March 2017 - tor-project - lists.torproject.org

Re: [tor-project] meek-azure funding has run out
by Sina Rabbani 19 Apr '17

19 Apr '17

Dear Team, I have good news, Rabbi Rob Thomas (robt(a)cymru.com) is going to cover the costs associated with keeping meek alive. So far I have setup 2 new accounts with Amazon and Azure and working to confirm the functionality. https://d183ohpl22nq2f.cloudfront.net/ https://meek.azureedge.net/ Cloudfront is working fine and i'm trying to resolve issues with the Azure CDN. Is there a ticket I can update with these details? I think I should also bring up a backend server (bridge) and share the new config lines for the Tor Browser Bundle. I'm hoping to get all this done by Monday or sooner. Thank you David for keeping this service operational for so long and thank you Rob for keeping it alive! All the best, Sina "Be the change that you wish to see in the world." - Mahatma Gandhi ----- On Jan 19, 2017, at 2:17 AM, Yawning Angel yawning(a)schwanenlied.me wrote: > On Mon, 9 Jan 2017 20:08:03 -0800 > David Fifield <david(a)bamsoftware.com> wrote: > >> On Mon, Jan 09, 2017 at 03:06:17PM -0800, Shari Steele wrote: >> > Hey David. >> > How much money do we need for 2017? >> >> The total for meek-azure November 2015 to November 2016 was $6290.69, >> or about $525 a month on average. I believe it could go 2× or higher >> if we relaxed rate limits. meek-amazon is higher, $13756.30 or >> $1150/month over the same time period. > > Has there been any progress on finding alternative funding for this? > dcf's comments on trac indicate "no", which would be unfortunate. > > -- > Yawning Angel > > _______________________________________________ > tor-project mailing list > tor-project(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-project

7 12

Arranging new default obfs4 bridges
by David Fifield 17 Apr '17

17 Apr '17

In November 2016 there was a discussion on the tor-team list about adding some new default obfs4 bridges (Subject: Coordinating to run high capacity obfs4 bridges). The thread turned into a discussion about the same entity running both bridges and exits, and didn't go anywhere. We haven't added any new obfs4 bridges, or changed the port number of any existing bridges, since January 2017 (Tor Browser 6.5 and 7.0a1). I suspect that the 20 existing default bridges are still under high load and we could stand to have some more bridges to help share it. Are we still interested in adding new obfs4 bridges? If so, do we have any leads on who could run them?

8 16

Fwd: [OTF-Announce] Announcement of Funding Opportunities
by isabela 31 Mar '17

31 Mar '17

Good stuff: -------- Forwarded Message -------- Subject: [OTF-Announce] Announcement of Funding Opportunities Date: Fri, 31 Mar 2017 11:59:39 -0700 (PDT) From: OTF-Announce <otf-announce(a)opentechfund.org> Reply-To: otf-announce+managers(a)opentechfund.org To: OTF-Announce <otf-announce(a)opentechfund.org> --- OTF FUNDING ANNOUNCEMENTS --- ============================================== Please find below several upcoming internet freedom-relevant funding application deadlines. There are two sections, the first for OTF support and the second for all alternative support mechanisms. Note that several of the listed application windows close in the next couple days. In addition to the open application windows listed below, you can also check our compiled list of alternative sources of support. This is especially true for efforts (like Rapid Response) that accept applications on a rolling basis. https://www.opentech.fund/apply/alternative-sources-support If you have any questions on the information below, please feel free to give a shout to us at OTFanytime. Thanks! 1. OTF FUNDING ============================================== OTF - Internet Freedom Fund Deadline: May 1, 2017 The Internet Freedom Fund is OTF's primary way to support projects and people working on open and accessible technology-centric projects that promote human rights, internet freedom, open societies, and help advance inclusive and safe access to global communications networks. Successful applicants are awarded monetary support up to $900,000 and no less than $10,000, with preference given to those projects and people who are new to the internet freedom community, helping those living within repressive environments, and are requesting less than $300,000 for a duration of less than 12 months. Apply: https://www.opentech.fund/requests/internet-freedom-fund <https://www.opentech.fund/requests/internet-freedom-fund> OTF - Core Infrastructure Fund Deadline: May 1, 2017 The Core Infrastructure Fund supports building blocks of digital security and circumvention projects. This may include efforts focused on sustaining or improving PGP, SSL, SSH, Tor, OTR, pluggable transports, code libraries, and other technologies used within the core building blocks of everyday Internet Freedom technology used by people throughout the world to increase their access, privacy, and security online. Apply: https://www.opentech.fund/requests/core-infrastructure-fund <https://www.opentech.fund/requests/core-infrastructure-fund> OTF - Rapid Response Fund Deadline: Ongoing The Rapid Response Fund is part of a broader OTF initiative which aims to facilitate the development of a strong digital emergency response community that can work together to resolve threats in a timely and comprehensive manner. OTF offers both direct financial support as well as technical services from trusted partners to resolve digital emergencies experienced by high-risk Internet users and organizations, such as bloggers, cyber activists, journalists. and human rights defenders. Apply: https://www.opentech.fund/requests/rapid-response-fund <https://www.opentech.fund/requests/rapid-response-fund> OTF - Labs Deadline: Ongoing For more specific, one-off support needs and services, check out OTF's Labs: Localization, Community, Engineering, Usability, Red Team, and Legal. Learn more about the Labs at: https://www.opentech.fund/labs <https://www.opentech.fund/labs> 2. ALTERNATIVE FUNDING & OPPORTUNITIES ============================================== *ProPublica - Data Institute *Deadline: March 31, 2017 11:59 PM EST* * The Data Institute is "a 11-day intensive workshop on how to use data, design and code for journalism. The workshop will be from June 7 to June 21 in our NYC offices." More information: https://projects.propublica.org/graphics/summer * * *NLNet Foundation - Network and Internet Technology *Deadline: April 1, 2017* * "NLnet foundation supports a large array of activities, from software development, standardisation work and development of educational material up to hacker festivals, digital rights activities and the international development of open source software licences. The NLnet contribution can also be used as so called "matching" for other subsidies from organisations such as the EU and Science foundations." More information: https://www.nlnet.nl/news/2017/20170401-call-en.html *Google - Summer of Code *Deadline: April 3, 2017 16:00 UTC* * Work with and contribute to open source projects over the summer. Among the 201 available mentor organizations are OTF-supported efforts K-9 Mail, Qubes OS, and Tor. "Google Summer of Code is open to university students, age 18 and older in most countries." More information: https://developers.google.com/open-source/gsoc/ * * *Knight Foundation - Prototype Fund *Deadline: April 3, 2017* * Knight Foundation's revamped Prototype Fund features thematic, rather than general, calls for applications. This call "will focus on growing concerns with trust in news and misinformation." Other changes include award amount (now $50k) and project duration (9 months) among others. More information: https://knightfoundation.org/challenges/knight-prototype-fund *The Walkley Foundation - Media Incubator and Innovation Fund *Deadline: April 6, 2017* * "The Fund is open to backing a broad range of ideas across the news, media and civic engagement industries. We’re fairly open-minded about what these projects could be. But we’d especially love to see ideas that empower journalism to fulfill its critical role in democracy of speaking truth to power, and supporting an engaged, connected and informed public." More information: http://www.walkleys.com/innovationgrants/ * * *BudgIT - Civic-Tech Media Fellowship* Deadline: April 10, 2017 "Public finance-focused civic-tech organization BudgIT is announcing a six-month, highly competitive Civic-Tech Media Fellowship designed to support six (6) journalists interested in covering human-angle stories. The fellowship will include training on Data Journalism, Investigative reporting, Desk research and provide up-to-date knowledge on the intersection between journalism, civil society and new media." More information: http://yourbudgit.com/call-for-application-budgit-civic-tech-media-fellowsh… * * *Annenberg-Oxford Media Policy Summer Institute* Deadline: April 14, 2017* * The Annenberg-Oxford Media Policy Summer Institute, held annually since 2004, brings together young scholars and regulators from around the world to discuss important recent trends in technology and its influence on information policy. The objective of the program is to help prepare, motivate, encourage and support students and practitioners who aspire to pursue a career in a media-related field, may it be in academia, business or in policy-related fields. Applications are welcomed from students and practitioners working in communications, media, law, policy, regulation, and technology." More information: http://globalnetpolicy.org/event/2017-annenberg-oxford-media-policy-summer-… Application: https://upennasc.hobsonsradius.com/ssc/aform/M00E4GfI670c0x67023M.ssc *School of Data - Fellowship and Data Expert Programmes* Deadline: April 16, 2017 "Fellowships are nine-month placements with School of Data for data-literacy practitioners or enthusiasts...The 2017 Fellowship will continue the thematic approach pioneered by the 2016 class. As a result, we will be prioritising candidates who possess experience in, and enthusiasm for, a specific area of data literacy training [and those who] can demonstrate links with an organisation practising in this defined area and/or links with an established network operating in the field." More information: https://schoolofdata.org/2017/03/02/apply-now-school-of-datas-fellowship-an… *Citizen Lab Summer Institute 2017 * Deadline: April 21, 2017 "The Citizen Lab Summer Institute on Monitoring Internet Openness and Rights is an annual research workshop hosted at the Munk School of Global Affairs, University of Toronto. The Citizen Lab Summer Institute (CLSI) is a meeting place for researchers and practitioners from academia, civil society, and the private sector who are working on Internet openness, security, and rights. It brings together perspectives from a wide range of backgrounds across technical and social science disciplines. Participants range from established experts to those just entering the area." More information: https://citizenlab.org/summerinstitute/2017.html Application: https://citlab.wufoo.eu/forms/2017-citizen-lab-summer-institute/ *Internet Policy Observatory - **Call For Proposals: Joint Digital Rights and Internet Freedom Research/Advocacy Projects* Deadline: April 30, 2017 "Applications should propose a research project that would provide empirical weight and further advocacy efforts in an area related to digital rights and internet freedoms. Topics of relevance include but are not limited to access to online resources, freedom of expression online, the economic and social effects of internet policies, ICT companies and human rights, privacy and surveillance online. Applicants should be able to justify the need for the research and are expected to produce a set of deliverables that are relevant to academic, advocacy, and policymaking communities." More information: http://globalnetpolicy.org/our-research/call-for-proposals/ * * *Mozilla - Open Source Support (MOSS)* Deadline: April 30, 2017 "MOSS is Mozilla’s program for supporting the Open Source and Free Software movement...MOSS currently has 3 tracks: Foundational Technology, Mission Partners, and Secure Open Source." More information: https://wiki.mozilla.org/MOSS#Program_Overview --------- In addition to the open application windows listed above, you can always check our compiled list of alternative sources of support: https://www.opentech.fund/apply/alternative-sources-support <https://www.opentech.fund/apply/alternative-sources-support> -- This is the announce list for Open Technology Fund, https://www.opentechfund.org --- You received this message because you are subscribed to the Google Groups "OTF-Announce" group. To unsubscribe from this group and stop receiving emails from it, send an email to otf-announce+unsubscribe(a)opentechfund.org <mailto:otf-announce+unsubscribe@opentechfund.org>. For more options, visit https://groups.google.com/a/opentechfund.org/d/optout.

1 0

Summary of meek's costs, February 2017
by David Fifield 29 Mar '17

29 Mar '17

Here's the summary of meek's CDN fees for February 2017. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 all 2015 $8006.59 + $8146.83 + $1292.89 = $17446.31 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 February 2016 $986.39 + $977.85 + $445.83 = $2410.07 March 2016 $1079.49 + $865.06 + $534.71 = $2479.26 April 2016 $1169.23 + $1074.25 + $508.93 = $2752.41 May 2016 $525.46 + $1097.46 + $513.56 = $2136.48 June 2016 $0.00 + $1117.67 + $575.50 = $1693.17 July 2016 $0.00 + $1121.71 + $592.47 = $1714.18 August 2016 $0.00 + $1038.62 + $607.13 = $1645.75 September 2016 $0.00 + $932.22 + $592.92 = $1525.14 October 2016 $0.00 + $1259.19 + $646.00 = $1905.19 November 2016 $0.00 + $1613.00 + $597.76 = $2210.76 December 2016 $0.00 + $1569.84 + $1416.10 = $2985.94 January 2017 $0.00 + $1550.19 + $1196.28 = $2746.47 February 2016 $0.00 + $1454.68 + $960.01 = $2414.69 -- total by CDN $13138.96 + $26345.34 + $10202.06 = $49686.36 grand total https://metrics.torproject.org/userstats-bridge-transport.html?start=2016-1… == Amazon a.k.a. meek-amazon == EU (Ireland) 492M requests $590.89 2924 GB $231.46 Global 9M requests $9.99 28 GB $2.14 US East (Northern Virginia) 410M requests $410.52 2668 GB $209.18 -- total 912M requests $1011.40 5621 GB $442.78 charge for alarms $0.50 https://atlas.torproject.org/#details/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == https://atlas.torproject.org/#details/AA033EEB61601B2B7312D89B62AAA23DC3ED8… Zone 1 440 GB $ 38.30 Zone 2 171 GB $ 23.63 Zone 3 3583 GB $ 895.68 Zone 4 4 GB $ 0.59 Zone 5 11 GB $ 1.81 -- total 4209 GB $ 960.01 Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

1 0

Tor project's use of Mailman
by johny 25 Mar '17

25 Mar '17

Hi all, I'm currently working on my GSoC proposal for the GNU Mailman project, which aims to implement encrypted mailing lists. I noticed that Tor project uses Mailman and has a few private lists as well. I think that Tor project's private lists might be a great example that could use such encrypted lists. What requirements would Tor project have of such encrypted mailing list? This would help me better understand potential uses of encrypted mailing lists in a real environment. My proposal uses PGP/MIME. A short description follows: It establishes a list keypair which subscribers use to encrypt their messages with. A user needs to present a PGP public key on subscription which will be later used to encrypt messages from the list. List owner moderates the list and accepts users subscription. User has to prove ownership of the key by signing a confirmation token. Subscriber then sends messages encrypted with list key and signed with the one he subscribed with. He receives messages encrypted to his key and signed by the original author as well as the list itself. Commands will require signature and confirmation too. A more detailed proposal can be found in the links below. -Jan ----- [Project idea]: https://wiki.list.org/DEV/Google%20Summer%20of%20Code%202017#Encrypted_List… [Proposal draft (site)]: https://neuromancer.sk/page/gsoc/mailman [Proposal draft (PDF)]: https://neuromancer.sk/static/mailman.pdf

4 4

Notes from March 16 2017 Vegas team meeting
by Karsten Loesing 21 Mar '17

21 Mar '17

Notes for March 16 2017 meeting: Isabela: 1) reviewing DRL response 2) submitting sponsorS final report / sponsor4 report 3) working with linda, hiro and network team on prep work for AMS 4) meeting with Mike / f2f tomorrow 5) will take a look at what arma and nick want my help with the NSF projects and start working on that next week Alison: 1) Finalizing Tor Meeting plans: buddies, agenda, strategic planning stuff 2) Working on content for the support portal 3) Eagerly awaiting results of the Community Council Guidelines vote 4) Sprucing up the community team wiki Shari: 1) Pulling together board book for Amsterdam meeting. 2) Getting ready for strategic planning discussion in Amsterdam and beyond. 3) Last minute Amsterdam details. 4) Reviewing DRL budget for submission. Karsten: 1) Started the vote on community council guidelines proposed by Alison and Damian, which will run until next Wednesday. 2) If all goes well, we'll be down to 4 out of 19 MOSS tasks by AMS, with still 3 out of 12 months ahead of us. Nick: 1) Hacking, triaging, etc 2) Sponsor4, sponsorR going well. 3) DRL status? 4) Amsterdam prep Arturo: 1) Tagged an ooniprobe release candidate: https://github.com/TheTorProject/ooni-probe/releases/tag/v2.2.0-rc.2. Testing of it is greatly appreciated! 2) Ironing out the last pending issues for upcoming mobile app release 3) Monday we will be releasing a report on internet censorship in Thailand 4) Did a bit of planning for the upcoming migration to new data processing pipeline and general re-organisation/cleanup of the rest of our infrastructure Georg: 1) Sponsor4 work and there mainly ESR52 transition tasks 2) We might need to make an emergency release due to Pwn2Own 3) I prepared my talk for Open Source Days Josh: 1) Tor Weekly News: "Reboot Edition" out tomorrow Friday, March 17th. 2) Strategic communications plan draft should be done by end of day today

1 0

Re: [tor-project] U.S. border crossing guide
by Nathan Freitas 20 Mar '17

20 Mar '17

On Fri, Mar 17, 2017, at 04:05 PM, David Fifield wrote: > On Fri, Mar 17, 2017 at 01:35:30PM -0500, Franklin Bynum wrote: > > == If you are a U.S. citizen == > > The government has to let you in. They can, however, detain you for > > questioning and search you and your property. > > If you want one person's account of what that's like, I (a U.S. citizen) > wrote about my experience being detained at the border in 2013 for not > answering questions. I was in secondary for around seven hours and in a > cell for most of that time. > > https://www.bamsoftware.com/writing/mia-cbp.html "Cool that Google gets a list of people detained by DHS." Thanks for reminding me of your experience and excellent write-up, David. Respect, +n

3 2

U.S. border crossing guide
by Franklin Bynum 20 Mar '17

20 Mar '17

Many of you will be crossing the U.S. border soon because of travel to the Tor Meeting. I was supposed to be there, but child care obligations will keep me stateside. As an immigration lawyer and a member of the Tor community, I would like to give you all a crash course in crossing the U.S. border. This document does not discuss anything related to seeking asylum or other refugee status. If you hold or may seek refugee status of any kind, seek professional help. == If you are not a U.S. citizen == If you have permanent resident status, have a visa or are a national of a country that is part of the Visa Waiver Program [fn:1], when you present yourself to an immigration officer at the border the officer evaluates whether you are inadmissible under any of the many grounds in section 212 of the Immigration and Nationality Act. [fn:2] Having a travel document does not guarantee you entry. All people who are not U.S. citizens are subject to the entire slate of grounds of inadmissibility, including long-time permanent residents. If the official finds that you are inadmissible, you will be denied entry and detained pending your removal. Some people, like permanent residents, will be detained for weeks until they can see an immigration judge to receive a hearing on their inadmissibility. The agent will likely ask you questions about who you are and where you are going. You have a right under the United States constitution to refuse to answer questions, but if you refuse to answer the officer will surely deny you entry and will likely detain you for further questioning. Immigration officers have wide latitude to question you and deny you entry. You have little legal recourse against this. Read the grounds of inadmissibility [fn:1] and you will see the many ways you can be lawfully denied entry, even as a permanent resident. If you have ever been arrested or otherwise feel that you may be singled out, contact me or another immigration lawyer before you intend to cross the border. == If you are a U.S. citizen == The government has to let you in. They can, however, detain you for questioning and search you and your property. == For everyone: border searches == At the U.S. border, immigration officers may search you basically for any reason, or no reason. They do not have to articulate any suspicion. They can, and do routinely, go through all your property, including your devices. They can clone your hard drive. They can attach forensic tools to your phone or other device. They can seize your item as evidence against you. You can not do anything to stop this. The one things you can do is refuse to give passwords. You have a constitutional right to remain silent that is fairly strong here. If you are a U.S. citizen, they have no recourse except to detain, question, and intimidate you further. They cannot detain you for an unreasonable amount of time, measured by what an imaginary "objective reasonable person" would think is reasonable. This amount of time will be longer than you personally think is reasonable. If you are a non-citizen, they could deny you entry for your refusal. If you are stopped and your device is searched or you are asked for passwords, contact me. == About me == I am a relay operator, a lawyer, and partner to Alison. I am in IRC at @frabyn. My practice is criminal defense and immigration in Texas. My website is https://bynumlaw.net/ * Footnotes [fn:1] https://travel.state.gov/content/visas/en/visit/visa-waiver-program.html [fn:2] https://www.uscis.gov/ilink/docView/SLB/HTML/SLB/0-0-0-1/0-0-0-29/0-0-0-200… -- Franklin Bynum Lawyer 2814 Hamilton Street Houston, Texas 77004 +1 713 343-8844

8 9

Cor Tor Team sponsor4 February work report
by isabela 16 Mar '17

16 Mar '17

Core Tor Team February 2017 Report We started to work on collecting measurements[1] of our consensus diff proposal (prop140) to analyze how much data Tor downloads today, how much data it would download after the consensus diff implementation is complete, and what we could do in order to reduce the downloaded volume further. We created the following tools[2] to help us collect and analyze our data: The populate.py and analyze.py scripts are for looking at the amount and causes ofmicrodescriptor change over time. The populate-consenus and analyze-consensus.py scripts look at the amount and causesof routerstatus change over time in the consensus. The diff-size tool determines the mean size for ed-based consensus diffs, after various consensus transformations and diff compression algorithms. With these tools, we were able to improve[3] Proposal 140 [4] "Provide diffs between consensuses", which is an important part for us to do to achieve our objective. They also lead to the creation of proposals 274 through 276, each of which will reduce the required bandwidth for directory operations (see below). We also created tools[5] to analyze different compression schemes related to Proposal 278 [6] "Directory Compression Scheme Negotiation", which is one of the design proposals we plan to implement in order to achieve our goals under this objective. We have the results of the first collection/analyses[7]. The other proposals related to directory bandwidth savings are: Proposal 274 [8] - Rotate onion keys less frequently Proposal 275 [9] - Stop including meaningful "published" time in microdescriptor consensus Proposal 276 [10] - Report bandwidth with lower granularity in consensus documents [1] https://trac.torproject.org/projects/tor/ticket/21205 [2] https://github.com/nmathewson/consensus-diff-analysis [3] https://trac.torproject.org/projects/tor/ticket/21209 [4] https://github.com/torproject/torspec/blob/master/proposals/140-consensus-d… [5] https://gitlab.com/ahf/tor-sponsor4-compression [6] https://github.com/torproject/torspec/blob/master/proposals/278-directory-c… [7] https://docs.google.com/spreadsheets/d/1devQlUOzMPStqUl9mPawFWP99xSsRM8xWv7… [8] https://github.com/torproject/torspec/blob/master/proposals/274-rotate-onio… [9] https://github.com/torproject/torspec/blob/master/proposals/275-md-publishe… [10] https://github.com/torproject/torspec/blob/master/proposals/276-lower-bw-gr… [11] https://github.com/torproject/torspec/blob/master/proposals/277-detect-id-s…

1 0

New UAE Users
by Matthew Finkel 15 Mar '17

15 Mar '17

Anyone know what caused the remarkable jump in direct and obfs3 users from the UAE that began on 16 Jan and 06 Feb, respectively? Sorry if I already missed the discussion about this. https://metrics.torproject.org/userstats-relay-country.html?start=2017-01-1… https://metrics.torproject.org/userstats-bridge-country.html?start=2017-02-… Thanks!

8 12