March 2017 - tor-project - lists.torproject.org

OONI status report - February 2017
by Arturo Filastò 15 Mar '17

15 Mar '17

# OONI Monthly Report: February 2017 February was an important month for the OONI project, as the launch of the ooniprobe mobile app for Android and iOS platforms significantly increased OONI's userbase and global coverage of censorship events. Below we provide some highlights from OONI's activities in February 2017. ## Launch of ooniprobe mobile app On 9th February 2017 we launched our mobile app for Android and iOS platforms. The development of the apps was carried out as part of Lorenzo Primittera's OTF fellowship through support from the OONI team. The new ooniprobe app includes network measurement tests that are designed to examine: * Blocking of websites ("Web Connectivity" test) * Presence of middle boxes ("HTTP invalid request line" test) * Speed and performance of networks ("NDT" test) This app can be installed on Android and iOS platforms through the following app stores: * Google Play: https://play.google.com/store/apps/details?id=org.openobservatory.ooniprobe * Apple nes.apple.com/us/app/id1199566366 More information about ooniprobe's mobile apps can be found through the post that we published on the launch date: https://ooni.torproject.org/post/ooni-mobile-app/ The launch of ooniprobe's mobile app received widespread media coverage. Some news outlets that wrote about ooniprobe's mobile apps include: * CNN: http://money.cnn.com/2017/02/08/technology/ooniprobe-censorship-mobile-app/ * Forbes: https://www.forbes.com/sites/leemathews/2017/02/09/tor-projects-new-mobile-… * The Atlantic: https://www.theatlantic.com/technology/archive/2017/02/ooniprobe-censorship… * Cyberscoop: https://www.cyberscoop.com/ooniprobe-tor-app-ios-android-censorship/ ## ooniprobe mobile app: Translations and feature requests Following the launch of ooniprobe's mobile apps, we started collecting feedback from our users and implementing feature requests. These are summarized through the following platform: https://trello.com/b/RgwVg6i8/ooniprobe-mobile-feature-requests More feature requests can be viewed through the tickets and pull requests of the following GitHub repositories: * https://github.com/TheTorProject/ooniprobe-ios * https://github.com/TheTorProject/ooniprobe-android * https://github.com/TheTorProject/ooni-wui In response to community feedback, we started working on the f-droid version of ooniprobe: https://github.com/TheTorProject/ooniprobe-android/issues/54. We also reviewed and edited the Citizen Lab's global test list (that is tested by ooniprobe's mobile app) quite extensively: https://github.com/citizenlab/test-lists/pull/133. We started coordinating the translation of ooniprobe's mobile apps through support from the Localization Lab. In February, ooniprobe was translated to the following languages: * Spanish * French * Italian Work is being done on adding translations for: * Hindi * Arabic We added support for translating ooniprobe's mobile apps (https://github.com/TheTorProject/ooni-wui/issues/31) and future releases will include translations. ## New web UI We made progress on implementing the new web UI following the UX review. We tagged a release candidate for ooni-probe that features the new web UI and made an open call for testing: https://github.com/TheTorProject/ooni-probe/releases/tag/v2.2.0-rc.1. ## Community engagement We have setup a slack to IRC bridge to encourage less technical users and OONI enthusiasts to join in our public discussions: https://slack.openobservatory.org/. Starting in February we have also started to hold broader community meetings on Slack and IRC with the goal of engaging more with the wider OONI community. The logs for the last community meeting can be found here: http://meetbot.debian.net/ooni/2017/ooni.2017-02-28-15.59.log.html. ## Updated documentation Since May 2016 we have been receiving legal consultation for the improvement of our documentation and practices pertaining to potential risks associated to the use of ooniprobe. To this end, we updated the following documentation: * OONI Data Policy: https://ooni.torproject.org/about/data-policy/ * Risks: Things you should know before using ooniprobe: https://ooni.torproject.org/about/risks/ The above documentation not only incorporates feedback that we received through legal consultation, but also includes information pertaining to ooniprobe's mobile apps. In addition, we published a test description for OONI's new NDT test (which is included in our mobile apps): https://ooni.torproject.org/nettest/ndt/ ## Research and data analysis In collaboration with Sinar Project, we carried out research and data analysis for our upcoming reports on Myanmar, Thailand, and Indonesia. We expect to publish these research reports within the next month. ## Userbase OONI's userbase expanded significantly in February thanks to the launch of our mobile apps. In February alone, ooniprobe was run 143,607 times from 2,765 different vantage points across 181 countries around the world. This information can also be found through our stats here: https://measurements.ooni.torproject.org/stats ~ The OONI team.

1 0

Security slider usability testing results
by Linda Naeun Lee 14 Mar '17

14 Mar '17

Hi all: The results of the security slider usability testing is here: https://docs.google.com/document/d/1Wr4e9OftQaIyvU-p2pN9JcdLsOAl9Z87hg4XWW8… In short, users seemed to choose the setting that would be right for them, functionality wise, even if they didn’t have good security understanding or mild misconceptions. UI should account for multiple ways of interaction. Some people said interesting things. Highlights include: -(the "safest" setting has bad connotations) P12: “I’m not sure, I don’t think I’ll be doing anything that would require that amount of safety. *giggles*” -(people making emotional decisions)P13: “I would probably choose the “safe” setting, there's the potential for more content being blocked on the safest setting, and I'm the kind of dum-dum who's willing to take my chances.” -(not understanding on-the-wire vs machine security defenses) P14: “I would choose the standard setting- I’m just going off of the experience I’ve had on the website I currently visit. I have Norton and feel like that keeps my computer pretty safe.” Cheers, Linda P.S.: I've been working on a more understandable security slider for a couple months now; documentation here: https://trac.torproject.org/projects/tor/wiki/doc/UX/OrfoxSecuritySlider -- Current Key: https://pgp.mit.edu/pks/lookup?search=lindanaeunlee GPG Fingerprint: FA0A C9BE 2881 B347 9F4F C0D7 BE70 F826 5ED2 8FA2

5 6

Notes from March 9 2017 Vegas team meeting
by Karsten Loesing 13 Mar '17

13 Mar '17

Notes for March 9 2017 meeting: Georg: 1) We got releases out (6.5.1, 7.0a2, and 7.0a2-hardened) 2) Continuing work on Sponsor4 items (ESR 52 transition, build system scalability, and integration of fingerprinting Q&A tool (aka own Panopticlick) Alison: 1) Linda, Colin, and I are working on next steps for the support portal: creating content, looking into design options for the banner and icons, messing around with the layout. We are meeting weekly about this and will also discuss it in AMS. 2) The Community Council Guidelines will go to a vote Friday. I'll be running the social contract proposal period at the same time. 3) More planning for AMS meeting. 4) Global South outreach: more trainings happening, also ilv has been doing a lot of work trying to get more relay operators in LatAm. He's run into some issues as some places don't meet basic technical requirements, and he does need funding to keep the operation going, but there is at least a lot of interest. 5) LFP event next week at Temple University -- March 15th 6) I'm going to SXSW for a day or two to meet up with some people/groups and talk about Tor. Shari: 1) lots of planning for Amsterdam meeting; specifically working on agenda for strategic planning discussion 2) pulling together board book for board meeting in Amsterdam 3) meeting with/talking to Yawning about what he's up to; Mitchell Baker about Tor/Mozilla collaboration 4) still trying to get caught up from my week out; getting ready to be out for a couple of weeks in Europe Nick: 1) Not really much prepared for Amsterdam meeting. Not sure what I should be doing. 2) Development proceeds apace. 3) Need to advance stuff with Roger's NSF plans: AMS might be a fine place. 4) Planning to take it easy for Thu/Fri next week, to improve reserves for Amsterdam. Karsten: 1) Trying to wrap up a few Sponsor X tasks/deliverables in the next 1.5 weeks in order to become more open to requests and suggestions brought up in Amsterdam. Mike: 1) Worked on Orbot roadmap for DRL (unfunded, so pretty pipe-dreamy) Isabela: 1) still working on the final report 2) final month of ISC/Orfox work - Linda is compiling user testing reports - we have some dev time to spend on it so we will be polishing things 3) catching up on things after the Seattle trip -> working on monthly report for sponsor4 / MOSS invoice / SIDA response / DRL response / network team release prep work 4) set to table at Libre Planet - thanks to jon's help 5) linda and I have syncs with simply secure - right now they are pretty much done with updating the style guidelines (incorporating feedback from the seattle meeting) the final version will be publish and they will be doing 2 blog posts about this project and Tor will published as 'guest contributors' at our blog. Hope this will bring good attention to the efforts on visual consistency of Tor and ux. 6) hiro survey is out and it seems ppl are answering it \o/ - I also organized the blog work stuff in a pad and hope to sync with hiro on it next week when she is back from IFF Josh: 1) I plan to relaunch Tor Weekly News on 3/17 2) I am still looking for more people from within Tor that want to join me in helping to make Tor more effective at social media. This can just be as simple as encouraging people to PM/DM me about, for example, interesting things happening in the world of tech privacy/security. But hopefully doing Tor Weekly news will also be something that will help me get more ideas and connect with more people in our community on a regular basis. Arturo: 1) OONI team is at the Internet Freedom Festival

1 0

New Subkeys for teor
by teor 11 Mar '17

11 Mar '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, Please refresh my PGP key. I have added new subkeys. gpg --recv-keys C8556CED5D90A0C529F64D43450CBA7F968F094B Thanks Tim (teor) -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJYw9XzAAoJEEUMun+WjwlL0VkP/2Rx4N3kpxAhfTl0vfiuWT2n n3jmk5CnaRTi0WhFC5kQnPagWwxXmmV89f2a/hW/3y2b713snHvm0aAQxIkG3fyk N5ES+c2CxvSKFjz1wstXvInLeDk+BOciqKSWrVQCcVEzf+f4MRJRF7pFH2iljS1W 9a70ceMKpPqPQjSqjFvRBKBgZ3ZWoW1l4JpJWJgH+SjH7N0YH289H9qrUB30czEJ QIB+26cX9oP379s0QcCImyYxAlb2PRq1hb23ScommMRSXJaMhVnB4ttNdx7gO1VI NZDI5HWaxc8KzgolR8LLAIvBaB6h7hTxWYIcdQKnz8cMyVU5sPObYIrvzRWyZiVZ 5Kbq1rBjFUbrEV1ClRs/3ly1NZRYylpGIVaZn4DrirUiQ1GturnQFPK8rIw+coTz 5wkugIbgPx2hsH/mb9JSP4sb+2ONBfZMBfrOBbMQZXSdpryzD1uRosffeu+htf1t QTs33cCPIhUtD+WB6zJgUxwtDTalxTNp5QgMUEnW73tYxQth8hBDH3cyGj5GEZKj GH3woxggJKkUZmHHymAE+ScKIVWIxMsoCdHxvHNHRTnBs15068EVe9lUR704PIgU SjpyUslBNAX/HxxgdVf8xWG93G3dZ7hx7yGkpD+NKx3G46urs51cTWOEWgJmmiVU fz17SzTM0bcWPTq+hdYr =7/m6 -----END PGP SIGNATURE-----

1 0

[important] Trac usage and alternatives survey
by Silvia [Hiro] 08 Mar '17

08 Mar '17

Hi everyone, as some of you might already know we have been working on a survey to see if we can identify possible Trac alternatives. The original question was: should we continue to patch Trac until we love it, or should we look around for a tool that might be able to do what we need? The idea of the survey is to identify what we actually need from a ticketing/wiki tool and eventually identify a solution that has all that we want (or that we can work with). So please take your time to answer the survey (it doesn't take longer than 2/3 minutes) https://storm.torproject.org/shared/mgNGJd30HpN8IL5XvoC4QhloRgDGLcpr6VzR89b… For any questions/doubts/rants feel free to write or ping me. -silvia

7 7

Re: [tor-project] *** List discontinued, please subscribe to tor-project@
by Damian Johnson 07 Mar '17

07 Mar '17

Hi Marcin, thanks for letting us know! I've heard rumors that we may resurrect TWN (Tor Weekly News). Hope so - that would provide an even better 'executive summary' than our status reports ever did. :P Cheers! -Damian On Tue, Mar 7, 2017 at 2:15 PM, Marcin Cieslak <saper(a)saper.info> wrote: > On Tue, 7 Mar 2017, Damian Johnson wrote: > >> Hi all! To cut down on confusion for newcomers we're merging this list >> with tor-project@. Both lists have the same characteristics and same >> target audience. > > Hello Damian, > > I have been a keep subscriber of tor-reports because it gave > me low-volume, constant-frequency overview of how the Tor Project > is doing. Say, "executive summary". > > The reports were short, quick to read and very informative. > 8 posts in January on -reports vs. 68 on -project. > > This has a chance to go into my main mailbox and not > some folder than I never get to read (like other Tor mailing lists). > > I am not sure what the confusion was, only recently there was some > discussion on -reports which was I hope a single incident. > > So, for me, -reports was much more informative than any other > project announcements. > > Marcin

1 0

Notes from March 2 2017 Vegas team meeting
by Karsten Loesing 06 Mar '17

06 Mar '17

Notes for March 2 2017 meeting: Alison: 1) More work on the Tor Meeting: nearly finished the gunner-style session's scheduling, working on the strategic planning plenary 2) Tor Tea Time: thinking of creating a regular communication session for community trust. 3) Support portal progress is coming along! This afternoon we have a meeting about Linda's mockup design and the next steps. 4) Finishing up the community council guidelines proposal period. Next week will be the vote. After that I will run the social contract proposal/vote. 5) Support portal progress is coming along! This afternoon we have a meeting about Linda's mockup design and the next steps. Georg: 1) Ordered a new code-signing certificate for Windows 2) Release preparations and work on migration to Firefox ESR 52 Shari: 1) lots of meetings with people visiting Seattle and catching up after being out for a week 2) onboarding and offboarding communications folks 3) thinking about strategic planning Nick: 1) so many releases 2) trying to do OKR on Tor implementation future Mike: 1) Trying to put together a team to work on the research side of Sponsor2. Isabela: 1) At Tor office - meeting Brad, Cass, Roger, Linda and others on many topics 2) Finished milestone 3 of ISC orfox project 3) Working on sponsor S final report 4) Getting things organized to table at Libre Planet 5) hiro sent out a very important survey about Trac - please encourage everyone you work with to answer that :) Karsten: 1) Cass submitted our funding proposal for metrics work after Sponsor X. 2) Preparing for Iain's Atlas usability improvements blog post to be published on Monday. Arturo: 1) We had our first community meeting on slack. It went very well and bunch of people showed up. 2) Working on reports on south east asian countries. Lot's of very interesting findings. 3) Lot's of development related to data analysis and pipeline work. Josh: 1) I am working out my gameplan for relaunching Tor weekly news 2) I spent a long time trying to figure out a lot of the who, what, where, when, and why type things in the Tor community and now I am feeling more confident in my ability to communicate about Tor in general. 3) I am putting together a press kit and a publications kit. I think the publications kit can live on the trac wiki. 4) Introducing myself to the world (people in the press, bloggers, community members, and other good people).

1 0

meek-azure funding has run out
by David Fifield 05 Mar '17

05 Mar '17

The grant I was using to pay for meek-azure ran out at the end of 2016. It was for $10,000 and it paid for meek-azure and meek-google (until the latter was shut down) throughout 2016. I can support it personally for maybe one more month but after that I'll have to shut it down. >From these graphs you can see that meek continues to be very popular, with both backing bridges constant pushing against the rate limits we imposed to control costs. I had hoped that by now we would find a way to pay for sustained deployment, but it hasn't happened. https://atlas.torproject.org/#details/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… https://atlas.torproject.org/#details/AA033EEB61601B2B7312D89B62AAA23DC3ED8… If someone wants to take over the service and raise funds I'm happy to let you. I've been able to manage keeping on top of monthly invoices and all that, but it's not my strong suit. I don't have any problem with continuing to run the bridge that the CDN forwards to, as that is much less expensive than the CDN, like $20/month rather than $600/month.

5 6

Re: [tor-project] meek-azure funding has run out
by Nathan Freitas 04 Mar '17

04 Mar '17

Yes, this is a critical capability of Tor for end-users, not only in Iran and China, but any network that is starting to deploy sophisticated DPI targeted at Tor. Thanks to David, Rob, Nima and others for finding a way forward for Meek. I hope we can continue finding ways to make domain fronting economical, as well, perhaps through a community crowd source hosting effort? I am working on updating Orbot to support these new endpoints. Are they ready for production yet? +n On Fri, Mar 3, 2017, at 08:54 PM, Nima Fatemi wrote: > David Fifield: > > I shut down the meek-azure CDN endpoints this morning, so meek-azure is > > going to stop working until the 6.5.1 release, which updates to Cymru's > > bridge. > > Hey David, > > I just wanted to take the opportunity and thank you for your continues > support to censored users. This is an important work that sometimes goes > under appreciated simply because it's not tangible for most people > active in the community. As someone who's experienced the struggle and > on behalf of those who do every day in this modern day, I take my hat > off to you. > > Same goes to all other Pluggable Transport developers. > > Thank you! > -- > Nima > 0X58C4B928A3E218F6 | @mrphs > > "I disapprove of what you say, but I will defend to the death your right > to say it" --Evelyn Beatrice Hall > _______________________________________________ > tor-project mailing list > tor-project(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-project

2 1

Summary of meek's costs, January 2017
by David Fifield 03 Mar '17

03 Mar '17

Here's the summary of meek's CDN fees for January 2017. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 all 2015 $8006.59 + $8146.83 + $1292.89 = $17446.31 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 February 2016 $986.39 + $977.85 + $445.83 = $2410.07 March 2016 $1079.49 + $865.06 + $534.71 = $2479.26 April 2016 $1169.23 + $1074.25 + $508.93 = $2752.41 May 2016 $525.46 + $1097.46 + $513.56 = $2136.48 June 2016 $0.00 + $1117.67 + $575.50 = $1693.17 July 2016 $0.00 + $1121.71 + $592.47 = $1714.18 August 2016 $0.00 + $1038.62 + $607.13 = $1645.75 September 2016 $0.00 + $932.22 + $592.92 = $1525.14 October 2016 $0.00 + $1259.19 + $646.00 = $1905.19 November 2016 $0.00 + $1613.00 + $597.76 = $2210.76 December 2016 $0.00 + $1569.84 + $1416.10 = $2985.94 January 2017 $0.00 + $1550.19 + $1196.28 = $2746.47 -- total by CDN $13138.96 + $24890.66 + $9242.05 = $44525.20+grand total https://metrics.torproject.org/userstats-bridge-transport.html?start=2016-1… == Amazon a.k.a. meek-amazon == EU (Ireland) 572M requests $687.30 2826 GB $222.64 Global 9M requests $9.96 31 GB $2.43 US East (Northern Virginia) 429M requests $429.20 2542 GB $198.16 -- total 1011M requests $1126.46 5400 GB $423.23 charge for alarms $0.50 https://atlas.torproject.org/#details/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == https://atlas.torproject.org/#details/AA033EEB61601B2B7312D89B62AAA23DC3ED8… As in December 2016, Azure's new zone pricing costs more than in the past. Most of the traffic is from "Zone 3", which is South America according to https://azure.microsoft.com/en-us/pricing/details/cdn/: Zone 1: $0.087/GB: North America, Europe, Middle East and Africa Zone 2: $0.138/GB: Asia Pacific (including Japan) Zone 3: $0.250/GB: South America Zone 4: $0.140/GB: Australia Zone 5: $0.170/GB: India Zone 1 538 GB $ 46.77 Zone 2 75 GB $ 10.40 Zone 3 4538 GB $1134.51 Zone 4 9 GB $ 1.21 Zone 5 20 GB $ 3.39 -- total 5180 GB $1196.28 Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

1 0