February 2019 - tor-project - lists.torproject.org

Tor Browser team meeting notes, 11 Feb 2019
by Georg Koppen 12 Feb '19

12 Feb '19

Hi all! We had another weekly Tor Browser team meeting yesterday in #tor-meeting2. The IRC log can be found at: And the notes from our pad are copied below for your convenience: Monday February 11, 2019 Discusion: - vision meeting retrospective? https://storm.torproject.org/shared/VzVdyS_d0Qxwr0o-ewcRyYcjiviT31bO91dz_Vu… - Tor Browser as a full browser brainstorm - hiring with folks from other teams involved? [GeKo: We could think about including folks from other teams in later stages of the hiring process] GeKo: Last week: - begin of the month team admin stuff (mcs/brade: I realized we had #27484 and #27486 as items on the roadmap. What do you think about those two for 8.5? At least the latter seems to be low-hanging fruit at first glance reply from mcs: More discussion is needed for #27484; maybe the UX team can test and get some feedback. I added #27486 to our TODO list) - reviews (#29120, #29183, #29238, #29378, #28885, #29180, #29349, #29325, backport of #29185 and friends to maint-8.0 branch) - wrote a patch for x86 Android support (up for review in #27210) - wrote a patch for aarch64 support (seems to compile fine; we have missing aarch64 support for Orbot, though, see: #28119) - wrote a patch for Rust support for Tor in Windows nightly builds (#25849) - wrote patch for #29453 - worked on the NSIS reproducibility issue (#29185), but no easy fix is in sight; need to see NSIS in action to understand what is wrong - vision meeting prep and follow-ups - thought a bit more about the patch for our mingw-w64-clang toolchain, need to do at least another revision once we are in better shape with Tor Browser 8.5 for Android - TBA-a3 planning and work (Torbutton localization which ties into #10760 + mobile branding #28622) - release prep This week: - release prep - TBA-a3 work - doing the vacation thing mcs and brade: Last week: - Created a patch for #29328 (account for tor 0.4.0.x's revised bootstrap status reporting). - Revised patch for #28885 (notify users that update is downloading). - Helped a little with #29347 (Rewrite meek-http-helper as a WebExtension). - Looked at #29045 (ask tor to leave dormant mode). - Filed #29357 for the Network Team to work on (add an ActiveOnStartup config option) - Worked on #28044 (Integrate Tor Launcher into tor-browser). - Received and responded to helpful feedback from intrigeri. - Code reviews. - Participated in Tor Browser Vision meeting. This week/soon: - #28044 (Integrate Tor Launcher into tor-browser). - #27486 (Onboarding: "Visit an Onion" creates an "about:blank" loading page) - Spend more time looking at the Firefox updater security audit report. tjr - Wrote the tor browser as a full browser brainstorm above - Fixed some tough tests for letterboxing. Hope to land it in Nightly this week. That would be really cool. - For those curious: making a colored margin, or a striped or otherwise non-white margin is not easy :) So it's white. - I will go on leave around Mar 11 until possibly late May - Talked to Jacek about accessibility (https://bugzilla.mozilla.org/show_bug.cgi?id=1520177 ), got a comparison file. No further movement - Organization for the monthly Mozilla/Tor meeting tomorrow! - confirmed gk's mingwclang builds run fine for me - read cypherpunks comments about the toolchain. While I agree with most of them, they all seem to be very non-essential changes; and I am more enthusiastic to work on more impactful work. - this and next few weeks: aside from letterboxing, mostly non-Tor stuff unless someone wants/needs something in particular [GeKo: I think it would be helpful to put the -g -gcodeview behind --enable-debug-symbols or something. We exclude that for the toolchain already][tjr: The correct incantation to avoid the debug flags should be --disable-debug --enable-debug-symbols=""] pospeselr: Last week: - #26568 (security settings) UI work, plumbed through torbutton settings to new about:preferences and partially in the door-hanger - alpha release build This week: - finish functionality/plumbing work for #25658, pipe in torbutton strings - macOS build for antonela and pili's india trip (by Wednesday) - uplift #29120 sisbell: Last week: - Added patches for tor-android-service - 29312 TBB for TOPL - working - requires some minor patches for versions This Week: - 29313 - TBB for tor-android-service - TBB with Orbot UI (whatever is currently in build but this should be compatible with new UI version) - By end of week I expect to have full TBB generated apk ready for testing/review sysrqb: Last week: TBA Bootstrapping (#28329) Reviewing TOPL patches This week: Push #28329 branch for review (today) Squeeze in any a3 patches, if possible TBA-a3 prep igt0: Last week: - Allowed the tor circuit for TBA to use strings from torbutton(part of the #28580) - TBB/TBA release prep meeting - Tried to follow the TOPL reviews/conversation This week: - More integration and edge case fixes for #28580 boklm: Last week: - made patches for: - #29325 (Non-Android Tor Browser nightly builds are broken when compiling obfs4) - #29183 (We are using Linux i686 langpacks in the Linux x86_64 builds) - #29378 (Remove 83.212.101.3 from default bridges) - backported #29158, #29181, #29235 patches to maint-8.0 - worked on #26323 (Build 32bit Linux bundles on 64bit systems) This week: - help with new releases - try to finish patch for #26323 (Build 32bit Linux bundles on 64bit systems) - continue work on testsuite - fix nightly builds emails - some reviews pili: Last week: - Tying up GSoC loose ends and submission - Preparing for Tor Browser vision brainstorm This week: - Follow up from vision brainstorm - India prep - I'll be in India next week so I'll miss the meeting but will be available via email and IRC - will need a custom build with security settings:) anto: Last week: - Prepared usability testing for India This week: - Support what is needed for TBA release - Check TB build for user testing - Added #27484 for ux discussion Georg

1 0

Network team meeting notes, 11 Feb
by Nick Mathewson 11 Feb '19

11 Feb '19

Hi! Transcript at: http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-02-11-17.58.html Notes below: = Network team meeting pad! = This week's team meeting is at Tuesday 22 January at 1800 UTC on #tor-meeting on OFTC, because Monday is a US public holiday. Welcome to our meeting! First meeting each month: Tuesday at 2300 UTC Other meetings each month: Mondays at 1800 UTC On #tor-meeting on OFTC. February schedule: * Monday 11 February at 1800 UTC * Monday 18 February at 1800 UTC * Monday 25 February at 1800 UTC March schedule: * Tuesday 5 March at 2300 UTC (This channel is logged while meetings are in progress.) (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! After each week's meetings, the contents of this pad will be sent to tor-project @ lists.torproject.org. After that is done, the pad can be used for the next week. == Previous notes == (Search the list archive for older notes.) 8 Jan: https://lists.torproject.org/pipermail/tor-project/2019-January/002155.html 14 Jan: https://lists.torproject.org/pipermail/tor-project/2019-January/002170.html 22 Jan: https://lists.torproject.org/pipermail/tor-project/2019-January/002184.html == Stuff to do every week = * Let's check and update the roadmap. What's done, and what's coming up? We're using a kanban now: https://storm.torproject.org/shared/_mx8PMGOHFBOximocl1gy3COvhLPr6k3Ja7JA1v… * Check reviewer assignments! Here are the needs-review tickets, by reviewer: https://trac.torproject.org/projects/tor/query?status=needs_review&reviewer… Here are the outstanding reviews, oldest first: https://trac.torproject.org/projects/tor/query?status=needs_review&componen… Including sbws: https://trac.torproject.org/projects/tor/query?status=needs_review&componen… * Also, let's check for things we need update on our spreadsheet! Are there important documents we should link to? Things we should archive? * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… Core Tor/sbws is now part of the bug triage, CI, and reviewer assignment roles == Reminders == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next releases * Remember to fill up actual point when you finish a task (as well as update the estimate when starting the issue). * Add planned PTO to the calendar https://storm.torproject.org/shared/ISA5L5nH0Xu88iqSCx9ZjCXYSMKOBTdbUeWarbd… * Check other's people call for help in their entries. ------------------------------- ---- 11 February 2019 ------------------------------- == Announcements == == Discussion == == Proposed tickets == * Teor is bringing a proposal for proposed ticket https://pad.riseup.net/p/network-team-triage-2018 Reminder: please add points estimates to proposed tickets! Please tag proposed tickets with 040-proposed or 041-proposed, and add a points estimate (in days). If the ticket needs to be added to the roadmap, put it on the list below, so we can talk about it at the meeting. === 035-proposed === #29042 Error loading private key after 0.3.5.7 upgrade needs_review #28248 Add comments around rust compilation flags accepted <=== accepted if Nick can do it quickly. #29134 Document the max number of v3 client auths I can make new === 040-proposed === Capacity Estimate TODO: turn capacity estimates into a script or spreadsheet ?? points of proposed tickets ?? points of accepted tickets ?? days left until the 0.4.0 release, approximately ?? * 0.36 = ?? coding days per person (see below for calculations) List of tickets that aren't on the roadmap #29040 -- Tor crashes if ClientOnionAuthDir contains more than one public key for a hidden service (new) <-- defer deciding until asn & dgoulet input #28363 -- Make a torrc option which prevents Tor from falling asleep Is this a duplicate of one of our Sponsor 8 dormant mode tickets? Open 040-proposed tickets: https://trac.torproject.org/projects/tor/report/77 Open 040-proposed tickets with no points estimate: https://trac.torproject.org/projects/tor/report/78 === 041-proposed === Capacity Estimate TODO: turn capacity estimates into a script or spreadsheet ?? points of proposed tickets ?? points of accepted tickets 113 days left until the 0.4.1 feature freeze, approximately 40 coding days per person, minus ?? days for 040 bugfixes 5/7 work days in week * 220/260 non-leave week days in year * 3/5 coding days in week = 0.36 coding days per calendar day (coding days exclude reviews, admin, travel, meetings) List of tickets that aren't on the roadmap #25417 -- HSFETCH support for v3 Hidden Services (needs_review) Points needs asn or dgoulet's input, how much effort will it take us to merge this code? Should we try for 0.4.1? There's something subtly wrong with a bunch of our HSv3 IPv6 code: <-- defer deciding until asn & dgoulet input #26992 -- Add intro point IPv6 address to service descriptors (needs_revision) #23588 -- Write fascist_firewall_choose_address_ls() and use it in hs_get_extend_info_from_lspecs() (needs_revision) #23576 -- Make service_intro_point_new() take a node instead of an extend_info (needs_revision) I have tried to debug the issue for a few hours, but I didn't make much progress. I expect it will take a few days to debug: let's defer these tickets, and pick them up if we have time later in the release There 79 tickets below, what do we do? Open 041-proposed tickets: https://trac.torproject.org/projects/tor/report/75 Open 041-proposed tickets with no points estimate: https://trac.torproject.org/projects/tor/report/76 {79 tickets here; tabling them till Brussels.} == Recommended links == Signal uses fixed-size, overlapping range requests to hide the exact length of its previews: https://signal.org/blog/i-link-therefore-i-am/ Could we use a similar technique in Tor Browser to hide sizes from the network? (The application and the remote site know the real size. Everything else just sees fixed-size HTTPS.) How teams produce great outcomes (a long read, but a good one): https://the-composition.com/the-origins-of-opera-and-the-future-of-programm… == Updates == NOTE NEW FORMAT! Name: Week of XYZ (planned): - What you planned for last week. Week of XYZ (actual): - What you did last week. Week of ABC (planned): - What you're planning to do this week. Help with: - Something you may need help with. PLEASE DO NOT BULK-DELETE THE OLD ENTRIES! Leave the "Planned" parts! Leave the parts for last week and this week! gaba: Week of 02/11 (planned): - get roadmap into the wiki - look at releases estimation - gathering documentation on software development practices at the network team <-- if you have anything documented send it my way teor: (offline) Week of 14 Jan (planned): High-Priority: - PrivCount proof of concept (#29004 and related tickets) - unit tests for extra-info documents Medium-Priority: - (no sbws reviews, I need to focus on PrivCount before the hackfest) - Sponsor 8 tasks - are these important enough to do anyway? - Ask metrics to monitor bootstrap speed - Tweak bootstrap settings to work when lots of fallbacks are down (and also on networks that drop packets) Week of 14 Jan (actual): High-Priority: - PrivCount proof of concept (#29004 and related tickets), focused on bandwidth stats this week - Travel preparation / hackfest preparation Medium-Priority: - a small IPv6 review, some sbws reviews - some proposed tickets admin, and other admin Help with: Nick: Week of 4 Feb (actual): - Implement a fast CSPRNG (#29023) - Finish and publish proposal 300 (walking onions) - Handle various merge-ready tickets - [limited hours, to make up for extra hours in Brussels] - Tag some critical 040 stuff. - Read session notes from Brussels. Week of 11 Feb (planned): - Identify remaining 040-must stuff - Fix some 040-must bugs; defer other 040 stuff. - Write a proposal about correct way to do onionbalance in v3 onion services - Maybe, write a proposal about "personalization" of the Tor network to prevent test network crossover. - Check OSS-Fuzz timeout issues to make sure they are false positives - "Evaluate" bridge statistics. (#29269) - Experiment with chutney & CI. dgoulet: Week of 4 Feb (actual): - Went over BridgeDB architecture and infrastructure with sysrqb. Confirmed access also on the infra. - Discussed with Rob/pastly the KIST issue and finally opened #29427. - In part recovered from jetlag and 9 day work/Fosdem marathon in Brussels. Week of 11 Feb (planned): - Deploy a local BridgeDB so I can start using and testing it. - Continue working towards a solution for #29427. - Put prop#289 code in needs_review (#26288). Once #29023 is merged upstream, I'll modify to use it and it will be final. Mike: Week of 2/04 (actual) - Worked on conflux flow control idea; made some progress but also found more problems - Recovered from Brussels; took more out of me than I realized Week of 1/21 (planned) - Start working on #29204 - Look into #29174 - Catch catalyst: week of 01/28 (2019-W05) (actual): - Brussels meeting week of 02/04 (2019-W06) (actual): - some time off to recover from Brussels - reviewing roadmaps week of 02/11 (2019-W07) (planned): - expense reporting - more review of #28226 - other reviews - bug triage rotation juga (offline): Week 4 Feb (actual): - Add units to the bandwidth key-values in the bandwidth file specification (#29326) - Commented the bandwidth file implementation in stem (#29332, #29333) - Remove three consecutive attempts to measure a relay (#29295) - Create an script to automate releases (#29294) - Report relays that sbws sees in the consensus, but never chooses to test (#28566) - Report excluded results in a relay's bandwidth line (#28565) - Report relays that sbws wants to test, but the test doesn't work (#28567) - Started with Write technical overview on how sbws works(#29149) Week 11 Feb (plan): - Register for the Demoday to present the bandwidth scanner (https://prototypefund.de/demo-day/) - Continue with Include scanner country and Web server country in the bandwidth file header (#29299) - Continue with Write technical overview on how sbws works(#29149) - Continue with Adapt bandwidth file classes to be compatible with stem (descriptors, etc) documents (#29057) - Consider implementing When sbws stops making progress, log a warning (#28652) - Consider implementing other children tickets to solve Monitor relays that are not measured by each sbws instance (#28547) Needs help with: - Reviewed #28668, but would like someone else to do a second review, since i'm not familiar with the code - It'd be great if all the sbws needs_review tickets for 1.0 milestone would be reviewed in the next 1/2 weeks, so that i can release 1.0 version before March (1.1 should be released at the end of March). asn: [Will be at dinner during meeting] Week of 02/04 (planned): - XXX Week of 02/04 (actual): - Attended FOSDEM. Had a few discussions about WTF-PAD with attending researchers. - Recovering from meeting. - Cleared most of the email backlog from the past 2 weeks - Figured out some potential GSoC projects. - Toyed a bit with the tor-researchers mailing list. - Did expenses for brussels. Week of 02/11 (actual): - Lots of review backlog. - Start looking at February's roadmap. - Start a tor-researchers thread about WTF-PAD projects. Help with: - We good. ahf: Week of ... (actual) Sponsor 19: - Network team meeting in Brussels. - New hire started(!): onboarding, roadmapping, etc. in Brussels - Went to FOSDEM. - Anti-censorship team meeting: discussed workflow for new snowflake developers and delegated first code review tasks amongst the team members. - Follow up on everything from the meeting: look at roadmapped tickets, etc. Sponsor 8: - We discovered some spec changes hadn't been merged. That have been fixed thanks to Nick. Misc: - Relaxed a bit after our meeting. - Sysadmin hiring seems to have reached its :-) Week of 2/11 (planned) Sponsor 19: - Review dcf's uTLS changes to meek-lite. - Continue with architecture document in #28848 - Create the goptlibext library after discussing with dcf on #28940 - Make progress with NGO discussion with arma and cohosh. Misc (and might need some help with, but most likely from weasel): - Solve the Windows CI issue that I didn't finish before meeting.

1 0

hackweek in Brussels - notes
by Gaba 11 Feb '19

11 Feb '19

Hi! We had a great hackweek in Brussels with the metrics, network and sysadmin teams. On Monday we set shared agreements [0] for the week and went through the agenda. We did the network team retrospective [1] and discussed how a lack of team diversity affects the quality of our work. One of the point that came out of there is a discussion on hiring process. At the beginning of the week we drafted the network team roadmap[3] and finish it [4] on Friday. The metrics team worked on its roadmap [2] and sysadmin team went over services[19]. Sessions we had: . Discussion on modularization[5] for the refactoring work we will be doing during 2019. . Where do we want to be in 2 years? [6] . ahf presented snowflake [7] and lead the discussion with cohosh [8] . Helping users that are not us [9] . Mike Perry presented the work he has been doing with asn on website traffic fingerprinting defense [10] . Teor presented the work on privcount and the challenges that we are having [11] . Discussion on code review [12] . Chutney for the next 6 months [13] . Juga presented what they are working on bandwidth scanner and open questions [14] . A discussion on the maintaner role [15] and on release planning [16] . Metrics team discussed the work on extending OnionPerf to work with Pluggable Transports [17] . Last but not least an evaluation of the hackweek [18] cheers, gaba [0] shared agreements https://trac.torproject.org/projects/tor/wiki/org/meetings/2019BrusselsNetw… [1] https://trac.torproject.org/projects/tor/wiki/org/meetings/2019BrusselsNetw… [2] https://storm.torproject.org/shared/TsgBadLSfM8uh_aftPjxmR_rm0a8E-4UQ2HEa_l0DHv [3] https://people.torproject.org/~nickm/volatile/roadmapping_v1/ [4] https://storm.torproject.org/shared/_mx8PMGOHFBOximocl1gy3COvhLPr6k3Ja7JA1v… [5] https://trac.torproject.org/projects/tor/wiki/org/meetings/2019BrusselsNetw… [6] https://trac.torproject.org/projects/tor/wiki/org/meetings/2019BrusselsNetw… [7] https://trac.torproject.org/projects/tor/wiki/org/meetings/2019BrusselsNetw… [8] https://trac.torproject.org/projects/tor/wiki/org/meetings/2019BrusselsNetw… [9] https://trac.torproject.org/projects/tor/wiki/org/meetings/2019BrusselsNetw… [10] https://trac.torproject.org/projects/tor/wiki/org/meetings/2019BrusselsNetw… [11] https://trac.torproject.org/projects/tor/wiki/org/meetings/2019BrusselsNetw… [12] https://trac.torproject.org/projects/tor/wiki/org/meetings/2019BrusselsNetw… [13] https://trac.torproject.org/projects/tor/wiki/org/meetings/2019BrusselsNetw… [14] https://trac.torproject.org/projects/tor/wiki/org/meetings/2019BrusselsNetw… [15] https://trac.torproject.org/projects/tor/wiki/org/meetings/2019BrusselsNetw… [16] https://trac.torproject.org/projects/tor/wiki/org/meetings/2019BrusselsNetw… [17] https://trac.torproject.org/projects/tor/wiki/org/meetings/2019Brussels/Not… [18] https://trac.torproject.org/projects/tor/wiki/org/meetings/2019BrusselsNetw… [19] https://trac.torproject.org/projects/tor/wiki/org/meetings/2019BrusselsAdmi…

1 0

January 2019 report for the UX team
by Antonela Debiasi 11 Feb '19

11 Feb '19

Hello Tor, During January the UX team have been collaborating with the Community Team on creating our new outreach material. Our ongoing work with Personas allowed us to create content focused on each different use case and user goal. We are going to have it localized and ready for download and print for organizations and partners who want to use them with their local communities. You can sneak peek them now: https://share.riseup.net/#8aTI-VwMHFbZaud4xkE_pA TBA is going to reach stable probably in March, and we worked closely with the mobile team to provide an intuitive and smooth experience for users connecting to Tor. The work is currently in development, and you can follow our design discussions here: https://trac.torproject.org/projects/tor/ticket/28329 Are you a Tor Browser Alpha kind of person? If yes, you already saw our new Tor Browser icon in action. If not, you can experience it by downloading our Alpha here (you can give us feedback also!) Thanks pospeselr for this shiny implementation! https://www.torproject.org/projects/torbrowser.html.en#downloads-alpha Pilar started a kanban board to track our open projects. You can lurk them here: https://storm.torproject.org/shared/4LLhH5s-55_Vj0uO9W8t6LD9_WqmuS9bjTB3AE3… During our global-south travel in Colombia last year, we met Bea. She is an activist and a Tor and Tails heavy user. We put her in contact with our friends at Tails and Sajolida interviewed her. They made it public this month, and you can read it: https://tails.boum.org/blueprint/interviews/#Bea We are still working with OONI on Explorer revamp. January was the time for the Country pages redesign. Our goals with this redesign are: giving an understanding to a visitor about how comprehensive and reliable the data OONI has on that country, present high-level findings, provide insights that act as an entry point to the search pages and cross-reference link to OONI research reports for that country. Maria coordinated usability research for our first wireframe iteration with partners, and it gave us light on how researchers are using Explorer nowadays and what they expect for the next iteration. That allowed us to work in a new round of high definition mockups focusing on how we are displaying data and how we are enabling the interface for researchers to compare across data sets. Take a look at this hottie that Elio is working on: https://www.figma.com/file/Z6PtVLW7YkqcTRIRsO2Qzg/Explorer-Country-Pages?no… The new Tor Project website is about to see the light, and we are polishing details in staging to make it possible: https://lektor-staging.torproject.org/tpo/staging/ Caroline Sinders is joining us this quarter as our User Research Coordinator. We put together the plans for our user Research for this Q119. We want to collect feedback on our new Onboarding and also on our new Security Settings. You can read them here: https://storm.torproject.org/shared/MUHbKrR0C1xakVNSQ0nRu9mwAdjAz5tSVhoOtZk… Gaba and Pilar collected priorities and needs for each team at the project. The UX Team ones for this 2019 are listed here: https://storm.torproject.org/grain/LjABMdzjECRMGoYeMgSjsf/ Hiro and I proposed a new feature for OnionShare that allows users to publish ephemeral .onion sites by merely dragging and dropping a folder inside OnionShare. This month, we got micahflee blessing, and it is scheduled for the next 2.1 release. You can read more here: https://github.com/micahflee/onionshare/issues/791 Are you a person interested on end-users? If you arrived to the end of this email, probably yes. Remember that our weekly meetings happen every Tuesday at 1400 UTC in #tor-meeting on OFTC. https://trac.torproject.org/projects/tor/wiki/org/teams/UxTeam See you online! A

1 0

Notes from February 7 2019 Vegas team meeting
by Karsten Loesing 08 Feb '19

08 Feb '19

Notes for February 7 2019 meeting: Arturo: 1) Moving forward with OONI Explorer design work 2) Resolving some incident which results in some measurements not being available in OONI Explorer and in the API Georg: 1) Moving forward with our mobile and toolchain work 2) Tor (Browser) hiring Pili: 1) GSoC Application for Tor submitted 2) Reviewed VPN with Tor doc 3) Organising Team Vision brainstorming sessions. Alison: 1) Working on training materials for the community portal. Also still finishing the outreach materials. 2) LFI recruitment 3) Three months checkins with all members of the first LFI cohort 4) Working on LF website redesign 5) Working on LFI curriculum 6) Colin held a relay operator meetup at FOSDEM 7) Kat is working on the next sponsor 19 report 8) Maggie wrote the first draft of the Tor vs VPN doc. I still need to review it! 9) Gus and emma held an AMA with Localization Lab. 10) Next community team meeting will be a brainstorming session about where we want to go in the next few years. Nick: 1) Recovering from Brussels meeting. 2) trying to wrap stuff up for 0.4.0. Make sure we know if there is a bug that you think is an 0.4.0 blocker or a must-backport blocker.V We don't need to have a discussion about this at this meeting, but please make sure that it is tagged with tbb-wants or tbb-needs, or the appropriate version of that for your project or team. 3) 0.4.1 opens for merges at the end of next week. 4) We're changing how we merge stuff in Tor: we plan to require that for each merge, the author, the reviewer, and the merger be three separate people. 5) Put out proposal 300: it's a start of a plan for scaling tor. 6) Due to brussels meeting recovery and upcoming leave, expect network team to be at low capacity for a while. Make sure we know about what you need us to know. Mike: 1) Recovering from brussels 2) Tagged a new vanguard release. Waiting on debian packages to appear in testing, then will do a blog post about using vanguards with onion services and Tor Browser. Sarah: 1) Donation page redesign and adding pages for monthly giving, major donors, and cryptocurrency. 2) Finalized Kraken account that will allow us to accept additional types of cryptocurrencies. Setting up wallets with the most requested. Engaging with folks who can cross promote to their followers when we launch. 3) Contacted all monthly donors to send 2018 donation statement. 4) Working with Jon to sort out some data-entry details. 5) Al submitted two proposals to NLnet and an OTF proposal as well as a narrative rewrite for the OTF onion services proposal. 6) Helped with the new Sponsors page. Steph: 1) inquiries. 2) working on the comms strategy 3) will be chatting with Mozilla about the internet health report. 4) finished new tor stories survey, will start sharing soon 5) reviewing website content Karsten: 1) Had a very useful team meeting together with the network team and sysadmin team in Brussels. 2) Made a new 6-month roadmap from February to July that will soon show up as Storm Kanban thing. 3) Started analyzing parts of the OnionPerf data that didn't make it to the Tor Metrics website so far. 4) Wrote down initial guidelines for adding new data to Tor Metrics (#29315). isabela: 1) working on budget estimations for dev meeting 2) Working w/ Sue on follow ups w/ sida 3) catching up on backlog of to do items from before Brussels 4) catching up w/ backlog of to do items from Brussels 5) planning a trip to Seattle office in March (probably week of March 11) 6) sent dev meeting change update to tor-project/internal antonela: 1) did a talk in FOSDEM last week, went great, we have designers interested in our work and I should back to them. 2) working on usability research documents for India and Thailand travels. 3) pushing all that is needed to have tpo.org and landings ready for release. You can sneak peek here https://lektor-staging.torproject.org/tpo/staging/. 4) working on donate.tpo wireframes to discuss this week meeting. 5) working on introducing a Call for Design structure where we can enable new UXD collabs to work on projects without funding. 6) working with OONI on Explorer redesign, we did usability research, we did a retrospective after that, and we are working on high definition mockups now. 7) preparing a call with Simply Secure next week to talk about Persona and a new possible OTF project, the new metrics portal. gaba: 1) recovering from hackweek 2) still in brussels doing tails stuff 3) digitalizing stuff from hackweek ewyatt: 1) General hr stuff

1 0

Anti-Censorship Team Meeting Notes, 7 Feb 2019
by Alexander Færøy 07 Feb '19

07 Feb '19

Hello. The weekly anti-censorship team meeting just finished. The IRC log of the meeting can be found at http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-02-07-19.58.txt We had two discussion topics for the meeting this week: - The Brussels meeting. We walked over what we discussed and worked on in Brussels that was related to the anti-censorship team. - The Snowflake workflow: We discussed how we should onboard more people to get involved with the Snowflake codebase. For now we'll ramp up the new people on the anti-censorship team and try to help each other with doing code reviews, but we continue with Trac + git.torproject.org. Later on we can look into experimenting with more "modern" workflows such as Gitlab if that becomes available. The status updates from this week: Gaba: Last week: - hackweek in Brussels This week (02/07): - digitalize roadmap from hackweek - get up all the stuff from snowflake, bridgedb and pluggable transports into its own roadmaps. dgoulet: This week: - Going over BridgeDB infrastructure with sysrqb. - Got commit access to bridgedb.git and ssh access to the machine where it is running. - Documenting everything in the process! ahf: Last week: - Tor meeting in Brussels + attended FOSDEM. - Onboarding of cohosh - Roadmapping with cohosh, arma, and gaba. Lots of tickets was created. Sorry for the confusion if some of the tickets have slightly vague descriptions. This week: - Relax a bit after our meeting. - Follow up on everything from the meeting: look at roadmapped tickets, etc. - Continue with architecture document. - Figure out where we should begin with Snowflake: code reviews, repositories, etc. - Do the goptlibext library after discussing with dcf on #28940 kat5: Working on: - report 2 - going over new tickets (since Brussels) to figure out what to integrate into report 2 Help with: - private bridge guide for NGOs (hold off until we figure out a strategy for making set-up easy) - not sure where this is nor what should heppen next anto (offline): Working on: - Planning a Call for Design for Gettor, once we have the PRD doc ready - https://docs.google.com/document/d/18R_tUnqfFkn7d93w0pEbBOLxB62KAWHbUGd5MPK… pili (offline): working on: - gettor - agreed on next steps to deploy refactored code with ilv and hiro - still need to define project scope with gaba, antonela and hiro help with: - Browser team can't commit anyone to work on snowflake web extension - can we not just: a) wait for integration into cupcake (see https://github.com/glamrock/cupcake/issues/24) - we can help them with this also b) wait for anti-censorship developer - we need to also think about who is going to maintain this webextension dcf: 2019-02-07 Last week: - added proxy support and more tests to meek with uTLS, now a merge candidate (#29077) - meek and snowflake sysadmin (#29171, #29172, gave cohosh access to broker and bridge hosts) - checked the meek fingerprint in Tor Browser 8 (#26241) - upgraded Go in tor-browser-build (#29167) - housekeeping in tor-browser-build (#29349) - started working on a WebExtension port of meek-http-helper, for compatibility with the next ESR and for experimentation with ESNI (#29347) This week: - get review on meek with uTLS, maybe merge? - open a discussion about meek/meek_lite with uTLS in Tor Browser to replace the headless Firefox - meek-http-helper WebExtension Help with: - review on https://bugs.torproject.org/29308 - disable old Snowflake proxy-go instances - review on https://bugs.torproject.org/29077#comment:20 - meek-client with uTLS Samdney: Working on: - Will also have a look at the WebExtension ticket #23888 :) - Looking for something where they can help!!! - If you have anything in the direction of "research" or "investigation" in something, then I'm your guy! :) (- I'm working on a research project about censor <-> classical attacker in game theory. That's maybe later, when I have results :), interesting for UX/dev stuff.) _hc/eighthave: uniqx and I have been working on ways to integrate PTs into apps easily. we have a working client/server automation setup based in Python. We also were trying to do a more generic proxy, https://lists.torproject.org/pipermail/tor-dev/2019-January/013637.html n8fr8 is working on getting obfs4 into our Android Pluggable Transports library. he's having trouble getting it to connect to our server automation In Feb, I'll be working on figuring out a good URL scheme for bridge configuraton - #15035 OTF accepted our Concept Note with Stephen Farrell for working on ESNI and ensuring circumvention is included. We are submitting the proposal now, chances look good! cecylia (cohosh): Last week: - network team meeting in Brussels - started getting onboarded to new anti-censorship team - looked a bit into what we need before we talk to NGOs about reachability of obfs4 bridges This week: - Come up with a definite plan for obfs4 reachability tests - Continue getting up to speed on snowflake - Start on Snowflake tasks Help with: - Decisions on workflow for various projects (Snowflake, and BridgeDB) - Will probably reach out for questions about current infrastructure catalyst: week of 2019-01-28 (2019-W05) (actual): - Brussels meeting week of 2019-02-04 (2019-W06) (planned): - recovery from travel - maybe look at #28925 some more Cheers, Alex. -- Alexander Færøy

1 0

January 2019 report for the Tor Browser team
by Georg Koppen 07 Feb '19

07 Feb '19

Hi everyone! 2019 started with two releases for the Tor Browser team, Tor Browser 8.0.5[1] and 8.5a7[2]. Both contain security fixes to Firefox and ship updated Tor versions (0.3.5.7 and 0.4.0.1-alpha, respectively). The alpha release, moreover, contains our new logo for the alpha channel (thanks to Antonela and Richard for driving this!) and a number of fixes to crashes noticed in previous releases.[3][4][5] Apart from working on those releases we moved forward with our work on the next Tor Browser for Android milestone, TBA-a3. All tickets tracked for this task can be found under the `TBA-a3` keyword.[6] For the desktop side we made further progress in our security settings redesign[7] and started to move to a new toolchain for Windows, which is now clang-based[8]. The full list of tickets closed by the Tor Browser team in January is accessible using the `TorBrowserTeam201901` keyword in our bug tracker.[9] In February we plan to release another alpha containing in partiulcar the latest improvements for mobile users and to start addressing the remaining blockers for a Tor Browser 8.5 stable release. We'll work further on our toolchain improvements (the mingw-w64/clang-based toolchain and building 32bit Linux bundles on 64bit machines[10]) and on our Tor Launcher and Torbutton integration into the browser code itself.[11][12] All tickets on our radar for this month can be seen with the `TorBrowserTeam201902` keyword in our bug tracker.[13] Georg [1] https://blog.torproject.org/new-release-tor-browser-805 [2] https://blog.torproject.org/new-release-tor-browser-85a7 [3] https://trac.torproject.org/projects/tor/ticket/28705 [4] https://trac.torproject.org/projects/tor/ticket/27531 [5] https://trac.torproject.org/projects/tor/ticket/28874 [6] https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~TBA… [7] https://trac.torproject.org/projects/tor/ticket/25658 [8] https://trac.torproject.org/projects/tor/ticket/28716 [9] https://trac.torproject.org/projects/tor/query?status=closed&keywords=~TorB… [10] https://trac.torproject.org/projects/tor/ticket/26323 [11] https://trac.torproject.org/projects/tor/ticket/28044 [12] https://trac.torproject.org/projects/tor/ticket/10760 [13] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig…

1 0

Board Meeting Minutes from December 10, 2018
by biella 06 Feb '19

06 Feb '19

Hi all, Please find our meetings from our Dec 10 2018 meeting here Regards, Gabriella https://gitweb.torproject.org/company/policies.git/commit/?id=83aa99915cd5a… Tor Project Board Meeting Minutes for December 10, 2018 Phone/video meeting called to order at 16:00 UTC Present: Isabela Bagueros, Shari Steele, Matt Blaze, Ramy Raoof, Cindy Cohn, Biella Coleman, Julius Mittenzwei, Roger Dingledine, Megan Price, Nighat D – Approval of October 1, 2018 minutes. Biella made the motion to approve, Ramy seconded, all voted in favor. RESOLVED: board approved minutes from October 1, 2018. 2. Board Discussed and Passed Two Resolutions around Bank and Stock Accounts – Motion one: The board of directors of the Tor Project, Inc., hereby authorizes Sue Abt, Erin Wyatt and Cindy Cohn to be added as a signatory on the organization's Bank of America checking account #XXXXX.Cindy moved the motion, Julius second, all voted in favor. – Motion two: The board of directors of the Tor Project, Inc., hereby authorizes Sue Abt to be added as signatory on the organization's Merrill Lynch stock account.Cindy moved the motion, Matt seconded the motion, all voted in favor. RESOLVED: Sue Abt, Erin Wyatt and Cindy Cohn added as signatories on the organization's Bank of America checking account and Sue Abt added as signatory on the organization's Merrill Lynch stock account. 3. Finances – Isabela went over grants, budget, and pending grants. – Discussion about changes aroundgrant writing and hiring priorities. Nick left 12:32 4. New board members – After Cindy’s initial discussion Shari, Ramy, and Biella volunteered to reach out to prospective candidate Meeting Adjourned at 18 UTC

2 1

Tor Browser team meeting notes, 4 Feb 2019
by Georg Koppen 04 Feb '19

04 Feb '19

Hello! Our first weekly meeting in February 2019 just finished. The IRC log, as usual, can be found at: http://meetbot.debian.net/tor-meeting2/2019/tor-meeting2.2019-02-04-18.29.l… The notes from the pad are: Monday February 4, 2019 tjr - I am working this week, on: https://bugzilla.mozilla.org/show_bug.cgi?id=1407366 letterboxing prototype replying to geko's reply to my emails would like to work on the accessibility issue; but I think jacek is better suited. i asked if it was on his radar (GeKo: thanks, and yeah, Jacek helping would be very neat here) review gk's mingw-clang work yah know - emails and stuff - Not planning to work on this week: https://bugzilla.mozilla.org/show_bug.cgi?id=1471698 Work around binutils corrupting mingw clang binaries. https://bugzilla.mozilla.org/show_bug.cgi?id=1524742 What is Tor's thought on this? (GeKo: not high prio but it would be neat to get this fixed) mcs and brade: Last week: - Shared draft proposal for #28044 (Integrate Tor Launcher into tor-browser): https://lists.torproject.org/pipermail/tbb-dev/2019-January/000951.html - Created a patch for #29180 (MAR download stalls when about dialog is opened). - Revised patch for #28885 (notify users that update is downloading). - Started to look at the Firefox updater security audit report. This week: - #29328 (account for tor 0.4.0.x's revised bootstrap status reporting). - #29045 (ask tor to leave dormant mode). - Spend more time looking at the Firefox updater security audit report. - Respond to feedback on #28044 proposal (Integrate Tor Launcher into tor-browser). pili: Last week: - GSoC - S8 (TBA) Q4 report submitted This week: - Tor Browser Release meeting - Tor Browser Vision meeting sysrqb: Last week: - 80% complete with patch for #28329 (Bootstrapping UI) (GeKo: Yay, for getting this ready, it's a ton of work!) - Began looking at TOPL patches - Chatted with Anto about bootstrapping UI This week: - Finally, really, actually finish #28329 - Finish TOPL patch review - Integrate #28329 with TOPL (if any changes are needed) - Move onto next TBA-a3 ticket boklm: Last week: - published the releases - made patch for #29193 (obfs4 needs golang.org/x/net/http2) - made patch for #29235 (Build of https-everywhere fails because python3.6 is not available in buster anymore) - read the proposal for #28044 (Integrate Tor Launcher into tor-browser) This week: - try to get working patch for #26323 (Build 32bit Linux bundles on 64bit systems) - continue work on testsuite - some reviews - make patch for #29183 (We are using linux i686 langpacks in the linux x86_64 builds) igt0: Last week: - UI for #25764 is done, the integration side is a bit messy. - Review and tested more stuff This week: - Fix rough edges of my patch to the #25764 GeKo: Last week: - did a lot of work regarding the mingw-w64/clang toolchain: wrote patches for #28716, #29307, #29319; helped upstreaming an lld patch (https://bugs.llvm.org/show_bug.cgi?id=40582) and opened tickets for the remaining items to work on; posted bundles on #28238 to test the result - work on Torbutton integration into Tor Browser (#10760) - started to look into NSIS reproducibility issue (#29185) - reduced my email backlog - helped with the releases and dealt with blog comments - looked over the Tor Launcher proposal This week: - more work on #29185 and #10760 - looking into open issues for the mingw-w64 toolchain (SSP support, reproducibility) - begin of the month team admin stuff pospeselr: Last week: - various code reviews - #25658 (securiyt settings) UI work This week: - #25658, make all the new XUL actually do something besides look pretty - antonela: would you like a preview build of what we have so far? sisbell: Last week: - 29080/27609: TOPL - fixed more issues In TOPL based on feedback/testing - pull request being reviewed. Added content providers to tor-android-service. Started fixes based on orbot patches (in tor-browser-build). This Week: - 29312 - TBB for TOPL - 29313 - TBB for tor-android-service - Finish adding patches for tor-android-service - Will be taking PTO Friday (and possibly following Monday) Georg

1 0

Tor Browser Release Meeting: Wednesday 6th February @1900UTC
by Pili Guerra 04 Feb '19

04 Feb '19

Hi everyone, It's time for our next Browser Release meeting: Wednesday 6th February @1900UTC over at #tor-meeting We’re now looking ahead at our next Tor Browser Alpha release at the end of February as well as the security and stable releases in March. We’ll be taking requests, so please come along if you have anything you’d like to discuss. We look forward to seeing you there :) Thanks! Pili — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

1 0