- tor-project - lists.torproject.org

Anti-censorship team meeting notes, 2026-09-17
by meskio 17 Sep '26

17 Sep '26

Hey everyone! Here are our meeting logs: https://meetbot.debian.net/tor-meeting/2026/tor-meeting.2026-09-17-16.00.ht… And our meeting pad: Anti-censorship -------------------------------- Next meeting: Thursday, 24 16:00 UTC Facilitator: cohosh ^^^(See Facilitator Queue at tail) Weekly meetings, every Thursday at 16:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress) This week's Facilitator: meskio == Goal of this meeting == Weekly check-in about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at the Tor Project and Tor community. == Links to Useful documents == * Our anti-censorship roadmap: * Roadmap:https://gitlab.torproject.org/groups/tpo/anti-censorship/-/boards * The anti-censorship team's wiki page: * https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/home * Past meeting notes can be found at: * https://lists.torproject.org/pipermail/tor-project/ * Tickets that need reviews: from projects, we are working on: * All needs review tickets: * https://gitlab.torproject.org/groups/tpo/anti-censorship/-/merge_requests?s… * Projects the TPI anti-censorship team is working on: * Project 146: Expanding access to digital media through the use of secure communications, infrastructure, tools, and techniques * https://gitlab.torproject.org/groups/tpo/anti-censorship/-/issues/?label_na… * Project 170: Monitoring and reporting on censorship against the Tor network * epic: https://gitlab.torproject.org/groups/tpo/-/epics/17 * Project 201: Signaling channels * board https://gitlab.torproject.org/groups/tpo/-/boards/2675?label_name[]=Project… == Announcements == * == Discussion == * About reviewing rust-pt and Rust-based Pt framework * https://lists.torproject.org/mailman3/hyperkitty/list/tor-dev@lists.torproj… * https://gitlab.torproject.org/pryty26/rust-pt * rob and 4i_un are going to review it and provide feedback == Actions == * == Interesting links == * Snowflake users 2x in the past week * https://metrics.torproject.org/userstats-bridge-transport.html?start=2026-0… == Reading group == * We will discuss "" on * * Questions to ask and goals to have: * What aspects of the paper are questionable? * Are there immediate actions we can take based on this work? * Are there long-term actions we can take based on this work? * * Is there future work that we want to call out in hopes that others will pick it up? * Next in the Reading Group Queue: * == Updates == Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week. Help with: - Something you need help with. cecylia (cohosh): 2026-09-17 Last week: - assessed that reported proxy deadlock was AI slop - got to the bottom of recent proxy issues - https://forum.torproject.org/t/running-snowflake-with-moav-260-gb-relayed-a… - https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - patched lyrebird bug (lyrebird#40039) - proteus hacking and design - triaged code audit bugs Next week: - continue review of UAT (team#178) - continue triaging code audit bugs - make proxy-bridge reachability checks robust to bridge outages (snowflake#40504) - research working group tasks: open issues for relevant pets/foci papers - open issue about ASL19 report suggestions dcf: 2026-08-20 Last week: Next week: Help with: meskio: 2026-09-17 Last week: - prepare .deb packages for PTs - release webtunnel to produce debian packages - research existing DNS transports (team#199) Next week: - research existing DNS transports (team#199) Shelikhoo: 2026-08-27 Last Week: - [Testing] Unreliable+unordered WebRTC data channel transport for Snowflake rev2 (cont.)( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) testing environment setup/research - Merge request Reviews - [Research] proxy pool overload and potential blocking in Iran ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [Research] Add three NAT type buckets to the snowflake broker ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [Develop] Work on TLSDelegate development - [Document] Updated the Snowflake Broker Installation Guide (https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/Survival-Gui…) (Done) - [Deployment] Snowflake Probetest deployment(https://gitlab.torproject.org/tpo/anti-censorship/pluggable-tran… (Done) Next (working) Week/TODO: - Merge request reviews - [Deployment]Unreliable+unordered WebRTC data channel transport for Snowflake rev2 (cont.)( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) Building custom Tor Browser with patch applied - Vantage point maintaince - [Research] proxy pool overload and potential blocking in Iran ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [Research] Add three NAT type buckets to the snowflake broker ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - Add 3 type nat bucket to snowflake broker - Implement TLS Delegate in Rust (cont.) onyinyang: 2026-09-17 Last week(s): - GG/AC Team meeting Next week: - Continue tasks for project #170 - send flagged bridges to vantage point or else collect them to be sent Switch back to some of these: As time allows: - Continue work on rdsys#196 - Continue Investigating rdsys#248 i.e., why dysfunctional webtunnel bridges are being distributed - Troubleshooting conjure not connecting in China - waiting for more information from conjure authors/maintainers - Lox still seems to be filling up the disk on the rdsys-test server despite changes made to delete old entries, look into what's going wrong Blog post for conjure: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/conj… - review Tor browser Lox integration https://gitlab.torproject.org/tpo/applications/tor-browser/-/merge_requests… - add TTL cache to lox MR for duplicate responses: https://gitlab.torproject.org/tpo/anti-censorship/lox/-/merge_requests/305 - Work on outstanding milestone issues: - key rotation automation Later: pending decision on abandoning lox wasm in favour of some kind of FFI? https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43096) - add pref to handle timing for pubkey checks in Tor browser - add trusted invitation logic to tor browser integration: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42974 - improve metrics collection/think about how to show Lox is working/valuable - sketch out Lox blog post/usage notes for forum (long term things were discussed at the meeting!): - brainstorming grouping strategies for Lox buckets (of bridges) and gathering context on how types of bridges are distributed/use in practice Question: What makes a bridge usable for a given user, and how can we encode that to best ensure we're getting the most appropriate resources to people? 1. Are there some obvious grouping strategies that we can already consider? e.g., by PT, by bandwidth (lower bandwidth bridges sacrificed to open-invitation buckets?), by locale (to be matched with a requesting user's geoip or something?) 2. Does it make sense to group 3 bridges/bucket, so trusted users have access to 3 bridges (and untrusted users have access to 1)? More? Less? theodorsm: 2026-05-28 Last weeks: - Researching possible DTLS block in Russia - https://github.com/net4people/bbs/issues/603#issuecomment-4451730751 - Implementing DTLS 1.3 in pion Next weeks: - Implementing DTLS 1.3 in pion Help with: - Facilitator Queue: cohosh onyinyang shelikhoo meskio 1. First available staff in the Facilitator Queue will be the facilitator for the meeting 2. After facilitating the meeting, the facilitator will be moved to the tail of the queue -- meskio | https://meskio.net/ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- My contact info: https://meskio.net/crypto.txt -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Nos vamos a Croatan.

1 0

minutes from the sysadmins
by Antoine Beaupré 15 Sep '26

15 Sep '26

Hey everyone, we had a meeting yesterday, and here are our minutes. # Roll call: who's there and emergencies - anarcat - groente - jerome - lelutin - zen-fu # Express check-in - how are you doing? - blocked on anything? # 2027 Roadmap draft presentation and discussion anarcat presented a draft 2027 roadmap based on previous conversations with the team and other team leads. More team leads need to be contacted to see if they have anything planned for 2027 that will affect us. The [pad has more details][] including a modified 5 year Tails roadmap. [pad has more details]: https://pad.tails.net/RBbLFv-TTCqk6dtp2WLXCA The Tails merge tasks should be added to https://gitlab.torproject.org/groups/tpo/tpa/-/work_items/5 when we adopt this roadmap, and the others to a new 2027 roadmap epic similar to https://gitlab.torproject.org/groups/tpo/tpa/-/work_items/2 Here is the modified roadmap that we ended up with: ## Must have - object storage (previously scheduled for 2026) - minio retirement - GitLab artifacts in object storage - ... with backups - ... scalable - Matrix home server deployment - tails merge items: - Monitoring (Icinga retirement, may be completed by 2026) - Shifts (may be completed in 2026) - Puppet merge completion (may be completed in 2026) - Authentication (start IDM deployment) - plan for the weblate merge in 2028 - GitLab (gitlab.tails.boum.org retirement, still backed by Jenkins CI, but plan for retiring Jenkins in 2029) - web team - year end campaign - not sure how much movement there will be, marble migration? ## Nice to have - merge hedgedoc (mostly switch authentication to gitlab.tpo, change domain, rebuild VM in our clusters) - Backups - Debian 14 "forky" upgrades (likely released in ~august 2027) ## Postponed to 2028 or later - email mailboxes - research on Nextcloud improvements or replacement - Firewall merge (previously scheduled for 2026) - SSO, full Tails authentication merge (previously scheduled for 2026) # Next meeting October 5th, we hope to discuss how we will organise our mornings during the Rotterdam meeting. # Metrics of the month * host count: 130, Puppet 129 (!) * number of Apache servers monitored: 33, hits per second: 725 * number of self-hosted nameservers: 6, mail servers: 11 * pending upgrades: 0, reboots: 0 * average load: 0.82, memory available: 4.7 TB/7.9 TB, running processes: 251 * disk free/total: 115.8 TB/255.3 TB * bytes sent: 701.2 MB/s, received: 499.4 MB/s * [GitLab tickets][]: 283 tickets including... * Needs Triage: 0 * Not Scheduled: 179 * Backlog: 70 * Next: 24 * Doing: 10 * (closed: 4663) * [~Needs Information][]: 5 open, 140 closed * [~Needs Review][]: 4 open, 219 closed * [~Technical Debt][]: 0 open, 0 closed [Gitlab tickets]: https://gitlab.torproject.org/tpo/tpa/team/-/boards [~Needs Information]: https://gitlab.torproject.org/groups/tpo/tpa/-/issues/?state=opened&label_n… [~Needs Review]: https://gitlab.torproject.org/groups/tpo/tpa/-/issues/?state=opened&label_n… [~Technical Debt]: https://gitlab.torproject.org/groups/tpo/tpa/-/issues/?state=opened&label_n… -- Antoine Beaupré torproject.org system administration

1 0

User Support Report for August 2026
by ebanam 09 Sep '26

09 Sep '26

Hello everyone, This is the report from the user support team for the month of August 2026. One correction in the last month's [report][]. I had accidentally mentioned: > 7. 7(↑) tickets: instructions to use GetTor. > [..] > 9. 5(↓) tickets: instructions on how to get Tor Browser binaries from GetTor. It must read: 7. 7(↑) tickets: instructions to use GetBridgesBot (our official Tor bridge distribution channel on Telegram). [..] 9. 5(↓) tickets: instructions on how to get Tor Browser binaries from GetTor. [report]: https://lists.torproject.org/mailman3/hyperkitty/list/tor-project@lists.tor… Note: (↑), (↓) and (-) are indicating if the number of tickets we received for these topics have been increasing, decreasing or have been the same from the previous month respectively. - Summary of updates from user support - General user support - Farsi-speaking user support - Russian-speaking user support - Frontdesk (email user support channel) - Telegram, WhatsApp and Signal user support channels - Highlights from the Tor Forum - Highlights from Google Play Store # Summary of updates from user support ## General user support * 426 tickets in total (↑68) * 295 tickets on Email * 73 tickets on Telegram * 11 tickets on Signal * 47 tickets on WhatsApp * In the aftermath of the Tor VPN 1.9.0Beta release we received [several reports][] that the app was crashing on their device. The rollout of the update was halted in the interim and we had been encouraging users who had already updated to revert to previous stable version of 1.8.0Beta. The issue stands resolved now and all users are encouraged to the update to the latest Tor VPN version of 1.9.1Beta. [several reports]: https://gitlab.torproject.org/tpo/applications/vpn/-/work_items/543 ## Farsi-speaking user support * 17 tickets in total (↓9) * 4 tickets on Email * 13 tickets on Telegram * There has been a dip in user support tickets from Farsi-speaking users in the last month. We received a mix of queries ranging between help with instructions to use bridges with Tor VPN Beta and Orbot. * Looking at [Tor Metrics][], there has been relatively stable number of users through August from Iran. [Tor Metrics]: https://metrics.torproject.org/userstats-bridge-country.html?country=ir&sta… ## Russian-speaking user support * 441 tickets in total (↓1) * 134 tickets on Email (↓22) * 290 tickets on Telegram (↑7) * 5 tickets on Signal (↑2) * 12 tickets on WhatsApp (↑12) * In August, we started getting more requests from users from Belarus and we are currently investigating the [dropping number of Tor users][] from the country. [dropping number of Tor users]: https://gitlab.torproject.org/tpo/anti-censorship/censorship-analysis/-/wor… # Frontdesk (email user support channel) * 453(↓) RT tickets created * 433(↑) RT tickets resolved Tickets by topics and numbers: 1. 181(↓) tickets: instructions to circumvent censorship for Chinese speaking users. 2. 134(↓) tickets: circumventing censorship in Russian speaking countries. 3. 31(↓) tickets: help with troubleshooting existing Tor Browser install on Desktop (Windows, macOS and Linux). 4. 13(↓) tickets: help with troubleshooting Tor VPN beta. Majority of these tickets have been about the [Tor VPN 1.9.0Beta crashing]. The issue is fixed with Tor VPN version 1.9.1Beta. 5. 11(↑) tickets: report of websites blocking Tor connections or not performing well in Tor Browser. 6. 6(↑) tickets: reports of fake apps on iOS AppStore masquerading as official Tor Browser. 7. 4(↓) tickets: circumventing censorship with Tor in Farsi. 8. 3(↑) tickets: queries about how onion services work. 9. 2(↑) tickets: instructions to change the default search engine on Tor Browser. 10. 2(↑) tickets: queries about ways to contribute to Tor. 11. 2(↑) tickets: reports of onion services offline. These onion services are not hosted by Tor Project and reporters are encouraged to report to the concerned onion service operators. 12. 3(↓) tickets: instructions to use WebTunnel bridges with Tor apps. 13. 2(↑) tickets: PII redaction request from Tor mailist list archives. 14. 2(↑) tickets: understanding how Tor Browser doesn't store persistent cookies and other browser information. 15. 1(↓) ticket: query about the privacy policy of Tor applications. 16. 1(-) ticket: instructions to download and install Tor Browser. 17. 1(↑) ticket: query about available job openings at Tor. 18. 1(↑) ticket: query about modifying the Tor circuit in Tor Browser. 19. 1(↓) ticket: report of Google's "My Location" feature showing their location as "Tehran" while using Tor Browser. Google's geolocation service has been flagging some Tor exit nodes in Europe as being from Tehran. 20. 1(↑) ticket: using Tor Browser on Arm architecture (Linux) 21. 1(↑) ticket: help with troubleshooting Tor blocked by a firewall. 22. 1(↑) ticket: Tor Forum related help. 23. 1(↑) ticket: help with post-install steps for running a Tor bridge. 24. 1(↑) ticket: query about about Tor's [trademark][]. 25. 1(↑) ticket: help with installing Tor Browser on Linux. 26. 1(↑) ticket: query about finding official documentation for Tor Browser (support.torproject.org) 27. 1(↑) ticket: query about the official Tor app to install for iOS (Onion Browser & Orbot). 28. 1(↑) ticket: query on how to check ExoneraTor. 29. 1(↑) ticket: help with setting up a Snowflake proxy. 30. 1(↑) ticket: help with instructions to download Tor Browser. 31. 1(↑) ticket: report of anti-virus software wrongly flagging Tor Browser. 32. 1(↑) ticket: query on how one can support relay operators and donate to [relay associations][]. [Tor VPN 1.9.0Beta crashing]: https://gitlab.torproject.org/tpo/applications/vpn/-/work_items/543 [trademark]: https://www.torproject.org/about/trademark/ [relay associations]: https://community.torproject.org/relay/community-resources/relay-associatio… # Telegram, WhatsApp and Signal user support channels * 451(↑) tickets resolved Breakdown: * 376(↓) tickets on Telegram * 16(↑) tickets on Signal * 59(↑) tickets on WhatsApp Tickets by topics and numbers: 1. 307(↑) tickets: circumventing censorship in Russian speaking countries. 2. 20(↑) tickets: help with troubleshooting Tor VPN beta. Majority of these tickets have been about the Tor VPN 1.9.0Beta crashing. The issue is fixed with Tor VPN version 1.9.1Beta. 3. 14(↓) tickets: instructions to circumvent censorship for Chinese speaking users. 4. 13(↓) tickets: circumventing censorship with Tor in Farsi. 5. 16(-) tickets: help with using censorship circumvention methods on Onion Browser (iOS) or Orbot (Android / iOS). 6. 8() tickets: instructions to fetch and use bridges from our official Tor bridges distribution channels. 7. 6(↑) tickets: reports of fake apps on iOS AppStore masquerading as official Tor Browser. 8. 6(↓) tickets: instructions to use GetTor. 9. 6(↓) tickets: help with troubleshooting existing Tor Browser install on Desktop (Windows, macOS and Linux). 10. 5(↑) tickets: help with using bridges with Tails. 11. 5(↓) tickets: query about Tor Browser support legacy operating systems. 12. 3(↓) tickets: questions about onion services and how to access them. 13. 2(-) tickets: report of websites blocking Tor connections or not performing well in Tor Browser. 14. 2(↑) tickets: newly installed app [automatically gets protected] even if "Protect all apps" is off on [Tor VPN][]. 15. 1(↑) ticket: instructions to update little-t tor. 16. 1(↑) ticket: instructions to configure [Exit location on Tor VPN][]. 17. 1(↑) ticket: help with troubleshooting existing Tor Browser install on Android. [automatically gets protected]: https://gitlab.torproject.org/tpo/applications/vpn/-/work_items/529 [Exit Location on Tor VPN]: https://support.torproject.org/tor-vpn/features/exit-location/ # Highlights from the Tor Forum * What information is visible to a [Snowflake proxy]. * [Persistent Storage] error on Tails. [Snowflake proxy]: https://forum.torproject.org/t/snowflake-proxy-volunteer-confusion/22045 [Persistent Storage]: https://forum.torproject.org/t/persistent-storage/21617 # Highlights from Google Play Store ## Tor Browser for Android * Tor Browser for Android (TBA) had a Google Play rating of 4.437 stars in August, which is higher as compared to in July. * Tor Browser for Android (TBA) got 583(↓46) new reviews. The total count of reviews for the app stands at 70,230. * For Tor Browser, the most common issue mentioned on reviews were the censorship against Tor in countries like Russia, China, Iran and Tor Browser being slow to browse. ## Tor Browser for Android Alpha * Tor Browser for Android Alpha app had a rating of 4.115 in August which is the same compared to July. * Tor Browser for Android Alpha got 8(↑4) new reviews. The total count of reviews for the app stands at 8,787. ## Tor VPN Beta * Tor VPN beta number of unique daily users is around 71,000 at the end of August. * The top 5 countries by the number of installations being (in descending order): Russia, India, Iran, the United States, and Turkmenistan. Thanks! -- ebanam

1 0

axsz
by lucasblake686＠gmail.com 09 Sep '26

09 Sep '26

dcAcx

1 0

Retiring unsupported Debian and Ubuntu container images
by Jérôme Charaoui 03 Sep '26

03 Sep '26

Hi folks, Conformant to TPA policy about container image lifecycle [0], we have retired the following container images hosted in the tpo/tpa/base-images project, due to the end of upstream support: - Debian 'bullseye' - Ubuntu 'focal' - Ubuntu 'oracular' - Ubuntu 'plucky' - Ubuntu 'questing' Thanks! -- Jérôme [0] https://gitlab.torproject.org/tpo/tpa/team/-/%20wikis/policy/tpa-rfc-87-con…

1 0

New scoped labels available in GitLab
by Duncan R. 03 Sep '26

03 Sep '26

Hi everyone, As part of the GitLab Ultimate Rollout <https://gitlab.torproject.org/groups/tpo/-/work_items/1>¹, the team have gradually been deploying scoped labels across our GitLab instance (credit to the GitLab Ultimate Task Force for their ongoing work here). This work is being tracked in the Scoped Label Strategy and Rollout <https://gitlab.torproject.org/groups/tpo/-/work_items/5> epic². Scoped labels are groups of mutually exclusive labels that are prefixed with a single term, or “scope", like so: ‘scope::label’. You can read more about scoped labels and their use-cases on GitLab Docs <https://docs.gitlab.com/user/project/labels/#scoped-labels>³, but one example you may already be familiar with are the Priority labels <https://gitlab.torproject.org/groups/tpo/-/labels?search=priority::>⁴ that were deployed last year. Several months ago we also deployed a suite of scoped Product labels <https://gitlab.torproject.org/groups/tpo/-/labels?search=product::>⁵, combining numerous existing labels used across GitLab. Today, the new scoped Product labels are primarily used in the Applications, Product and UX groups on GitLab, but may be of relevance to other teams too. This week we grouped various existing labels — Bug, Task, Documentation, Feature and Technical Debt, in addition to a new Enhancement label — into scoped Kind labels <https://gitlab.torproject.org/groups/tpo/-/labels?search=kind::>⁶. These labels should be used to classify work items (e.g. epics, issues, tasks et cetera) based on the work needing done. Any work items that were previously tagged with one of the existing labels should be migrated automatically over to the corresponding new label. For example, if you had an issue tagged as “Bug”, that issue should now be tagged as “Kind::Bug”. Equally, when you search for the “Bug” label in the work item attributes sidebar, you’ll notice that GitLab will return the “Kind::Bug” label instead now. New labels like Product:: and Kind:: are intended to encourage consistency across GitLab, but Team Leads and project maintainers should decide for themselves if using these labels as part of their workflow would be beneficial. The aim here is to provide helpful tools for issue-wranglers, and not to burden everyone with unnecessary labelling bureaucracy. If you would like to see an additional label added to either of these scoped sets, or have any other feedback, please open an issue in tpo/team <https://gitlab.torproject.org/tpo/team/-/work_items>⁷ or feel free to ping me directly. Note that if the label you would like to add is specific to a certain team or project, with less applicability to the wider organization, it may make more sense to add it at the group or project level rather than the TPO level. Thanks, Duncan [1] GitLab Ultimate Rollout: https://gitlab.torproject.org/groups/tpo/-/work_items/1 [2] Scoped Label Strategy and Rollout: https://gitlab.torproject.org/groups/tpo/-/work_items/5 [3] Scoped Labels (GitLab Docs): https://docs.gitlab.com/user/project/labels/#scoped-labels [4] Priority labels: https://gitlab.torproject.org/groups/tpo/-/labels?search=priority:: [5] Product labels: https://gitlab.torproject.org/groups/tpo/-/labels?search=product:: [6] Kind labels: https://gitlab.torproject.org/groups/tpo/-/labels?search=kind:: [7] tpo/team: https://gitlab.torproject.org/tpo/team/-/work_items — Duncan R. Product Manager & UX Lead The Tor Project, Inc. <https://torproject.org/> My working hours may not be your working hours. If I message you outside of your working hours, know that I do not expect an immediate response and that I support your right to disconnect.

1 0

Anti-censorship team meeting notes, 2026-08-27
by meskio 27 Aug '26

27 Aug '26

Hey everyone! Here are our meeting logs: https://meetbot.debian.net/tor-meeting/2026/tor-meeting.2026-08-27-16.00.ht… And our meeting pad: Anti-censorship -------------------------------- Next meeting: Thursday, 17 16:00 UTC Facilitator: cohosh ^^^(See Facilitator Queue at tail) Weekly meetings, every Thursday at 16:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress) This week's Facilitator: meskio == Goal of this meeting == Weekly check-in about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at the Tor Project and Tor community. == Links to Useful documents == * Our anti-censorship roadmap: * Roadmap:https://gitlab.torproject.org/groups/tpo/anti-censorship/-/boards * The anti-censorship team's wiki page: * https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/home * Past meeting notes can be found at: * https://lists.torproject.org/pipermail/tor-project/ * Tickets that need reviews: from projects, we are working on: * All needs review tickets: * https://gitlab.torproject.org/groups/tpo/anti-censorship/-/merge_requests?s… * Projects the TPI anti-censorship team is working on: * Project 146: Expanding access to digital media through the use of secure communications, infrastructure, tools, and techniques * https://gitlab.torproject.org/groups/tpo/anti-censorship/-/issues/?label_na… * Project 170: Monitoring and reporting on censorship against the Tor network * epic: https://gitlab.torproject.org/groups/tpo/-/epics/17 * Project 201: Signaling channels * board https://gitlab.torproject.org/groups/tpo/-/boards/2675?label_name[]=Project… == Announcements == * No meeting September 3 and 10, everybody at Global Gathering == Discussion == * snowflake broker deployment * new version of probetest is already deployed in the broker but not configured in nginx * the deployment of broker will also include the proxy ratelimiting feature * shelikhoo will deploy it next week * cohosh will write to tor-relays warning about the proxy fairness change * A developer of an open source stack is asking a few questions regarding snowflake-proxy, it's relevant because the developer implemented snowflake-proxy as a feature that the stack server-side users can optionally run to help the Tor network users, but the dev eloper has a few questions regarding it here: * https://forum.torproject.org/t/running-snowflake-with-moav-260-gb-relayed-a… * What happens to Tor on a whitelisted mobile network in Russia? * either like 100 whitelisted sites or any internet but 16KB/s * Tor connects but webbrowsing doesn't work * services are allowed by IP, not just DNS == Actions == * == Interesting links == == Reading group == * We will discuss "CensorLess: Cost-Efficient Censorship Circumvention Through Serverless Cloud Functions" on Aug/20/2026 * https://www.petsymposium.org/popets/2026/popets-2026-0096.pdf * https://www.petsymposium.org/popets/2026/popets-2026-0096.php * Questions to ask and goals to have: * What aspects of the paper are questionable? * Are there immediate actions we can take based on this work? * Are there long-term actions we can take based on this work? * * Is there future work that we want to call out in hopes that others will pick it up? * Next in the Reading Group Queue: * == Updates == Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week. Help with: - Something you need help with. cecylia (cohosh): 2026-08-27 Last week: - revised cost analysis of serverless rendezvous - read ASL19 report "Resilience runs through people" - https://asl19.org/en/blog/2026-06-01-the-future-of-internet-resilience-lies… - reviewed UAT MRs - wrote up some thoughts on proxy reachability checks Next week: - continue review of UAT (team#178) - make proxy-bridge reachability checks robust to bridge outages (snowflake#40504) - research working group tasks: open issues for relevant pets/foci papers - open issue about ASL19 report suggestions dcf: 2026-08-20 Last week: Next week: Help with: meskio: 2026-08-27 Last week: - prepare .deb packages for PTs - update telegram doc strings with TB text - make a rdsys release Next week: - research existing DNS transports (team#199) Shelikhoo: 2026-08-27 Last Week: - [Testing] Unreliable+unordered WebRTC data channel transport for Snowflake rev2 (cont.)( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) testing environment setup/research - Merge request Reviews - [Research] proxy pool overload and potential blocking in Iran ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [Research] Add three NAT type buckets to the snowflake broker ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [Develop] Work on TLSDelegate development - [Document] Updated the Snowflake Broker Installation Guide (https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/Survival-Gui…) (Done) - [Deployment] Snowflake Probetest deployment(https://gitlab.torproject.org/tpo/anti-censorship/pluggable-tran… (Done) Next (working) Week/TODO: - Merge request reviews - [Deployment]Unreliable+unordered WebRTC data channel transport for Snowflake rev2 (cont.)( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) Building custom Tor Browser with patch applied - Vantage point maintaince - [Research] proxy pool overload and potential blocking in Iran ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [Research] Add three NAT type buckets to the snowflake broker ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - Add 3 type nat bucket to snowflake broker - Implement TLS Delegate in Rust (cont.) onyinyang: 2026-08-27 Last week(s): - Work for project #170 to detect bridge blocking - create API endpoint to poll for flagged bridges? Next week: - Continue tasks for project #170 - send flagged bridges to vantage point or else collect them to be sent Switch back to some of these: As time allows: - Continue work on rdsys#196 - Continue Investigating rdsys#248 i.e., why dysfunctional webtunnel bridges are being distributed - Troubleshooting conjure not connecting in China - waiting for more information from conjure authors/maintainers - Lox still seems to be filling up the disk on the rdsys-test server despite changes made to delete old entries, look into what's going wrong Blog post for conjure: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/conj… - review Tor browser Lox integration https://gitlab.torproject.org/tpo/applications/tor-browser/-/merge_requests… - add TTL cache to lox MR for duplicate responses: https://gitlab.torproject.org/tpo/anti-censorship/lox/-/merge_requests/305 - Work on outstanding milestone issues: - key rotation automation Later: pending decision on abandoning lox wasm in favour of some kind of FFI? https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43096) - add pref to handle timing for pubkey checks in Tor browser - add trusted invitation logic to tor browser integration: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42974 - improve metrics collection/think about how to show Lox is working/valuable - sketch out Lox blog post/usage notes for forum (long term things were discussed at the meeting!): - brainstorming grouping strategies for Lox buckets (of bridges) and gathering context on how types of bridges are distributed/use in practice Question: What makes a bridge usable for a given user, and how can we encode that to best ensure we're getting the most appropriate resources to people? 1. Are there some obvious grouping strategies that we can already consider? e.g., by PT, by bandwidth (lower bandwidth bridges sacrificed to open-invitation buckets?), by locale (to be matched with a requesting user's geoip or something?) 2. Does it make sense to group 3 bridges/bucket, so trusted users have access to 3 bridges (and untrusted users have access to 1)? More? Less? theodorsm: 2026-05-28 Last weeks: - Researching possible DTLS block in Russia - https://github.com/net4people/bbs/issues/603#issuecomment-4451730751 - Implementing DTLS 1.3 in pion Next weeks: - Implementing DTLS 1.3 in pion Help with: - Facilitator Queue: cohosh onyinyang shelikhoo meskio 1. First available staff in the Facilitator Queue will be the facilitator for the meeting 2. After facilitating the meeting, the facilitator will be moved to the tail of the queue -- meskio | https://meskio.net/ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- My contact info: https://meskio.net/crypto.txt -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Nos vamos a Croatan.

1 0

Duplicate tor browser icons on Debian 13 / GNOME 48
by fa 25 Aug '26

25 Aug '26

Hello, Thank you very much for developing Throne. I really appreciate your work on the client. I have a small issue/question. After installing tor browser, two separate Throne icons appear in the GNOME application menu, almost as if the application has been installed twice. I’ve attached a screenshot showing the issue. My system information: - *OS:* Debian GNU/Linux 13 (trixie) - *Architecture:* 64-bit - *GNOME:* 48 - *Windowing System:* Wayland - *Kernel:* Linux 6.12.101+deb13-amd64 - *Firmware Version:* GGCN49WW Is this a known issue, or could there be two different .desktop entries being installed? Thank you again for your work. Best regards

2 1

Anti-censorship team meeting notes, 2026-08-20
by Shelikhoo 20 Aug '26

20 Aug '26

Hey everyone! Here are our meeting logs: https://meetbot.debian.net/tor-meeting/2026/tor-meeting.2026-08-20-16.01.ht… And our meeting pad: Anti-censorship work meeting pad -------------------------------- Anti-censorship -------------------------------- Next meeting: Thursday, August 27 16:00 UTC Facilitator: meskio ^^^(See Facilitator Queue at tail) Weekly meetings, every Thursday at 16:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress) This week's Facilitator: shelikhoo == Goal of this meeting == Weekly check-in about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at the Tor Project and Tor community. == Links to Useful documents == * Our anti-censorship roadmap: * Roadmap:https://gitlab.torproject.org/groups/tpo/anti-censorship/-/boards * The anti-censorship team's wiki page: * https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/home * Past meeting notes can be found at: * https://lists.torproject.org/pipermail/tor-project/ * Tickets that need reviews: from projects, we are working on: * All needs review tickets: * https://gitlab.torproject.org/groups/tpo/anti-censorship/-/merge_requests?s… * Projects the TPI anti-censorship team is working on: * Project 146: Expanding access to digital media through the use of secure communications, infrastructure, tools, and techniques * https://gitlab.torproject.org/groups/tpo/anti-censorship/-/issues/?label_na… * Project 170: Monitoring and reporting on censorship against the Tor network * epic: https://gitlab.torproject.org/groups/tpo/-/epics/17 * Project 201: Signaling channels * board https://gitlab.torproject.org/groups/tpo/-/boards/2675?label_name[]=Project… == Announcements == * Reading group next week (August 20) CensorLess: Cost-Efficient Censorship Circumvention Through Serverless Cloud Functions https://www.petsymposium.org/popets/2026/popets-2026-0096.php == Discussion == * snowflake broker deployment * new version of probetest is already deployed in the broker but not configured in nginx * the deployment of broker will also include the proxy ratelimiting feature == Actions == * == Interesting links == == Reading group == * We will discuss "CensorLess: Cost-Efficient Censorship Circumvention Through Serverless Cloud Functions" on Aug/20/2026 * https://www.petsymposium.org/popets/2026/popets-2026-0096.pdf * https://www.petsymposium.org/popets/2026/popets-2026-0096.php * Questions to ask and goals to have: * What aspects of the paper are questionable? * Are there immediate actions we can take based on this work? * Are there long-term actions we can take based on this work? * * Is there future work that we want to call out in hopes that others will pick it up? * Next in the Reading Group Queue: * == Updates == Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week. Help with: - Something you need help with. cecylia (cohosh): 2026-08-20 Last weeks: - Implemented and merged rate limit map for proxy polls (snowflake#40506) - Fixed proxy prometheus metrics in the case a client doesn't have SDP candidates (snowflake#40544) - Updated wording of help text for -outbound-address proxy option (snowflake#40515) - decommissioned old Conjure bridge (conjure#46) - reviewed 3 bucket NAT type MR (snowflake!727) - wrote a summary of CensorLess and some Tor integration options (research#19) Next week: - continue review of UAT (team#178) - make proxy-bridge reachability checks robust to bridge outages (snowflake#40504) dcf: 2026-08-20 Last week: Next week: Help with: meskio: 2026-08-20 Last week: - research existing DNS transports (team#199) - redirect bridgest.torproject.org/info to the distributors documentation (rdsys!659) - catching up after AFK Next week: - research existing DNS transports (team#199) Shelikhoo: 2026-08-20 Last Week: - [Testing] Unreliable+unordered WebRTC data channel transport for Snowflake rev2 (cont.)( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) testing environment setup/research - Merge request Reviews - [Research] proxy pool overload and potential blocking in Iran ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [Research] Add three NAT type buckets to the snowflake broker ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [Push] Update staging environment for 3 type nat https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - [Document] Updated the Snowflake Broker Installation Guide (https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/Survival-Gui…) - [MR Merged] Snowflake’s Go 1.25 toolchain update (https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow…) ; sadly go1.27 released the same day - [Deployment] Snowflake Probetest deployment(https://gitlab.torproject.org/tpo/anti-censorship/pluggable-tran… Next (working) Week/TODO: - Merge request reviews - [Deployment]Unreliable+unordered WebRTC data channel transport for Snowflake rev2 (cont.)( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) Building custom Tor Browser with patch applied - Vantage point maintaince - [Research] proxy pool overload and potential blocking in Iran ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [Research] Add three NAT type buckets to the snowflake broker ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - Add 3 type nat bucket to snowflake broker - Implement TLS Delegate in Rust (cont.) onyinyang: 2026-08-20 Last week(s): - Work for project #170 to detect bridge blocking - flag bridges that have a drop - create API endpoint to poll for flagged bridges? Next week: - Continue tasks for project #170 - send flagged bridges to vantage point or else collect them to be sent Switch back to some of these: As time allows: - Continue work on rdsys#196 - Continue Investigating rdsys#248 i.e., why dysfunctional webtunnel bridges are being distributed - Troubleshooting conjure not connecting in China - waiting for more information from conjure authors/maintainers - Lox still seems to be filling up the disk on the rdsys-test server despite changes made to delete old entries, look into what's going wrong Blog post for conjure: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/conj… - review Tor browser Lox integration https://gitlab.torproject.org/tpo/applications/tor-browser/-/merge_requests… - add TTL cache to lox MR for duplicate responses: https://gitlab.torproject.org/tpo/anti-censorship/lox/-/merge_requests/305 - Work on outstanding milestone issues: - key rotation automation Later: pending decision on abandoning lox wasm in favour of some kind of FFI? https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43096) - add pref to handle timing for pubkey checks in Tor browser - add trusted invitation logic to tor browser integration: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42974 - improve metrics collection/think about how to show Lox is working/valuable - sketch out Lox blog post/usage notes for forum (long term things were discussed at the meeting!): - brainstorming grouping strategies for Lox buckets (of bridges) and gathering context on how types of bridges are distributed/use in practice Question: What makes a bridge usable for a given user, and how can we encode that to best ensure we're getting the most appropriate resources to people? 1. Are there some obvious grouping strategies that we can already consider? e.g., by PT, by bandwidth (lower bandwidth bridges sacrificed to open-invitation buckets?), by locale (to be matched with a requesting user's geoip or something?) 2. Does it make sense to group 3 bridges/bucket, so trusted users have access to 3 bridges (and untrusted users have access to 1)? More? Less? theodorsm: 2026-05-28 Last weeks: - Researching possible DTLS block in Russia - https://github.com/net4people/bbs/issues/603#issuecomment-4451730751 - Implementing DTLS 1.3 in pion Next weeks: - Implementing DTLS 1.3 in pion Help with: - Facilitator Queue: cohosh meskio onyinyang shelikhoo 1. First available staff in the Facilitator Queue will be the facilitator for the meeting 2. After facilitating the meeting, the facilitator will be moved to the tail of the queue

1 0

"Napping Guard" (2020)—was it reported to Tor?
by David Fifield 18 Aug '26

18 Aug '26

I was looking at this 2020 research paper: https://ieeexplore.ieee.org/document/9343014/ https://sci-hub.ru/10.1109/TrustCom50675.2020.00097 "Napping Guard: Deanonymizing Tor Hidden Service in a Stealthy Way" Chen Muqian, Wang Xuebin, Shi Jinqiao, Zhao Can, Wang Meiqi, Fang Binxing In the abstract and introduction, they say: In addition, we also propose a mitigation of Napping Guard attack, and report the design flaw to the Tor project. But they don't give details of reporting the flaw or what happened after that, as far as I can see. Did the reporting happen, and did it result in changes in Tor? I also noticed this more recent paper by some of the same authors: https://ieeexplore.ieee.org/document/10570737 "Knock-Knock: De-Anonymise Hidden Services by Exploiting Service Answer Vulnerability" Zhang Qingfeng, Chen Muqian, Wang Xuebin, Zhao Can, Liu Qingyun, Shi Jinqiao This one, too, says "Lastly, we present a method to mitigate watermark attacks and report the design flaw to the Tor Project." Did that happen?

2 1