October 2018 - tor-project - lists.torproject.org

Notes from October 11 2018 Vegas team meeting
by Karsten Loesing 12 Oct '18

12 Oct '18

Notes for October 11 2018 meeting: Georg: 1) Anti-censorship team hiring plan/progress? Alison: 1) I think the meeting was awesome. Gus in particular did an incredible job getting lots of locals involved. I like the method of starting with a Tor training before the meeting. I have some ideas for how things could have gone better but overall I'm happy with it. Going to shoot out an email today or tomorrow for meeting feedback, with a reminder to people to put their notes on the wiki. I will also start a round of thank-yous to some locals, and try to do a debrief with the folks who were at the feminist meetup (which was amazing). Immediate feedback from this group? 2) Thoughts about the next Tor Meeting -- Stockholm doesn't seem to work for many people, other ideas given were Athens or Lisbon closer to our regular meeting time. I was thinking I'd make a survey after the meeting group gets back to me with possible costs etc. 3) Working on a Library Freedom website makeover and rebrand. 4) Finishing up LFI curriculum for the pilot, starting work on the next one. 5) Finishing up the community team roadmap. We have a lot of travel coming up. 6) Next week I'm starting to prep for LFI recruitment, which will begin in December or so. 7) Library Freedom starts the Glass Room Experience in North American libraries next week! Arturo: 1) We have released a beta of the OONI Probe desktop app for Windows and macOS: https://github.com/ooni/probe-desktop/releases/tag/v3.0.0-beta.1 2) We have released a beta of the OONI Probe CLI for macOS, windows and linux: https://github.com/ooni/probe-cli/releases/tag/v3.0.0-beta.1 3) The OONI meeting in Mexico went very well, we now have a tentative roadmap for the next 12 months 4) We have started collaborating closer with the Tor UX team, yay! 5) Working toward the upcoming OONI Probe mobile launch. 6) Updated test lists: https://github.com/citizenlab/test-lists/pull/398 & https://github.com/citizenlab/test-lists/pull/399 7) Submitted September report: https://lists.torproject.org/pipermail/tor-project/2018-October/002006.html Nick: 1) Back to software. Half my team is sick or taking a break, so stuff's a bit slow. 2) Talking at Berkman about decentralization this afternoon. 3) Discussions happening about gettor and who should own it. Sponsor19 timing leaves us in a weird place wrt coordination. Karsten: 1) Started working on 1 new graph and 2 updated graphs as a result of talking to people in Mexico City. 2) About to release CollecTor 1.8.0 with a couple smaller fixes, also in response to missing out server descriptor descriptors over the weekend. Sarah: 1) YE campaign planning. Today will add more ideas to the social media components. 2) Wrote a blog about my first Tor meeting. 3) Getting Al ramped up. 4) Still trying to work out best way to accept cryptocurrency. Roger: 1) Fosdem talk submission 2) Started the sponsor19 list and threads - i wonder if everybody with a task has confirmed seeing the mail? 3) Many anti-censorship dev applications still coming in 4) Should add new Penn funding to sponsors page. Anything else to add? Yes: Handshake. 5) We have another sysadmin interview right after this meeting Steph: 1) working with the berkeley group on our brand study. reviewing their survey and making sure they have relevant info 2) preparing for EOY fundraising campaign. taglines done, reviewing artwork 3) responding to inquiries 4) planning comms strategy for next year, met with Isa to discuss isabela: 1) organizing and having 1:1s with a lot of people (weekly) Gaba, Erin, Steph, Sarah, Pili, Sue 2) synced with all Fundraising/Grants working group (we will have a weekly sync to keep track of all fundraising and grants work) 3) finishing sponsor17 final reports 4) getting onion proposal updated with OTF feedback 5) Vegas team will get bigger soon :) 6) October is the last month of transition - will be in Seattle during the week of Nov 12 where we will finalize it Mike: 1) One of the outcomes of the research.torproject.org meeting was to create a public tor-researchers mailinglist, but with subscribe approval. Is this possible? Who do I ask? [yes it is possible, see https://trac.torproject.org/projects/tor/wiki/doc/emailLists#HowdoIaskforan… -RD]

1 0

September Fundraising Report
by sstevenson＠torproject.org 10 Oct '18

10 Oct '18

I hope everyone who was in Mexico has recovered from the various illnesses that seemed to affect many of us! Here is what was up in Tor Fundraising World in September: Began sketching out the year-end giving campaign that will have the theme, “Strength in Numbers.” The campaign launches October 23rd and will feature a match from Mozilla and additional match opportunities from another donor. Helped get the newsletter banner up in Tor Browser. So far this effort has resulted in significant email list growth. It is currently up to 12,454 names when on 9/6, it had 7,840. Wrote to donors who had not given in several years about Tor Browser 8 and Tor for Android and asked them to consider giving again. Several donated - even up to $1,000 - after not giving since 2015. Sorted through the status of all current grants with the team in Seattle and made a grant roadmap covering the next few months. Researched possible private foundation funding that can be pursued at the beginning of next year. Began working with a consultant to ensure Tor is registered for fundraising in all states. The process is on hold until the 990 is complete. Began updating Tor’s Guidestar profile. Met in person with one of our grant managers. Worked with OONI on a proposal that will now be included as part of a larger anti-censorship proposal that is due in early November. Welcomed Al whose first day at Tor was in Mexico City! I hope you will all help with the year-end campaign by sharing messages on social media and talking with your networks about the amazing work being done at Tor. Sarah Sarah Stevenson Fundraising Director The Tor Project sstevenson(a)torproject.org Public Key: 93B3 AC08 4257 FA3D D4BB 8E95 CC08 5DBA C015 612A

1 0

OONI Monthly Report: September 2018
by Maria Xynou 10 Oct '18

10 Oct '18

Hello Tor world, In September 2018, the OONI team released a beta of the OONI Probe desktop apps for Windows and macOS, established a new partnership with Paraguay's TEDIC and updated a number of test lists. ## Beta of OONI Probe desktop app We have released a beta of the OONI Probe desktop apps for Windows and macOS: https://github.com/ooni/probe-desktop/releases/tag/v3.0.0-beta.1 The aim of this beta release is mostly to sort out stability issues related with shipping measurement-kit and the new OONI Probe CLI on macOS and Linux. We are therefore currently limiting the testing to more tech-savvy users. As the UI of the desktop app has yet to be finalized, the most useful feedback currently pertains to the functionality of the app and any bugs (rather than the UI). That said, the application is feature complete and supports the same functionality shipped as part of the mobile apps. Namely it supports: * Running the websites, instant messagging, middleboxes and performance tests * Viewing the test results for all the above tests * An onboarding wizard with our informed consent procedure * Changing some of the most basic app settings Help in testing the apps is greatly appreciated! If you run into any issues, please report them to bugs(a)openobservatory.org. You should also use the "Hard reset" button in the About of the app before installing the stable version of the app. If you run into any issues, that button may be a viable workaround (note: it will delete all your measurements and settings). ## Established new partnership We are excited to have formally established a new partnership with Paraguay's TEDIC! As part of our new partnership, we aim to collaborate on the study of internet censorship in Paraguay through the collection and analysis of OONI Probe network measurements. Social media announcement: https://twitter.com/OpenObservatory/status/1042760192197373952 ## Updated test lists We carried out research to update the following test lists: 1. Nigeria: https://github.com/citizenlab/test-lists/pull/387 2. Jordan: https://github.com/citizenlab/test-lists/pull/388 3. Argentina: https://github.com/citizenlab/test-lists/pull/390 4. Colombia: https://github.com/citizenlab/test-lists/pull/393 In previous months, we also updated the South Sudan test list: https://github.com/citizenlab/test-lists/pull/366 We also updated the Ugandan and global test lists (https://github.com/citizenlab/test-lists/pull/391) and created new test lists for Cameroon (https://github.com/citizenlab/test-lists/pull/392) and Greece (https://github.com/citizenlab/test-lists/pull/394) ## Community use of OONI data ### Berkman report on Telegram blocking in Iran The Berkman Centre for Internet and Society published a research report examining the blocking of Telegram in Iran: https://thenetmonitor.org/bulletins/censorship-and-collateral-damage-analyz… OONI data on the blocking of Telegram was used as part of this research. ### Digital Security Lab Ukraine reports Through the use of OONI Probe, Digital Security Lab Ukraine has been investigating internet censorship in occupied territories of Ukraine. In September 2018, they published two research reports based on OONI data: 1. Blocking of websites in Crimea (that aren't included in the Russian blocklist): https://medium.com/@cyberlabukraine/crimea-has-a-website-ban-list-additiona… Digital Security Lab Ukraine uncovered the blocking of at least eight Ukrainian websites in Crimea that aren't included in Russia's official blocklist. This research was covered by RosKomSvoboda (a public organization aimed at countering internet censorship): https://roskomsvoboda.org/41726/ 2. Blocking of at least 56 Ukrainian websites in Luhansk: https://medium.com/@cyberlabukraine/at-least-56-ukrainian-websites-are-bloc… Digital Security Lab Ukraine uncovered the blocking of at least 56 Ukrainian websites in Luhansk, many of which include media websites and human rights sites. It's worth noting though that they did not find evidence of internet censorship in Donetsk. ## Community activities ### Community meeting We held a community meeting on Slack (https://slack.openobservatory.org/) on Tuesday, 25th September 2018. As part of our September community meeting, we discussed updating test lists and digging through OONI data. ### OONI presentation at CryptoInstallFest OONI's Leonid gave a presentation in Moscow at CryptoInstallFest on his findings regarding recent internet censorship events in Russia. * Slides: https://slides.ooni.io/2018/CIF * Summary of new findings: https://usher2.club/articles/mt-free-pre-block/ * Information about the event: https://cryptofest.ru/agenda Relevant media coverage: * (en) https://en.crimerussia.com/gromkie-dela/wi-fi-in-moscow-underground-used-fo… * https://www.the-village.ru/village/city/news-city/326087-maxima-vs-telegram * https://www.the-village.ru/village/city/news-city/326091-maxima-vs-telegram… * https://roem.ru/28-09-2018/273997/fil-kulin-opisal-mehanizm-dobavleniya-v-n… * https://tjournal.ru/77024-ekspert-maksimatelekom-pomogaet-roskomnadzoru-blo… ### Tor Meeting & OONI Team Meeting The OONI team traveled to Mexico City to participate in the bi-annual Tor Meeting between 29th September 2018 to 3rd October 2018: https://trac.torproject.org/projects/tor/wiki/org/meetings/2018MexicoCity As part of the invite-only days of the Tor Meeting, OONI facilitated the following sessions: * Censorship Rapid Response: Brainstorming on collaboration between OONI and Tor and determining next steps * Future and next steps for BridgeDB * OONI data format pain management * Tor anti-censorship strategy brainstorming and next steps As part of the public days, we facilitated an OONI session that aimed to introduce locals to OONI Probe and engage them with censorship measurement research. We also had a UX review of the revamped OONI Probe for Android mockups with the Tor UX Team, where we gathered valuable feedback. You can see the mockups here: http://design.ooni.io/mockups/probe-android Following the Tor Meeting, the OONI team hosted its internal team meeting in Mexico City on 4th & 5th October 2018. As part of our 2-day internal meeting, we had the following sessions: * Roadmap for the next 12 months (with more detailed roadmapping for the next 6 months) * Revamping OONI Probe mobile apps: Determining next steps towards stable release * Revamping OONI Explorer: Detailed roadmap & discussion of issues and next steps * OONI Probe desktop apps: Next steps * Brainstorming on new nettests * Probe Orchestration: Next Steps * OONI Partnership Program & community needs * Improving OONI Run & enabling automatic daily testing (until probe orchestration is rolled out) * Measurement-Kit: Future directions * Brainstorming on automating test list methodologies * Fundraising ## Userbase In September 2018, OONI Probe was run 257,139 times from 4,661 different vantage points in 211 countries around the world. This information can also be found through our stats: https://api.ooni.io/stats ~ The OONI team. -- Maria Xynou Research & Partnerships Director Open Observatory of Network Interference (OONI) https://ooni.torproject.org/ PGP Key Fingerprint: 2DC8 AFB6 CA11 B552 1081 FBDE 2131 B3BE 70CA 417E

1 0

Network team meeting notes, 9 Oct 2018
by Nick Mathewson 09 Oct '18

09 Oct '18

Hi, all! We had our meeting today. The logs and decisions are at http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-10-09-16.59.html . Below are the contents of our meeting pad... = Network team meeting pad! = Welcome to our meeting! Mondays at 1700 UTC on #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! Note the meeting location: #tor-meeting on OFTC! (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) After each week's meetings, the contents of this pad will be sent to tor-project @ lists.torproject.org. After that is done, the pad can be used for the next week. == Previous notes == (Search the list archive for older notes.) 4 Sep: https://lists.torproject.org/pipermail/tor-project/2018-September/001965.ht… 10 Sep: https://lists.torproject.org/pipermail/tor-project/2018-September/001972.ht… 17 Sep: https://lists.torproject.org/pipermail/tor-project/2018-September/001982.ht… 24 Sep: https://lists.torproject.org/pipermail/tor-project/2018-September/001996.ht… 1 Oct: No online meeting; in-person meeting in Mexico City. == Stuff to do every week = * Let's check and update the roadmap. What's done, and what's coming up? url to roadmap: https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Check reviewer assignments at https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Also, let's check for things we need update on our spreadsheet! Are there important documents we should link to? Things we should archive? * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… * Community guides, it's time to hand off to the next guide! * Let's look at proposed tickets! [but see discussion] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… == Reminders == *ok, Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next releases ------------------------------- ---- 9 October 2018 ------------------------------- == Announcements == Tor 0.3.2 is now unsupported. https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… Tor Calendar: we have a shiny new one for adding time off https://storm.torproject.org/grain/H6dQejgGAizq6MYMawwPzq/ Tor employees, please do timesheets each week, or in the worst case by the end of the month. The new schema (all network team work goes in "Network Team") should make this much faster. == Discussion == * We must assign bug and CI tickets in 0.3.5; they should get fixed ASAP. - nickm * What do we need to do to "finish up" our roadmap? I know it's a living document, but how far are we from something we can work from? -nickm Reminder for this discussion: sponsor 8 issues are priority as it is finishing at the end of the year -gaba There are a few things in the UX roadmap related to network team. Let's check that we have it on our roadmap -gaba (https://storm.torproject.org/grain/2uvMtMh7xKDubdC5np68tN/) * Finish & validate new "minimal rotations" plan from meeting? (Idea was to define minimial versions of each rotation, and possibly drop the ones that don't actually make sense) -nickm Plan and comments: https://pad.riseup.net/p/team_rotation * Reminder: Capacity estimation: adding actual points in the big beautiful spreadsheet from the roadmap -gaba * Proposal to change the meeting only once every 4 weeks to a time that teor can attend. Patch party time? -gaba == Recommended links == Have a look at Catherine West's rustconf 2018 closing keynote. Lots of neat architectural thinking. https://kyren.github.io/2018/09/14/rustconf-talk.html == Updates == NOTE NEW FORMAT! Name: Week of XYZ (planned): - Leave blank for now, since we didn't make plans for last week Week of XYZ (actual): - What you did last week Week of ABC (planned): - What you're planning to do this week. Mike (sick, may not be online during meeting): Week of 10/1 (actual): - OMG so many meetings Week of 10/8 (planned): - OMG so much followup - Create tor-researchers list - Figure out Mozilla all Hands - wtf-pad mails Nick: Week of 10/1 (actual): - Wrap up meeting stuff, take a couple of days mostly-off Week of 10/8 (planned): - Talking about decentralization at Berkman on Thursday - Post-process meeeting notes into a usable form - Work with gaba et al to finalize roadmap - Review and merge - Work on continuous integration issues - Find a better solution on #27971 (having to force security level 1 for TLS backward compat) - Try to fix bugs in 0.3.5 - Finish whitepaper? - Work on sketch for subsystem API - Work on sketch for communication API ahf: Week of 10/1 (actual): - Tor meeting. - Wrote a scraper for Trac in Python, so we might be able to move on with some of the ideas that came up in our CI session! Needs some cleanup though. Week of 10/8 (planned): Sponsor 8: - Figure out which tasks I'm on from the roadmap session and begin there. Sponsor 19: - Work on PT document for Kat. Misc: - Backlog of Trac + IRC + Mail - Look into sysadmin candidate + participate in interviews. - Catch up on hiring process for anti-censorship team role. - Go over my meeting notes from the Tor meeting to see if we need to fill out any tickets. asn: [will be on a flight back to gr during meeting): Week of 10/1 (actual): - Tor meeting. - Mike I pushed a branch with the WTF code reading we did together `adaptive_padding_comments`. Week of 10/8 (planned): - Catch up with intense amounts of email, backlogs and minor tasks that have accumulated during the meeting. - Do a presentation on "state of Tor" in FOSSCOMM (the Greek open source conference) on Saturday. - Maybe try to read some more WTF-PAD code if I get the time. dgoulet: Week of 10/1 (actual): - A bit uneventful. Few tickets reviewed and a little bit of triage. - Followed the meeting as much as I could using the Wiki notes, some IRC insights and emails. Week of 10/8 (planned): - Write Sponsor19 report. - Figure out where I am in the Roadmap and start on that. - Prioritizing 035 tickets before merge window opens next week. gaba: Week of 10/1 (actual) - Tor meeting Week of 10/8 (planned): - roadmap - cleaning on notes - schedule 1 on 1s catalyst (sick, might be offline for actual meeting): week of 10/1 (2018-W40) (actual): - Mexico City and all the meetings week of 10/8 (2018-W41) (planned): - update existing Mexico City session notes from my handwritten notes - travel accounting - reviews - talk more about hiring process stuff with ahf and komlo? - design meetings rotation

1 0

September 2018 report for the Tor Browser team
by Georg Koppen 09 Oct '18

09 Oct '18

Hi! September was the month of the releases for the Tor Browser team. As said in our previous monthly report we got our Tor Browser 8.0[1], Tor Browser 8.5a1[2], and Tor Browser for Android 1.0a1[3] out. However, then we needed to pick up 2 security releases done by Mozilla which resulted in Tor Browser 8.0.1[4], Tor Browser 8.0.2[5], Tor Browser 8.5a2[6], and Tor Browser 8.5a3[7]. Apart from closing security holes in Firefox, with the release of Tor Browser 8.0.1 and 8.5a2 we took the opportunity to fix the most pressing issues encountered during our Tor Browser 8.0 rollout. Those included a crash during start-up on older macOS systems (10.9.x)[8] and a suboptimal solution to our user agent treatment[9]. Remaining issues are still tracked with the `tbb-8.0-issues` keyword.[10] Tor Browser 8.0.2 and 8.5a3 only closed Firefox security holes.[11] This was the first time we needed to do security releases during a dev meeting which was... exciting. Many thanks to boklm who did the heavy-lifting here. Besides working on those releases we nailed down our future plans towards a stable Tor Browser for Android[12], prepared our dev meeting and met face to face in Mexico. The full list of tickets closed by the Tor Browser team in September is accessible using the `TorBrowserTeam201809` keyword in our bug tracker.[13] For October we plan to finish our roadmap for the coming 6 months[14] and try to make solid progress towards our second alpha release for Tor Browser for Android, which is plan in early November. At the end of October another round of desktop releases is planned to pick up the latest batch of Firefox security patches and more fixes for Tor Browser 8 related issues. All tickets on our radar for this month can be seen with the `TorBrowserTeam201810` keyword in our bug tracker.[15] Georg [1] https://blog.torproject.org/new-release-tor-browser-80 [2] https://blog.torproject.org/new-release-tor-browser-85a1 [3] https://blog.torproject.org/new-alpha-release-tor-browser-android [4] https://blog.torproject.org/new-release-tor-browser-801 [5] https://blog.torproject.org/new-release-tor-browser-802 [6] https://blog.torproject.org/new-release-tor-browser-85a2 [7] https://blog.torproject.org/new-release-tor-browser-85a3 [8] https://trac.torproject.org/projects/tor/ticket/27482 [9] https://trac.torproject.org/projects/tor/ticket/26146 [10] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… [11] https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/ [12] https://lists.torproject.org/pipermail/tbb-dev/2018-September/000910.html [13] https://trac.torproject.org/projects/tor/query?status=closed&keywords=~TorB… [14] https://lists.torproject.org/pipermail/tbb-dev/2018-October/000916.html [15] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig…

1 0

Tor Browser team meeting notes, 8 Oct 2018
by Georg Koppen 09 Oct '18

09 Oct '18

Hi all! We had our first weekly Tor Browser meeting in October yesterday and here are, as usual, the link to the the IRC meeting log: http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-10-08-18.01.log… and to our meeting notes on the pad: Discussion: -Roadmap (https://pad.riseup.net/p/tbb-roadmap-2018-19) -Timesheets! (GeKo: they need to be submitted by 7th the following month and approved by 10th the following month) -status updates redux (GeKo: If you work, then please put a status update to #tor-dev, so we all keep in sync over the week) -team rotations (see: https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… for what the network team has) (GeKo: We'll start with more build duty rotations and think about other areas where the rotation idea might be useful) - tjr: should i cancel the monthly mozilla sync tomorrow? Leaning strongly towards yes. (GeKo: Yes, this got cancelled) GeKo: Last week: -dev meeting -secruity releases preparation (much thanks to boklm for doing the heavy-lifting!) This week: -esr60 wrap-up -catching up on reviews -work on design doc (#25021) and release doc update (#25030) -finalizing the roadmap -getting back to staring at our reproducible build issues with rust (#26475) -start looking into single-locale repacks (#27466) -tjr: when would be a good time to chat about the tb8 retrospective with focus on mozilla stuff? - [tjr] Did Ethan & co indicate they wanted to be there? 15:00 UTC is our usual meeting time for Europe+West Coast... -mcs/brade: do we still need to do #27239 or are we done with the feedback for the network team? Response from mcs: We recently commented in #27691 (a child ticket). There are a lot of tickets though, so we should take another look and give feedback to the network team. We may need to ask catalyst for a summary of how clients like Tor Launcher will be affected. mcs and brade: Since our last meeting: - Attended face-to-face meeting in Mexico City. - Helped with triage of new tickets. - Completed some code reviews. - Tested Tor Browser 8.0 to 8.0.1 updates. - Created a patch for #27623 (wrong default pref values in Tor Browser 8.0). - Helped with regression #27865 (Tor Browser 8.5a2 is crashing on Windows). - Created a patch for #27905 (many occurrences of "Firefox" in about:preferences). - Investigated #27828 ("Check for Tor Browser update" doesn't seem to do anything). - Completed end-of-month administrative things. This week: - Finish post-travel paperwork. - #27828 ("Check for Tor Browser update" doesn't seem to do anything). igt0: Last week: - Attended the f2f Tor meeting - decompressing from the meeting. (take a look in the notes, double check the roadmap and so on) This week: - #25013 (Move TorButton code to the tor browser repository) - Write proposal for tor button for android. boklm: Last week: - attending Mexico meeting - releasing security releases This week: - work on torbrowser testsuite - try to make rebundling faster by generating multiple bundles in parrallel (#27218) - some reviews sisbell: Last week: - Generated tarball of android dependencies - android-toolchain work and testing: #26697 #27439 This Week: - #27440 LLVM Support (fix regression) - #27443 - Firefox: this requires some amount of rework to align with changes in android-toolchain. pospeselr: Last week: - mexico city - fixed dev pc - cleaned up logger built to debug #26381 (sandbox race condition on windows) This week - ping ethan on #3600 - #3600 work (disable cookies being passed through on redirects) - [tjr] any chance you could summarize what the plan is for this? [pospeselr] yes - last week, was getting up to speed on the redirect cookie problem ( https://developer.mozilla.org/en-US/docs/Web/HTTP/Redirections seems like a good place to start here for reference) - it looks like there are three classes we need to worry about: HTTP redirects (302 and friends), JS redirects (window.location), and HTML redirects (http-equiv="refresh" meta tag) - initial plan is to prototype/hack a solution for HTTP redirects, see what breaks (and build test page for each) - [tjr] When you say " just disable the cookie redirect via a pref"... what do you mean? - rather than just blanket disabling cookie forwarding on redirect, only do so when a pref is enabled to improve chance the patch can get uplifted - [tjr] I still don't understand. You're on a.com. You click a link to b.com (which sends cookies for b.com). You receive a redirect to c.com. You're saying "We won't send cookies for c.com"? - [pospeselr] that sounds about right, unless I'm misunderstanding the ticket - [tjr] I don't think this is helpful. The cookies for b.com have already been sent to b.com. There's a very limited benefit here... I think a design document would be helpful; but it's up to you =) - [pospeselr] the discussion can be found here: https://trac.torproject.org/projects/tor/ticket/3600 Not my area of expertise so if there's obvious holes here I'm all ears. Seems like concern of affiliated websites cookies being used to auto-log you in (ie when traversing various google properties) - putting logger up on github w/ patch that can be directly applied to firefox for that logging goodness tjr - Close to landing a mingw-clang x86 job - Close to landing pdb support for mingw-clang - Worked on mingw-gcc jemalloc a bunch. No conclusions. Next step is to compile esr60 with mingw-clang and see how that looks.... - Worked on the mozilla-release issue with sukhe a bit. Couldn't build tb-alpha. This is really confusing. I wonder which will get done first: mingw-clang or this.... pili - How do we decide when/whether to incorporate user feedback into Tor Browser releases? (GeKo: There are no strict rules that govern this so far: it depends on how many users are affected by an issue, what else we have to do etc.) arthuredelstein: Last week: - Finished at Mexico meeting - Took a day off - Worked on https://bugzilla.mozilla.org/show_bug.cgi?id=1330467 (FPI permissions) - Patch for https://trac.torproject.org/27959 (2018 Tor Browser donation text) This week: - Try to finish FPI permissions - Look at tbb/8 issues, including https://trac.torproject.org/projects/tor/ticket/27290 - Work on donation banner code when ready - Optimistics SOCKS if time Georg

1 0

Tigas' CDMX Meeting / Onion Browser report
by Mike Tigas 09 Oct '18

09 Oct '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi y’all! I was asked to write up some notes on the CDMX Meeting for tor-mobile folks; figured the report might be useful to my fellow onionfolk in the way that other reports are on this list. Anyway, some updates on Onion Browser-ish things, with a focus on the Tor meeting (mostly just summarizing some notes I took and TODOs I made): * From before the meeting: A few weeks ago I finally posted to my Patreon after like, a year of silence? Something like that. There’s plenty of updates on the past year of work in there.[1] * I provided an update on installs/usage: Onion Browser crossed 1 million downloads at some point in April. There are about 1,700 app sessions per day (which only counts users who’ve opted in to analytics and sharing that data with app developers[2], so it’s a very low-ball count). * Folks are seeing a lot of fake “Tor” or “Onion Browser” apps in the Apple App Store or the Google Play Store. In the past we’ve submitted requests to Apple about apps using the Tor branding or the Onion Browser name. (Technically trademark is the only thing we have to act on, since our permissive OSS licenses allow redistribution as long as the correct license bits are written down in there.) Someone said we should maybe have something (in the wiki?) about what to do if you find someone else’s app pretending to be official Tor/Onion Browser/Orbot/etc -- like who to notify here, and what steps & language we use when submitting the request to the app stores. * I learned from Nick that as of 0.3.4.X, “DisableNetwork 1” now also disables unnecessary CPU wakeups (basically things only needed when Tor is connected) -- this might help with some of the stability issues that happen when the device sleeps (since I do set DisableNetwork when that event is triggered). * There’s (possible?) new funding from Guardian Project that will hopefully jump-start more work on Onion Browser again soon. Had a great conversation with Fabby who works with Guardian Project; looking forward to putting a roadmap together when I have some spare cycles again. (I’ll probably have more time to have those conversations in earnest after the US election.) * Started working on an update to Tor.framework (the little-t tor integrating bits that build into Onion Browser) to update the Tor in it. (It’s currently stuck on 0.3.3.x right now.) I’m like 99% sure the current issues are due to cleanup and refactoring in tor (like some of the work towards making it usable as a library). Couldn’t work on it in CDMX because I didn’t bring a Mac with Xcode on it, but I’ve been tinkering around with it since I got back.[3][4] Hopefully more on that soon. * Not exclusively Onion Browser related, but since I also do operate a few .onions, I was around a lot of conversations about .onion usability (esp with long v3 ones) and things like HTTPS Everywhere and alt-svc headers as solutions. I’d love to get some work in on alt-svc in Onion Browser[5], and maybe experiment with some explicit user consent like in [6]. Hand-in-hand with that, it could be cool to implement some built in list of well-known and well-attested clearnet -> onion site mappings in the app (going along with the HTTPS Everywhere ruleset in the app). [1]: https://www.patreon.com/posts/lots-of-long-21317240 [2]: https://support.apple.com/en-us/HT202100 [3]: https://github.com/iCepa/Tor.framework/compare/master...mtigas:tor_0_3_5_2-… [4]: https://github.com/OnionBrowser/OnionBrowser/commit/90dc95f11c2949d7114bc1f… [5]: https://github.com/OnionBrowser/OnionBrowser/issues/148 [6]: https://trac.torproject.org/projects/tor/attachment/ticket/21952/21952.png Cheers, Mike Tigas https://mike.tig.as/ | @mtigas 0xDFD760C4 | 0x6E0E9923 -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEGzfVMu3Uhpsce8OaFLh4upXaaEoFAlu765oACgkQFLh4upXa aEprCA/9EtaMTvV0OI46d9XrWHl3OXYQZxPE4XtG9tbXs0oB7fL9cUEJTRbdjSQE kBHHQ7gmJKGvoaBrNtjmRhc87QMQwhPC0vofMSWiXuZI41QKPE2GN+iVRMobHYaL qAJMtzzbu8SZrUtN9vkdxkgpPxuGhxdmvArlGsYhVXSgptcevSeqPAdDtbxAOTto 7jJ8GbK754wpnGRQA3BzkBO8gAiFSAyriMSODfcFIlsINf0ZP+FWzflgwzTh5HwJ 8cZ002CiHuXq+iqxJiRkbkLHI4ogipmKDDestQk5qX2XUPka/qe0qajmR1kaRzXx iqEbay+uicztULPC0R/X1sXPIlljx5UQWhJhWbOFRpz1V92oTq+qSvI5nL+52mw4 5otg5D3I8iIeHlla+iUKlS58dzkuSVSjKWbxUTQY03GGy1q2WYjZywmbwPFbUePA /AhzYs5Hhw1bSt3FL3B/aWsnifQjYpz2HoO2pogLkdYDkB3iDaVix7G2Wyg4Q/7q I2bbxak5Z3BiYYKmOA4y9m6fozxj4AmfaNTPMesad56uw3L7JdHslsBohCgEiitB rbC+tJOw+hH+mYf4vh66/qt9XOP/p3F3pj4i8SgJE0WeWXAIlESScsjKHw4JyNkm VLOtVrXNkN32sY0bsirhD/rrQPxiVogPbSTX80t62vP61BpzElqItwQBEwoAHRYh BOk8LVk3LzcQmzAuvZFvvD/f12DEBQJbu+ubAAoJEJFvvD/f12DEZkICCOB6XMFS RlQ0x16PkNoYJzZdetjiT8SkNTmnx5T1bk5mUjoJ0FAR7kOjl6T+bYLPzNcosya2 5sCpCDBiLO8x8TrlAgUXvpXo+uckSTIKGgU2b0fvGd4ZjtRuf2a42y29TPtjd/ZZ 0fpyI9vffzDg8hI7kBnLeKiHqxTrNnhS0BwtMHSmdg== =q/Ny -----END PGP SIGNATURE-----

1 0

Stem Release 1.7
by Damian Johnson 08 Oct '18

08 Oct '18

Hi all, I'm delighted to announce the release of Stem 1.7! https://blog.atagar.com/stem-release-1-7/ This is a full year’s accumulation of fixes and improvements. For a list of everything that's changed please see... https://stem.torproject.org/change_log.html#version-1-7 Cheers! -Damian

1 0

Tor user feedback update - September 2018
by Andie Eoch 03 Oct '18

03 Oct '18

Hey all! Welcome to September's user feedback update! First, I'd like to introduce myself - my name is Maggie, and I'm the new user advocate! Please don't hesitate to contact me with questions, suggestions, concerns, or your highest quality gifs. You can find me as wayward on IRC, as @meochaidha on twitter, or through email at waywardwyrd at protonmail dot com. I've started a new sheet to track user feedback and bug reports for the next months. Data from this month was gathered from comments on the Tor blog, r/TOR [1], IRC, and stackexchange. You can find the user feedback sheet below [2]. If you have any suggestions for new fields in this doc, or for other info to include in these monthly summaries, please let me know! TL;DR: Overall, it looks like the team did a really stellar job of tackling issues that popped up after the TB 8.0 release. We still have room for improvement in terms of new user education, accessibility, and advocacy. ---- Most popular tags on StackExchange: - tor-browser-bundle: 5 this week, 26 this month - configuration: 12 this month - security: 9 this month - windows: 10 this month - linux: 8 this month - hidden-services: 6 this month - anonymity: 6 this month - bridge: 5 this month -- The biggest issues of September have been: - crashes on OSX after updating to TB 8.0.1+ (#27482) [3] - RESOLVED - crashes with various linux distros: ------ older Ubuntu/Mint distros (#27508) [4] - OPEN ------ CentOS 6 (#27552) [5] - RESOLVED - dissatisfaction with the changes to user agent spoofing (#26146) [6] - RESOLVED - issues with UI after updating to TB 8.0, including missing bookmark bar (#27264) [7] and Tor icon (#27175) [8]; both RESOLVED - NoScript is not saving per-site permissions (#27175) [9] - RESOLVED - users are confused by the change to the location of circuit information - some users think it was removed (#27663) [10] - MODIFIED - disabling accessibility on Windows breaks screenreaders (#27503) [11]. High priority - OPEN- Tor 0.3.4.8 is leaking memory (#27813) [12] - OPEN (you can find a more complete list of TB8-related tickets below, as well! [13]) -- Common questions from users this month (many answered on FAQ, links in annotations): - What is Tor [14], and why should I use it? - Does using a VPN with Tor improve or harm privacy [15]? - How can I use Tor on my iPad? [16] - Do I need to use Tor for regular browsing; or, when is it appropriate to use Tor? - Why is my relay using less bandwidth now that it received a guard flag [17]? - My school blocked the Tor executable - how do I access Tor now? - Does using a Firefox theme (night mode, etc.) with the Tor browser de-anonymize me? - There's a lot of general confusion when things break (expectedly) in the higher security slider settings - perhaps we should consider how to make the effects of security levels clearer, or adding an FAQ entry? -- Thanks, team! Come find me and say hi if you're at the Mexico City meeting this week, and give me all the feedback you have [18]! ---- /annotations/ 1. what do they think this is, an ACRONYM or something ? ? ? ? ? 2. https://storm.torproject.org/shared/mPq1dBuXpcPIk1W5QUI883VHHKpkgR65Z6RIJmG… 3. https://trac.torproject.org/projects/tor/ticket/27482 4. https://trac.torproject.org/projects/tor/ticket/27508 5. https://trac.torproject.org/projects/tor/ticket/27552 6. https://trac.torproject.org/projects/tor/ticket/26146 7. https://trac.torproject.org/projects/tor/ticket/27264 8. https://trac.torproject.org/projects/tor/ticket/27175 9. https://trac.torproject.org/projects/tor/ticket/27175 10. https://trac.torproject.org/projects/tor/ticket/27663 11. https://trac.torproject.org/projects/tor/ticket/27503 12. https://trac.torproject.org/projects/tor/ticket/27813 13. [https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~tbb… 14. https://www.torproject.org/docs/faq.html.en#WhatIsTor 15. https://www.torproject.org/docs/faq.html.en#IsTorLikeAVPN 16. https://www.torproject.org/docs/faq.html.en#Mobile 17. https://www.torproject.org/docs/faq.html.en#MyRelayRecentlyGotTheGuardFlagA… 18. https://imgur.com/a/Vr7gf0X ---- Maggie Tor Project Community Team pronouns: she/they | twitter: [@meochaidha](https://www.twitter.com/meochaidha) pgp: 0626 9C68 D0CC 1A5B E41B 72F2 615E B878 975C 4CDC

1 0

Key Signing Party! send your key DEADLINE Sept 29th
by emma peel 01 Oct '18

01 Oct '18

Hello people! So, I will be hosting a Key Signing party in Mexico during the Tor Meeting. Key signing parties should be called certificate verification parties but we are conditioned by the interface, so we call it key signing. Please send me your key on a signed email (unless is another kind of key...), even if it is already in db.torproject.org. before Sept. 29th. ------------------- DEADLINE Sept 29th. ------------------- You also need to be present on the party to get signatures... Lets verify and kill the MitM! ------------------------------------------------------------------ INSTRUCTIONS ------------------------------------------------------------------ Please don't participate of the party if you don't want public signatures... it creates overhead and its very likely that somebody will upload your key to the server with a new signature! Make sure you have a 4096 bit RSA key. If not, generate a new one: http://ekaia.org/blog/2009/05/10/creating-new-gpgkey/ Make sure you follow the OpenPGP Best Practices: https://riseup.net/en/security/message-security/openpgp/best-practices You can get your key on a file called mynickname.asc by doing: gpg --export --armor [your fingerprint] mynickname.asc You can also use this opportunity to add your OTR fingerprints, or other services you may want to certify for the people attending. For the OTR fingerprint, depending on your client: Pidgin: https://otr.cypherpunks.ca/help/fingerprint.php Adium: https://adium.im/help/pgs/AdvancedFeatures-OTREncryption.html BitlBee: otr info irssi: /otr info At the meeting: verify ====================== 0. don't sign anything! 1. i will send the final file the day before, through the list 2. you can come with your laptop, or with a printed version of the file. 3. if you print the file, write the output of this command on the paper: gpg --print-md sha256 fingerprint-verification-unverified.txt 4. read out the checksum and make sure everyone has the same file 5. create a copy of the file to make notes: % cp fingerprint-verification-unverified.txt fingerprint-verification-annotated.txt 6. everyone (silently): verify your fingerprint(s) and user ID(s) in the document are correct 7. everyone (publically): identify yourself and verify that the fingerprint(s) and user ID(s) are correct 8. everyone: fill in the checkboxes in fingerprint-verification-annotated.txt: Fingerprint OK, ID OK 9. when done, sign the document: gpg --detach-sign fingerprint-verification-annotated.txt 10. at home, sign the keys.

3 3