July 2020 - tor-project - lists.torproject.org

[INFORMATION REQUEST] Onion Service Web Site Deployments
by Matthew Finkel 21 Jul '20

21 Jul '20

(tl;dr: We'd like more information about how onion services are deployed, and whether we should re-think about the current assumption that connections with all onion services are secure. Do you send HTTP (unencrypted/unauthenticated) traffic between the onion service and a remote web server?) Hello everyone, Recently we received a question and concern regarding how Tor Browser interacts with web sites over HTTP. Over the last few years, Tor Browser has increasingly trusted HTTP connections with a .onion address (HTTP+.onion) due to the inherent security properties of onion services. The security assumptions Tor Browser makes about these connections is based on another critical assumption: connections between the onion service and the destination web server are "secure" [0]. This assumption is correct when an onion service is run beside the web server and connections between the two components are over localhost/loopback/etc. However, onion services can connect to a remote web server instead, and when the connection between those hosts/components is not secure then Tor Browser's security assumption about the overall connection is wrong. Let's call this latter configuration an "onion tunnel" (for lack of a better term right now). We are now aware some web sites are deploying onion tunnels where the connection between the onion service and the web server is not secure. As a result, we are considering reverting [1] a change of behavior in Tor Browser where "secure cookies" may leak in plaintext under some circumstances in an onion tunnel deployment. Tor Browser treats connections with onion services as secure in other ways, as well. We'd like more information about how onion services are deployed, and whether we should re-think about the current assumption that all .onion connections are secure. Do you know of deployments where HTTP (unencrypted/unauthenticated) traffic is sent between the onion service and a remote web server? (Please email me privately if you feel more confortable with that.) Thanks, Matt [0] In this context, let's say "secure" means a connection that provides unidirectional authenticity, and bidirectional integrity and confidentiality. TLS is the typical example, but onion services provide these properties, too. [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40033

4 6

Tor Browser meeting notes, July 20th 2020
by Gaba 20 Jul '20

20 Jul '20

Hi! Tor Browser meetings are happening every Monday at 1800UTC on #tor-meeting in irc.oftc.net For the last meeting: Log: http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-07-20-18.00.log… Pad: http://kfahv6wfkbezjyg4r6mlhpmieydbebr5vkok5r34ya464gqz6c44bnyd.onion/p/tor… *************************************************************************************** This pad is shared publicly. *************************************************************************************** == Tor Browser meeting pad! == Next meeting is at Monday 27th July 1800 UTC on #tor-meeting on OFTC. July Schedule: * Monday 20 July 18:00 UTC * Monday 27 July 18:00 UTC Release meetings: https://pad.riseup.net/p/tor-browser-release-meeting-keep Tuesday July 21st 18:00 UTC Wiki page for the team: https://gitlab.torproject.org/tpo/applications/team/-/wikis/home (This channel is logged while meetings are in progress.) (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) Upcoming Releases and other important dates: Latest Releases: 2020.06.30: 10.0a2 - ESR68.10 https://blog.torproject.org/new-release-tor-browser-100a2 2020.06.30: 9.5.1 https://blog.torproject.org/new-release-tor-browser-951 Previous notes: https://lists.torproject.org/pipermail/tor-project/ (Search the tor-project mailing list archive for older notes.) == What project we are working on? == SPONSOR 58 - Tor Browser Security, Performance, & Usability Improvements Milestone: https://gitlab.torproject.org/groups/tpo/-/milestones/11 Parent ticket: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/33664 Timeline: https://nc.torproject.net/s/ow2r6cLgL7Cd9BA == Stuff to do every week == Board https://gitlab.torproject.org/groups/tpo/applications/-/boards - any change? Check reviews not taken! How reviews from last week worked? Any blocker? Tickets on needs review: https://gitlab.torproject.org/groups/tpo/applications/-/issues?scope=all&ut… Merge Requests https://gitlab.torproject.org/groups/tpo/applications/-/merge_requests ------------------------------- ---- 20 July 2020 ------------- ------------------------------- == Announcements [please date] == == Discussion [please date] == [mcs 13 July 2020] How are we tracking desktop esr78 tasks? Are we using the “Sponsor 58” keyword? Or a milestone? For example, tor-browser#33855 does not have any interesting labels; in Trac, it was a child of #33534. https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/33855 for 10.0 release MUST DO we use milestone https://gitlab.torproject.org/groups/tpo/applications/-/milestones/1 for anything 10.0 release related to sponsor 58 and MUST DO we use milestone https://gitlab.torproject.org/groups/tpo/-/milestones/11 for anything that may be able to go into sponsor 58 we use label 'Sponsor 58' 10.0 but not s58 we use label 'TB-10.0-could' Assumptions Tor Browser should make about an active connection with an onion service Fenix hosting on Gitlab (ahf) - Should we get some content into https://gitlab.torproject.org/tpo/applications/fenix/ ? the repository is empty right now and i wonder if we should sync (manually) what there is on mozilla's github? The DoH DNS resolver is blocked by the patch from https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/33962. This means that people who want to test DoH with Tor must risk DNS leaks (DoH itself is proxied, but DoH/TRR has modes that issue native DNS queries in parallel for perf tests) Gitlab CI == Status Updates == Please update the status in the same place every week under your name Name: Week of XYZ (planned): - What you planned for last week. Week of XYZ (actual): - What you did last week. Week of ABC (planned): - What you're planning to do this week. Help with: - Something you may need help with. ahf: Week of 13/6 (planned) - Fenix - Land \r\n issues. - Help with merges/reviews on sbws Week of 13/6 (actually) - SBWS reviews. - Got test instance up and running for first version of our Gitlab Lobby. - Landed \r\n patches. - Got Gitlab-CI to run for MR's and merges. - Updated my Fenix checkout and continued the fight with the build-system. Week of 20/6 (planned): - Fenix - Help with merges boklm: Week of 2020-06-15 (actual): - Made patches to use rootless containers and was able to do builds of Tor Browser for windows-x86_64 and osx-x86_64 (tor-browser-build#23631 and rbm#40001). For some unknown reason the builds based on wheezy are not working. Week of 2020-06-22 (planned): - Add some documentation for rbm#40001 and set the patch as Needs Review - Improve patch for rbm#32272 to handle Ctrl+C Mike: Week of 07/06 (planned): - gecko-dev proxy audit (#40017) Weeks of 07/06-07/20 (actual): - gecko-dev proxy audit, DNS portion (#40017 and #33962) - Hong Kong Happy Path UX discussions - PETS - SANS Tor Talk Week of 07/20 (planned): - gecko-dev proxy audit, Socket portion - Minor congestion control proposal tweaks, from Toke's latest review - Metrics meeting for extra onionperf instances mcs and brade: Week of July 13th (actual): - Commented in tor-browser#33533 (Rebase esr68 patches on top of esr78). - Closed tor-browser#33867 (Disable password manager and password generation). - For tor-browser#33534, reviewed pref changes made in recent Firefox releases. - Created patches for: - tor-browser#33852 (Clean up about:logins (LockWise) to avoid mentioning sync, etc.) - tor-browser#33855 (Don't use site's icon as window icon in Windows) - tor-browser#30682 (Adapt Intermediate Preloading for Tor Browser) Week of July 20th (planned): - Do some testing of the ESR78-based updater (desktop). - Open more issues for things found in tor-browser#33534 (Review FF release notes from FF69 to latest). - Work on some of these “child” issues. sysrqb: Week of 13 July (planned): #33939 Review and land tpo/applications/tor-browser-build!13 (updated toolchains) Update tor browser signing key Week of 13 July (actual): #33939 Had some conversations with Mozilla about providing additional support Discussion about security expectations/assumptions Tor Browser makes about onion services (resulting in #40033) Updated tor browser signing keys Landed !13 Week of 20 July (planned): #33939 #34407 review dev.tpo? Release prep GeKo: Week of July 13 (planned): Vacation Week of July 13 (actual): Vacation Week of July 20: Finish build of application services Help with release Reviews (#27105, #30832, #33954) Go over "Merge Ready" things and actually merge them :) Fix up remaining desktop toolchain issues for alpha toolchain (#34227 + child tickets contain all the things we are aware of currently) Antonela: Week of July 13 (planned): Work on S58 tickets TBA UI Review HTTPS-E Names https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40010 Review Onion Location https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40020 Week of July 13 (actual): Work on S58 tickets TBA UI https://gitlab.torproject.org/tpo/applications/fenix/-/issues/34407 https://gitlab.torproject.org/tpo/applications/fenix/-/issues/34405 https://gitlab.torproject.org/tpo/applications/fenix/-/issues/34406 Reviewed Onion Location https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40020 Week of July 20: Continue working on S58 TBA UI 👀 https://marvelapp.com/prototype/783fhfb Back to S30 - Connect to Tor ft bridges Back to S9 - dev.tpo.org acat: Week of 6th July (planned): - Revise & Rebase #33533 to 79beta and test tor-browser-spec#40001 process - 40010: Improve/Simplify HTTPS-Everywhere Onion Name Implementation - torbutton#40001: Generate tor-browser-brand.ftl from brand.properties and brand.dtd - Iterate on tor-browser#33791: Evaluate Firefox tests - I was thinking of finding the subset of FF tests that pass and putting it in some list/script, so that we can run/keep track of it. +1 (+1, yes, please) Week of 13th July (planned): - Vacations (including today). Week of 6th June (actual): - 40010: Improve/Simplify HTTPS-Everywhere Onion Name Implementation - torbutton#40001: Generate tor-browser-brand.ftl from brand.properties and brand.dtd Week of 20th July: - Iterate on tor-browser#33791: Evaluate Firefox tests - Revise & Rebase #33533 to 79beta and test tor-browser-spec#40001 process - 40024: Go over rebased patches again and reorder pieces where needed Jeremy Rand: Week of 6 July (planned): File some GitLab issues about Namecoin support in macOS/Windows. Work on getting Electrum-NMC 4.0.1 ready. Work on upstreaming Electrum-NMC patches. More NLnet coordination. Publish OTF statement on Namecoin.org. Maybe figure out why email notifications aren't working for me from GitLab. <-- notifications were disabled before, they do not work for a specific project for you? --gaba (Hmm, maybe something was fixed without me noticing, will try again. -Jeremy) Week of 6 July / 13 July (actual): File some GitLab issues about Namecoin support in macOS/Windows. More NLnet coordination. Publish OTF statement on Namecoin.org. Managed to get email notifications from GitLab working by switching mail servers. Seems my previous mail server has a STARTTLS issue that might have been the issue. Week of 20 July (planned): Work on getting Electrum-NMC 4.0.1 ready. Work on upstreaming Electrum-NMC patches. Start coding patches for porting Tor Browser Namecoin support to Windows. -- she/her are my pronouns GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

1 0

Tor Browser Release meeting on July 21st
by Gaba 20 Jul '20

20 Jul '20

Hi! We will be having a Tor Browser release meeting on Tuesday July 21st. Meeting pad: http://kfahv6wfkbezjyg4r6mlhpmieydbebr5vkok5r34ya464gqz6c44bnyd.onion/p/tor… cheers, gaba -- she/her are my pronouns GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

1 0

Network meeting, July 20th
by Gaba 20 Jul '20

20 Jul '20

Hi! Network meetings are happening every Monday at 1700UTC on #tor-meeting in irc.oftc.net. Everyone is welcome to participate in them! Meeting Log: http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-07-20-16.58.log… Contents of the meeting pad: == Network meeting pad! == Next meeting is at Monday 27th July 1700 UTC on #tor-meeting on OFTC. June Schedule: * Monday 20 July 17:00 UTC * Monday 27 July 17:00 UTC Welcome to our meeting! We meet each month at: Mondays at 1700 UTC On #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! After each week's meetings, the contents of this pad will be sent to tor-project @ lists.torproject.org. After that is done, the pad can be used for the next week. == Previous notes == (Search the tor-project mailing list archive for older notes.) 15 June: https://lists.torproject.org/pipermail/tor-project/2020-June/002877.html 22 June: https://lists.torproject.org/pipermail/tor-project/2020-June/002890.html == Stuff to do every week == Let's check and update our roadmap: What's done, and what's coming up? Any change? Board: https://gitlab.torproject.org/groups/tpo/core/-/boards S28 & S30 - Continue after October - Ahf - maybe dgoulet can do some of this after August? S55 - Nickm & dgoulet, ends 15 August Non sponsor stuff DoS defenses = Dgoulet + Asn Library Size reduction = Ahf + Dgoulet sbws = Ahf + Juga Check reviewer assignments! How reviews from last week worked? Any blocker? Here are the outstanding reviews, oldest first, including sbws: Merge requests in Core: https://gitlab.torproject.org/groups/tpo/core/-/merge_requests Let's check out 0.4.4 release status and open tickets! Tickets in 0.4.4.x with no owner. https://gitlab.torproject.org/dashboard/issues?scope=all&utf8=%E2%9C%93&sta… nickm: https://gitlab.torproject.org/dashboard/issues?scope=all&utf8=%E2%9C%93&sta… dgoulet: https://gitlab.torproject.org/dashboard/issues?scope=all&utf8=%E2%9C%93&sta… ahf: https://gitlab.torproject.org/dashboard/issues?scope=all&utf8=%E2%9C%93&sta… asn: https://gitlab.torproject.org/dashboard/issues?scope=all&utf8=%E2%9C%93&sta… Core Tor Releases: https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/CoreTorRele… == Reminders == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next releases. * Check other's people call for help in their entries. Volunteers need help. Please help them when you are around. Maybe we should have times of day when different people are responders, and expectations of who helps. ------------------------------- ---- 20 July 2020 ------------------------------- == Announcements [please date] == == Discussion [please date] == issues in https://gitlab.torproject.org/tpo/core/team/-/issues anybody interested in the gitlab/appveyor/gitlab script unification? (nickm + ahf will chat; ahf can't start this week) when are we supposed to figure out 045 scope? 046 scope? Let's plan to talk about 045 on next Thursday (30 July) === Active Proposed Policies === * Pull Request Guidelines (stalled) === Design proposals under discussion === 315: require more fields in directory documents (still waiting [6/1]) 316: flashflow (asn and nickm are reviewing, should schedule discussion with pastly. [5/18]) 317: dns (under discussion on ML [5/18]) 318: limit protovers (waiting for more commment; needs discussion [6/1]) 319: wide everything (nick replied on ml; waiting for more discussion [6/1]) 320: tap out again - Do we have a consensus to replace this with a "deprecate v2 onion services" proposal? If so, who writes it? [6/1] protover rethinking (teor's email to tor-dev) (nick needs to reply [5/18]) 321: happy families (need feedback [6/1]) 322: dirport linkspec (need feedback [6/1]) == Recommended links == == Updates == Name: Week of XYZ (planned): - What you planned for last week. Week of XYZ (actual): - What you did last week. Week of ABC (planned): - What you're planning to do this week. Help with: - Something you may need help with. PLEASE DO NOT BULK-DELETE THE OLD ENTRIES! Leave the "Planned" parts! Leave the parts for last week and this week! (feel free to delete your own stuff that's more than 1-2 weeks old) Nick: Week of 13 July (planned): - Revise my working checklists, and distribute them? - Keep an eye on blog comments for release posts - Review and merge stuff, with prioirity for 044 fixes. - Help with 044 fixes. - S55 hacking - Misc tool and technical debt hacking - Keep an eye on OpenSSL bug status (https://github.com/openssl/openssl/issues/12377) Week of 13 July (actual): - Discussed issues with API and exit-blocking - S55 hacking and review - General hacking and review - Misc tool and technical-debt hacking Week of 20 July (planned): - Catch up on emails - Still keep an eye on openssl bug status - Chutney attack! - Try to wrap up all s55 work with dgoulet - Try to make 044 progress as needed/possible - Work on checklists more. - ahf: Week of 13/6 (planned) - Fenix - Land \r\n issues. - Help with merges/reviews on sbws Week of 13/6 (actually) - SBWS reviews. - Got test instance up and running for first version of our Gitlab Lobby. - Landed \r\n patches. - Got Gitlab-CI to run for MR's and merges. - Updated my Fenix checkout and continued the fight with the build-system. Week of 20/6 (planned): - Fenix - Help with merges asn: Week of 29/06 (planned): - More PoW work - A look at v3 metrics. - More OBv3 hackathon. Someone is hacking on distinct descriptor support. - Need to adapt the gitlab process to using MRs as discussed on Thurdsay. - A bunch more reviews & merges. Week of 29/06 (actual): - Lots of network team reviews/merges/bugfixes work. - Some v3 metrics work. - More OBv3 reviews. - Triaging gitlab tickets. Week of 06/07 (planned); - Going AFK on Friday so biggest priority is to finish all reviews/merges/044 tickets by then. jnewsome: Week of July 6 (planned): - Get code-coverage PR cleaned up and merged - Implement phantom memory-marshalling optimization "for real" and merge Week of July 6 (actual): - Got code-coverage tracking merged into shadow - Reworked CI to move logic from GH proprietary config to shell scripts, and added scripts to run it locally via Docker - More work on memory-marshalling mmap optimization: wrote an IntervalMap in Rust to track mmap state Week of July 13 (planned): - Memory-marshalling mmap optimization Week of July 13 (actual): - Finished up and merged IntervalMap https://github.com/shadow/shadow/pull/886 - Started making Shadow C code callable from Shadow Rust code (bindgen + wrappers) https://github.com/shadow/shadow/pull/887 - Prototyped some different approaches of modelling Shadow's object graph in Rust https://github.com/sporksmith/dev-journal/blob/master/rust-ownership/Shadow… Week of July 20 (planned): - Write MemoryManger in Rust to implement mmap-based memory access in Shadow/Phantom - OoO next week - have fun! pastly: Week of 18 May (planned): - Finish bones of external FlashFlow repo (python?) to control tor clients that perform FF measurements - Finish bones of little-t tor changes s.t. measurement can be performed - Discuss FlashFlow with network team devs as they have questions c: Week of July 6 (actual): - fix up chutney #40002 Week of July 13 (actual): - #40002 merged in Week of July 20 (planned): - tor #21524 and other IPv6-tagged issues dgoulet: Week of 13/07 (actual): - s55, s55 and s55 (IPv6). :) Week of 20/07 (planned); - s55 - New list of fallback dirs -- she/her are my pronouns GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

1 0

Package wiki discontinuation
by Damian Johnson 18 Jul '20

18 Jul '20

Hi all. Just a quick friendly head's up that now that Trac is read-only the packages wiki I've maintained these last three years will be discontinued... https://trac.torproject.org/projects/tor/wiki/doc/packages I suspect hardly anyone used it, but if anyone would care to create a GitLab replacement the script to keep such a page up to date is located at... https://gitweb.torproject.org/doctor.git/tree/package_versions.py Cheers! -Damian

1 0

Anti-censorship meeting notes,16 July 2020
by Cecylia Bocovich 17 Jul '20

17 Jul '20

Hi! Here are our meeting minutes: http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-07-16-15.58.html And here is our meeting pad: Anti-censorship work meeting pad -------------------------------- Next meeting: Thursday July 16th 16:00 UTC Weekly meetings, every Thursday at 16:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress). == Goal of this meeting == Weekly checkin about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at Tor. == Links to Useful documents == Our anti-censorship roadmap: Roadmap: https://gitlab.torproject.org/groups/tpo/anti-censorship/-/boards The anti-censorship team's wiki page: https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/home Past meeting notes can be found at: https://lists.torproject.org/pipermail/tor-project/ Tickets that need reviews: from sponsors we are working on: All needs review tickets: https://gitlab.torproject.org/groups/tpo/anti-censorship/-/merge_requests?s… Sponsor 30 https://gitlab.torproject.org/groups/tpo/-/milestones/4 https://gitlab.torproject.org/groups/tpo/-/milestones/7 https://gitlab.torproject.org/groups/tpo/-/milestones/5 https://gitlab.torproject.org/groups/tpo/-/milestones/6 Sponsor 28 must-do tickets: https://gitlab.torproject.org/groups/tpo/-/milestones/10 possible tickets: https://gitlab.torproject.org/groups/tpo/-/issues?scope=all&utf8=%E2%9C%93&… Anti-censorship related tickets that we want other teams to fix: https://pad.riseup.net/p/tor-anti-censorship-tickets-keep <-- it will be moved into gitlab with TPO labels == Announcements == The censorship track at PETS starts at 16:40 UTC today at https://www.youtube.com/watch?v=JdDgAuuilZk and a recording of the VPN talk we're going to discuss next week is available at https://www.youtube.com/watch?v=3aSO4ZMKjmY == Discussion == Any naming suggestions for our experimental BridgeDB successor? https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/Baby-Name-Bo… == Actions == == Interesting links == Privacy Enhancing Technologies Symposium 2020 is this week. The censorship session is 16:40–17:55 UTC on Thursday. https://petsymposium.org/2020/program_UTC.php I skimmed the program for papers that look relevant to us. There's one on VPN usage, two on decoy routing, and one on rendezvous using cryptocurrency. Emotional and Practical Considerations towards the Adoption and Abandonment of VPNs as a Privacy-Enhancing Technology https://petsymposium.org/2020/files/papers/issue1/popets-2020-0006.pdf Running Refraction Networking for Real https://petsymposium.org/2020/files/papers/issue4/popets-2020-0073.pdf SiegeBreaker: An SDN Based Practical Decoy Routing System https://petsymposium.org/2020/files/papers/issue3/popets-2020-0051.pdf MoneyMorph: Censorship Resistant Rendezvous using Permissionless Cryptocurrencies https://petsymposium.org/2020/files/papers/issue3/popets-2020-0058.pdf == Reading group == We will discuss "Emotional and Practical Considerations Towards the Adoption and Abandonment of VPNs as a Privacy-Enhancing Technology" on July 23rd https://petsymposium.org/2020/files/papers/issue1/popets-2020-0006.pdf https://www.youtube.com/watch?v=jksejehBQII Questions to ask and goals to have: What aspects of the paper are questionable? Are there immediate actions we can take based on this work? Are there long-term actions we can take based on this work? Is there future work that we want to call out, in hopes that others will pick it up? == Updates == Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week. Help with: - Something you need help with. phw: This week (2020-07-16): Experimented with a generalisation of BridgeDB. ...based on "Clean Architecture": https://blog.cleancoder.com/uncle-bob/2012/08/13/the-clean-architecture.html Added a handful of new papers to CensorBib. Merged obfs4 bridge setup guide for Windows. Reviewed tpo/anti-censorship/bridgedb#40003. Merged tpo/anti-censorship/bridgedb#33647. Merged tpo/anti-censorship/bridgedb#33835. Next week: Wrap up tpo/anti-censorship/wolpertinger#34259. Help with: cecylia (cohosh): last updated 2020-07-16 Last week: - PETS 2020 conference participation and artifact committee stuff - Getting really bogged down with sponsor 28 evaluation work - some snowflake mobile UI discussion and reviews - opened a ticket to implement more NAT discovery at browser proxies (snowflake-webext#13) - ran some performance tests on a symmetric NAT to check for improvements from #34129 (#33666) This week: - take a look at #25595 - NAT discovery at proxies (snowflake-webext#13) - snowflake sponsor 28 evaluation work - maybe take a look at snowflake#21314 or some other blockers on #19001 - continue with GetTor + BridgeDB refactor Needs help with: - review of tor-browser-build#40016 (i'll ping the applications team) juggy : This week: - Dig into the algorithm for how BridgeDB distributes bridges Next week: - Implement audio captchas in moat, figure out how to reduce audio captcha request size - Keep studying BridgeDB to write architectural overview Help with: arlolra: 2020-06-11 Last week: - Next week: - follow ups to #33365 - start on #31201 Help with: - dcf: 2020-07-16 Last week: - reviewed RFC 5780–compatible STUN server for Snowflake broker. - https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - commented on STUN server selection for Tor Browser - https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - archived Snowflake WebExtension 0.4.0 Next week: - find out what went wrong with trying to give cohosh CDN access (snowflake#30510) - set up an etherpad for public bug reporting and link it from https://snowflake.torproject.org/#bugs (snowflake#34435) Help with: Antonela: 2020-07-16 - (S28) Snowflake Android App UI https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - (S30) Making bridges.tpo looks like tpo.org https://gitlab.torproject.org/tpo/anti-censorship/bridgedb/-/issues/34322 - (S30) Planning activities for the user group in HK (happening next week): - Run emma https://gitlab.torproject.org/tpo/ux/research/-/blob/master/scripts%20and%2… - Discovery issues with Bridges flow - working on the script https://gitlab.torproject.org/tpo/ux/research/-/issues/4 agix:2020-07-02 Last week: -Worked on #27984 Next week: -Work on #34318 Help with: -Review of #27984 (It's just a feedback implementation) hanneloresx: 2020-06-25 Last week: - Read existing documentation for BridgeDB. Get acclimated to GitLab. - Started investigating #32117 - Filed and fixed #40003 Next week: - Work on #32117 - Work on #33727 Help with: - thymbahutymba: 2020-04-02 Last week: - CI/CD pipeline for multiarch docker images, which has a problem with the apt tor version even though the apt repository have been changed into the Dockerfile. Next week: Help with: HashikD: 2020-07-16 Last week: - Made designs for Snowflake mobile: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - #6 Showing users stat about how many clients they served in the past 24 Next week: - Turn Designs in to code - Contemplating Help with: -

1 0

Metrics meeting notes, July 16th
by Gaba 16 Jul '20

16 Jul '20

Hi! Metrics Meetings are happening every Thursday at 15UTC in #tor-meeting in irc.oftc.net Next meeting will be on July 21st and you are all welcome to come! Today we had a very short meeting but woswos presented the project they are working one. Check it out: https://dashboard.captcha.wtf/ Here are the minutes for the meeting of July 16th: Log: http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-07-16-14.59.log… Public pad URL is: https://pad.riseup.net/p/tor-metricsteam-2020.1-keep And here is the pad notes: Links: Metrics Team wiki page: https://gitlab.torproject.org/tpo/metrics/team OnionPerf board: https://gitlab.torproject.org/tpo/metrics/onionperf/-/boards OnionPerf milestone: https://gitlab.torproject.org/groups/tpo/metrics/-/milestones/1 All Metrics Roadmap: https://gitlab.torproject.org/groups/tpo/metrics/-/boards Next meeting: Thursday, July 21st, 15 UTC ----------------------------------------------------- Agenda Thursday, July 16th, 15 UTC ----------------------------------------------------- Data portal UX research Woswos project: https://dashboard.captcha.wtf/ -- she/her are my pronouns GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

1 0

Tor Wiki
by Gaba 15 Jul '20

15 Jul '20

Hey! I have been migrating and updating the wiki from trac into Gitlab. I want to give a brief update on where we are at. Main wiki for The Tor Project is at https://gitlab.torproject.org/tpo/team . It has links to all the other wikis from groups and projects as well as official resources mantained by The Tor Project. Inside each group there is a wiki for that group: Anti-censorship - https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/home Applications - https://gitlab.torproject.org/tpo/applications/team/-/wikis/home Community - https://gitlab.torproject.org/tpo/community/team/-/wikis/home Metrics - https://gitlab.torproject.org/tpo/metrics/team/-/wikis/home Network - https://gitlab.torproject.org/tpo/core/team Network Health - https://gitlab.torproject.org/tpo/network-health/team Sysadmin - https://gitlab.torproject.org/tpo/tpa/team/-/wikis/home UX - https://gitlab.torproject.org/tpo/ux/team/-/wikis/home Operations - https://gitlab.torproject.org/tpo/operations/team/-/wikis/home And inside each project we should have a wiki for specifics of that project. for example: https://gitlab.torproject.org/tpo/metrics/onionperf/-/wikis/home The projects we are working on this year are at: https://gitlab.torproject.org/tpo/team/-/wikis/Sponsors-2020 And past Tor meeting notes and info are at https://gitlab.torproject.org/tpo/team/-/wikis/Meetings There may be missing info or not updated (and I may still be working on it when I have time). If you spot anything please update it or send me a message. thanks! gaba -- she/her are my pronouns GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

1 0

User feedback program: past, present and future (2018-2021)
by gus 14 Jul '20

14 Jul '20

Hi, In the last three years, Community and UX teams have been working together to collect user feedback and integrate it into our products while preserving Tor users' privacy. In this email, we're going to explain the present, how it works, and our next phase. ## 1. User Advocate Since 2018, the Community team works with an intern from Outreachy[0] as a User Advocate. You can read more about this project here: "Help us support our users"[1]. Every month, the User Advocate submits to the tor-project mailing list an User Feedback Report with questions and comments from our Frontdesk system and other sources (Reddit, Tor stack exchange, Google Play, blog comments, IRC #tor, etc.). If you were around at that time, maybe you remember Pari presented an user feedback research[2] at the Tor Dev Meeting in Rome, in 2018. You can read our previous user feedback reports here: Cybelle (2018)[3], Wayward (2019)[4], and Cleopatra (2020)[5]. As Nicolei started last month, on May 19th, he sent his first user feedback report[6]. Nicolei's internship will end in August this year. And Outreachy will open a new selection process in September/October. After the report is sent, we discuss the issues and comments at UX and/or Community team meetings on IRC (#tor-meeting). For some of these issues, we open new tickets in Gitlab, our new bug tracker, and the user advocate adds comments to open issues. For example, we have some tickets to improve the website, Tor Browser and other products. We have plans to introduce a global label [user-feedback] to make explicit which issue came directly from users. There's also a proposal to use Discourse, but so far, we only discussed it a few times during the Gitlab process and at the last all hands, and mostly to improve our blog moderation and user feedback. ## 2. User Research: UX feedback and Tor training in the Global South As part of sponsor work, the Community and UX teams have met users face to face during our digital security training in the Global South. We wrote about it and also added some metrics of this project in a blog post[7], "Reaching people where they are." The user research reports are publicly available here[8], and the users we've met during this project informed the work we did to outline User Personas. Personas were made not to frame our work to any target, but instead to reach a common understanding across teams of "Who are Tor users?" and who we are designing for. We also did a session about Users Personas[9] in Stockholm Dev Meeting (2019). We sent a more detailed narrative report regarding the activities to all Tor core contributors in January (2020), where outlines each activity we ran carefully in all the countries we visited. The new Community portal reflects the first step in understanding the different roles we host in our community. The intent is to serve as a home for non-savvy technical people but also technical people as relay operators or onion sites admins to collaborate with Tor. Furthermore, we made public and gave open access to the material at the training section in the Community portal, where we collected and organized the materials that we have used during our travels and meetings with groups. All this content was co-designed with our community based on their needs. The most significant difference from Frontdesk, where users come to us to report issues, this program works with our team members to reach out and go to communities to run usability tests and interviews with users. Both ways of collecting user feedback complement each other. We not just collect feedback but also teach about digital security holistically, to encourage critical users to make decisions by themselves. Threat modelling exercises to understand digital security assets have been run with communities in the Global South. The point about the whole program it's not just a way to collect software feedback. Part of our non-profit work is to educate users about privacy, anonymity and technology as a way to promote and advance human rights. We developed a program focused on building a network of human rights defenders, journalists, whistleblower platforms, digital security trainers, hackerspaces, activists, marginalized communities, and having a stable relationship with them, the people who trust and most need our software. In the last year, we built partnerships in our first Training Program, where NGOs and other organizations in the Global South were running Tor training and UX tests by themselves. We had training in Brazil, Colombia, Mexico, Uganda, Indonesia, and Tanzania. We developed a process of continuous improvement for these organizations to collect feedback from their assistants about our products and the decision they just ran[10]. ## 3. Next steps The next phase of this sponsor will happen from July 2019 - 2020, where we will focus on supporting our partner organizations during this Covid-19 pandemic, the migration to secure spaces for running their activities online and also the spread of remote user research made by them and for us on our recently released improvements in Tor Browser for desktop and Android, and the entire Tor Project new portals. In July, Narrira Lemos will be back to work with us as a fellow from Bertha Institute. The work Nah will be running will be focused on mobiles and per se Tor Browser for Android. She also will give support (as she did in 2019) on coordinating user research with communities. Antonela and Gus UX and Community Team ## Notes [0] Outreachy https://www.outreachy.org/ [1] https://trac.torproject.org/projects/tor/wiki/Outreachy#TheProjects [2] https://gitlab.torproject.org/legacy/trac/-/wikis/org/meetings/2018Rome/Not… [3] Jun 2018 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2018-June/001829.html Jul 2018 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2018-July/001871.html Aug 2018 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2018-August/001940.html [4] Oct 2018 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2018-November/002058.html Nov 2018 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2018-December/002125.html Dec 2018 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2019-January/002176.html Jan 2019 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2019-February/002230.html Feb 2019 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2019-March/002259.html Mar 2019 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2019-May/002311.html Apr 2019 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2019-May/002333.html [5] Dec 2019 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2020-January/002645.html Jan 2020 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2020-February/002688.html [6] https://lists.torproject.org/pipermail/tor-project/2020-June/002887.html [7] https://blog.torproject.org/reaching-people-where-they-are [8] https://community.torproject.org/user-research/ [9] https://gitlab.torproject.org/legacy/trac/-/wikis/org/meetings/2019Stockhol… [10] https://gitlab.torproject.org/tpo/ux/research/-/tree/master/community https://lists.torproject.org/pipermail/tor-project/2020-May/002850.html -- The Tor Project Community Team Lead http://expyuzz4wqqyqhjn.onion/

1 0

Anti-censorship team monthly report: June 2020
by Philipp Winter 14 Jul '20

14 Jul '20

Hi all, Our June report is already on the blog (including a Chinese translation): https://blog.torproject.org/anti-censorship-june-2020 ...but I forgot to send it to this mailing list. Here's what we accomplished in June 2020: Snowflake ========= * Snowflake is now available on Android for alpha versions of Tor Browser: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/30318 * Snowflake proxy app on Android is now able to relay data back and forth. - Updated wiki with information on the project: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - Started working on a UI that lets users add custom STUN, broker, relay URLs: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - Implemented relaying data back and forth between client and Tor relay: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - Establishing a connection with WebSocket. https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - Handling connection termination or failures from WebRTC. https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - Establishing a connection with the client using WebRTC. https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - Created a service to do the work in the background and implemented a wakelock. https://trac.torproject.org/projects/tor/ticket/34268 - Chose libraries for the project: Google's WebRTC library for WebRTC, Retrofit for HTTP calls, OkHttp for WebSocket, RxJava for reactive programming. * Implemented NAT discovery for Snowflake clients. https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… * Investigated and abandoned attempts to do NAT discovery for browser-based proxies. https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… BridgeDB ======== * Added a favicon to bridges.torproject.org. https://gitlab.torproject.org/tpo/anti-censorship/bridgedb/-/issues/19774 * Made progress towards making BridgeDB's email autoresponder more robust to quoted emails. https://gitlab.torproject.org/tpo/anti-censorship/bridgedb/-/issues/33835 * Made lots of progress towards having BridgeDB report internal metrics. https://gitlab.torproject.org/tpo/anti-censorship/bridgedb/-/issues/31422 * Added a feature that allows us to blacklist bridges that run a given set of Tor versions (e.g., if they suffer from problematic bugs). https://gitlab.torproject.org/tpo/anti-censorship/bridgedb/-/issues/29184 * Cleaned up and rebased a patch that updates BridgeDB's dependencies. https://gitlab.torproject.org/tpo/anti-censorship/bridgedb/-/issues/33647 * Made progress towards getting BridgeDB to parse and take into account bridge blocking information. https://gitlab.torproject.org/tpo/anti-censorship/bridgedb/-/issues/34260 GetTor ====== * Investigated a path towards adding GetTor to BridgeDB. https://gitlab.torproject.org/tpo/anti-censorship/bridgedb/-/issues/3780 * Made some progress towards fixing GetTor's Twitter responder. https://gitlab.torproject.org/tpo/anti-censorship/gettor-project/trac/-/iss… * Fixed a typo in the GetTor Gitlab provider links. Updated GetTor for Tor Browser 9.5 release. Outreach ======== * Philipp gave a talk about our anti-censorship work as part of OONI's Internet Measurement Village 2020. https://www.youtube.com/watch?v=g6xEfNHkFKY * Published May 2020 team report as blog post. https://blog.torproject.org/anti-censorship-may-2020 * Had a meeting and discussion with V2Ray developers. https://github.com/net4people/bbs/issues/36 UX == * Made progress towards extending anti-censorship personas. https://gitlab.torproject.org/tpo/ux/trac/-/issues/32811 * Moved forward with censorship scenarios that we will address as part of our Sponsor 30 grant. https://gitlab.torproject.org/tpo/anti-censorship/trac/-/issues/40003 * Created draft for "get bridges" user research. https://gitlab.torproject.org/tpo/ux/research/-/issues/4 Miscellaneous ============= * Improved emma's Makefile. https://gitlab.torproject.org/tpo/anti-censorship/emma * The Tor Project transitioned from Trac (our previous bug tracker) to Gitlab. * Moved our obfs4 bridge Docker image to new organization account. https://hub.docker.com/orgs/thetorproject

1 0