tor-project October 2017

tor-project@lists.torproject.org

42 participants
24 discussions

Notes from October 19 2017 Vegas team meeting
by Karsten Loesing 23 Oct '17

23 Oct '17

Notes for October 19 2017 meeting: Georg: 1) Preparing Tor Browser 7.0.7 and 7.5a6 with the updated donation campaign code 2) Working on getting the roadmap updated with all the team dependencies Nick: 0) What a great meeting! 1) Internews PT meeting on monday/tuesday seemed to go okay; I think they're likely to adopt practices resulting in convergence on a stable PT 2.x design. 2) Probably not here today; after 9 days of meetings, I need a break. 3) Network team did a draft roadmap. We included items that depend on, or that will affect, other teams. Arturo: 1) Published a report on censorship in Pakistan in collaboration with Bytes for All: https://ooni.torproject.org/post/pakistan-internet-censorship/ 2) We are migrating our email from runbox to GSuite 3) Updated 4 tests lists: https://github.com/citizenlab/test-lists/pull/241, https://github.com/citizenlab/test-lists/pull/242 4) We are going to publish tomorrow a blog post about the OONI team gathering 5) Started experimenting with gatsby and contentful for revamping our website: https://github.com/openobservatory/ooni-website/tree/gatsby, found a bunch of bugs in gatsby, may not end up using it. 6) Created a repository containing licenses for OONI software: https://github.com/openobservatory/legal. Does anybody know some good friendly lawyers we could reach out to regarding the licensing of data? 7) Began adding support for the new OONI API to OONI Explorer: https://github.com/TheTorProject/ooni-explorer/pull/119 8) Following discussion with metrics and TBB teams we started adding support for extracting tor related metrics inside of ooni-pipeline: https://github.com/TheTorProject/ooni-pipeline/pull/98 9) My interview for an Italian TV program is available here: https://www.youtube.com/watch?v=EDZNqYiiYfo. I also explain what Tor is and how it works. (retweet if you wish: https://twitter.com/OpenObservatory/status/920941902408626178) 10) Making some progress on OONI Probe 3.0: https://github.com/OpenObservatory/ooniprobe-cli 11) The deployment process of our website has levelled up. When a branch is merged into master, travis will automatically build it and push it to staging. Deploying it is then just a matter of running a simple script (this could be improved) isabela: 1) followed via jitsi some of the workshops and sessions of Montreal meeting 2) worked on responding OTF design proposal (deadline oct 24th) - getting sponsor8 stuff updated and adding modularization proposal to it (deadline next friday 27th) 3) Organizing inter-team roadmap review / dependencies check: https://storm.torproject.org/shared/85fNa4NXH0lxi1SRMrDNTaDQCyJIuNgHiSgfsiz… Need to know if team leads here agrees with it. [Geko: sounds good to me, Arturo: sgtm, karsten: Oct 23 is reaaaally soon] [alison: I also would like a little more time but overall I think it's a good plan] 4) adam is getting our sponsor4 amendment for a NCE changing the deadline till end of January 5) all day meeting with Shari today here in NYC! Karsten: 1) Recovered from Montreal, worked off some tickets from my inbox, reviewed quite some code, ignored the rest. Shari: 1) talking with fellow travelers about safety in our community 2) working on modularization proposal with Isa and Tommy 3) working on end-of-year blog post and other eoy stuff 4) Tor meeting feedback? Steph: 1) working w hiro to finalize newsletter portal and to make some design changes to the blog 2) working on fundraising campaign, launching monday 3) tidying up comms retrospective, adding to 2018 strategy, incl notes from montreal. will be working in seattle in november with shari and tommy to finalize 4) tommy is taking on compiling positive onion services use cases 5) IFF submissions are due Oct 31 Brad: 1) Working on several follow-up items from Montreal this week 2) Submitted paperwork necessary to open brokerage account for accepting stock donations 3) Held discussions with employees in Montreal about updated time budgets, and have been rolling out the new budgets this week. 4) Compliance reports for Sponsor 8 due 10/31, so please submit Sept. time sheets asap if you haven't already done so. Alison 1) I hope everyone had a good meeting! I did. I was really pleased to see how many people reported feeling happier/healthier at this meeting. 2) I hope to get a post-meeting survey out soon (need to check in with Jon and gunner) 3) September 2018 meeting -- Brazil? 4) The implicit bias session was great. We should do more plenaries like these. 5) We should also do a roadmapping-share session with all teams. 6) Can we talk about how possible it would be to organize childcare at future meetings?

9 9

Hosting opportunity for open source projects
by Nima Fatemi 17 Oct '17

17 Oct '17

Hey there, At GSoC the conversation about hardware needs of open source projects came up and someone mentioned "Open Source Lab"[1] has managed and unmanaged hosting services. I'm not sure if this has come up before in conversations before but judging from their 'hosting details'[2] page, I'm wondering if we can take advantage of their services to save some money off hosting or make the life of our students a bit easier. Just wanted to make sure that people know this exists as it seems to be a useful thing. I hope you're having a good time at the dev meeting. [1] https://osuosl.org/ [2] https://osuosl.org/services/hosting/details/ -- Nima 0X58C4B928A3E218F6 | @mrphs "I disapprove of what you say, but I will defend to the death your right to say it" --Evelyn Beatrice Hall

4 4

Cease and Desist: Copyright Infringement.
by Yawning Angel 12 Oct '17

12 Oct '17

Dear Mr. Nathan Freitas, It has come to my attention that you have made an unauthorized use of my copyrighted work entitled obfs4proxy (the "Work") in the preparation of a work derived therefrom. I have reserved all rights in the Work, which was first published on 2014. Your work entitled Orbot, which appears as a binary distribution available on the Google Play store and F-Droid contains a copy of the Work, without including copies of the Work's copyright notice, conditions, and disclaimer as set out in the Work's software license. Therefore, I believe you have willfully infringed my rights under 17 U.S.C. Section 101 et seq. and could be liable for statutory damages as high as $150,000 as set forth in Section 504(c)(2) therein. I demand that you either comply with the terms set forth in the Work's software LICENSE, or immediately cease the use and distribution of all infringing works derived from the Work, and all copies, including electronic copies, of same. And furthermore that you desist from this or any other infringement of my rights in the future. If I have not received an affirmative response from you by October 17th, 2017 indicating that you have fully complied with these requirements, I shall consider taking any and all legal remedies available to rectify this situation at any time without further notice to you. This letter is without prejudice to my rights and claims, which are expressly reserved. Sincerely yours, Yawning Angel

2 3

Analyzing bwauth disagreements
by Tom Ritter 10 Oct '17

10 Oct '17

In which I pretend to know how to do statistics or data analysis; but really hope I spur people to point out what I'm doing wrong =) Methodology: 1) Run two bwauths on the same box 2) Collect votes (and raw bwauth votes where available) for a month from all bwauths (including the duplicate one) 3) Stick the tuple (vote timestamp, relayid, bwauthid, bw value) into a database 4) Measure the percent difference in bandwidth for the same relay at the same vote time between two bwauths as (abs(r1.bw - r2.bw) / ((r1.bw + r2.bw) / 2) 5) Average that value for all relays for a given vote time to get the overall percent difference for that vote time 6) Graph it for multiple bwauth pairs 7) Get a slight flavor difference of the above value by limiting it to relays with a bandwidth value of at least 100, to see if there are any differences Code: Download and archive votes and raw bwauth votes: https://github.com/tomrittervg/bwauth-tools/blob/master/download_files.py cron it up, run it every hour at 15 minutes after the hour. MySQL Database schema: https://github.com/tomrittervg/bwauth-tools/blob/master/schema.sql Process the files and put them in the database: https://github.com/tomrittervg/bwauth-tools/blob/master/files_to_database.py Run the last query to get the data: https://github.com/tomrittervg/bwauth-tools/blob/master/queries.sql Plot it: https://github.com/tomrittervg/bwauth-tools/blob/master/plot_data.py Optionally run something like grep -v "\\\\N,\\\\N,\\\\N,\\\\N,\\\\N,\\\\N,\\\\N,\\\\N" query.csv > non-blank-lines.csv, or change non-blank-lines.csv to query.csv ~ One month of data is 29,194,717 rows or ~4GB of data, and you want to run the query and the plotting overnight. Conclusions: The data!! https://raw.githubusercontent.com/tomrittervg/bwauth-tools/master/data.png x axis: unix epoch of the vote time y axis: percent disagreement between maatuska's bwauth and the indicated bwauth The two bwauths run from maatuska agree quite consistently. However they have the only instance of DISagreement between the 'all' set of relays and the '>100' set. maatuska and moria agree eerily closely. two bwauths agree with each other to the same amount consistently over time, although how much they agree depends on the two bwauths being compared the 'base' agreement, how much two identical bwauths will agree, is around 35% there is not much difference between 'all relays' and 'relays > 100' Follow Up: Is my data correct? maatuska and moria being that close together is suspicious. Compare moria<->longclaw, moria<->faravahar, and longclaw<->faravahar Change the bandwidth limit to >1000 and see if they produces more or less disagreement I can start applying bwauth patches, and run the new bwauth code, from the same vantage point and use this methodology to determine if new code has altered the results. IF it has altered the results: are they better results or worse? Don't know! I should measure the disagreements between bwauths when grouping relays by country. Because I have raw vote data from maatuska and moria, I can test the hypothesis that relays fall between gaps in scanners. Maybe. I could probably get positive proof this occurs but maybe not proof it _doesn't_ occur. -tom

4 8

Damian's Status Report - September 2017
by Damian Johnson 09 Oct '17

09 Oct '17

Hi all, here's what I've been up to this last month... http://blog.atagar.com/september2017/ Cheers! -Damian

1 0

September 2017 report for the metrics team
by Karsten Loesing 06 Oct '17

06 Oct '17

Hello Tor, hello world! Below you'll find the highlights of Tor metrics team work done in September 2017. On behalf of the Tor metrics team, Karsten Deployed a number of improvements for Atlas including fixing a long standing issue with bandwidth sorting in search results by finally considering units [1], showing the first recorded time a relay was seen [2], and displaying DNS names on the details pages. [1] https://trac.torproject.org/projects/tor/ticket/23137 [2] https://trac.torproject.org/projects/tor/ticket/21958 Moved CollecTor's directory listings to the CollecTor page on the Tor Metrics Website [3] in an attempt to provide a single human-facing website for all aspects around Tor Metrics. [3] https://metrics.torproject.org/collector.html Deployed a second back-end server for the Onionoo service [4] to remove yet another single point of failure. [4] https://metrics.torproject.org/onionoo.html Released CollecTor 1.3.0, metrics-lib 2.1.0, and Onionoo 4.1-1.5.0 [5] which all include upgrades to Java 8. [5] https://lists.torproject.org/pipermail/tor-dev/2017-September/012443.html Did some housekeeping in Trac's Metrics/* components [6], reducing the list of open tickets [7] from around 300 to slightly more than 200. [6] https://lists.torproject.org/pipermail/metrics-team/2017-September/000443.h… [7] https://trac.torproject.org/projects/tor/query?status=!closed&component=^Me… Held a 1-day in-person team meeting in Berlin to draft a roadmap for the next 12 months and to do a ticket triage.

1 0

Comments on Donor FAQ page?
by Tommy Collison 06 Oct '17

06 Oct '17

Hello world! I'm reviewing Tor's donor FAQ page [1] and making some copy edits. If anyone has comments or thinks that the FAQ page is missing something, give me a holler. Cryptographically yrs, Tommy [1] https://donate.torproject.org/donor-faq.html

2 1

Notes from October 5 2017 Vegas team meeting
by Karsten Loesing 06 Oct '17

06 Oct '17

Notes for October 5 2017 meeting: Karsten: 1) Wrote a roadmap draft for metrics team work until Q3/2018 that we'd like to share with tor-dev@ on Friday and ask for feedback on missing goals or possibly wrong priorities. If you can, please give it a look and tell us whether that's a bad idea for some reason (or be the first to provide feedback!) 2) What's the current process for adding people to tor-internal@? Conclusion, updated after the meeting: https://gitweb.torproject.org/community/policies.git/tree/membership.txt#n46 Georg: 1) Mozilla All Hands coordination: sent mails to Ethan 2) Continued hiring process for Sponsor8: we are almost done for the browser positions I think Nick: 1) Alpha released: now ahf and isis have the experience of doing it. Planning to add more people as we go along. 2) Trying to manage questions of stability vs bugfixing in 0.3.2. Seem to be doing okay, but risk remains. 3) Going to New England Systems Verification Day at MIT tomorrow; will present some of our verification wishlist. 4) We have found that, although our test coverage is improving as a percentage, our number of uncovered lines is not falling. We need to evaluate strategies here to improve our coverage. 5) Rust is a fun programming language. We'll be talking about Rust stuff at the Montreal meeting a lot. Shari: 1) Getting ready for Montreal meeting 2) Mark Your Calendars: next Tor Meeting dates are March 11-15 in Rome; we're signing contract with hotel this week 3) Any topics to discuss for open or closed board meeting? 4) Was in San Francisco last week; lots of meetings. Isabela: 1) Sent some orientation to network team for roadmap and retrospective sessions at teams meeting day 2) Got all the stuff UX team needs to print for Montreal - sending to Jon today (hopefully is not too late) 3) Finished the designer proposal with Tommy - hopefully we will get it 4) Working with steph and hiro on the newsletter - final reviews and tests 5) Met with Nick and coordinated some stuff including Chile :) I emailed folks there to confirm the presentation will update speakers list when I get more information from Chile people (and copy Nick of course) 6) Excited with all the sessions in Montreal - please reinforce the note taking :) so folks like me can follow up 7) Preparing for including modularization work as part of sponsor8 contract - me, shari and tommy are meeting tomorrow about that Steph: 1) Lots of sharing / promotion: blog posts and releases, upcoming events 2) Checking over final changes with Isa and Hiro to have our newsletter ready 3) Working with GR + comms team on fundraising campaign - have major designs set! 4) Will start to more thoroughly track upcoming events and will try hand at coordinating sessions

1 0

September 2017 Report for the Tor Browser Team
by Georg Koppen 05 Oct '17

05 Oct '17

Hi! In September the Tor Browser team made three releases: Tor Browser 7.0.5[1], 7.0.6[2], and 7.5a5[3]. Tor Browser 7.0.5 fixed an incompatibility of HTTPS-Everywhere with higher security slider levels in Tor Browser.[4] In fact, it made Tor Browser compatible with any WebExtension not just that one. 7.0.6 and 7.5a5 picked up new Tor versions (0.3.1.7 and 0.3.2.1-alpha respectively) and above all the usual Firefox security updates by including Firefox 52.4.0esr. Worth noting for both versions as well is a fix for a crash bug that could kill all tabs if one closed a single tab.[5] Tor Browser 7.5a5 contains for the first time content sandboxing in Firefox enabled on Windows and Linux. Please give it a test as we want to have this feature on the stable channel as soon as we can. Included in this alpha, too, is a patch that will hopefully help our users who run into crashes on Windows by backporting Mozilla code for blocking libraries that are known to interfere with Firefox processes.[6] Apart from the release related work we focused on remaining Sponsor4 items. In particular, we finally switched to our new, rbm-based build system which we used for the first time for official builds when preparing the packages for Tor Browser 7.5a5.[7] We made progress as well working on 64-bit builds for Windows[8][9] and testing UBSan for finding bugs that are the result of undefined behavior[10]. Our improvements to the Tor Launcher UI are starting to emerge, too, thanks to the collaboration with the UX team.[11][12] The full list of tickets closed by the Tor Browser team in September is accessible using the `TorBrowserTeam201709` keyword in our bug tracker.[13] In October we plan to finish our Tor Launcher UI improvements, get our Security Slider update done[14] and will hopefully have some Tor Browser nightly builds for 64bit Windows available. We'll continue testing further Tor Browser hardening techniques like UBSan, STACK[15], and Intel's MPX[16] and start experimenting with improving our bridge distribution in Tor Launcher[17]. All tickets on our radar for this month can be seen with the `TorBrowserTeam201710` keyword in our bug tracker.[18] Georg [1] https://blog.torproject.org/tor-browser-705-released [2] https://blog.torproject.org/tor-browser-706-released [3] https://blog.torproject.org/tor-browser-75a5-released [4] https://trac.torproject.org/projects/tor/ticket/23258 [5] https://trac.torproject.org/projects/tor/ticket/23393 [6] https://trac.torproject.org/projects/tor/ticket/23582 [7] https://trac.torproject.org/projects/tor/ticket/23213 [8] https://trac.torproject.org/projects/tor/ticket/23228 [9] https://trac.torproject.org/projects/tor/ticket/23229 [10] https://trac.torproject.org/projects/tor/ticket/12418 [11] https://trac.torproject.org/projects/tor/ticket/23262 [12] https://trac.torproject.org/projects/tor/ticket/23261 [13] https://trac.torproject.org/projects/tor/query?status=closed&keywords=~TorB… [14] https://trac.torproject.org/projects/tor/ticket/23409 [15] https://trac.torproject.org/projects/tor/ticket/12420 [16] https://trac.torproject.org/projects/tor/ticket/16352 [17] https://trac.torproject.org/projects/tor/ticket/23136 [18] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig…

1 0

Mozilla "All Hands" coordination
by Roger Dingledine 05 Oct '17

05 Oct '17

Hi folks, Some of us have been invited to the upcoming Mozilla All-Hands meeting in Austin in December: https://wiki.mozilla.org/All_Hands/Austin Georg (gk@torproject) is coordinating our plans, to be sure to have enough of the right people there. We think it would be wise to get a good cross-section of the Tor world there -- not just a pile of browser devs. So, if you (a) got an invite, or (b) would like to go as a Tor person, please let Georg know. The deadline for answering their invites is Oct 5, so be sure to do it with enough time before that deadline. (Technically it is not an invite, but rather a nomination for an invite, and then on Oct 5 they'll do some internal process to decide actual invites.) --Roger

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

tor-project October 2017