June 2017 - tor-project - lists.torproject.org

Reviving the 'Trac discussion' - next meeting on July 11th
by isabela 01 Aug '17

01 Aug '17

Hi everyone, It has been a while since we started evaluating if we want to find alternatives to Trac. You might remember we sent a survey out to collect more info, and based on the answers we believe we should figure out a better solution. https://lists.torproject.org/pipermail/tor-project/2017-March/000975.html https://lists.torproject.org/pipermail/tor-project/2017-March/000978.html In Amsterdam meeting we hosted a discussion on the results of our survey and up to this moment we have been evaluating gitlab as a possible alternative to Trac or eventually as a possible code review tool we can use. But this has been a little 'loose' and we wanted to organize things better in order to be able to make decisions and move forward. Therefore we are thinking of breaking this into 3 'tasks' we want to cover for development: * continue integration - jenkins is doing this now for us (only used for internal contributors tho, would be nice to think of a way external contributors could use it / maybe setting up travis for them) * code review - We have a test gitlab instance running at https://oniongit.eu [or emuo4mf6vwghcaqn.onion]. Network team has accounts on it and we would like to have more people testing it. Please bear in mind that this is a test machine, it is not backed up, and can be slow on occasions. * issue tracker - could be gitlab or another solution, we are still looking into how to solve this one (yes, the wiki is not on this list for now) So! We would like to propose the following moving forward: 1. Meet on irc to answer any questions on this new approach and get more people trying our gitlab testing installation [MEETING IS ON JULY 11TH TUESDAY AT 1400 UTC ON #tor-project channel] 2. Set up a 'end date' for our gitlab testing phase - that is why we would like more folks trying it out 3. Look into a plan to provide CI for external contributors (using travis maybe?) 4. Create a list of requests for what we need for issue tracker and see what to do about that We believe that covering the points above will help us move forward with this project. Please reach out to hiro if you'd like to have access to the gitlab test set up. Any questions/feedback is welcome as always. thanks! isabela and hiro o/

3 5

Update from Tor's Community Council
by Jens Kubieziel 13 Jul '17

13 Jul '17

Hi friends, I am writing on behalf of the Community Council with some updates. We wanted to be in touch and let folks know what we have been up to since the recent election. We have had several meetings with the new Council (Alison, qbi, Linda, Hiro, Gunner). We are enjoying working together. In the near term, we are prioritizing the drafting of policies and procedures for the Council. Our plan is to draft these sequentially and then ask for community input once we think specific policies and procedures are ready for feedback. Procedures we are drafting include case handling, Council operations (e.g. when and how we meet), and Council elections. Policies we are drafting include conflict of interest, operational security (in particular what we store and where), and confidentiality (what is and is not confidential). We welcome anyone interested to reach out to any or all Council members if you have input, questions or concerns you would like to share We'll continue to update the community at least once a month. thanks, -- Jens Kubieziel http://www.kubieziel.de Weisheit ist mehr als Wissen: Es kommt darauf an, was zu tun ist, und nicht, was zunächst getan werden soll. Herbert Clarke Hoover

4 4

Default obfs4 bridges frosty and dragon reporting 0 bandwidth since ~June 18
by David Fifield 10 Jul '17

10 Jul '17

These bridges, added to Tor Browser in ticket #22468, are reporting 0 bandwidth since a few days ago. Is there something wrong with them? https://atlas.torproject.org/#details/854173307E33686BBBAC36A3A093BEF320B71… https://atlas.torproject.org/#details/D9E712E593400635462172121B7DB90B07669…

1 1

Websites tickets triage - a.k.a. weakly cleanup
by Silvia [Hiro] 30 Jun '17

30 Jun '17

Hi, I'd like to organise a weekly websites component ticket triage. It will be held on #tor-project, ideally in the evenings (UTC speaking). I am thinking to start this coming Thursday (6th of July) at 19.00. If this tentative day and time doesn't work and you would really like to be around for the weekly cleanup, please let me know. Talk soon, -hiro

2 1

meetings and laptops
by S. Banerian 30 Jun '17

30 Jun '17

In view of possibilities of issues with laptops and travel, I was wondering if folks had taken access issues into account in planning meetings. I, for one, likely will not try to take a laptop into the US. Thoughts? stefani

1 0

Notes from June 29 2017 Vegas team meeting
by Karsten Loesing 30 Jun '17

30 Jun '17

Notes for June 29 2017 meeting: Alison: 1) Community Team roadmap progress -- still identifying goals and dependencies for the rest of the year. Main priorities are the dependencies and thinking about better ways to have communication channels with devs. 2) Potential new support hire planning with the comms team and the community team 3) Trusteer and Tor Browser situation -- some Windows 10 users can't open TB with Trusteer (anti-fraud, required by banks) software enabled. Colin is digging into this, hoping to have a full update soon. This issue is making me think broadly about support to developer feedback. 4) Support wiki -- hope to have this out next week. Making final edits, writing blog post now. Roger: 1) I did some of my logistics/bureaucracy stuff this past week, but much remains: SponsorR paper to review, PETS paper to review, Defcon slides to write, three NSF reports to start 2) Membership guidelines discussion is proceeding. I think we're getting good feedback so far, and there is work to be done. 3) Brad, Isa, Shari, are we all set with that government certification thing? 4) If you need a Defcon ticket, I might be able to swing a few. Let me know. 5) I'll be seeing Isabela in person right after this meeting, and probably Alison a bit after that, if you need us to discuss anything. Steph: 1) First more donor-focused email newsletter going out in 1-2 weeks. Working with Giant Rabbit to get set up on CiviCRM; they have to create an unsubscribe capability for sending newsletters. I'm creating the template now. Will start monthly, possibly become more frequent. Will be fed by previously published content: blog posts, jobs, press, events, etc. 2) Will be moving press list to CiviCRM; Giant Rabbit is building out with chosen fields now Nick: 1) Putting out releases this week with fixes for TROVE-2017-006. Affects 0.3.0 and later. TBB releases will be warranted IMO. 2) Wanting to resolve license status of torspec: https://trac.torproject.org/projects/tor/ticket/18788 What to do? Should I grab a copyright person? 3) We're starting a "must have regression tests for bugs" policy; let's see how it goes. Other teams might want to watch and see whether they want one too. 4) Wrt fiscal year closing soon: let's not be quiet if anybody's timesheets/reports are late. Instead let's reach out to them right away, so we don't leave Sue & Brad hanging. 5) Should I approve timesheets? How? 6) Working on getting point-of-contact for PT issues. 7) Discussing how we can interact better with external developers/teams who write big patches. Arturo: 1) OONI measurements API now uses as a backend the new data processing pipeline: https://github.com/TheTorProject/ooni-measurements/pull/22 2) Next week we will be making a new ooniprobe mobile release that adds support for sending push notifications to users informing them of things happening in their country/network, asking them to collect more data. Shari: 1) Did some budget work and readjusting expenses based on new fiscal year starting next week. 2) Working with communications team to get our voice right. (nickm offers to help) 3) Back to the drawing board with strategic planners. 4) Working with Erin on updating employment and other Tor policies. 5) Pulling together a team and talking with Giant Rabbit about our end-of-year fundraising plans. Karsten: 1) Released Tor Metrics Library 2, blogged about it, completed Sponsor X award that ends June 30, 2017. Mike: 1) At Mozilla all hands this week. They are excited to work with us. The overall mood seems much more favorable to us than in years past. Isabela: 1) Working on spreadsheet with time allocation for network team and sponsors. 2) Website redesign contract soon coming in for review, to be signed mid-August. Brad: 1) Preparing for year-end close process (fiscal year ends 6/30) 2) Transitioning to new payroll provider for US-based employees effective 7/1

1 0

Is anybody going to Defcon?
by Roger Dingledine 28 Jun '17

28 Jun '17

I'm giving a talk, and I think I can get some of us in for free if I work at it. Let me know if you're a Tor person and you're going and you'd otherwise be needing to pay for registration yourself. --Roger

2 1

GSoC 2017 - unMessage: Report #2
by Felipe Dau 28 Jun '17

28 Jun '17

Hi everyone! This is my report #2 for the unMessage GSoC project. # Updates Since the last report, I mostly worked on the file transfer task (#12) as well as on the logger task (#30). As I intended to implement the file transfer using asynchronous calls, I was able to use the previous work I had done for the asynchronous task (#21) as well as make a few improvements to it. # Deliverables These are the tasks we selected for the first evaluation period: - Improve setup script #35 [0] - Use attrs #34 [1] - Support file transfer #12 [2] - Add a logger #30 [3] These tasks have been finished and their code has been merged to the develop branch [4]. More technical details can be found in the tickets. # What's next The next steps for this second set of tasks are: - Continue making the methods listed in #21 [5] asynchronous - Start writing unit tests for #33 [6] The code for these new tasks can be found in my unMessage fork [7]. Sorry for the delay :/ Thanks, -Felipe [0]: https://github.com/AnemoneLabs/unmessage/issues/35 [1]: https://github.com/AnemoneLabs/unmessage/issues/34 [2]: https://github.com/AnemoneLabs/unmessage/issues/12 [3]: https://github.com/AnemoneLabs/unmessage/issues/30 [4]: https://github.com/AnemoneLabs/unmessage [5]: https://github.com/AnemoneLabs/unmessage/issues/21 [6]: https://github.com/AnemoneLabs/unmessage/issues/33 [7]: https://github.com/felipedau/unmessage

1 0

network team meeting notes, 26 June
by Nick Mathewson 26 Jun '17

26 Jun '17

Hi, all! You can find the transcript from our weekly meeting at http://meetbot.debian.net/tor-dev/2017/tor-dev.2017-06-26-16.59.html Here are our notes: ----------------------- Network team pad, for 26 June Meeting (or 27 June, for those in UTC+5 or later) Notes from last week's meeting: * https://lists.torproject.org/pipermail/tor-project/2017-June/001208.html (Did we do what we had planned?) Announcements and reminders: * review-group-18 is still not cleared. We have 3 tickets left in needs_review there which need to get reviews before nickm makes a review-group-19. * review-group-19 will come once the last 3 tickets in review-group-18 are done. * There are still 34 tickets in 0.3.1.x, including 9 in status "new" with no owner. We need to get 0.3.1.x done! * Employees: remember harvest. [also, if you have pending expense reports, try to submit them before end of june - you can do that via harvest as well if you like] * Isabela will ping people to start collecting information for nsf reports Things we should talk about: * We need a PT person (or at least point of contact) * How important is noise for padding statistics? Mike is thinking "Not very" compared to the type of attack described vs related guard discovery attacks I want to fix first. Tasks for after the meeting: * July team rotation schedule is available at: https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… teor: Last week: * Fixed a nasty security bug in PrivCount, released 1.0.2, and upgraded all the things * Deployed PrivCount HSDir upload stats on a relay for testing * Looked at all the privcount-tagged trac tickets and updated the PrivCount TODO lists * Tried to help out with the PaddingStatistics implementation #17857 etc. * Stop relays from knowing HS client and service addresses #22688, #22689 * Added a hs-network-min network to chutney: #22667 * Logged a few bugs in Tor and Tor Browser This week: * Document the PrivCount HSDir upload stats test outcomes * Prioritise the remaining 6 hidden service events (HSDir client, HSDir cache evict, Intro service, Intro client, Rend service, Rend client) Mike: Last Week: * Worked on #17857 and #22212. * Discussed padding statistics - I am not seeing this as urgent. * Reviewed #13605 (reduced exit policy option) This Week: * Mozilla all hands, all week... asn: Last week: - Caught up with backlog that accumulated during meeting - Work on prop247 stuff. Started the simulator work: It can currently do a basic prop247 simulation and print out some useful output. - Worked with David on some prop224 stuff - Reviewed some prop224 code and other tickets This week: - Review prop224 groundwork #21979 - Continue prop247 simulation. This week I'll spend debugging, make the compromise adversary models and create some nice graphs. - Update prop224 spec wrt SRV / desc overlap behavior based on discussions with david and the current implementation. - Rewrite the overlap logic of prop224 to use the slot system instead of absolute human times. - Revisit #22006 based on nick/isis review. - Hopefully Write wilmington blog post if I get the time. haxxpop: Last week: - Finished reviewing asn's client-side descriptor fetch code. He replied and I also did reply back :) - Read some lattice-based crypto (as a hobby) This week: - Review dgoulet's load and configure service code #21979 (with asn) - Maybe*, take over Fuzz v3 hidden services #21509 (if it's not done yet) dgoulet: Last week: * DRL meeting on Mon, Tue and Wed. (Nick asks: any takeaway lessons?) * Code review on a couple of hidden service tickets. * We do have #21859 (prop224 e2e code) in needs_review now on Gitlab which is the first ticket in review for prop224 inclusion in 032. * Discussed some action items with asn on prop224 about some intro points engineering issues and overlap period logic that is out of sync in the proposal. This week: * Full throttle prop224 work with splitting the service branch in smaller ones for review and upstream merge. * Continuing and hopefully finishing the client implementation. * July is really our target for a minimally working prop224 for both our sponsors and our Defcon talk (early August). Thus, expect lots of work on that on my part. nickm: Last week: * Thanks to ahf, helped diagnose big regression from prop140 (consensus diff) work: we weren't checking if-modified-since correctly any more! Ahf has a fix; testing again now. * Worked on compression issues that toralf found. * Reviewed lots of code. Merged a bunch. Continued bug triage. * Chased through some contacts to find clarity about copyright status for patches on old ticket from Access Labs. All's well. This week: * Pending isabela, send out notes on Who Works On What Between Now And September. * Circulate "supported platforms list" current draft from https://pad.riseup.net/p/QWpY4UYfAsaK , turn it into a wiki page, pending comment. Any comments? * Review more code * Fix pending 0.3.1.x bugs * Release another 0.3.1.x alpha * Write some stuff for 0.3.2.x * Work on or defer remaining 0.3.1.x tickets * More ticket triage on "unspecified" * Prepare for 0.3.2.x triage. ahf: Last week: Sponsor 4: - Been working on Sponsor 4 measurements with Nick: Looks good for clients so far, but we have regressed badly for relays. We think we know what the primary cause is (see #22702). - Been working on a fix for bug #22702 (Never send a consensus which the downloader already has). - Wrote a script to collect directory measurement from Tor logs. Can be found in ahf/tor-sponsor4-compression on GL.com - Working with Nick on the initial results: data in https://people.torproject.org/~ahf/sponsor4/ - Code review: #22719, #22502 (and thus #22626 + #22628), #22629 Misc: - Code review: #3056 This week (ordered): - Land fix(es) for #22702 after we have confirmed they work. - Land fix for the issue where a relay gets killed by the sandbox because we allocate a little bit over 16 MB memory. - Actually get around and finish the merge of prop #278 that I've kept postponing. - Help out with 0.3.1 issues - If time allows for it: write down a short text that tells the progress we have made with the sponsor 4 work (?) catalyst: Last week: * Reviewed a lot of review-group-18 and 0.3.1 tickets * Progress on reviewing #7869 * Registered for oniongit This week: * Check #7869 test coverage * Investigate #20532 * Investigate more test-stem issues * Bug triage * Ping komlo about followup from Wilmington testing session * Follow up and review support person hiring stuff * Experiment more with oniongit isabela: last week: - passed on next tasks to invoice for sponsorR to Brad - finally sent sponsor4 may report - working with tommy on modularization SOI - synced with Brad to get the info to build the spreadsheet for network team people's time allocation this week: - still waiting on one spreadsheet from brad to get back with nick on people's time allocation - hope to get that done this week - looking forward to finish a couple of pending tasks: update the brief for tor launcher automation and get an update on user growth strategy out to tor-internal - off on july 4th (national holiday) and july 5th-7th to get some personal stuff done - catch up with hiro on what we discussed in wilmington related to gitlab and trac pastly: Last weekish: - I hope you like documentation. I wrote a bunch - I hope you like tests. Did those too Time weekish: - nickm asks: "how is the permission-to-release coming?" - pastly says: no news. Was told it would take ~4 weeks about ~2.5 weeks ago - but plans on sharing with dgoulet and anyone that asks nicely ASAP - Finish fleshing out KIST tests. Main one remaining is for the scheduling loop - Once done fleshing out, will push to oniongit and ping dgoulet to make time for meeeeee isis: Last week: * code review on #22006 and #13703 * small patch for #4019 * did employment/insurance/tax paperwork * answering questions and comments for the internship post This week: * Expenses for amsterdam (!), seattle, and wilminton * Lay out tickets for tasks in the next couple months and figure out sponsors and timelines * Some meetings for Mozilla All-Hands that I should attend * BBC Radio interview * Start setting up backend stuff for moat since I believe the TB Team needs it soon(anything else that is higher priority?) [isa: I think for now this is it. like we chated TB team in august: https://storm.torproject.org/shared/pdwxRlkwBXvDC2SFqB8oFWpiu7RQx1wu0FTcIFw…] * Review the internship applications and narrow down the choices and pick one and get them started * Email to Rust team about where we're at * Email to oxidators about steps moving forward and tasks we need to assign ourselves

1 0

Core Tor team sponsor4 May report
by isabela 23 Jun '17

23 Jun '17

Core Tor team May 2017 report In May we released Core Tor 0.3.0.6 stable, our first stable release on the 0.3.0 series. [1] We also spend sometime organizing a team face to face meeting for June (Network Team Hackfest). This is part of an effort to give teams more opportunities to work face to face beyond our bi-annual meetings. We will be sharing more updates from this gathering on our blog. As part of proposal 140 we merged a GSoC project (#13339) [2] that created consensus diffs, done two years ago, and which will be of greater utility now with proposals 140 and 274-278. For that we had to do some update in the code and add more tests, here is the full list of tasks to add this project to our code base: * #21643 Extract, test, revise, and clean the diff code [3] * #21644 Fuzz the diff and patch code [4] * #21647 directory caches cache multiple past diffs or consensuses [5] * #21648 Caches generate diffs as appropriate [6] * #21649 Caches serve diffs on request [7] * #21650 Clients request diffs and handle diffs in replies [8] * #21673 Handle signatures correctly [9] * #22143 Implement May 3 updates to diff format in prop140 [10] * #22148 conformance to proposal, unhandled corner cases [11] * #22149 Update dir-spec with prop140 protocols [12] We are finished writing and testing proposal 278, and its relevant portions are now merged into dir-spec.txt (#22275) [13]. Tickets related to this effort: * #21664 - Prop278: Make the current 'torgzip' module a submodule of a new 'compression' module [14] * #21662 - Prop278: Add support for LZMA2 and/or Zstandard [15] * #21663 - Prop278: Refactor the torgzip module to support additional compression schemes [16] * #22066 - Prop278: Add memory measurement code in LZMA and Zstandard compression backends [17] * #22085 - Prop278: Refactor and simplify compression tests [18] * #21665 - Prop278: Establish an upper-bound for LZMA2 memory usage [19] * #21667 - Prop278: Handle new headers in directory.c [20] * child-tickets: * #21668 - Prop278: Update cached_dir_t and related types to no longer assume single compresison method [21] * #22065 - Prop278: Parse the Accept-Encoding header and pass it to "get" handlers [22] In June, we will be testing the merged code further, evaluating its performance, and fixing any bugs we find. [1] https://blog.torproject.org/blog/tor-0306-released-new-series-stable [2] https://trac.torproject.org/projects/tor/ticket/13339 [3] https://trac.torproject.org/projects/tor/ticket/21643 [4] https://trac.torproject.org/projects/tor/ticket/21644 [5] https://trac.torproject.org/projects/tor/ticket/21647 [6] https://trac.torproject.org/projects/tor/ticket/21648 [7] https://trac.torproject.org/projects/tor/ticket/21649 [8] https://trac.torproject.org/projects/tor/ticket/21650 [9] https://trac.torproject.org/projects/tor/ticket/21673 [10] https://trac.torproject.org/projects/tor/ticket/22143 [11] https://trac.torproject.org/projects/tor/ticket/22148 [12] https://trac.torproject.org/projects/tor/ticket/22149 [13] https://trac.torproject.org/projects/tor/ticket/22275 [14] https://trac.torproject.org/projects/tor/ticket/21664 [15] https://trac.torproject.org/projects/tor/ticket/21662 [16] https://trac.torproject.org/projects/tor/ticket/21663 [17] https://trac.torproject.org/projects/tor/ticket/22066 [18] https://trac.torproject.org/projects/tor/ticket/22085 [19] https://trac.torproject.org/projects/tor/ticket/21665 [20] https://trac.torproject.org/projects/tor/ticket/21667 [21] https://trac.torproject.org/projects/tor/ticket/21668 [22] https://trac.torproject.org/projects/tor/ticket/22065

1 0