October 2018 - tor-project - lists.torproject.org

Are there countries where using Tor is illegal?
by Cristian Consonni 11 May '25

11 May '25

Hi, (Sorry if this question has already been asked in the past, feel free to point me to the relevant resources.) I know that the legal FAQs by the EFF state that: «we believe that running a Tor relay — including an exit relay that allows people to anonymously send and receive traffic — is legal under U.S. law.»[1] I also know there is a list of countries for which there is legislation that exclude communication service providers from liability. They are indicated in the Legal of the Tor Exit Guidelines page[2], they are USA, Germany, Netherlands, Austria, France, and Sweden. >From some articles in the press[3a][3b] it may be illegal - depending on how you interpret the wording[*] - to use Tor (and other technologies such as VPNs or proxies) in the UAE, with fines ranging in the millions of dirhams (hundreds of thousand of dollars). A couple of weeks ago it was discussed - on this list as well - that a law was introduced to the state parliament to ban Tor[4a][4b]. This follows a case of some months ago of a Russian Tor exit node operator being arrested for inciting mass riots and terrorism[4c][4d]. The idea of blocking VPNs or Tor seems to have already been considered in the past[4e]. This infographic about pluggable transports[5] suggests access to the Tor network is censored or limited in China, Uzbekistan, Iran, and Kazakhstan. Tor being censored orblocked may be different from it being illegal. What about other countries? Is there a place where I can find more about this topic? Cristian [1]: https://www.torproject.org/eff/tor-legal-faq.html.en [2]: https://trac.torproject.org/projects/tor/wiki/doc/TorExitGuidelines [3a]: http://www.emirates247.com/news/emirates/dh500-000-fine-if-you-use-fraud-ip… [3b]: http://news.softpedia.com/news/people-caught-using-vpns-tor-or-proxies-in-t… [*]: «Whoever uses a fraudulent computer network protocol address (IP address) by using a false address or a third-party address by any other means for the purpose of committing a crime or preventing its discovery» [4a]: https://lists.torproject.org/pipermail/tor-talk/2017-June/043293.html [4b]: https://trac.torproject.org/projects/tor/ticket/22055 [4c]: https://lists.torproject.org/pipermail/tor-talk/2017-April/043109.html [4d]: https://techcrunch.com/2017/04/24/dmitry-bogatov-tor-russia/ [4e]; https://torrentfreak.com/vpn-and-tor-ban-looming-on-the-horizon-for-russia-… [5]: https://www.torproject.org/images/PT/2016-07-how-to-use-PT.png

4 3

35C3 Vouchers
by Jonathan Marquardt 05 Nov '18

05 Nov '18

Hello everyone! If anyone has any 35C3 vouchers left, please notify me! I'd like to attend the relay operators meetup. -- OpenPGP Key: 47BC7DE83D462E8BED18AA861224DBD299A4F5F3 https://www.parckwart.de/pgp_key

2 1

Tor Browser Release Meeting Today - Wednesday 31st November 18:00UTC
by Pili Guerra 31 Oct '18

31 Oct '18

Hi everyone, Just a reminder that we’ll be having our bi-weekly Tor Browser release meeting today at 18:00UTC. Please come with any questions, requests and comments you may have. Everyone is welcome! Pili — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

1 1

Tor Browser team meeting notes, 29 Oct
by Georg Koppen 30 Oct '18

30 Oct '18

Hi! The meeting log of our weekly meeting yesterday can be found on http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-10-29-18.01.log… The pad contents are pasted below for your convenience: Monday October 29, 2018 Discussion: - next meeting (GeKo: we switch to 1900 UTC from next week on, wiill send an email to tbb-dev) - security control redesign (GeKo: the plan is to due the incremental approach: implement what we have in proposal 101 and start thinking about making especially the "safer" mode even more usable; scheduling meeting for next week Wed 1900 UTC to hammer our the remaining issues; will send mail to tbb-dev) GeKo: Last week: - helped with getting releases out - done with Tor bundles ticket triage (yay) - reviews (a bunch of tor-browser-build patches for our Tor Browser for Android, #28082, #26498, #28185, #28125; started with #22343) - we hired external folks to fix our Windows accessibility bug (#25703), not sure when we get that work scheduled, though, yet - work on the security control redesign (#25658) - work on updating our design doc (not as much as I have hoped, though :( ) (#25021) - started first look into single-locale repacks and thinking how to integrate that into our build system (#27466) This week: - more reviews - tba release? (GeKo: yes, we'll have one this week) - further work on tor browser design doc update (#25021) - looking closer into single-locale repacks (#27466) - looking closer at fpi of redirects - begin of the month updates -afk for parts of wed + whole thu+fri igt0: Last week: - Tested a bit #28125(TBA proxy bypass, i need to write down what kind of tests i did) - Sent a new patch to #26690 (padlock on mobile) - Have a patch to #27111 (about:tor on mobile, however it is blocked by #25013) - Implemented the donation banner, however it is not easy testable because it depends of #27111 This week: - More updates to the #25013 (Move TorButton code to the tor browser repository) - more reviews tjr - I got a mingw-clang x64 build with sandbox running and seemingly stable - Have to upstream a MinGW patch and land a couple of MinGW bumps, but then it will be in TC - Will work on getting tests running, and doing some TC build stuff cleanup - To the extent possible, would love to start working on moving this into rbm. (GeKo: As I said on IRC, ping either boklm or me, I opened #28238) - I can probably start this, but will need guidance. - Fuzzyfox landed in Nightly, and you can enable it yourself and try it out - Have to add prefs manually. Has an intermittent crash-on-enable. Performance is sometimes fine, sometimes unusable?? - Circulated the 3600 design doc to mozilla folks. - I think folks are planning to show up to the Wens morning meeting to discuss it, so Richard, would be great if you could come. sysrqb: Last week: Worked on #28125 (DNS leak on Android) Attended funder meeting This week: Continue working on #28125 Reviewing #25013 (integrating torbutton into tor-browser) Rust audit Integrating Orbot into TBA boklm: Last week: - helped publish the new releases - reviewed patches to integrate android build in tor-browser-build - opened and started thinking about #28176 (Cleanup and add the testsuite to tor-browser-build.git) and started some prototype to try to see if that looks like a good idea This week: - follow-up on #26148 (binutils reproducibility issue) - continue looking at #28176 and how to bring back the testsuite - make patch for #27265 (rbm issue when downloading some files) and #27045 (Add option for firefox incremental builds) - afk on Thursday pospeselr: Last week: - posted tech overview doc for #3600 (redirects) to dev list: https://storm.torproject.org/shared/Kw99Ow0ExZFFC6FKD5CeryfVFAoAL9Z_iEVlflI… - associated #3600 prototyping - updated tbblogger to use fmtlib: - utf8, utf16, utf32, and wide strings and pointers all handled transparently regardless of OS/CPU architecture This week: - #3600 doc feedback, prototyping sisbell: Last week: - # 27441 Debian image to use stretch - merged - # 26696 Platform def in rbm.conf - merged - # 26697 Android toolchain - merged - # 27443 Firefox for Android - fixed packaging issues. This Week: - # 27443 - sync mozconfig entries with the one in tor browser repo. Cleanup system dependencies - # 28144 - TorButton investigate adding to projects arthuredelstein: Last week: Starting working on automated unit tests for #22343 (Save as) Made more progress on FPI of permissions (https://bugzilla.mozilla.org/1330467) Opened #28163 (Make "new window" and "new tab" menu item labels consistent) and #28174 (Block non-.onion subresources) Wrote patch for #28187 (Change Tor Circuit display to an onion) This week: Keep pursuing FPI permissions Finish unit tests for 22343 (Save as) for future uplift Look into more ff60-esr bugs? Read through pospeselr's redirect document and make comments pili: Last week: Experimenting with roadmap formats... This week: More roadmap experimentation Thinking about matching up tor browser releases/features with user testing sessions reviewing anto's wiki docs :D AFK Thursday and Friday anto Last week: #28093 - Made TBA mobile + tablets EOY Banner mocks - https://trac.torproject.org/projects/tor/ticket/28093#comment:4 #25658 - Worked on Security Settings This week: #25658 - More on Security Settings Sent Tor Browser Icon Poll - https://lists.torproject.org/pipermail/tor-project/2018-October/002034.html Writing wiki docs for the work we did over the circuit display and .onion security indicator. If you think I'm missing anything important, please let me know! WIP here: https://storm.torproject.org/shared/Ju1LYUrUQBsBNAXJX9xr1u5XPUOSNEGia1emcAj… https://storm.torproject.org/shared/51oEioNhpFgEYAcVswnczZORLmGjR_mlVsYKdPz…

1 0

Network team meeting notes, 29 Nov
by Nick Mathewson 29 Oct '18

29 Oct '18

Hello! Our meeting logs are at http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-10-29-16.58.html Here are the contents of our pad: = Network team meeting pad! = Welcome to our meeting! First meeting each month: Tuesday at 2300 UTC on #tor-meeting on OFTC. Other meetings each month: Mondays at 1700 UTC on #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! Note the meeting location: #tor-meeting on OFTC! (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) After each week's meetings, the contents of this pad will be sent to tor-project @ lists.torproject.org. After that is done, the pad can be used for the next week. == Previous notes == (Search the list archive for older notes.) 24 Sep: https://lists.torproject.org/pipermail/tor-project/2018-September/001996.ht… 1 Oct: No online meeting; in-person meeting in Mexico City. 9 Oct: https://lists.torproject.org/pipermail/tor-project/2018-October/002005.html 15 Oct: https://lists.torproject.org/pipermail/tor-project/2018-October/002027.html 22 Oct: https://lists.torproject.org/pipermail/tor-project/2018-October/002032.html == Stuff to do every week = * Let's check and update the roadmap. What's done, and what's coming up? url to roadmap: https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Check reviewer assignments at https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Also, let's check for things we need update on our spreadsheet! Are there important documents we should link to? Things we should archive? * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… * Community guides, it's time to hand off to the next guide! * Let's look at proposed tickets! 0.3.5 (bugs only): https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… 0.3.6: https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… == Reminders == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next releases * Remember to fill up actual point when you finish a task (as well as "fix" the estimate when starting the issue). * Add planned PTO to the calendar https://storm.torproject.org/shared/X4hcTHZ9_Nw14FzTi3kabO6E8etGYHwLvshGv_C… << Remember that priority is Sponsor 8 - roadmap is sort out by priority >> In November everybody need to start checking snowflake as it is something that is coming in December. ------------------------------- ---- 29 October 2018 ------------------------------- == Announcements == Please don't bulk-delete all the old entries from this pad any more. Instead, delete the "planned" and "actual" for the previous week, but leave the "planned" for this week in place. The first team meeting of each month is at Tuesday at 2300 UTC on #tor-meeting on OFTC. That's next week! (It's ok if the time doesn't work for you, we'll see you the week after.) Let's send an email to tor-dev about the meeting time next week. Alpha/Master maintainer doc: https://trac.torproject.org/projects/tor/ticket/28225 == Discussion == teor says: I moved all features and some bugs out of 035-roadmap-proposed. Some of them went into 036-roadmap-proposed. Which remaining bugs in 035-roadmap-proposed can be deferred? (See links above.) catalyst asks: which time zone switch are we following for the meeting? US? A: Monday meeting will switch with US DST. patch party remains fixed at 23:00 UTC. US DST switches on 04 Nov, but first meeting of the month is at patch party time. so 12 Nov meeting is at 18:00 UTC. == Recommended links == Giving a talk about Tor and Human Rights? Here's a good general guide for talking about human rights: https://australianprogress.org.au/how-to-talk-about-human-rights/ == Updates == NOTE NEW FORMAT! Name: Week of XYZ (planned): - What you planned for last week. Week of XYZ (actual): - What you did last week. Week of ABC (planned): - What you're planning to do this week. Help with: - Something you may need help with. PLEASE DO NOT BULK-DELETE THE OLD ENTRIES! Leave the "Planned" parts! Nick: Week of 10/22 (planned): - Review and comment on latest prop295 draft. - Help Gaba with anything she asks for help with - Move review, more merge - Ramp dgoulet up with code merging? - Possibly, implement pub/sub API? - Attending "New England Systems Verification Day" on Friday - Work on storing families with less RAM. (sponsor8, memory, #27359) Week of 10/22 (actual): - Review, merge, etc - Initial pubsub api work - Ask for comment and discuss pubsub work. - Ran into trouble with #27359 (storing families with less RAM). Needs discussion post-meeting - Attended NESVD. Evangelized trunnel as an example of a frontend that could stand a formally verified backend. Learned that some of the fiat-crypto folks are doing lattice-based crypto. Made other contacts. - Answered tons of email Week of 10/29 (planned): - Implement pubsub message dispatch API and subsystems API. - Do something with consensus mmap patches. (But what?) - release 0.3.4.next? - Get un-stuck on #27359? - Try to design an "extra dormant mode" for #2149 - Want help with: - I'm not on enough roadmapped stuff right now. Who needs help? [dgoulet] I might! Lets talk quickly after meeting. Mike: Week of 10/22 (planned): - Fix up last few XXX's in the wtf-pad branch; write tests - Work with asn to review it Week of 10/22 (actual): - Got wtf-pad branch to asn+teor; initial fixups from their comments - Discussions with Jaym about https://trac.torproject.org/projects/tor/ticket/23512#comment:36 Week of 10/29 (planned) - Write more tests for wtf-pad; help asn with review and/or chutney tests - Write diff for nickm's datagram paper - Update WTF-PAD proposal - Maybe help Jaym diagnose why #23512 seems off? ahf: Week of 10/22 (planned): Sponsor 8: - Figure out "who does what" for #25502 and start/continue on that. Sponsor 19: - Work with Kat if anything comes up? Misc: - Anti-censorship position interviews/evaluation/etc. - Do the reviews I didn't do last week. - Had 1:1 with Gaba Week of 10/22 (actual): Sponsor 8: - Split #25502 into child tickets with tasks. - Some discussion with David on PT protocol enhancements for signaling PT connectivity status. - Hacking on #28179 Sponsor 19: - Nothing came up. Misc: - Code reviews. - More reviews of anti censorship candidates. Week of 10/29 (hopefully): Sponsor 8: - Continue implementation for #28179 - Talk with HC about ARM64 Orbot Sponsor 19: - Spend some time (half a day? a morning maybe?) on some of the Snowflake tasks. Misc: - End of month tasks. asn: Week of 10/22 (planned): - Start reviewing WTF-PAD code, assuming that the branch lands this week (cc mike). - Still haven't made WTF-PAD roadmap tickets. - Do coverity hsv3 issue #28120 - Reviews. Week of 10/22 (actual): - Opened ticket for the WTF-PAD code review #28142, and started reviewing and testing it. A few review comments have been left on github, and I'm still reviewing/testing the feature. - Fixed coverity issue #28120. - Reviewed #28096 and #28123. Week of 10/29 (planned): - Continue reviewing/testing WTF-PAD code. - Encountered very annoying issue with chutney while testing WTF-PAD that seems to be PEBCAK. Need to diagnose and fix. - Do reviews. dgoulet: Week of 10/22 (planned): - Implement #27838 solution asn and I came up with. - Probably work with ahf on roadmap item #25502. - 035 ticket work, many need patches or/and review. - Wanting to go over pubsub design from Nick. Week of 10/22 (actual): - #27838 in merge_ready - Wrote with ahf the PT and Control spec for #28180. It is currently under review: https://lists.torproject.org/pipermail/tor-dev/2018-October/013522.html - Review/Patch tickets work (see Timeline). - A bit of ticket triage for the tor-hs key word and 035 Milestone. - Worked on the alpha/master maintainer policy which is now in #28225 ready to be merged upstream (doc/HACKING/Maintaining.md) - Went over Nick's pubsub design. Some back and forth on the network team list. - Migrated the bad relay detection system to a new server, the old one was going down and I needed to avoid a little downtime as possible. - Discussion with asn and haxxpop on the tor-keygen tool specifically for the HSv3 client auth. Week of 10/29 (planned): - Get further into #25502 meaning taking care of #28180 and hopefully starting to implement soon. - Reviews and 035 tickets as much as possible. - Draft the stable maintainer policy with teor's help. gaba: (not presencial) Week of 10/22 (actual): - hackweek - weekly 1:1s - more fundraising - roadmap - traveling to sustainble OSS and OTF Summit Week of 10/29 (planned): - OTF Summit in Taipei - week 1:1 - fundraising & proposals - roadmap: I will check on people about sponsor8 tickets catalyst: week of 10/22 (2018-W43) (planned): - reviews - other high-priority 0.3.5 work as needed - community guide rotation - sketch out more details of sponsor8 task breakdown - anticensorship hiring? - comment on pubsub proposal - comment on prop#295 revisions if there's time week of 10/22 (2018-W43) (actual): - reviews - community guide rotation (nothing major) - looked at some anticensorship hiring stuff - reviewed pubsub proposal somewhat week of 10/29 (2018-W44) (planned): - reviews - hiring stuff - more detailed outline of sponsor8 work - 0.3.5 bugfixes as needed haxxpop: Week of 10/22 (planned): - Try writing the man page for client auth keygen cli Week of 10/22 (actual): - Started writing man page of `tor-keygen` but it's not finished yet. Week of 10/30 (planned): - Continue writing the man page teor: Week of 22 Oct (planned): - Work on PrivCount in Tor prototype: module design, merge privcount_shamir, stub other modules - Finish code review, small revision, and small ticket backlog - Make the fallback script ignore addresses in the whitelist, so we can rebuild the fallback list - Post-travel admin (awaiting timesheet advice from accounting) - Blog post on PrivCount research (awaiting notes from other researchers) Week of 22 Oct (actual): - CI + Coverity Rotation: it seemed like things were mostly ok, nickm helped with coverity - Worked on code review, small revision, and small ticket backlog - Started working on a travis CI config for the chutney repository - Once we have a working chutney/tor config, I can use Travis to test PrivCount in Tor - Reviewed code to add test-stem to the tor travis config - Did an extensive but incomplete review the padding pull request, focusing on floating point - Hackfest planning - Deferred blog post because people are busy - Responded to dgoulet's email about the release maintainer role Week of 29 Oct (planned): - Get my timesheets and post-travel admin done (awaiting advice from accounting) - Work on PrivCount in Tor prototype - minor fixes to privcount_shamir - module design, merge privcount_shamir, stub other modules - finish off the travis CI config for chutney / turn it into a config to test PrivCount in Tor - Make the fallback script ignore addresses in the whitelist, so we can rebuild the fallback list - Work on code review backlog. Maybe small revision and small ticket backlog if I have time Help with: - juga: Week of 22 Oct (planned): - sbws - get pull requests merged to master - check remaining tickets for sbws 1.0 and try to fix them all - bandwidth file specification - create pull requests with updates - core tor component with bwauth keyword - prioritize open tickets Week of 10/22 (actual): - sbws - get pull requests merged to master - check remaining tickets for sbws 1.0 and try to fix them all: - Compare sbws total scaled bandwidth with total consensus bandwidth - disable rtt measurements - Check prioritisation - Update documentation - bandwidth file specification - create pull requests with updates Week of 10/29 (planned): - sbws - relase 1.0, update deb - start using sbws in production (#28224) - tor code - start with #21377: DirAuths should expose bwauth bandwidth files - prioritize open tickets - bandwidth file specification - whatever needs to get fixed after review Help with: - anyone: - review: #27690 Update bandwidth-file-spec with scaling methods - review: #28085 Update key/values in the bandwidth file spec (unless merging without reviewing is an option in torspec)

1 0

Minutes
by Gabriella Biella Coleman 29 Oct '18

29 Oct '18

Hello, You can find the latest Tor Board minutes from our August 2018 meeting here: https://gitweb.torproject.org/company/policies.git/tree/minutes/TPI_Board_M… The https://gitweb.torproject.org/company/policies.git/tree/minutes regards, Biella -- Gabriella Coleman Wolfe Chair in Scientific and Technological Literacy Department of Art History & Communication Studies McGill University 853 Sherbrooke Street West Montreal, PQ H3A 0G5 http://gabriellacoleman.org/ 514-398-8572

1 0

[Survey] Tor Browser Icon
by tor＠antonela.me 29 Oct '18

29 Oct '18

Hi Tor! Over this year, we've worked hard to provide a better experience for Tor Browser users. We made big visual updates to the browser, and now we need to bring the icon on board. We want to poll our community to make this decision: Which of these icons best represents Tor Browser to you? https://survey.torproject.org/index.php/989654 The survey is anonymous and will be open until November 9th. Make your vote! Thanks, A

1 0

Notes from October 25 2018 Vegas team meeting
by Karsten Loesing 26 Oct '18

26 Oct '18

Notes for October 25 2018 meeting: Sarah: 1) Launched YE campaign on Tuesday. So far we've raised $9,000 and brought in over 100 first-time donors. We've also had 9 new people sign up to be monthly donors. This is closely tracking the early results from 2017. 2) Responding to a lot of email resulting from the campaign. 3) Al moving ahead on anti-censorship grant proposal, family foundation letter, and modularization proposal. Nick: 1) Going places and meeting up with people over next couple of weeks: New England Systems Verification Day (tomorrow). Let me know if there's any contacts or connections I should try to make. Pili: 1) Tor Visual Identity Brainstorm research 2) Started thinking about reporting User Testing - content and format 3) Working on better Roadmap visualization, starting with Browser Team Roadmap (mainly for myself for now) 4) Public Holiday and PTO next week (Thurs 1st and Fri 2nd November) Karsten: 1) Worked on updating metrics-web's ipv6servers module to cover existing statistics on relays by flags/versions/platforms as well as new statistics for relays by consensus weight and bridges by flags/versions/platforms. Still very much work in progress. 2) Deployed changes to streamlined percentile computation using Apache Commons Math and a bugfix related to 0-vs.-null in OnionPerf performance graph. Georg: 1) Got releases out (desktop stable and alpha) with the fundraising banner, work is ongoing for a donation banner for Tor Browser for Android as well 2) Reached out to potential external contractor to fix Windows accessibility bug (aka https://trac.torproject.org/projects/tor/ticket/27503) (Shari: I am fine with the invoice approach. It was addressed to me, so should I sign it? Or should we get that changed to, say, you and you sign it once they got the things corrected I mentioned?) Shari: 1) Finally back in the office after a month of traveling! 2) Ready to get involved with various funding proposals due soon. (See Sarah's summary.) However I can be most helpful. 3) Edited end-of-year appeal letter. Ready to get more involved however that is most helpful. 4) Reviewing newer sysadmin resumes. 5) Setting up call to talk about Protasia and whether Tor Project should get involved with their publicity stuff. 6) Met with Isabela in New York. On schedule for official handoff the week of November 12. 7) Spoke at Yale Law School last week. 8) Gotta do some expense reports! Steph: 1) helped launch EOY campaign. changed all social media profiles, created thank you card, lots of social sharing, etc 2) submitted request for a stand at FOSDEM 3) preparing LibrePlanet submission 4) putting together copy on Tor’s history for the website 5) working with The Berkeley Group on our brand perception study Mike: 1) Working on Sponsor2 things 2) Nothing for the group isabela: 1) Met with shari in NYC 2) went to DRL Implementers meeting 3) working on DRL report 4) reviewing proposals and trying to help with the drl one due in nov 5) plan on organizing 1:1s with vegas leads that I dont have 1:1 yet 6) getting myself onboard on Tor's financial world :) Anto: 1) EOY campaign is done \o/ 2) preparing email to invite people to join the Tor Browser Icon's pool 3) reviewed research.tpo.org 4) met with Pili and Helen to optimize user research reporting 5) working on TB Security Settings 6) working on tpo.org + tpo.org/about prototype Gaba: 1) kicked up the hackweek preparation for network and metrics team happening at the end of january (jon is helping with logistics) 2) reviewing moss proposal and organizing around that 3) 1:1 with people 4) followed up on people doing stuff for gettor (hiro and israel) 5) roadmaps on network team and metrics on the way 6) attending sustaining open source software unconference (https://sustainoss.org/) and then traveling to taipei for otf summit 7) If I get interesting thoughts/ideas related to this unconferences that I'm attending, should I share notes anywhere?

1 0

Network team meeting notes, 22 Oct
by Nick Mathewson 23 Oct '18

23 Oct '18

Hi! Our meeting logs are at: http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-10-22-16.58.html Here is our update pad: ------------ = Network team meeting pad! = Welcome to our meeting! Mondays at 1700 UTC on #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! Note the meeting location: #tor-meeting on OFTC! (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) After each week's meetings, the contents of this pad will be sent to tor-project @ lists.torproject.org. After that is done, the pad can be used for the next week. == Previous notes == (Search the list archive for older notes.) 17 Sep: https://lists.torproject.org/pipermail/tor-project/2018-September/001982.ht… 24 Sep: https://lists.torproject.org/pipermail/tor-project/2018-September/001996.ht… 1 Oct: No online meeting; in-person meeting in Mexico City. 9 Oct: https://lists.torproject.org/pipermail/tor-project/2018-October/002005.html 15 Oct: https://lists.torproject.org/pipermail/tor-project/2018-October/002027.html == Stuff to do every week = * Let's check and update the roadmap. What's done, and what's coming up? url to roadmap: https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Check reviewer assignments at https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Also, let's check for things we need update on our spreadsheet! Are there important documents we should link to? Things we should archive? * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… * Community guides, it's time to hand off to the next guide! * Let's look at proposed tickets! [but see discussion] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… == Reminders == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next releases * Remember to fill up actual point when you finish a task (as well as "fix" the estimate when starting the issue). * Add planned PTO to the calendar https://storm.torproject.org/shared/X4hcTHZ9_Nw14FzTi3kabO6E8etGYHwLvshGv_C… << Remember that priority is Sponsor 8 - roadmap is sort out by priority >> ------------------------------- ---- 22 October 2018 ------------------------------- == Announcements == Please don't bulk-delete all the old entries from this pad any more. Instead, delete the "planned" and "actual" for the previous week, but leave the "planned" for this week in place. == Discussion == - Merging code into master by subsystem. - Reminder to comment/note on team rotation changes: https://pad.riseup.net/p/team_rotation - Anybody can help juga with sbws stuff (other than teor)? - ahf & catalyst - Hackweek Preparation https://pad.riseup.net/p/tor-netteam-hackweek-2019.1-keep == Recommended links == == Updates == NOTE NEW FORMAT! Name: Week of XYZ (planned): - What you planned for last week. Week of XYZ (actual): - What you did last week. Week of ABC (planned): - What you're planning to do this week. Help with: - Something you may need help with. PLEASE DO NOT BULK-DELETE THE OLD ENTRIES! Leave the "Planned" parts! Nick: Week of 10/15 (planned): - Any roadmapping tasks Gaba asks me to help with. :) - More review and merge - Finish new-API design proposals, ask for review - Meet to discuss Gettor plans - Talk with Teor about ideal meeting schedule (ie, which meeting to move to a more convenient time) - Talk with Teor about stable maintenance? - Talk with Catalyst and Ahf about bootstrap reporting subtasks and plans - Talk with Gaba about hackweek planning - Release an 0.3.5 alpha - Open merge window for 0.3.6. Week of 10/15 (actual): - Code review and merged - Tried to help others with debugging hard stuff. Not sure I really solved anything, but I maybe was an effective "rubber duck". ( https://en.wikipedia.org/wiki/Rubber_duck_debugging ) - Released 0.3.5.3-alpha, opened master for 0.3.6 - Chased down a big-endianness bug as #28115 - Talked with various people as per plans - Needs review: Put out API design proposals at https://people.torproject.org/~nickm/volatile/api-design/ . - Tracked down OSS-Fuzz regression, opened https://github.com/google/oss-fuzz/issues/1886 - Did #27225 (Memoize summarize_protover_flags()) to reduce allocation count and maybe memory fragmentation - Week of 10/22 (planned): - Review and comment on latest prop295 draft. - Help Gaba with anything she asks for help with - Move review, more merge - Ramp dgoulet up with code merging? - Possibly, implement pub/sub API? - Attending "New England Systems Verification Day" on Friday - Work on storing families with less RAM. (sponsor8, memory, #27359) Want help with: - I'm not on enough roadmapped stuff right now. Who needs help? - I need comments on that pubsub API proposal Mike: Week of 10/15 (planned): - Get farther into wtf-pad updates; update roadmap - Gather other wtf-pad implementations and data Week of 10/15 (actual): - Updated WTF-PAD branch and some roadmap estimates - Gathered more info about wtf-pad - Branch is in pretty good shape, needs another pass for fixes, needs testing - Think we have too many tiny wtf-pad tickets and things in the roadmap. Most are done. Week of 10/22: - Fix up last few XXX's in the wtf-pad branch; write tests - Work with asn to review it ahf: Week of 10/15 (planned): Sponsor 8: - Back to using timer based event loop handling for PT's on Windows as per discussion in Mexico. (#25502) - Look into which initial messages we should submit from the PT. Sponsor 19: - Finish document section on PT's for Kat's S19 report. Misc: - Anti-censorship + sysadmin job interview tasks. - Lots of reviews(?) with merge window opening? Week of 10/15 (actual): - Finished s19 report document with asn - Lots of CV reviews for anti-censorship position - Ticket reviews. - Worked on splitting #25502 into more tickets. Week of 10/22: Sponsor 8: - Figure out "who does what" for #25502 and start/continue on that. Sponsor 19: - Work with Kat if anything comes up? Misc: - Anti-censorship position interviews/evaluation/etc. - Do the reviews I didn't do last week. - Had 1:1 with Gaba asn: Week of 10/15 (planned): - Mike: we need to make tickets for all the WTF-PAD roadmap stuff. - Finish up backlog. - Check the censorship dev job applications. - Do all the reviews (many!) - Read WTF-PAD backlog. Not sure if I will have time to start the big review yet, given how much other stuff I have to review. Week of 10/15 (actual): - Did reviews (#27549, #27928, #28026, #27471, #27995) - Wrote patch for 035 ticket: #26812 - Sponsor19 report done with ahf. - Opened coverity hsv3 issue ticket: #28120 - Helped neel with #27841. - Sketched out plan about #27838 with dgoulet. - Reviewed censorship dev job applications. - Wrote a report back from the Tor relays workshop we did last week: https://lists.torproject.org/pipermail/tor-relays/2018-October/016468.html - Continued crunching backlog, and also read the WTF-PAD thread. - Discussed Briar's future HS rendezvous scheme: https://lists.torproject.org/pipermail/tor-dev/2018-October/013499.html Week of 10/22: - Start reviewing WTF-PAD code, assuming that the branch lands this week (cc mike). - Still haven't made WTF-PAD roadmap tickets. - Do coverity hsv3 issue #28120 - Reviews. dgoulet: Week of 10/15 (planned): - Tickets++ Week of 10/15 (actual): - Hunted down #27813 which took me ~3 days and from that #28089 and #28090 were created causing the issue. Fixed and released in 0.3.5.3-alpha. - HSv3 tickets: #27841, #27471, #27995. Discussion with asn on #27838 to find the best approach to solve the issue. - Wrote s19 report (task6 and task10c). Week of 10/22 (planned): - Implement #27838 solution asn and I came up with. - Probably work with ahf on roadmap item #25502. - 035 ticket work, many need patches or/and review. - Wanting to go over pubsub design from Nick. gaba: Week of 10/22 (planned): - anti-censorship dev job interviews - more hackweek - weekly 1:1s - more fundraising - roadmap - traveling to sustainble OSS and OTF Summit catalyst: Week of 10/15 (2018-W42) (planned): - reviews - other high-priority 0.3.5 work as needed - open some tickets with observations to help get Chutney reliable enough to run from CI - review anticensorship job applications? week of 10/15 (2018-W42) (actual): - reviews - changes for #27800 (log more stuff when we get colliding ed25519 IDs and make them seem less alarming) - looked at prop#295 revisions somewhat -- in addition to formatting stuff, some substantive issues remain - looked over nickm's pubsub proposal week of 10/22 (2018-W43) (planned): - reviews - other high-priority 0.3.5 work as needed - community guide rotation - sketch out more details of sponsor8 task breakdown - anticensorship hiring? - comment on pubsub proposal - comment on prop#295 revisions if there's time haxxpop: Week of 10/15 (planned): - Discuss with asn and dgoulet about the client auth keygen cli Week of 10/15 (actual): - As planned Week of 10/22 (planned): - Try writing the man page for client auth keygen cli teor: Week of 15 Oct (planned): - Post-travel admin - Blog post on PrivCount research - Work on PrivCount in Tor prototype: module design, merge privcount_shamir, stub other modules - Code reviews - Meeting about Tor talk - Make the fallback script ignore addresses in the whitelist - Inbox zero? Week of 15 Oct (actual): - Dealt with my email backlog, and some of my review, revision, and quick fix backlogs - gave advice on #28042 (sbws doesn't have enough results), reviewed fixes in #28062, ... - reviewed IPv4/IPv6 autoselection patch #27490 - did bug triage process x3, and added links to useful queries Feedback: Reviewing all modified tickets is really hard. (I want a timeline view that just has Core Tor tickets, or a search with change previews, but that seems impossible) - Meeting about tor talk at Internet Feeedom Hack - worked through the outstanding PrivCount Shamir tasks (#25669) - email response to prop295 revision, asked when we can do public review - helped blueprint for free speech with a grant (could be related to sponsor 19, who do I talk to about sponsor 19?) Week of 22 Oct (planned): - Work on PrivCount in Tor prototype: module design, merge privcount_shamir, stub other modules - Finish code review, small revision, and small ticket backlog - Make the fallback script ignore addresses in the whitelist, so we can rebuild the fallback list - Post-travel admin (awaiting timesheet advice from accounting) - Blog post on PrivCount research (awaiting notes from other researchers) Help with: - Hints for staying focused on big tasks. It helps if I work on big tasks first, then check email, IRC, and team rotations later in the day (or the next day). (Is it ok to not check email, IRC, and rotations for a day?) - Does anyone need help with 0.3.5 bugs? Are there critical bugs I could help fix? - If anyone wants to voice chat and work on a problem together, let me know. juga: Week of 10/15 (actual): - Use secs-away when provided instead of data_period (#28105) - Stop removing results that are not away from some other X secs (#28103) - what to do with small bandwidth files (#28042) - When sbws has measured less than 60% of relays, write a header with progress (#28076) - Publish bandwidth files only when they contain only the 60% of relays (#28062) - update bandwidth file specification - Make a policy for adding new sbws relay keys(#28099) - Update key/values in the bandwidth file spec (#28085) Week of 10/15 (planned): - what to do with small bandwidth files (#28042) - 2 new minor bugs in sbws - upload sbws deb release when stem deb release 1.7 - sbws 0.8.0 stretch-backports, when ^ - check torflow in shadow, worth implementing sbws in shadow? - write in human language about the current problem with bandwidth scaling - update bandwidth file specification Week of 22 Oct (planned): - sbws - get pull requests merged to master - check remaining tickets for sbws 1.0 and try to fix them all - bandwidth file specification - create pull requests with updates - core tor component with bwauth keyword - prioritize open tickets Help with: - teor: - #28042 (teor says: done!) - should we stablish 1h/week for bwauth reviews?, should we stablish a day of the week to do that? (to help you plan your time on bwauth reviews) - anyone: - should dirauth start taking results from sbws when we decide/fix #28042 (the dirauth/sbws is ready to do it) (teor says: yes, one dirauth is safe. Please open a task so we can track issues. Let's monitor network performance and consensus weight before and after. mikeperry, is there anything else we should watch?)

1 0

Notes from the Tor Browser meeting, Oct 22 2018
by Georg Koppen 23 Oct '18

23 Oct '18

Hi! We had another weekly Tor Browser meeting yesterday. For those interested in the chat backlog, see: http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-10-22-18.00.log… The items from our pad are: Discussion: - [tjr] TBB 8 Retrospective. Proposed Times: - Tuesday: 3 PM UTC - Thu/Fri 2:30 PM UTC - Either this week or next; same times. (GeKo: Next week Tue 3 PM UTC sounds good) - Ideally would like to get georg, boklm, arthur and anyone else interested tjr - Regrets for missing last weeks meeting and saying nothing - Tickets I think we can close: https://trac.torproject.org/projects/tor/ticket/13410 (Disable self-signed certificate warnings when visiting .onion sites) [GeKo: I don't think we tackled that issue] https://trac.torproject.org/projects/tor/ticket/22162 We did this, right? (Review speculative connections) [GeKo: I don't think we got to that yet] - I want to start filing sandbox tickets. - Specifically: If an attacker's goal is to identify a user outside Tor, by stealing a persistent identifier and causing a proxy bypass, and they can accomplish these goals inside the Content Process, I see no reason to spend efforts on sandboxing the parent first. (Excepting promoting architectural decisions that will make it easier to do the Parent later.) - So I want to file tickets about issues we need to fix in the content process to block the attacker. - First examples: PTCPSocket and PUDPSocket IPC methods look like they would allow this; although I haven't tested - Maybe landing fuzzyfox this week? - mingw-clang - Landed pdb support, and it works! symbolized stack traces, yay! - Got --enable-sandbox to compile with help from Martin - Working on why build doesn't run: https://bugzilla.mozilla.org/show_bug.cgi?id=1497895 - Also doing various build cleanup stuff: https://bugzilla.mozilla.org/show_bug.cgi?id=1500802 and children; https://bugzilla.mozilla.org/show_bug.cgi?id=1500102 mcs and brade: Last week - Finished #26263 (browser app icon positioned incorrectly in macOS DMG installer window). - With the same patch, we also fixed #25151 (Update Tor Browser branding on installation). - Helped with #28039 (Tor Browser log is not shown anymore in terminal since Tor Browser 8.5a2). - Reviewed the team roadmap, especially our tasks. Upcoming: - We will be on vacation Tuesday, October 23 - Wednesday, October 31. sysrqb: Last week: Reviewed #26690 (Padlock icon for TBA) Reviewed #27111 (about:tor for TBA) Began creating a patch for #24920 (TBA should only have Private Tabs) Continued Rust audit (#27616) Investigated #27431/#28125 (TBA DNS leak) S19 text This week: Create branch for patching #28125 (TBA DNS leak) Finish rust audit - #27616 At funder's meeting this week pili: Last week: Sponsor19 report brainstorming Tor Browser Release meeting This week: Looking to label tickets with Sponsors Evaluating best ways to track roadmap items, spreadsheet, other... Orfox issues - are we tracking all the relevant issues sent over by Fabiola from Guardian Project? How are they identified? [sysrqb: No, and unfortunately we're mostly ignoring Orfox currently. We should follow up on those issues and decide on a plan for Orfox] GeKo: Last week: -release prep -reviews -worked on #26475, Tor Browser design doc update (#25021), #28039, and #28075 -meetings and syncs -ticket triage (there is no Applications/Torbutton anymore, please use Applications/Tor Browser + keyword `tbb-torbutton, similar things will happen this week with Applications/Tor bundles/installation: it will DIE; please use Applications/Tor Browser + keyword `tbb-rbm` if really needed) This week: -release help -more work Tor Browser design doc update -die, Applications/Tor bundles/installation, die (#20648) -looking into singe-locale language repacks (#27466) -mail to Apple about their experiences with redirect isolation sisbell: Last week: - # 27441 Debian image to use stretch (ready to merge) - # 26696 Platform def in rbm,conf (ready to merge) - # 26976 hardening wrapper - closed (don’t need to fix) - # 26975 Mobile branding (fixed/closed) - # 26697 Android toolchain - removed gradle dependencies (now in Firefox project) - # 27443 Firefox for Android - applied boklm patch for a script to download and package artifacts This Week: - Investigate if patches (or parts of patches) needed with latest setup - Investigate if sdk 23 still needed with latest Firefox code [sysrqb: we should be targeting 26, so I don't think we need 23 for anything(?)] arthuredelstein: Last week: Patches for: #26498 (Fix bn-BD and es-AR locale for Tor Browser) #28082 (Add 4 more Tor Browser locales) #28111 (For about:tor, use a Tor Browser icon in identity box) #22343 (Save as... in the context menu results in using the catch-all circuit) #28093 (2018 Tor Browser Android donation banner) Worked on: https://bugzilla.mozilla.org/show_bug.cgi?id=1330467 (When "privacy.firstparty.isolate" is true, double-key permissions to origin + firstPartyDomain) S19 text This week: Keep trying to finish permissions FPI Help to look at redirect FPI approaches Help with TBA donation banner? (#28093) (GeKo: igt0 put this on his plate and is coordinating with antonela in case there are assets that need to get adapted) boklm: Last week: - helped with building the new releases - reviewed and tested patches for: - #21704 (Abort install if CPU is missing SSE2 support) - #26475 (ESR60-based Tor Browser bundles are not built reproducibly with Stylo enabled using rustc > 1.25.0) - reviewed patches for #26693 (Integrate Tor Browser for Android into tor-browser-build) - made patch for #27438 (Android Gradle Build Downloads) - started looking at #28117 (Some URLs can't be downloaded with LC_ALL=C) - worked on tor browser testsuite setup (#26149) This week: - help publish the new releases - enable running testsuite on nightly builds (#26149) - check if more updates are needed for #25030 pospeselr: Last week: - #3600 work (redirect cookies) - began work on design doc (turns out this is a really hard problem) - fixed a few bugs in tbblogger This week: - #finish design doc edits and post on storm - #3600 igt0: Last week: - #25013 (Sent a patch and tested on android and desktop with different locales) - Reviewed and tested #28104 This week: - More work on #25013 - Update #26690 (padlock icon for tba) - Update #27111 (about:tor button for tba) Georg

1 0