March 2020 - tor-project - lists.torproject.org

Are there countries where using Tor is illegal?
by Cristian Consonni 11 May '25

11 May '25

Hi, (Sorry if this question has already been asked in the past, feel free to point me to the relevant resources.) I know that the legal FAQs by the EFF state that: «we believe that running a Tor relay — including an exit relay that allows people to anonymously send and receive traffic — is legal under U.S. law.»[1] I also know there is a list of countries for which there is legislation that exclude communication service providers from liability. They are indicated in the Legal of the Tor Exit Guidelines page[2], they are USA, Germany, Netherlands, Austria, France, and Sweden. >From some articles in the press[3a][3b] it may be illegal - depending on how you interpret the wording[*] - to use Tor (and other technologies such as VPNs or proxies) in the UAE, with fines ranging in the millions of dirhams (hundreds of thousand of dollars). A couple of weeks ago it was discussed - on this list as well - that a law was introduced to the state parliament to ban Tor[4a][4b]. This follows a case of some months ago of a Russian Tor exit node operator being arrested for inciting mass riots and terrorism[4c][4d]. The idea of blocking VPNs or Tor seems to have already been considered in the past[4e]. This infographic about pluggable transports[5] suggests access to the Tor network is censored or limited in China, Uzbekistan, Iran, and Kazakhstan. Tor being censored orblocked may be different from it being illegal. What about other countries? Is there a place where I can find more about this topic? Cristian [1]: https://www.torproject.org/eff/tor-legal-faq.html.en [2]: https://trac.torproject.org/projects/tor/wiki/doc/TorExitGuidelines [3a]: http://www.emirates247.com/news/emirates/dh500-000-fine-if-you-use-fraud-ip… [3b]: http://news.softpedia.com/news/people-caught-using-vpns-tor-or-proxies-in-t… [*]: «Whoever uses a fraudulent computer network protocol address (IP address) by using a false address or a third-party address by any other means for the purpose of committing a crime or preventing its discovery» [4a]: https://lists.torproject.org/pipermail/tor-talk/2017-June/043293.html [4b]: https://trac.torproject.org/projects/tor/ticket/22055 [4c]: https://lists.torproject.org/pipermail/tor-talk/2017-April/043109.html [4d]: https://techcrunch.com/2017/04/24/dmitry-bogatov-tor-russia/ [4e]; https://torrentfreak.com/vpn-and-tor-ban-looming-on-the-horizon-for-russia-… [5]: https://www.torproject.org/images/PT/2016-07-how-to-use-PT.png

4 3

February Fundraising Report
by Sarah Stevenson 28 Apr '20

28 Apr '20

Below you will find the Fundraising Team's February report. Please let us know if you have any questions! ## Grants DRL: We have been working on submitting two full proposals to DRL, one for usability (joint project with Tails & Guardian Project) and another for scalability. We will submit these at the beginning of March. Zcash Foundation: Zcash Foundation granted us $50,000 to work on the Specification phase of the Walking Onions proposal[1]. Thank you Chelsea for making this connection, and to Nick for helping to write the proposal and advocate for the work. We still need funding for the proof-of-concept and implementation phases of Walking Onions. If you know someone, or some entity, that might be interested in supporting this work, please let us know! Nathan Cummings Foundation: A joint proposal with FPF we submitted was declined. DIAL Open Source Center: We submitted a small proposal to DIAL to help support the Walking Onions work. OTF: We are working on a third round of OTF revisions on the Tor Browser proposal. We submitted a Learning Lab application to help publicize the onion services work in Sponsor 30. OTF also agreed to fund an in-person meeting to do some work on DDoS protections as it pertains to high profile onion services. We submitted some informal requests to the Judith Neilson Institute for Journalism & Ideas and the Omidyar Foundation. We also met with the Internet Society Foundation. ## Donate Buttons on Website We closely monitor organic donations made via donate.torproject.org. By ‘organic’ we mean non-monthly donations generated primarily via donate links throughout our webpages. It is important to track this income because it accounted for $231,472 in FY18, $239,479 in FY19, and $334,418 so far in FY20. Small changes to our web pages can affect this income. This graph[2] shows average daily online income per month. This clearly illustrates the importance of our EOY campaign and the call to action on about:tor. There are a few other events to note in the past year. The new website launched in March 2019. The first iteration did not include a prominent donate button and the average daily income decreased until we made the donate button yellow April 26th. Then average daily income increased modestly, and increased significantly after May 26th when we added the donate link to about:tor. Since that addition, we have been averaging $600 per day in organic donations (except during the campaign when the average was significantly more.) At the end of February 2020, we saw a sharp decline in these organic donations. We suspected the redesign of /download was partially responsible. Antonela quickly added the yellow donate button back to that page and we saw donations go back up to about where they were in early February. This prompted us to take a look at other modifications and we decided to highlight the donate language on /thank-you and the donate language on about:tor will be updated upon the next release. We are also beginning plans to update donate.torproject.org and are working with Giant Rabbit to be able to make those changes ourselves. ## Events We are still planning for the major donor event in San Francisco March 26th and foundation lunch in New York April 13th. Hopefully covid-19 will not alter those plans. ## Newsletter/Email list We are still seeing around 10,000 people join our email list each month and now have over 179,000 subscribers. Since the list was so large, it was taking around 24 hours to send an email message to the whole group. Giant Rabbit made some changes to our system and now a bulk email is delivered in around 3 hours. Each new subscriber gets a welcome email a day or two after they join the list and then are offered a sticker pack for a $17 donation a few weeks after that. [1] https://grants.zfnd.org/proposals/1642205075-walking-onions-scaling-the-tor… <https://grants.zfnd.org/proposals/1642205075-walking-onions-scaling-the-tor…> [2] https://trac.torproject.org/projects/tor/attachment/wiki/org/teams/Fundrais… <https://trac.torproject.org/projects/tor/attachment/wiki/org/teams/Fundrais…> Sarah Stevenson (she/her) Fundraising Director The Tor Project sstevenson(a)torproject.org Take back the internet with Tor. https://donate.torproject.org/ Public Key: 93B3 AC08 4257 FA3D D4BB 8E95 CC08 5DBA C015 612A

2 2

Tor Browser Team Meeting Notes, 06 January 2020
by Matthew Finkel 13 Apr '20

13 Apr '20

Hello everyone, Our first meeting of 2020 was held on 6 January. 2020 will be an exciting year for Tor Browser! We have a busy year ahead of us and we're hitting the ground running. The logs are available at http://meetbot.debian.net/tor-meeting2/2020/tor-meeting2.2020-01-06-18.29.l… Summary: 1) Discussed how we can move forward with implementing per-site settings 2) Discussed how long it will take before we start writing 2020 instead of 2019 on documents 3) Discussed future plans for Namecoin integration (adding more platforms, timeline for adding in Alpha, etc.) With regard to (3), Namecoin is currently available in Tor Browser Nightly builds on Gnu/Linux 64-bit. Please provide feedback is you try it! ================================ Week of January 6, 2020 Discussion: How long will we be dating things 2019 when signing documents? Will this decade be as roaring as the 1900s version? - if it will be, is that a good thing pospeselr: Last weeks: - #31855 (remove end of year fundraising campaign) - small progress on Mozilla 1601040 and 1594455 This week: - continue baby-sitting above Mozilla tickets - #30570 (implement per-site security settings) - what do folks think about the discussion in the ticket? - tldr: looks like to build something consistent with the design laid out there requires a lot of work basically reimplementing what NoScript does, or heavily refactoring/redesigning NoScript's internals :/ - look into umatrix extension as an alternative to NoScript - put umatrix findings in a doc or on the ticket mcs and brade: Last few weeks: - #32636 (Clean up locales shipped with Tor Launcher). - Code review for #31855 (Remove EOY Campaign from about:tor). - Sponsor 27 work: - #19757 (permanent storage of client auth keys and associated management UI). - Time off for Christmas and end of year. This week/upcoming: - #19757 (permanent storage of client auth keys and associated management UI). boklm: Last few weeks: - Made patches for: - #32768 (Create a build-infos.json file containing firefox platform_version and buildid) - #32805 (Make creation of downloads.json optional) - Worked on #25102 which is almost finished (Add script to sign nightly build mar files, generate update-responses xml and publish the new version) - Looked at blog comments This week: - Help with publishing new releases - Finish work on #25102 (script to sign nightly build mar files, generate update-responses xml and publish the new version) and remaining things for #18867 (Ship auto-updates for Tor Browser nightly channel) - Try #32768 (Make script to optimize upload and download of Tor Browser releases) - Look at macOS signing situation sysrqb: Last few weeks: Mostly distracted by holidays, family, etc. Preparing releases for this week This week: Releases Reviewing roadmap for Q1 2020 Finishing remaining items we didn't finish last year Jeremy Rand: Last few weeks: #30558 is merged, yay. Attended 36C3; gave a talk and workshop; ran into boklm there :) This week: Ponder next steps for Namecoin now that the initial merge to Linux Nightly has happened. ================================ - Matt

1 11

next gitlab meeting
by Gaba 01 Apr '20

01 Apr '20

Hey! We are still working on any available time on having a migration from trac :) There has been some blockers on the way BUT Alex is moving forward with it. We are going to be meeting on Wednesday April 1st at 1700 UTC in #tor-meeting in irc.oftc.net The agenda will be - where we are at - what was able to get resolved and how and what is not going to get resolved - next steps cheers, gaba [0] context: https://nc.torproject.net/s/3MpFApQ7cwfrPZE -- Project Manager: Network, Anti-Censorship and Metrics teams gaba at torproject.org she/her are my pronouns GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

2 1

S27 meeting today: Tuesday 31st March @ 15UTC
by Pili Guerra 31 Mar '20

31 Mar '20

Hi everyone, This is your weekly reminder of our S27[1] (Onion Services) meeting today. This will likely be the last meeting on this sponsor for a while as we wrap up the implementation of this project. I look forward to seeing you there! Thanks, Pili [1] https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor27 <https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor27> — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

1 0

Network health meeting notes, 30 Mar 2020
by Georg Koppen 30 Mar '20

30 Mar '20

Hi! Yesterday, we had our last weekly meeting in March 2020 in #tor-meeting. The IRC log can be found at: http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-03-30-18.00.log… Here come the items from our pad (both statuses and discussion points): Discussion: -Do we have criteria for badexit flag in case of non-malicious behavior? See for instance thread on tor-relays <https://lists.torproject.org/pipermail/tor-relays/2020-March/018276.html>ff. Should we essentially overrule dir-spec here, defining what a(n) (good) exit is? [GeKo: it seems we are in favor for creating some policy according to which we badexit relays even though they formally fulfill the dir-spec requirements; I put that on my plate and loop the folks on the network-health list in] Statuses: GeKo: Last week: -sbws work (mainly reviewing #30905) -more work on issues encountered with our bad relay scanners (dug a bit more into #33663; might be a check/exitscanner bug) -more work on resource load failures caused by Cloudflare (for the Coil folks) -badexiting relays for #32864; follow-up This week: -review follow-up patches for #30905, finishing #33009 -work on #33758 (more fixups/investigations for issues with bad relay scanners) -work on #33696 (integrate badexiting into badconf-entry.py script) -more work on exit relay blocking problem (#33500 etc.) -monthly team admin stuff -ggus: the eff got back to us how should we proceed? [GeKo: ggus goes over the mail and sets up a pad where we then can collaborate] Gus: Last week: - Worked with Steph on tweet/announcement: https://twitter.com/torproject/status/1243251875601952771 This week: - Review EFF Legal FAQ Georg

1 0

Tor Browser Release meeting this week: Wednesday 18th March @ 18UTC
by Pili Guerra 30 Mar '20

30 Mar '20

Hi everyone, We’ll be having our Tor Browser release meeting this week. This week we’re moving the time of this meeting to its summer time schedule: Please join us on Wednesday 18th March @ 18UTC on #tor-meeting. Thank you! Pili — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

1 1

Tor Browser Team Meeting Notes, 23 March 2020
by Matthew Finkel 30 Mar '20

30 Mar '20

Hello everyone, We held our weekly meeting on 23 March, 2020. The meeting log is available at http://meetbot.debian.net/tor-meeting2/2020/tor-meeting2.2020-03-23-17.59.l… During that meeting we improving our release process and which responsibilities can be distributed differently across members of the team. ================================ Week of March 23, 2020 Discussion: Please tag transition/migration tickets for S58 Retrospective Dockshackathon this week - Is there anything missing in the Tor Browser Manual we could add during this week? Release management pospeselr: Last week: - #19251 code review - #33534 (release notes/tickets review) - Made it halfway through FF74 tickets, should have the ticket short list by EOD This week: - #33534 -> rest of FF74 and FF75 mcs and brade: Last week: - Code reviews. - Revised patch for #19251 (onion services error page). - Helped with #33672 (Force include https-everywhere in incremental mar update). - Responded to Thomas Klausner (NetBSD) on tbb-dev (Tor Launcher questions). This week/upcoming: - Review latest patch for #21952 (Onion-Location). - Review latest patch for #28005 (.onions in HTTPS-E). - Review rebased updater patches (#33533). - Revisit #30732 (“Your Firefox is critically out of date" banner). - Revisit #32418 (on every start TB complains that it can't update). - Investigate #29630 (TorBrowser creates empty directory in "/tmp”). sisbell: Last Week: #33685: zlib support for Android (in review) #31499: Update libevent 2.1.11: tested across platforms, don’t need osx path with latest (in review) #28765: Libevent for Android: update rbm,conf so we include options across all platforms (windows, Mac, linux). Verified building for each. (In review) #28766: tor build for android, includes zlib support (in review) Fenix: #33557: Android Toolchain for Fenix: fix bin path #33561: Upgrade openssl to use Android NDK 21 This Week: Follow up on reviews of Android Tor Support (priority) Fenix: #33564, #33565, #33562 -libevent, zstd, lzma for NDK 21 #33626: Add TBB project for GeckoView Jeremy Rand: Last week: - Got some test reports via r/Namecoin. Much of it was constructive. - Lower productivity than usual due to isolation precautions to avoid COVID-19. This week: - Relay r/Namecoin test reports to tor-talk mailing list, file bugs where appropriate, ask for additional clarification from testers where appropriate. - Try asking for more test reports via Twitter, maybe elsewhere in my social graph. boklm: Last week: - Made a patch for #33672 (Force include https-everywhere in incremental mar update) - Rebased patch for #25102 (Add script to sign nightly build mar files, generate update-responses xml and publish the new version) - Helped with new releases - Monitored blog comments This week: - Some reviews - Work on proposal for quilt workflow - Work on testsuite setup - Work on setup of automatic rebasing of tor-browser patches on mozilla-central - Help with getting rebased patches from #33533 building in tor-browser-build pili: Last week: - trac triage - Tor Browser release meeting - Started putting together Sponsor58 page for transition to Fenix: https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor58 - Started tagging S58 tickets: https://trac.torproject.org/projects/tor/query?sponsor=^Sponsor58&col=id&co… This week: - trac triage - S58 - Docshackathon - S27 March report sysrqb: Last week: - Release prep for 9.0.7 - Firefox bug - Chatted with sisbell about Fenix - Made progress on macOS signing/notarization - Investigated https-everywhere downgrade question This week: - Releasing 9.0.7, release prep 9.5a9, releasing 9.5a9 - Finally looking at acat's rebasing work? acat: Last week: - Revised #28005 (Officially support onions in HTTPS-Everywhere to use securedrop testing update channel.) - Revised #21952 (Onion-location) - Updated Onion-Location spec to match current implementation. This week: - Possibly revise #28005, #21952. - Try to get #33533 working in tor-browser-build (will try boklm suggestion) - Get browser unit tests working for #33533? ================================ Thanks, Matt

1 0

Tor Browser Team Meeting Notes, 16 March 2020
by Matthew Finkel 30 Mar '20

30 Mar '20

Hello everyone, We held a weekly meeting on 16 March, 2020. The meeting log is available at http://meetbot.debian.net/tor-meeting2/2020/tor-meeting2.2020-03-16-17.59.l… During the meeting we discussed how Javascript should be handled and disabled on the Safest security level. ================================ Week of March 16, 2020 Discussion: - Should we be using Trac’s merge_ready status for tickets for which review is complete? Who should change a ticket’s state to merge_ready? - Javascript configuration on Safest pospeselr: Last week: - release note reviews (#33534) - windows update/platform documentation updates This week: - finish release note reviews (#33534) GeKo: Last week: - not much done; a bit help with the JS bypass bug This week: - more design doc update (#25021) - test new mar signing key (#33173) - maybe working on reproducibility of lucetc (#33488) mcs and brade: Last week: - Code reviews. - Reviewed the manual update instructions, etc. for the TB 9.5a7 release. - Replied to email query from Guardian Project people r.e. implementing Moat. This week/upcoming: - More code reviews, including rebased updater patches (#33533). - Respond to review comments in #19251 (onion services error page). - Revisit #30732 (“Your Firefox is critically out of date" banner). - Revisit #32418 (on every start TB complains that it can't update). - Investigate #29630 (TorBrowser creates empty directory in "/tmp”). acat: Last week: - Reviews (#33482: Update about:tor donate string, #19251: TorBrowser might want to have an error page specific to when .onion links fail) - Made patch for #33342 (Disconnect search addon causes error at startup) - Revised #28005 (Officially support onions in HTTPS-Everywhere) to use securedrop testing update channel. This week: - Revise #21952 (Onion-location: increasing the use of onion services through automatic redirects and aliasing) to address review comments. - Whatever is most useful for Tor Browser ESR -> regular release migration (or Fenix): - Try to get a tor-browser-build for #33533 (Rebase Tor Browser esr68 patches on top of mozilla-central) - Take a look at fixing tests? - ... sysrqb: Last week: - Released 9.5a7, 9.0.6, and 9.5a8 - Investigated Javascript bug on Safest security level This week: - Close-out javascript bug - Release prep for 9.0.7 and 9.5a9 - Respond to sisbell regarding Fenix questions - Look at acat's work with rebasing patches boklm: Last week: - Tested updates in nightly builds: it seems to be working correctly - Opened upstream pull request for #33535 (Patch openssl to use SOURCE_DATE_EPOCH for copyright year) - Looked at possible workflow with quilt - Helped with new releases - Looked at blog comments This week: - Try to get rebased patches from #33533 building in tor-browser-build - Set branch for #25102 in needs_review (Add script to sign nightly build mar files, generate update-responses xml and publish the new version) - Work on testsuite setup - Work on setup of automatic rebasing of tor-browser patches on mozilla-central - Work on proposal for quilt workflow - Some reviews Jeremy Rand: Last week: - Relayed some Namecoin feedback from Twitter and LinuxReviews to tor-talk. - Posted on r/Namecoin asking for more feedback, hopefully some more feedback will trickle in soon. - Hacked around with #32355 some more. This week: - Wait for more feedback on the Namecoin integration in Nightly. - Maybe hack around with #32355 some more. sisbell: Last Week: - #33556: TBB for android-components - After integrating with fenix build, I identified a number of unneeded Mozilla project dependencies and removed them. Various plugin fixes. Package artifacts as maven repo. Cleaned up patches. I also identified a couple of areas further of investigation. - #33184: Support for fenix - various plugin fixes, removing of dependencies, now using android-component artifacts locally, learning build internals This Week: - #33184: Fenix - get complete build working (this will still use precompiled artifacts from Mozilla’s gecko view aar) - #33626: TBB for GeckoView - start setting this up so I can identify build dependencies for this (rust, clang). Open related issues. pili: Last week: - trac triage - Browser team February report This week: - trac triage - Tor Browser release meeting ================================ Thanks, Matt

1 0

This week, time zone + Americans = confused
by Roger Dingledine 28 Mar '20

28 Mar '20

Hi folks! Here is your notice that this week, if you have a meeting that involves UTC times and involves Americans, you should expect confusion. (The time in the US and maybe some other places just changed today, but UTC didn't.) Here is your chance to take this information and do something proactive and smart with it. :) I hear the Europeans will go through the reverse version of this confusion on March 29. Be safe, --Roger

1 1