July 2018 - tor-project - lists.torproject.org

Tor Browser team meeting notes, 23 July 2018
by Georg Koppen 24 Jul '18

24 Jul '18

Hello! Below are the notes from our latest Tor Browser meeting. As usual the IRC log can be found at meetbot.debian.org: http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-07-23-17.59.log… The notes from our pad are: Tor Browser Meeting Notes Monday July 23, 2018 Discussion: -I [tjr] read through the Hacking document. Had a few observations: "For historical reasons, Tor Browser tickets are spread across several Trac components: "Tor bundles/installation", "TorBrowserButton", "Firefox Patch Issues", and "Tor Launcher". We are considering consolidating many of these components and switching to keywords instead, but that hasn't happened yet." I don't think this is still true? https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Hacking#Howweu… Maybe we could move Orfox/Orbot to another page? [GeKo: I'll open a ticket for restructuring the Hacking document] when a new nightly build is available on https://people.torproject.org/~linus/builds/. <- I don't think this is active anymore? [boklm: ah yes, this part of the page (about QA and Testing) needs some updates][GeKo: I'll open a ticket for this item] -How do we want to use Github (if at all)? [GeKo: I'll think a bit more about it and then wil write a mail later this week as reply to Isa getting the discussion started on the mailing list taking into account what we discussed during the meeting] -Moving away from storm to some etherpad for meeting notes? [GeKo: We'll decide that next week when Arthur is back] - Sandboxing meeting: what should we prepare? Any agenda? (Did I miss it?) mcs and brade: Last week: - Finished reviewing undocumented bugs since FF52esr for #22074. - Debugged and created a workaround for #26514 (intermittent updater failures on Win64 (Error 19)). - Tried to test Snowflake on macOS 10.9 for #26251 (Adapt macOS snowflake compilation). - Got sidelined due to #26876 (tor.real fails to start on macOS 10.9). - Helped with triage of incoming tickets. - Reviewed a couple of patches: - #26603 (remove obsolete HTTP pipelining prefs) - #26353 (First request goes over catch-all circuit) This week: - Prepare for and attend sandboxing futures meeting. - Start on #25695: Activity 5.1: Redesign Tor Browser homepage ("about:tor") - Review our notes from #22074 (undocumented bugs since FF52esr) and file additional tickets if necessary. - Get back to #26381 (about:tor page does not load on first start in localized Windows bundle) - After the Tor Browser nightly builds include the network team's fix for #26876, do some testing for #26251 (Adapt macOS snowflake compilation to new toolchain). pospeselr: Moving house tomorrow and Tuesday so won't be in the meeting Won't have internet installed until *sometime* on Wednesday Last week: - Portland - #26540 patch works now (pdfjs range-based request first party isolation) - failed to reproduce windows DNS leak we got email'd about - fixed up #26456 patch and ran automated try server tests to verify changes don't break anything (haven't had a chance to look at results yet) This Week: - moving - #21785 (storage api) - #tbbfingerprinting boklm: Note: currently traveling to PETS so I will be missing second half of the meeting (after 18:30 UTC) Last week: - vacation This week: - finish dealing with backlog - attending PETS - can help with building a new alpha if we want to do one this week [GeKo: Not this week, but hopefully next week] - fill binutils ticket tjr - More #26476 work. I have reduced even more differences between the two toolchains, still crashes. - Confirmed that the TC build runs though: https://treeherder.mozilla.org/#/jobs?repo=try&revision=9a1a8cc2c8224e38c0b… - Confusingly though, if I remove --disable-maintenance-service I get a NSS build error.... If nothing else gives me a result I guess I'll dig into that more - I'm getting pushback on landing required NSS patches into -esr60... so I am delaying pushing back on that until I have more ducks in a row regarding tests running [GeKo: What are we talking about here? And what would be the impact if we don't get those patches landed? I wonder if we could cope with that and maybe it would be more useful to focus on getting nightlies with mingw-w64 running again?] [tjr: The impact would be that we can't get the gcc or clang MinGW builds running in ESR branch. I have been focusing on that rather than mingw-clang on -central.] [GeKo: Well, RyanVM told me a while ago, that tests for mingw-w64 are running (to catch regressions due to security bugfixes etc. so, I was under the impression that there are things running on ESR60 for us, even it is not exactly what we ship, hence my question][tjr: esr60 is running the x86 build only. I forgot about that. These NSS patches are holding up the x64 build and tests (assuming I can the damn tests fixed for whatever else is breaking them).] [GeKo: Okay, the plan here is to let the 32bit esr60 on Mozilla's infrastructure and the manual 64bit testing before release be enough and focus on mozilla-central again instead] - But that is going slowly/hard to allocate time for - This is holding up landing the build jobs for x64 or mingw-clang - I don't think the mingw-clang build (with stylo) is as stable as Jacek thinks it is [GeKo: Why not? Any bug reports/pointers?][tjr: I don't know anything more than "I tried to run it and it didn't always start for me, or stay running. Haven't investigated, or compared with/without stylo or asked Jacek.] - A few other outstanding issues for MinGW: - jemalloc on mingw-gcc (This is a shame, because it means Tor Browser will be lacking exploit mitigations) - mingw-clang sandbox sysrqb: Last week: Received good feedback on TBA/Orfox rebased patches (26401) and worked on revisions Attended HOPE Spoke at HOPE Contributed to joint statement against white nationalists/fascists at HOPE and in our spaces Talked with some people about sandboxing Tor Browser This week: Finish 26401 Read Isa's sponsor 8 mail and respond Sandboxing meeting tomorrow at 15:00 UTC Review igt0's torbutton modification for mobile sisbell: Last Week: Android toolchain + licenses working in RBM Worked on getting arm target working on Rust (nearly complete) This week: Complete arm target on rust Working browser on Android Create branch for public review Cleanup build changes GeKo: Last week: -coped with my backlog -bunch of reviews (most importantly, and most time-consuming the one for #26401; then #26590, #26795, #26477, #26569, #26216, #9145, #25485) -worked further on #26475 (there might be light on the end of the tunnel due to alex's last comment given that I can already feel glandium's "this-drives-me-crazy" mentioned in https://github.com/rust-lang/rust/issues/52044. Thus the bug has to be the same. :) ) -helped with Sponsor8 reporting (sysrqb, igt0: please add items I forgot, see tbb-dev mail) [sysrqb: yes!] -worked a bit on #26628 (backporting an Origin Attributes bug that could lead to browser crashes) -looked a bit a proxy bypasses on mobile and resumed network code review (#22176) -looked over remaining UX issues for both mobile and desktop alphas This week: -finally tracking down #26475 and hopefully finding a fix for it -more reviews -more network code review (#22176) -I need someone looking at #26874 (pospeselr can you do that?) and I need someone working on the onboarding part (#25695) (mcs/brade could you do that); sysrqb, igt0: who has #25696 on his plate? [sysrqb: I can put it on my plate, unless igt0 wants it] [igt0: either way is fine] -PSA: I have to be AFK from 8/2-8/12, alas (this is one of the things I could not postpone as the planning for it where already done before Mozilla moved the ESR release, I am sorry for that) igt0: Last week: - Tried to make the preferences.xul work on mobile, started to migrate the code to xhtml (#26884) - Investigated how the onboarding works on android and reviewed #25696 (Design of alpha onboarding for Tor Browser for Android) - Investigated about MAR on android. (Firefox team never used it) This Week: - Finish #26884 - Review again #26401 sukhe: Last Week: - I continue with #26476 (crash on Windows) with tjr, #12968 (HEASLR). - I have given up on up #26251 (Snowflake) again. I am going to wait for the mingw-w64/clang builds perhaps. - Worked on #25485; waiting for more discussion to finalize This Week: - Continue the above tickets unless something comes up. Georg

1 0

services updates - june 2018
by silvia [hiro] 23 Jul '18

23 Jul '18

Hi, here is the service report for June. Continuing translation work for support portal. We have been working on translations via transifex and we now have the PO files build within Lektor. Newsletter is being built via Lektor now and uses the Tor Styleguide. Trac status update As you all know trac has been having issues for a while now. In the last month I have been implementing a few configuration options as described in: https://trac.edgewall.org/wiki/TracPerformance More specifically I have set: * max_daysback: 30 (It was set to 90 days before and this is known to cause issues with trac installation with 'some history' like ours) * use_chunked_encoding: true Also Teor started a Trac permissions cleanup. Thanks Teor for this! I went I bit further and cleaned up a few more not really needed groups. I think now everything will be easier to follow. I have also restricted cypherpunks powers following the vandalism of the last few days. I think this is a temporary middle ground till things are quieter. Talk soon, -hiro

1 0

US congress wrote a letter to Google and Amazon on domain fronting
by Arturo Filastò 22 Jul '18

22 Jul '18

In case you missed here is a letter to Google and Amazon on the blocking of domain fronting by Senator Rubio and Wyden: https://www.wyden.senate.gov/imo/media/doc/Wyden%20Rubio%20Letter%20to%20Am… Press coverage: https://www.cyberscoop.com/domain-fronting-ban-letter-ron-wyden-marco-rubio… https://www.accessnow.org/access-now-supports-bipartisan-questioning-of-goo… ~ A.

7 15

[TSoP 2018] Ahmia status update ~ report #5
by Stelios Barberakis 20 Jul '18

20 Jul '18

Hello all, Bi-weekly update for ahmia: --- Ahmia Site ---: * Finished Usage statistics [1] * I have been playing around with Elasticsearch's `fuzziness` feature, to find out if we can utilize it to improve results. This is still R&D, my current proposal is [2] * I have been trying out weighted fields on Elasticsearch, to find out if search results are improved or not. Both deciding which results are better, and checking on multiple input combinations, are tricky ~ this is still R&D. --- Ahmia Crawler ---: * Fixed [3], [4] Thank you, Stelios [1] https://github.com/ahmia/ahmia-site/commit/5c36f95e58d90b322f5e8dabf39c18e3… [2] https://github.com/ahmia/ahmia-site/issues/25 [3] https://github.com/ahmia/ahmia-crawler/issues/7 [4] https://github.com/ahmia/ahmia-crawler/issues/9

1 0

Notes from July 19 2018 Vegas team meeting
by Karsten Loesing 20 Jul '18

20 Jul '18

Notes for July 19 2018 meeting: Georg: 1) Back from vacation and dealing with backlog 2) Work with UX team to prepare the next desktop alpha (hopefully ready in about two weeks) and the first Tor Browser for Mobile alpha (hopefully ready in about two weeks as well) 3) Shari: Do you know when our current bug bounty contract is supposed to expire? Shari: 1) Welcome, Sarah! 2) getting caught up from week out of the office 3) general stuff related to getting Sarah acclimated, plans for Mexico City, upcoming grants 4) sorting through Shuttleworth Fellowship candidates Nick: 1) Away next week at PETS 2) Teor is onboarding this week; all seems well. 3) new bridge auth deployment seems to be going okay. 4) Planning to revise roadmap to reflect reality and staffing changes once Isa is back online in early nov. Steph: 1) presented at NYU Tandon with Matt, thanks to gman and Yin for helping out! 2) preparing for HOPE tomorrow. Our presentation is Friday, and we have a booth all weekend. Bringing lots of swag. 3) whipped up a 1pager for the NYU students and HOPE table 4) got travel and lodging squared away for Def Con - Roger’s AMA is Sat Aug 11 at 6pm in the crypto village 5) responded to a couple press inquiries 6) helping spread the word about upcoming meetups 7) working on copy for TBA Karsten: 1) Released CollecTor 1.7.0 to recognize the new bridge authority. 2) Released Onionoo 6.1-1.15.0 with several new features. Mike: 1) Vanguards post hopefully going up today/early tomorrow before asn's HOPE talk [can i check out the posts? -steph] 2) Research post following soon after (Roger has seen it, had some comments) Roger: 1) I owe Heather a "staff x sponsor" matrix. Going to do that before I leave for PETS. Alison: 0) HOPE is tomorrow! I'm spending today making sure all of our plans are in place. 1) PETS is this weekend! Colin is very excited for the relay operators meetup and has been getting lots of last minute RSVPs 2) Gus and I are working on TB 8.0 documentation 3) LFI is in week 7 and we're preparing for our in-person meetup the first weekend in August 4) Continuing to work on the Mexico City meeting. Planning to send the agenda ideas email out the first week of August.

1 0

Automatic Circumvention For Briar
by Torsten Grote 18 Jul '18

18 Jul '18

Hi all, some of you might know Briar which uses Tor as its internet data transport. Currently, we only use direct Tor connections, but we also want the app to work where connections to Tor might get blocked. Since we don't want all of our users go through bridges, we need to know where it is really needed, because we want things to work out of the box as much as possible. So I did some research and was surprised that there doesn't seem to be a maintained list of places where Tor is blocked. Therefore, I looked into OONI vanilla_tor measurements from the past year and into the ratio of bridge users per country in the last three months with data from Tor Metrics. You can find the result here: https://grobox.de/tor/ (needs JavaScript) You will notice that Iran, Turkey and Venezuela are absent from both lists. Even China has a surprisingly high success rate. Do these countries maybe block the connections only later when the OONI probe doesn't listen anymore or is the blocking just very inconsistent? Tor Metrics also shows quite a few direct relay users in those countries. So once we know where Tor is likely to be blocked, we would like to know where bridges will work and which kind. The only data source for this that we found are the OONI tcp_connect measurements. You can find our results from the past year here: https://grobox.de/tor/bridges.html (needs JavaScript) This is looking at TCP connection success rates in some pre-selected countries compared to a control group. Only China seems to be interfering with bridge connections, but not with all and not all the time. When you only show Tor Browser bridges and even the ones with bad control group reachability, you will see that there's quite a few that perform very poorly. You might want to rethink including them. If anybody finds these pages useful, I could set up a cronjob that automatically updates them. I imagine that countries have other ways to interfere with bridge connections besides simple TCP blocking. If anybody is aware of reliable data sources for those, please let me know. Eventually, I would also be interested in knowing which pluggable transports work in which country. One-off academic research has limited usefulness here as we ideally have fresh data to decide parameters before each new Briar release. Which bridges should we include in Briar? The first impulse is to just use whatever Tor Browser is using, but on IRC somebody told me that those bridges are already overloaded and that we better request some through the usual channels. Is that the recommended approach? Thanks and Kind Regards, Torsten

2 1

Tor Browser team meeting notes, 16 July 2018
by Georg Koppen 17 Jul '18

17 Jul '18

Hi all! We had another Tor Browser meeting yesterday. The IRC log can be found at http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-07-16-18.05.log… and here come, as usual, the meeting notes from our pad: Monday July 16, 2018 Discussion: - I think the Sandboxing Meeting is scheduled for next Tuesday 15:00 UTC? (GeKo: Yes) - We should think about possible sessions we could offer for the mexico dev meeting open days; we'll have a talk about Tor Browser 8 then (please volunteer if you want to do the talking part) but I think we are a big team with lots of things going on and we could contribute more - mcs: some ideas: UX changes in Tor Browser 8, a design overview (aka “How is Tor Browser different from Firefox?”), sandboxing futures. - arthuredelstein: I'd like to talk about browser privacy testing (For Tor Browser and other browsers with "Tor mode") - Tor Browser on Github? boklm: Last week: - reviewed #26355 (Make sure only Windows users on Windows7+ are trying to use Tor Browser based on ESR60) - reviewed #26251 (Adapt macOS snowflake compilation to new toolchain) - made patch for #26569 (Redirect pre-8.0a9 alpha users to a separate update directory) - looked with sisbell at list of things to do to integrate Tor Browser for Android into tor-browser-build and opened some tickets: #26693, #26695, #26696, #26697 This week: - on vacation sysrqb: Last week: Investigated report of proxy-bypass (#21863) Investigated Android APK signing key (#26536) Discussed and researched some Android localization with Emma (#26536) Helped with BridgeDB things Prepared HOPE presentation slides for talking about Tor Browser, TBA, and Tor on Mobile Scheduled Sandboxed Tor Browser meeting on next Tuesday, 24 July at 15:00 UTC This week: Helping talk about Tor with high schoolers on Monday Talking at HOPE on Friday with other Tor people tjr: - Worked on #26476 with sukbir a bunch. Currently blocked on needing to increase the file descriptor ulimit inside the container. Don't know how. - I've tried increasing the ulimit for user account and root on the host; but it did not propagate into container. - We know the issue is --gc-sections, we don't know why it happens to Tor and not Mozilla; we're investigating that. (It's not the sandbox or any Tor patches.) - Jacek finished his contract: - He got --enable-stylo working: https://reviewboard.mozilla.org/r/256840/diff/1#index_header - He landed most of his patches into -esr60 - I have a few more to land for him, plus the build job - Not done for mingw-clang: --enable-sandbox, x86, debugging pdbs - I need to investigate test failures for the x64 build, and then I can land that in esr60 - I am getting fuzzyfox reviewed, and then we could experiment with it maybe GeKo: Last Week: -Vacation This Week: -Deal with my backlog -Help with the mobile alpha release as needed -Finish investigating Stylo related reproducibility issues on macOS (#26475) -Continue network review (#22176) -reminder to do the status: updates at least daily -reviews -Is there anything anybody needs from me urgently? (igt0: Not urgent, however I believe #26401 has high priority) (GeKo: Yes, I finish my comments tomorrow) pospeselr: patch for #26456 (HTTP onion sites inheriting HTTPS certs) could use a review (GeKo: that's on my list for tomorrow, too) Last Week (s): - found a potential solution for #26540 (pdfjs FPI violations) and have a patch up little janky, people should definitely take a look at it - needs to be tweaked for multi-process (ie browser.tabs.autostart = true) - medical stuff - took care of a bunch of moving related bs This Week: - partial vacation in Portland this week, working mornings in cafes - fixup #26540 patch - #25555 looks like interesting, so I'll grab that one (reimpleent Optimisitc SOCKS feature) Next Week: - moving apartments (hopefully) on the 24th, I'm sure there will be tons of problems to deal with/people to yell at but we'll see igt0: Last Week: - Took a look in the tor browser settings: #26574 - Fixed a typo in the mobile addon handler: #26704 - Tested torbutton functionalities on mobile: domain isolator, dragDropFilter, content-policy - meeting about TBA release This week: - More preparation for TBA release arthuredelstein: Last Week: - Patches for: #26590 (SVG isn't blocked in Safest security setting with 8.0a9) #26603 (remove obsolete http pipelining prefs) #26353 (speculative connect violating FPI) #26237 (fix ordering of toolbar) - Investigated: #18598 (disabled WebSpeech by default) #16339 (ensure ImageCapture API is disabled) - Proposed #26765 (Add Tor Browser indicator where Firefox PB indicator is) - Worked on my HTTP2 patch #14592, in progress This week: - Keep working on #14952 - More fingerprinting / ff60esr patches Following week: - I will be on vacation week July 23 - 27. Am I the only one who finds this sandstorm document very hard to use? Wondering if I'm doing something wrong or if we could switch to an etherpad. (GeKo: There are more folks that seem to apply workarounds. Let's resume this discussion once everyone was able to think about it) sisbell: Last Week: Got android and build dependencies in build container for RBM build Added stretch for containers This Week: Get Android license acceptance working in build Get mach build commands working on container build sukhe: Last Week: - I am still working on #26476 (crash on Windows) with tjr and #12968 (HEASLR). Picked up #26251 (Snowflake) again. - Since these all are blocking currently, is there anything else I can focus on in the meantime? (GeKo: Yes, #25485 would be helpful) This Week: - Continue the above and find something else to work on based on "Last Week" isabela: - request (about TBA release) Georg

1 0

Network team meeting notes, 16 July 2018
by Nick Mathewson 17 Jul '18

17 Jul '18

Hi! Our meeting transcript is at: http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-07-16-17.01.html Below are the notes from our pad = Network team meeting pad, 16 July 2018 = Welcome to our meeting! Mondays at 1700 UTC on #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! Note the meeting location: #tor-meeting on OFTC! (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) == Previous notes == 11 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001828.html 18 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001835.html 25 June: https://lists.torproject.org/pipermail/tor-project/2018-July/001863.html 2 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001866.html 9 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001884.html == Stuff to do every week = * Let's check and update the roadmap. What's done, and what's coming up? url to roadmap: https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Check reviewer assignments at https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Also, let's check for things we need update on our spreadsheet! Are there important documents we should link to? Things we should archive? * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… * Community guides, it's time to hand off to the next guide! * Let's look at proposed tickets! [but see discussion] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… == Announcements == * 035 triage has happened; we may need another round, though. * HOPE is this week; some folks are (or will be) offline. * PETS is next week; some folks will be away. == Reminders == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next releases == Discussion == * Should we schedule meetings for these? * Discuss prop 295 (New crypto from Tomer Ashur et al) {actually, let's see what we think after Tuesday's patch-party time.} * Revise roadmap to match current staffing. * 035-roadmap-proposed items (Backlog seems significant-ish) * Shall we just use the same pad, week after week, rather than creating a new one each week? teor: works for me, but how do we get rid of old content? dmr: can just move it below, or delete it (tbb-team just moves it below) asn: reasonable idea! (if this software had tabs we could even make a new tab for each meeting) ahf: Cool with me. I think we made a new one out of concern for vandalism? dgoulet: I don't mind but lets remember that Riseup pad expire so as long as we send the report regurlarly on tor-dev@, I'm ok! dmr: I think as long as the pad is constantly used, it won't expire == Updates == Nick: * Last week: * Merged a bunch of merge-ready stuff * Reviewed SOCKS refactor/trunnel patch from rl1987 again; added fuzzing support to test it. * Finished some post-refactoring cleanup work. * Released 0.3.3.8 and 0.3.4.4-rc * Cleared through my fast-fix items for 0.3.5 * Helped find and diagnose an apparent configuration bug in sid's clang that was making some clang jenkins builds fail. * Wrote up first draft of templates for announcements * Experimented with porting tor crypto to NSS. Some progress made; digest and rand are ported. (How) should I procede? * Added more guidelines about what is _not_ supported long-term in LTS releases. * This week: * TBD depending on roadmap revisions * PETS discussions. * CI rotation * More NSS, possibly? teor (offline): last week: - Reviewed removing Tor2web mode (#26367) - Dealt with my bwauth backlog (I think! pastly and juga please let me know if I missed anything) - Bwauth code and spec reviews and fixes (#26694, #26740, #26694, #3723) - Bwauth documentation (#26702) - Chutney bwauth network (#26801) - More work on the sbws bandwidth measurements https://github.com/pastly/simple-bw-scanner/issues/182 - Trac spam - Tried to work out why Travis builds are leaving a coredump behind (#26787/#26788) - Email and IRC backlogs - More setup tasks & admin this week: - Book Mexico travel - Work out timesheets - Fix and test an onion service ed25519 id mismatch bug (#26627) - Finish PrivCount in Tor blinding and secret sharing branch (#25669) - work out what to do about Rust i128 miscompilation - Implement PrivCount in Tor noise (#26637) - Work out if I need to test C code from Rust (#26398) - Work on a per-relay / per-consensus / per-counter noise spec for PrivCount in Tor (part of #25153) - Reduce my other review and revision backlogs, if I get time Mike (maybe offline?): last week: - Vangaurd post ready - Research post half-ready This week: - Finish & post research post - Make pip packages for vanguards; post asn: Last week: - Reviewed vanguard blog post by Mike. Also made some drawings that could be used. Let me know what else is there to be done, Mike. - Made some final touches to vanguard proposal. Mike: it's still not merged. Let me know if you want me to merge it. - Revised #25552 based on Nick's review, and found an important bug during log analysis. I've since fixed the bugs and been testing the branch. It works really great. - Spent some time discussing client auth and revising HSv3 spec to fit the UX we are looking for. Useful decisions were reached. - Prepared HOPE slides with David. - Reviewed #26663 - Opened some hsv3 tickets #26769, #26768. This week: - Finalize #25552 branch. - Meet with Isa in NYC and fix up the onion service proposal. - Finalize prop224 spec wrt client auth. - Publish vanguard blog post. - Will be on the Tor panel at HOPE conf. haxxpop: Amazing!, I will wait to watch your presentation on Youtube! - Catch up with [tor-dev] UX improvement proposal: Onion auto-redirects using Alt-Svc HTTP header ahf: Last week: Sponsor 8: - Began rewriting transports.c to receive events from the event loop (should be last step before a merge) for bug #25502. - Filled out Isa's S8 Q2 reporting. Misc: - Attempted fix for a couple of Coverity errors in #26780. - Rebased #26437 to fix AppVeyor issue. - Lifted Linux specific Sandbox code into its own file. Began work on cleaning up configuration interface to work with MacOS too. Bug #26374 This week: Misc: - Make #24546 mergable after recent restrcture. - Harvest reporting. - Enjoy vacation in NY including going to HOPE. Back Wednesday the 25th. catalyst: Last week (2018-W28): - community guide rotation -- opened #26785 for a gcc warning disabling issue; shepherded #26492 somewhat - reviewed a few tickets related to Rust builds - wrote more stuff in the github strategy doc This week (2018-W29): - bug triage rotation - code review - ping a few people about big patches doc - swap in stuff about bootstrap-related roadmap items haxxpop: Last week: - Discussed with asn dgoulet and nickm about client auth spec This week: - If the client auth spec is finalized, I will fix and rebase my client auth PR dgoulet: Last week: - Worked on #20700 HSv3 client authorization specification along with haxxpop, asn and nickm. - Patch for #26367 which is the removal of Tor2web (roadmap item). Now in merge_ready. - Reviewed the remaning code refactoring tickets from nickm. - Worked on the slide for our HOPE talk. - HSv3 reachability issue that I might have found the problem on Saturday! See #26709 for the gist of my findings. Running an experiment. - Worked with Roger and gman to help with the new Bridge Authority setup. This week: - I leave for NY (HOPE) on Wed morning so I'm here today and tomorrow. haxxpop: Amazing!, I will wait to watch your presentation on Youtube! - Do as much as possible onto #20700 before meeting asn f2f to discuss outstanding issues. - Try to fix the two HS important issues we have namely #26709 and #26806. - I'm Community Hero this week but most of it will be at HOPE eheh... - I'll need to switch with someone next week for Bug Triage, I won't be there. isabela: reiviewing pm candidates thanks for the information about sponsor8 work on Q1 o/ I will compile all answers received from network folks for the github survey and start oganizing all the teams answers so a proposal can come out of it picking up the onion services proposal this week (trying to get it done before hope) on vacation next week o/ i am thinking of a possible plan to get modularization phase1 (1year of work) payed by a different sponsor (from the one we already applied this project proposal and has been on review for a looong time already) dmr: - not sure whom to talk with, to get a mirrored nyx repo on GitHub - would like to discuss best way to manage several minor improvements to torspec WIP branch: https://github.com/dmr-x/torspec/commits/WIP-torspec-improvements

1 0

Notes from July 12 2018 Vegas team meeting
by Karsten Loesing 13 Jul '18

13 Jul '18

Notes for July 12 2018 meeting: Roger: 0) new bridge auth, and with luck new bridgedb operator 1) fosdem plans? (belgium invite) Nick: 1) Nothing new since last thurs. 2) I'll need to know more about the how & when of the bridgeauth change. Mike: 1) Nothing new for the group isabela: 1) Continue to review candidates for PM 2) Sent sponsor9 phase 2 plan - this week working on countries support doc to send by Friday 3) Getting started on onion services full proposal to OTF and collecting ideas for a proposal so OCF related to relay operators 4) Got NCE for Metrics team work with sponsor13 (new deadline is March 31st 2019) 5) Getting started on sponsor8 Q2 report (due end of July) 6) Prep-work for Tor Browser for Android alpha release [ https://storm.torproject.org/shared/HQq4zW-G7dcAHjDbzuRKShaDSr5-AizVeU4hzO2… ] 7) Finishing interviews and selection of Fundraising Director 8) Trying to get my visa application for Taiwan (OTF meeting) 9) Looks like the GNUHealth conference will indeed happen in November (I was invited to talk about how Tor can be useful for health care systems). 10) HOPE is next week! and the week after (Monday 23rd) I will be on vacation o/ 11) Does anyone has an idea for what do we use our current Azure account? I am looking into it to know if we can use that or need a new one to have Moat working w/ Azure Steph: 1) preparing for HOPE presentation and booth 2) preparing for presentation at NYU Tandon on Monday 3) helping with TBA copy 4) behind on blog posts 5) responding to an inquiry Shari: 1) catching up after a week out of the office 2) putting out job offer for new fundraising director 3) hopefully starting interviews for new project manager(s) 4) reviewing several grant reports/proposals due between now and end of month 5) signing a few NCEs and other important things Karsten: 1) Made a couple of Onionoo changes that we're planning to release and deploy early next week. 2) Started working on a grant proposal for metrics team work related to supplementary data about relays. Alison: 1) finalizing plans for HOPE 2) LFI is in week 6 3) preparing for LFI in-person weekend in August 4) Mexico City meeting planning 5) working on sponsor9 support doc 6) Colin is finalizing PETS plans 7) Gus is getting ready to go to Kenya Arturo: 1) Starting UX interviews next week 2) Making progress on OONI Probe desktop apps 3) Investigating case of Tor blocking in venezuela 4) Will start looking at the tor_api.h this week or the next 5) Updated South Sudan test list (based on research): https://github.com/citizenlab/test-lists/pull/366 6) Maria is giving a lecture about OONI in Kiev tomorrow, and she's facilitating an OONI workshop in Kiev on Saturday 7) Submitted footage and materials for OONI MOOC

1 0

[TSoP] stem.client - status report #4
by Dave Rolek 13 Jul '18

13 Jul '18

Hi everyone! This is my fourth status report for the stem.client TSoP project [1]. You may see my previous reports on the tor-project ml. [2][3][4] This report is much of a week late - I'm quite sorry about that. # Updates I've still been feeling ill, and it's been a bit unpredictable for when symptoms flare up, so that's been tough to deal with and work around. (I'm still moving forward, though, just not as effectively as I'd like.) Some of my progress comes in longer-term plans than I can effectively showcase here, but I'll try. ## GitHub mirroring I think #26197 [5] sparked a lot of discussion on Tor's use of GitHub as a mirror and means to accept PRs. Preliminary discussions when trying to move the ticket forward by bringing it up in a network-team meeting revealed a bit of uncertainty into how mirroring was done, and (iiuc) eventually led to Isa getting involved to survey all the teams on current and future usage. It looks like things are working out well for stem now :), and overall Tor's GitHub usage seems better understood and better standardized! (For instance, the most recent PR was marked as auto-merged/closed by 'torproject-pusher' today [6]) I'll continue to be involved as needed to facilitate stem and nyx needs w.r.t. GitHub repos. (Damian mentioned he's got a lot on his plate already and asked if I could take the lead on this.) nyx still doesn't have a repo, so I'll be sure to follow up on this. ## stem.client - re-roadmapping I continued to push some lingering things in code review [7] and architecture [8] discussions forward. That led to a reconsideration of goals and roadmap between Damian, teor, and me. Based on the primary goal of prototype allowing exit traffic, I've mapped out the main tasks of the remainder of the project as follows: 1. refactor: Relay cell encryption/decryption/processing 2. centralize ORPort reads/sends (demux/mux) at connection level 3. implement required RelayCell subclasses (e.g. parsing of decrypted body) 4. <potentially: other RelayCell subclasses> 5. use these RELAY cells in Circuit / Stream construction/management 6. re-envision Circuit.send() and other methods (e.g. Circuit.extend()) 7. refactor into Stream class, subclass(es) 8. introduce "dumb" path selection for exit traffic This roadmap will be re-evaluated as progress on #1-3 is made. ## stem.client - further review, fixes A few tickets/PRs have been done to follow up on Damian's changes [9], which followed up on the previous commits I did from code review. [10] These two tickets/PRs include bug fixes and some other improvements: * NetinfoCell doesn't preserve unused content during unpacking [11] * Cell unused content is ignored while packing [12][6] ## stem.client - RELAY cells I've started outlining the class hierarchy for the required RELAY cells, tackling roadmap items #1-3. It's still in very early stages, so I don't have changes ready to push. ## stem, general Nothing to show this time around. I've taken minor notes for 'dev' tickets, but I won't be pursuing much of these yet, in the interest of focusing on the roadmap first. ## tor protocol, general I'm still glancing through the tor-design paper [13][14][15] and updates [16][17][18] while reading the specification. I think I've read through enough of the paper now that I won't need to glance often, but I'm still keeping it in mind. As I've been working through the spec, I've been tracking changes to make that improve it. Some of these are just shorthand notes (so I don't have them available to share in an understandable way), but others have made it to (probably) solid commits. I've pushed a WIP branch to GitHub [19], which I will be rebasing / force-pushing as necessary. *Please* feel free to check it out - just don't rely on it to be git-stable. # What's next ## stem.client I'll be working on the roadmap mentioned above. The first thing I'll be working out into commits is moving some of the bytes-level handling of RELAY cells out of the Circuit class and into cell.py, since this handling currently seems to violate the abstractions we want. ## stem, general I still have a few 'dev' tickets I'd like to work on. For a while I've wanted to work on the tox configuration, but I may break that up into more important and nice-to-have changes to it. ## tor-spec As aforementioned, I'll continue to push forward on improvements to tor-spec.txt. Again, you may see what I've got mostly push-ready in my WIP branch on GitHub. I'll bring this up in the next network-team meeting and figure out the best logistics for merging these in. # Other Tor things Not too much on the side - still an advocate for Tor in-person when people chat with me, but it hasn't happened as much in the past few weeks. Still trying to attend the Community team meetings when I can. # Closing As with before, I've been active and reachable over IRC, where my nick is dmr. Please don't hesitate to reach out to me via IRC or email! I've been *much* less proactive in reading scrollback recently, in order to combat some of the reduced capacity due to illness. Please mention my nick if you'd like to get my attention, otherwise it's *very* unlikely I'll see it outside of a meeting! Thanks, Dave [1] https://lists.torproject.org/pipermail/tor-dev/2018-April/013090.html [2] https://lists.torproject.org/pipermail/tor-project/2018-May/001811.html [3] https://lists.torproject.org/pipermail/tor-project/2018-June/001830.html [4] https://lists.torproject.org/pipermail/tor-project/2018-June/001858.html [5] https://trac.torproject.org/projects/tor/ticket/26197 [6] https://github.com/torproject/stem/pull/5 [7] https://trac.torproject.org/projects/tor/ticket/26227 [8] https://trac.torproject.org/projects/tor/ticket/26226 [9] https://gitweb.torproject.org/stem.git/log/?id=3818cf41cae98ae7558f5002ef3a… [10] https://github.com/torproject/stem/pull/1 [11] https://trac.torproject.org/projects/tor/ticket/26684 [12] https://trac.torproject.org/projects/tor/ticket/26766 [13] https://www.torproject.org/docs/documentation.html.en#DesignDoc [14] https://svn.torproject.org/svn/projects/design-paper/tor-design.pdf [15] https://svn.torproject.org/svn/projects/design-paper/tor-design.html [16] https://blog.torproject.org/blog/top-changes-tor-2004-design-paper-part-1 [17] https://blog.torproject.org/blog/top-changes-tor-2004-design-paper-part-2 [18] https://blog.torproject.org/blog/top-changes-tor-2004-design-paper-part-3 [19] https://github.com/dmr-x/torspec/commits/WIP-torspec-improvements

1 0