after Labor Day :) Isabela: 1) working with the ux team to prepare for internal launch of our style guidelines and how we will roll it out 2) working on DRL proposals - deadline is tomorrow (august 26) 3) got reports out to otf and drl 4) coordinating with ux team and network team some ideas of sessions for dev meeting (trac session, style guidelines session etc) Alison: 1) Tor meeting agenda planning 1a) we need to talk about agenda priorities (from this team and getting individual community member engagement); One from Shari:" I’d really like there to be a discussion about a theme for our end-of-year fundraising campaign. Last year it was “This Is What a Tor Supporter Looks Like.” What should it be this year?" 1b) welcoming new people: buddy system, welcome event 1c) creating a "safer space" 2) Working on HOPE wrapup post 3) Community team continuing to work on the support portal 4) and membership docs Karsten: 1) Drafted a first schedule for the Berlin meeting together with Georg. https://trac.torproject.org/projects/tor/wiki/org/meetings/2016BerlinMeetup 2) Almost released metrics-lib 1.4.0 together with iwakeh, but ran into a bug and postponed the release. 3) Worked a lot on the ExoneraTor database redesign I started with Sebastian the week before. 4) Commented a bit on grants in response to questions by Isabela and Cass. Roger: 1) Doing all my logistics Mike: 1) I got image signing working for CopperHead - I now have a script that takes the official copperhead images, adds in Google Apps and OrWall, and produces verified-boot compatible images. I'm still working out some bugs with OrWall and the keyboard, and need to figure out how updates are going to work, but concept is now more or less proven. 2) Been helping a bit with the DRL Tor Browser Mobile proposal. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXw/RwAAoJEC3ESO/4X7XBZYMH/i0m1E8h/M8OR/eiaVZQ0yJy zMJqx20DmmPAGgzqdHk/MlZKt9EXoNho4Mg96BA5p4sB+RmQ6/ksDIkkPp1uFNmt Em3xifkJ2Ie7TVFHkjtd9wiwDowJr++44ht1yXk9BIdMgEFrKnCo852TjTUGBd5R IElY/BMLNiE49hnmyw+vTHx98OH2eDPfr+RuBnYN1FaGKdAJbCMYidcYojQUfKwS 8TuqWn/WsjZUjHrOUflBsrTBZ3RuEokbv2vOtW8HnVuj2NRyDsFLGNfNQKBsCSNA Lv62DOxBn7TkMy2C54lEZAoVQZ3xpNVJ72W2geQuWAall0alyKRFvTxk/9Jh2l0= =qKsA -----END PGP SIGNATURE-----

1 0

New Bridge Authority
by isis agora lovecruft 26 Aug '16

26 Aug '16

Hello all, Today, I am very excite to take a field trip (!!) to a datacenter (!!!) with some most excellent folks from Greenhost (DrWhax and Sacha!!!). We will be racking a server and installing an OS on it, and getting it ready to be a new Bridge Authority to replace Tonga. Earlier this week, David Goulet and I got a Bridge Authority up and running in a test network, so perhaps a logical step will be to put the new Bridge Auth into the test network and ensure that it's at least cursorily behaving. The new Bridge Auth needs a name. Suggestions welcome. :) Best regards, -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://fyb.patternsinthevoid.net/isis.txt

16 21

I'm offline Aug 29 - Sep 13
by Roger Dingledine 24 Aug '16

24 Aug '16

Hi everybody, Here's a reminder that I'll be offline Aug 29 - Sep 13 inclusive. And I mean actually offline with no devices. So if there's something critical that you need me to do before I disappear, now is a great time to remind me of it. Items on my current high priority todo list: * Get the SponsorM (NSF) annual report in, so the program manager can have a chance to review it and tell us what changes she wants. I'll aim to coordinate with somebody smart to cover for me while I'm gone in case they throw some surprise last-minute time-critical questions at us. Based on past experience there is a good chance they will. :( * Get the SponsorV (NSF) annual report in, if Micah Sherr (prof at Georgetown who is ) finishes his first draft of it in time. * Get the "here are the tickets and stuff that we did for year 2" list to SponsorR so they can pay us for year 2 and so they can start the paperwork for year 3. * Try to get my upcoming travel under control, along with expenses and reimbursements. Aren't logistics fun! * Follow up to Shari about some future funding opportunities and whether they match our mission enough for us to go for them. * What else am I missing? --Roger

1 0

Rapid response against censorship
by isabela 22 Aug '16

22 Aug '16

Hello Tor, I took the freedom to create a project under the Community Team wiki which is an attempt to create a rapid response program against censorship events. In the past months we did a little bit of that, by tweeting in PT to people in Brazil teaching them to use Tor when Brazuka judge blocked Whatsapp, we tweeted reaching out to Uganda folks also in an attempt to get as many people to know about Tor as possible when the government was blocking social media during the elections, and most recently we tweeted in TR when the government blocked Social Media during the coup event last month. One might say: 'well if social media is blocked why you using to teach people how to circumvent the blockade?'. What works here is the 'mouth to mouth' outreach, while many in the country where the censorship event might not be able to access social media, relatives and friends abroad can still do it and they are in communication with those inside the country. As an immigrant living abroad I can tell you that *it is a thing* I for instance called my family and told them to use orbot so we could still talk with Whatsapp while the blockade was happening. Of course we could do more and spread the word via email lists and other venues and communication channels. We also could be more prepared and have messages already translated in multiple languages so it's easier to have something in the right language for the population we want to reach. We can try to document these events and our actions to respond to it as well e.g. https://blog.torproject.org/blog/tracking-impact-whatsapp-blockage-tor There is many things we could be building here to have such a program in place! I started this wiki: https://trac.torproject.org/projects/tor/wiki/org/teams/CommunityTeam/Proje… Just to show how we can start organizing this things -- those phrases there are just examples, not the real thing right now. I was wondering if the Community Team and others would be into this idea and would like to help improve that page. Maybe we can even do it during the hacking day of the dev meeting! What y'all think of that? Cheers, Isabela -- PM at TorProject.org gpg fingerprint = 8F2A F9B6 D4A1 4D03 FDF1 B298 3224 4994 1506 4C7B @isa

4 4

Notes from August 18 2016 Vegas team meeting
by Karsten Loesing 22 Aug '16

22 Aug '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for August 18 2016 meeting: Georg: 1) I helped a bit with the OTF proposal 2) The tbb-build machine is still not reachable. Who can move this forward? Shari: 1) Lots of planning for the meeting formerly known as TorDev. Question: Will people be hanging out in Seattle for the weekend after the meeting for hacking? If so, can we estimate how many people might stay so we can make sure we've got a good space for this to happen? 2) Trying to get a handle on our funding proposal processes. Worked on a job description for a grants manager, talking with team on how to make budgets look more like other nonprofit funding proposals, sent note to OTF asking for some specific guidance. 3) Reached out to a couple of community members to offer them the opportunity to talk about all that's been happening. 4) Trying to help think about the organization of the UX team. Mike: 1) Finally got email working again over the weekend. I think I didn't lose any, but not sure. 2) Helped with OTF budget revamp. Isabela: 1) OTF proposal deadline moved to sept 1st! 2) I will need someone to review my grammar at drl reports 3) documenting 'rapid response' plan in the wiki -- katie and alison will probably want to be involved here 4) starting to work on wireframes for metrics team \o/ 5) working on priorities with network team since we are in the last mile with 2 contracts 6) prep for proposals deadline on august 26 Karsten: 1) met with Sebastian; worked on databases for website statistics and TB downloads and on fixing ExoneraTor by making its database smaller 2) talked to isabela and then made some preliminary plans for extending scope of metrics to client and application statistics, based on sanitized website logs, possibly GetTor requests, possibly app store statistics, etc. 3) made plans with iwakeh to put out two new releases of metrics tools this month -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXuqLSAAoJEC3ESO/4X7XBkwkIAMCr/1Nbi7SMRMPMR8LEv34C T1JRs8WeiSjeGogze2qpeRcJYCtq4HsbWCCEjOvpxfS+70kDDe/jZag6wc/1HsPr TPnYe+yl3Dp9j8jBYE40ixDd/ESQiYa/dA6ScsaFaUXb6dbxghzJKxHwE+oHXxjU i340LP4IG5waF0kz7IRPT+w1flm/UYbfMlg//HeVNdOWbdAfuf2qs1Y0xQCiDy3Q eMQMVS4LBjm5NCZnr4YEoS9t6jHIv+q5Bb6lbibUD1EIW5yE9f+gQVz18hfHGqUg ZSJYjDYcObhF5P9unduagdn7Z1tQRzRcVEvlvzZhmRl+bm9PZKTEvFL8igPr7LI= =c/mI -----END PGP SIGNATURE-----

1 0