- tor-project - lists.torproject.org

OONI Monthly Report: April 2020
by Maria Xynou 11 May '20

11 May '20

Hello, Throughout April 2020, the OONI team worked on the following sprints: * Horseshoe Crab Sprint (30th March 2020 - 12th April 2020) * Blue Bottles Sprint (13th April 2020 - 26th April 2020) * Beluga Sprint (27th April 2020 - 3rd May 2020) Our work can be tracked through the various OONI GitHub repositories: https://github.com/ooni Details and highlights are available in this report. ## Public launch of new OONI Probe desktop app We launched a new OONI Probe desktop app for Windows and macOS! You can download and install the new app here: https://ooni.org/install/desktop To announce the launch of the new OONI Probe desktop app and share relevant highlights, we published a blog post: https://ooni.org/post/2020-ooni-probe-desktop-app/ ### Localization Thanks to support from the Localization Lab community, the new OONI Probe desktop app was translated to 14 languages: Chinese, Arabic, Farsi, Russian, Thai, Turkish, Spanish, French, Portuguese, Italian, Greek, Slovak, Catalan, and German. We launched the desktop app with 12 of these languages, excluding Arabic and Farsi, which we will be included in future releases once we have added RTL support. ### Press coverage The launch of the new OONI Probe desktop app received press coverage from Deutsche Welle (DW), who published an article about it: https://www.dw.com/en/ooni-an-app-for-detecting-internet-censorship/a-53224… The DW article was also published in the following languages: * German: https://www.dw.com/de/ooni-eine-app-um-internetzensur-aufzusp%C3%BCren/a-53… * Chinese: https://www.dw.com/zh/ooni%E5%BA%94%E7%94%A8%E7%A8%8B%E5%BA%8F-%E8%AE%A9%E4… * Farsi: https://www.dw.com/fa-af/ooni-%D8%A7%D9%BE%D9%84%DB%8C%DA%A9%DB%8C%D8%B4%D9… * Spanish: https://www.dw.com/es/ooni-la-aplicaci%C3%B3n-para-detectar-la-censura-en-i… ## Adding support in OONI Probe for availability testing of the circumvention tools Tor, obfs4proxy, and Psiphon We released OONI Probe Desktop 3.0.0 (the new OONI Probe desktop app for Windows and macOS) which includes support for running the new Tor and the Psiphon circumvention tool tests. Tor test: https://ooni.org/post/2020-ooni-probe-desktop-app/#tor Psiphon test: https://ooni.org/post/2020-ooni-probe-desktop-app/#psiphon ## Analyzing collected censorship circumvention tool test results and integrating them into OONI Explorer and the OONI API Following the release of the new OONI Probe desktop app (which includes the new Tor and Psiphon tests), we started to collect, analyze, and publish OONI Probe measurements from the testing of Tor and Psiphon around the world. These measurements -- which are also available via the OONI API (https://api.ooni.io/) -- can easily be searched and accessed through OONI Explorer: * Tor measurements: https://explorer.ooni.org/search?until=2020-05-12&test_name=tor * Psiphon measurements: https://explorer.ooni.org/search?until=2020-05-12&test_name=psiphon Measurements collected from around the world are published on OONI Explorer in near real-time. ## Improving censorship circumvention tool methodologies to include metrics that are also related to the performance of the tool To improve our methodologies for measuring censorship circumvention tools, we aim to measure the performance of those tools as well. To this end, we: * Added support for running the NDT speed test over Psiphon: https://github.com/ooni/probe-engine/issues/506 * Switched to using the golang implementation of DASH, which will allow us to run this performance test over the Psiphon network: https://github.com/ooni/probe-engine/issues/501 * Made progress in refactoring netx to enable which more performance testing in the testing clients: https://github.com/ooni/probe-engine/issues/543 ## Developing OONI Probe orchestration logic that is specific to circumvention tool testing As part of our work on developing OONI Probe orchestration logic that is specific to circumvention tool testing, we discussed with Tor’s anti-censorship team how we would integrate bridge testing into OONI probe services. See: https://github.com/ooni/backend/issues/396 ## OONI Probe mobile app Some of the main new changes that the next releases of the OONI Probe mobile app will feature include: * New/improved design for the Dashboard * “Run” button (in the Dashboard) to run all OONI Probe tests at once * Grouping the middlebox tests inside the Performance card * Adding a new Circumvention card to release the new Tor & Psiphon tests In preparation for the next releases, we worked on the following tickets: * Implement new dashboard layout: https://github.com/ooni/probe/issues/1094 * Run All Tests button: https://github.com/ooni/probe/issues/826 * Implement Run All Tests button: https://github.com/ooni/probe/issues/1093 * Group the middlebox tests with the performance test group: https://github.com/ooni/probe/issues/835 * Remove notification settings screens: https://github.com/ooni/probe/issues/1090 * Verify network information settings: https://github.com/ooni/probe/issues/1112 * Remove country code in the opt out settings of the app: https://github.com/ooni/probe/issues/1105 * New navbar appearance on iOS: https://github.com/ooni/probe/issues/1108 * Create experimental flavour for the Android app: https://github.com/ooni/probe/issues/1080 * Remove/update obsolete NDT fields: https://github.com/ooni/probe/issues/1107 We also created a beta branch with support for automatic daily testing: https://github.com/ooni/probe/issues/1059 ## Push notifications As part of our ongoing efforts to add support for sending out push notifications, we deployed a production countly instance on Digital Ocean: https://github.com/ooni/backend/issues/379 We also made a developer build of the OONI Probe mobile app which uses countly to receive push notification and try it out: https://github.com/ooni/probe/issues/1101 We also did some testing of the countly backend to ensure that it is not a critical path and that downtime of the service will not affect our mobile app user: https://github.com/ooni/backend/issues/393 Then we updated the developer OONI Probe mobile app build to also support for receiving OONI Run links via push notification: https://github.com/ooni/probe/issues/874 ## Making the OONI Probe apps rely entirely on the OONI Probe golang engine We continued to make progress on making the OONI Probe mobile and desktop apps rely entirely on the golang based probe-engine. To this end, we completed the work in the following tickets: https://github.com/ooni/probe-engine/issues/125 https://github.com/ooni/probe-engine/issues/349 https://github.com/ooni/probe-engine/issues/352 https://github.com/ooni/probe-engine/issues/376 https://github.com/ooni/probe-engine/issues/396 https://github.com/ooni/probe-engine/issues/453 https://github.com/ooni/probe-engine/issues/482 https://github.com/ooni/probe-engine/issues/489 https://github.com/ooni/probe-engine/issues/501 https://github.com/ooni/probe-engine/issues/504 https://github.com/ooni/probe-engine/issues/538 https://github.com/ooni/probe-engine/issues/543 https://github.com/ooni/probe/issues/1017 https://github.com/ooni/probe/issues/1036 https://github.com/ooni/probe/issues/1040 As part of the process of switching entirely to the new golang probe-engine, Measurement Kit (https://github.com/measurement-kit/measurement-kit) has now been deprecated. Since several third-party projects rely on Measurement Kit, we published an upgrade path for all the use cases that we know of. This documentation is available here: https://github.com/measurement-kit/measurement-kit/blob/master/README.md As part of the process of deprecating Measurement Kit, we also worked on the activities in the following tickets: https://github.com/measurement-kit/measurement-kit/issues/1921 https://github.com/measurement-kit/measurement-kit/issues/1913 ## Expanding OONI Probe measurement methodologies As part of our ongoing efforts to expand our measurement methodologies, we: * Integrated the Go implementation of the DASH test into probe-engine: https://github.com/ooni/probe-engine/issues/501 (and implemented ConnectTime in the DASH test: https://github.com/ooni/probe-engine/issues/281) * Made improvements in the specification of the data format to allow for incrementally updating the data format without introducing breaking changes: https://github.com/ooni/probe-engine/issues/423 * Refactored and carried out research related to netx: https://github.com/ooni/probe-engine/issues/543 (i.e. netx is code used by probe-engine as a low level library to collect network, DNS, and HTTP events that occur during OONI measurements) * Analyzed measurements and performed quality assurance for our SNI blocking experiment: https://github.com/ooni/probe-engine/issues/547 & https://github.com/ooni/probe-engine/issues/299 ### Measuring SNI based filtering in Iran To check whether our new SNI blocking experiment (https://github.com/ooni/spec/blob/adf9537c43ef848b96792f8dea99fbd7f93fe608/…) works as expected, we tested it in Iran (where this censorship technique is known to be deployed) with the help of local community members. Following our experiments in Iran, we concluded that the new OONI SNI blocking experiment works as expected. To document and share our experiments and findings, we published the report “Measuring SNI based blocking in Iran”, which is available here: https://ooni.org/post/2020-iran-sni-blocking/ ## Prototype of system for probe URL selection To improve URL testing, we created a prototype system for probe URL selection which is now being deployed in production. Below we share details. ### Policy for URL prioritization We started off by writing and publishing a document that describes the new smart URL list system, why it’s needed, which problems it aims to address, how community members can contribute to URL priorities, and how we plan to roll this system out. This document is available here: https://ooni.org/post/ooni-smart-url-list-system/ We also published a policy that determines the criteria for URL prioritization: https://ooni.org/post/policy-url-prioritization/ooni-policy-url-prioritizat… ### Adding weights to Citizen Lab categories Creating a smart URL list system requires adding weights to the Citizen Lab category codes (based on which tested URLs are categorized), to ensure that certain categories of URLs receive more testing over others (depending on the criteria outlined in the aforementioned policy for URL prioritization). Our first steps therefore involved adding weights to the Citizen Lab category codes: https://github.com/ooni/ooni.org/issues/431 We will likely revise these weights as the system is rolled out and we receive community feedback. ### Prototype system The prototype is available through this ticket: https://github.com/ooni/backend/issues/361 The prototype system for URL prioritization is implemented in the backend through the following pull request: https://github.com/ooni/pipeline/pull/312 ## Analyzing data to extract website metrics We completed, deployed, and merged a series of improvements to our fast-path data processing pipeline: https://github.com/ooni/backend/issues/233 To add data export capabilities for website-related metrics, we implemented an API call to extract metrics from the counters table (in JSON and CSV): https://github.com/ooni/backend/issues/321 ## OONI Explorer Once the smart URL list system has been rolled out, we aim to add support to OONI Explorer (or, potentially, another web platform) for user accounts that (among other things) would enable users to run database-heavy queries for website-centric measurements. To this end, we did some research to understand, in practice, how these accounts could work across the various OONI products. See: https://github.com/ooni/backend/issues/391 and https://github.com/ooni/ooni.org/issues/434. During the April 2020 OONI Community Meeting, we did a poll to collect feedback and understand if OONI users would have issues with certain authentication methods, if OONI accounts were created. Our idea is to have an account that has interoperability across OONI Probe, OONI Explorer, and OONI Run to support seamless integration between the platforms. ## OONI backend To improve our backend services, we: * Implemented rate limiting on exposed services: https://github.com/ooni/backend/issues/260 * Completed our work around investigating API slowness and DB issues: https://github.com/ooni/backend/issues/381 * Improved DB query monitoring: https://github.com/ooni/backend/issues/382 * Decreased DB query load (throttling, caching, blocking bots): https://github.com/ooni/backend/issues/383 * Implemented throttling of the API based on IP address: https://github.com/ooni/backend/issues/394 * Investigated missing Psiphon measurements in the fast-path pipeline: https://github.com/ooni/backend/issues/296 * Ensured that the API gives priority to fast-path table data: https://github.com/ooni/backend/issues/283 * Investigated API query slowdown: https://github.com/ooni/backend/issues/401 * Added rate limiting to the API: https://github.com/ooni/backend/issues/405 * Added support for parallelising can processing in the fast-path pipeline: https://github.com/ooni/backend/issues/392 ## Improving OONI server infrastructure As part of our ongoing efforts to improve our server infrastructure, we: * Deployed workarounds for slow networking between servers: https://github.com/ooni/backend/issues/384 * Ensured that the new OONI Explorer redirects to HTTPS by default: https://github.com/ooni/backend/issues/252 * Made improvements to the fast-path pipeline: https://github.com/ooni/backend/issues/233 * Installed a clickhouse test instance on EC2: https://github.com/ooni/backend/issues/388 * Tested and benchmarked Greenhost object storage: https://github.com/ooni/backend/issues/247 * Dropped UI components from OONI API that are duplicated in OONI Explorer: https://github.com/ooni/backend/issues/139 ## Improving the quality of OONI software As part of our ongoing efforts to improve the quality of OONI software, we: * Refactored and did research around netx: https://github.com/ooni/probe-engine/issues/509 * Sanitized the netx error strings: https://github.com/ooni/probe-engine/issues/546 * Discussed the react-native integration plan: https://github.com/ooni/probe/issues/1058 ## OONI Run usability study To enable community members to more effectively use OONI Run (https://run.ooni.io/) we aim to research its limitations and collect structured community feedback through an OONI Run usability study. In April 2020, we created a user research plan and decided to collect feedback through a combination of a survey and a series of interviews with community members. Throughout the month, we created and circulated the survey, and we carried out interviews. ### Survey We created a survey with the goal of collecting more quantitative information on community needs, challenges, and feedback for the improvement of OONI Run. This survey is primarily meant to be completed by OONI Run users, as we include detailed questions that require experience with the OONI Run platform. The survey is available here: https://ooni.typeform.com/to/r9c5ee Throughout April 2020, we circulated the survey on social media and on multiple mailing lists, as well as with our network of partners. We aim to analyze the data collected through the survey in mid-May 2020. ### Interviews Through interviews with community members, we aim to collect more in-depth qualitative information to better understand their needs, challenges, and feedback for the improvement of OONI Run. The interviews also provide us an opportunity to observe how community members interact with the OONI Run platform. The interviews involve three user personas: * Measurement campaign coordinators: Experienced OONI Probe users who use OONI Run to generate links and coordinate censorship measurement campaigns * Measurement campaign volunteers: OONI Probe users who receive OONI Run links to perform testing and participate in censorship measurement campaigns * Internet freedom community members: People who care about internet censorship, but who haven’t necessarily used OONI Run before As each of these personas have different experiences with OONI tools, we drafted separate interview questions for each persona. During the last week of April 2020, we interviewed 7 community members. We plan to continue and complete the interviews by mid-May 2020. ### Blog post To promote the survey and encourage more community members to participate in the interviews, we wrote and published a blog post that shares the survey and information about the interviews. This blog post is available here: https://ooni.org/post/2020-ooni-run-survey-and-interviews/ ## OONI website Leading up to the public launch of the OONI Probe desktop app, we made a series of improvements to the OONI website. These include new Install pages (https://ooni.org/install/) for our mobile (https://ooni.org/install/mobile) and desktop clients (https://ooni.org/install/desktop) The new Install pages have a new layout, design, and copy. We also edited the copy for most of the other pages on the OONI website to ensure that the information we provide is up to date and relevant. As part of these copy edits, we updated the risks documentation (https://ooni.org/about/risks/) we updated the test descriptions (https://ooni.org/nettest/) and we improved the layout and copy of the landing page (https://ooni.org/) We also wrote and published OONI’s mission statement: https://ooni.org/about/ ## Updated OONI Data Policy We published an updated version of the OONI Data Policy: https://ooni.org/about/data-policy The new version of the OONI Data Policy shares the principles that govern our data practices, and we explain what data we collect, process, store, and publish when you use OONI Probe. We explain how you can opt out of the various forms of data collection and publication. We also share which analytics we use for the OONI website, OONI Explorer, and the OONI desktop app, and we explain how you can opt out of analytics all-together. ## Test list updates Throughout April 2020, we: * Updated the Global test list: https://github.com/citizenlab/test-lists/pull/600 * Updated multiple test lists with COVID-19 related sites shared by the Citizen Lab: https://github.com/citizenlab/test-lists/pull/601 ## Data analysis In April 2020, we analyzed OONI measurements for the following: * OTF Information Controls Fellow: https://github.com/ooni/ooni.org/issues/453 (analysis of OONI measurements collected from Myanmar) * Community members in Myanmar: https://github.com/ooni/ooni.org/issues/471 (longer-term analysis of OONI measurements collected from Myanmar) * Community members in Guinea: https://github.com/ooni/ooni.org/issues/488 (to examine the blocking of social media during Guinea’s March 2020 elections) * Website monitoring project: https://github.com/ooni/ooni.org/issues/454 ## GitHub sponsorship Our application to receive donations through our GitHub repositories was accepted! OONI now has a GitHub sponsors profile: https://github.com/sponsors/ooni We are therefore in the position to receive recurring donations. ## Community use of OONI data ### Blocking of sites hosting COVID-19 related information in Venezuela Through the use of OONI Probe and OONI data, VEsinFiltro reported new censorship cases in Venezuela involving the blocking of sites hosting COVID-19 related information. Many of these cases were shared on Twitter: https://twitter.com/vesinfiltro/status/1250579061937770496, https://twitter.com/vesinfiltro/status/1250571183579373568, https://twitter.com/vesinfiltro/status/1253423468273471490, https://twitter.com/vesinfiltro/status/1253122594976468993. VEsinFiltro also published a report (which links to OONI measurements) on the blocking of and the phishing attempts against the Heroes of Health platform (created by the management of Juan Guiado): https://vesinfiltro.com/noticias/2020-04-26-phishing_heroes_salud ### Blocking of websites in Egypt Masaar published a report on the blocking of websites in Egypt over the last months (“Internet Censorship in Time of Social Distancing”), through the use of OONI Probe and OONI data. Their report is available here: https://masaar.net/en/internet-censorship-in-time-of-social-distancing/ ## Community activities ### OONI Community Meeting On 28th April 2020, we facilitated the monthly OONI Community Meeting on our Slack channel (https://slack.ooni.org/) during which we discussed the following topics: 1. Updates from the OONI team. 2. Adding user accounts to OONI Explorer. 3. Monitoring potential censorship events during the upcoming elections in West Africa. 4. Challenging the blocking of social media during Guinea’s March 2020 elections in a strategic litigation case with OONI data. 5. Women on Web blocked in Spain: Technical analysis. 6. Reducing the latency of publication of measurements from custom URL tests and experimental tests. 7. SNI-based blocking. ### IFF Glitter Meetup On 30th April 2020, we were invited to attend the IFF Glitter Meetup as featured guests to discuss the OONI Probe desktop app launch. The notes from what was discussed are available here: https://internetfreedomfestival.org/wiki/index.php/April_30_2020_GM#Convers… ### Coordination of COVID-19 site testing in Mexico Our Mexican partners, R3D, published a blog post where they encourage OONI Probe testing of COVID-19 related websites. Their post is available here: https://r3d.mx/2020/03/27/ayudanos-a-descubrir-bloqueos-de-informacion-sobr… ## Userbase In April 2020, 7,175,892 OONI Probe measurements were collected from 6,124 networks in 214 countries around the world. This information can also be found through our measurement stats on OONI Explorer (see chart on “monthly coverage worldwide”): https://explorer.ooni.org/ ~ The OONI team. -- Maria Xynou Research & Partnerships Director Open Observatory of Network Interference (OONI) https://ooni.org/ PGP Key Fingerprint: 2DC8 AFB6 CA11 B552 1081 FBDE 2131 B3BE 70CA 417E

1 0

TBB 9.5 stable release meeting on Tuesday May 12th at 15UTC
by Gaba 08 May '20

08 May '20

Hi! On Tuesday May 12th at 15 UTC we are meeting in #tor-meeting to talk about the Tor Browser 9.5 stable release. Pad with discussion items are here: https://pad.riseup.net/p/tor-browser-release-meeting-keep cheers, gaba -- she/her are my pronouns GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

1 0

Anti-censorship meeting notes, 07 May 2020
by Philipp Winter 07 May '20

07 May '20

Hi all, Here are our meeting minutes: http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-05-07-17.58.html And here is our meeting pad: Anti-censorship work meeting pad -------------------------------- Next meeting: Thursday May 7th 18:00 UTC Weekly meetings, every Thursday at 18:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress). == Goal of this meeting == Weekly checkin about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at Tor. == Links to Useful documents == * Our anti-censorship roadmap: https://gitlab.torproject.org/torproject/anti-censorship/roadmap/boards * Our roadmap consists of a subset of trac tickets. For 2020 Q1, the trac keyword is anti-censorship-roadmap-2020Q1 * Next planning session: last week of April * The anti-censorship team's wiki page: https://trac.torproject.org/projects/tor/wiki/org/teams/AntiCensorshipTeam * Past meeting notes can be found at: https://lists.torproject.org/pipermail/tor-project/ * GetTor's roadmap: https://gitlab.torproject.org/groups/torproject/anti-censorship/gettor-proj… * Tickets that need reviews: from sponsors we are working on: * https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor30 * https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor28 * Anti-censorship related tickets that we want other teams to fix: * https://pad.riseup.net/p/tor-anti-censorship-tickets-keep ------------------------- --- May 7th 2020 -- ------------------------- == Announcements == * We have a GSoC student, Hashik, who is joining the team starting this week and working on building a Snowflake proxy app for Android == Discussion == * Shall we move our anti-censorship meeting time to 17:00 or 16:00 UTC? * Will make it easier to attend for folks in Asia * What works or doesn't work for you? * Any beginning circumvention developers want experience implementing a pluggable transport? David posted a roadmap for a DNS transport. * https://lists.torproject.org/pipermail/anti-censorship-team/2020-May/000089… == Actions == * == Interesting links == * https://jewlscholar.mtsu.edu/bitstream/handle/mtsu/6199/Sheffey_mtsu_0170N_… * MSc thesis on "Adversarially Enhanced Traffic Obfuscation" * By the author of "Improving Meek With Adversarial Techniques" from FOCI 2019, https://censorbib.nymity.ch/#Sheffey2019a * https://github.com/net4people/bbs/issues/13 == Reading group == * We will discuss "Salmon: Robust Proxy Distribution for Censorship Circumvention" on May 14 * https://censorbib.nymity.ch/#Douglas2016a * Questions to ask and goals to have: * What aspects of the paper are questionable? * Are there immediate actions we can take based on this work? * Are there long-term actions we can take based on this work? * Is there future work that we want to call out, in hopes that others will pick it up? == Updates == Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week (related to anti-censorship work). Help with: - Something you may need help with. phw: This week (2020-05-07): * Read Salmon paper. * Reviewed #34061, #34062, and #34089. * Wrapped up #30794 (lightweight censorship analyser) for now because it's working and usable so far. * More work on wolpertinger. * Filed #34089 to expose bridges.torproject.org/wolpertinger/ * Filed #34116 to look into setting up OONI's MetaDB on polyanthum (to get OONI's test results) * Wrote code to read cached-extrainfo docs and bridges stored in SQLite DB. * Some coordination with Sina regarding meek-azure. * Things are not looking good; currently no funding in sight. * A little bit of GSoC coordination. * Improved BridgeDB's email autoresponder test in #12802. * Looked into #33945 to figure out why BridgeDB's email autoresponder fails after a while. * Still not sure. Will deploy work-in-progress fixes, which may help. * Attended onionperf call. Will probably be working one day per week on it. Next week: * Help with: * https://trac.torproject.org/projects/tor/ticket/12802 Gaba: () Last week (2020-03-30): * not much related to anti-censorship This week (planned): * anti-censorship retrospective cecylia (cohosh): last updated 2020-05-07 Last week: Last week: - android reproducible build for snowflake (#28672) - GetTor twitter responder fixes (#27330) - Reproduced chrome proxy hang (#31278) - Discussed transifex issues with snowflake - snowflake webextension reviews - Investigated running a STUN server at the broker (#25591) - Created a ticket for using RFC5780 to determine the NAT type of peers (#34129) - Made PI meeting slides for next week - Onboarding Hashik (our new GSoC student) - fix for chrome idle proxy hang (#31278) This week: - sponsor 28 PI meeting (Monday, Tuesday) - More work on reviving the twitter responder in GetTor (#33036, #27330) - look at old GetTor mirrors (#33893) - More work on NAT type discovery (#34129) - Take a look at the multiplexing design for Snowflake (#25723) - investigate #33669 - Follow up on discussions of debian obfs4proxy package Needs help with: - review of GetTor twitter fixes (#27330) - review of chrome idle proxy hang fix (#31278) juggy : Temporary hiatus due to finals prep This week: - Researched XUL and dug into previous conversations around integrating Tor Launcher into Tor Browser, why porting to Web Extensions might not work, etc. Next week: - Implement audio captchas in moat, figure out how to reduce audio captcha request size - Keep studying BridgeDB Help with: - arlolra: 2020-05-07 Last week: - webext repo versioning / publishing #34140, #34126, #34132, #34127 Next week: - follow ups to #33365 - start on #31201 Help with: - dcf: 2020-05-07 Last week: - merged patch to reduce Snowflake client connection timeout (#34042) - converted snowflake turbotunnel merge (#34043) into a Tor Browser ticket Next week: - review fix for Chrome proxy hang (#31278) - check with Kyle about snowflake fingerprinting results - share access to the snowflake broker CDN configuration (#30510) Help with: agix:2020-05-07 Last week: - Incoperated some more feedback on #33835 Next week: - Started work on #27984 Help with: - catalyst: 2020-04-16 last week: - more work on #5304 (PT outbound bind address) - started looking at #29128 (assemble bridge line) this week: - more background research and work on s28/s30 tickets thymbahutymba: 2020-04-02 Last week: - CI/CD pipeline for multiarch docker images, which has a problem with the apt tor version even though the apt repository have been changed into the Dockerfile. Next week: Help with:

1 0

S58 Meeting on Mondays at 1800 UTC [Tor Browser Security, Performance, & Usability Improvements]
by Gaba 05 May '20

05 May '20

Hi! We are meeting every Monday at 18:00UTC to coordinate the project S58's work [0]. Next meeting is on May 11th. Agenda and notes: https://pad.riseup.net/p/_kbebKhZvNcUuqxQL5NV cheers, gaba [0] https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor58 -- she/her are my pronouns GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

1 0

Network health meeting notes, 4 May 2020
by Georg Koppen 05 May '20

05 May '20

Hi! We just had a short sync yesterday about network health work. You can find the IRC log at: http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-05-04-17.59.log… There was no pad involved this time, so no notes from it. Moreover, this was the last network-health meeting for quite some time I suspect as we are currently reorganizing our team structure in the wake of the recent lay-offs. There is no network-health team anymore and network-health topics will likely be part of meetings concerned with core Tor work in the foreseeable future. But details are not set yet. Georg

1 0

Do you own the dockerhub user name torproject?
by Philipp Winter 04 May '20

04 May '20

I recently tried to set up an organisational dockerhub account named torproject but the name was already taken, by a seemingly inactive user account: <https://hub.docker.com/u/torproject> Does anyone on here own this account, or knows who might? Thanks, Philipp

1 0

Anti-censorship team monthly report: April 2020
by Philipp Winter 30 Apr '20

30 Apr '20

Hi all, Here's what the anti-censorship team has been up to in April: Snowflake --------- * Merged Turbo Tunnel features into Snowflake. (Allows persisting a session across separate proxies.) <https://bugs.torproject.org/33745> <https://lists.torproject.org/pipermail/tor-talk/2020-April/045571.html> Merging into Tor Browser is pending: <https://bugs.torproject.org/34043> * Implemented measures to hand out more restrictive proxies less often. <https://bugs.torproject.org/33666> * Split Snowflake into two repositories(one for Go, one for the web-based proxy code). <https://bugs.torproject.org/33593> * Updated pion webrtc in Tor Browser. <https://bugs.torproject.org/33576> BridgeDB -------- * Moved forward with creating a feedback loop between OONI and BridgeDB. Work-in-progress code is available at: <https://gitlab.torproject.org/torproject/anti-censorship/wolpertinger> <https://bugs.torproject.org/32740> * Removed PGP support from BridgeDB. The feature has been broken for quite a while, is overly complex, and not particularly useful. <https://bugs.torproject.org/17548> * Renamed a bunch of source code files in BridgeDB, so they no longer collide on a file system that's case insensitive. <https://bugs.torproject.org/29686> * Made BridgeDB's email responder more usable. The instructions are now more clear and it will return with bridges no matter what -- even if the user's request was malformed. <https://bugs.torproject.org/30941> * Improved a Python script that tests BridgeDB's email responder by periodically sending email. <https://bugs.torproject.org/12802> * Made progress towards improving the robustness of BridgeDB's email autoresponder, so it no longer gets confused by Gmail's quoted-printable responses. <https://trac.torproject.org/projects/tor/ticket/33835#ticket> GetTor ------ * Fixed a bug caused by malformed email addresses. <https://bugs.torproject.org/34027> * Refactored to remove duplicate code. <https://bugs.torproject.org/34035> * Cleaned up logs. <https://bugs.torproject.org/34061> * Fixed a bug in the service shutdown code. <https://bugs.torproject.org/34062> * Removed a bunch of old GetTor code. <https://bugs.torproject.org/32912> Miscellaneous ------------- * Reviewed a submission for the Tor Research Safety Board. * Moved forward with creating a "censorship snapshot" that encodes how each country blocks Tor. Eventually, this snapshot should help Tor Browser figure out how to best circumvent in each country. <https://bugs.torproject.org/28531> * Built a prototype of a lightweight censorship analyser that's meant to be run by censored users. It can help us create the censorship snapshot in #28531. <https://bugs.torproject.org/30794> * Created a new mailing list for anti-censorship service outage alerts. If this interests you, you can subscribe here: <https://lists.torproject.org/cgi-bin/mailman/listinfo/anti-censorship-alerts> * We organised two reading groups, in which we discussed the following two papers: <https://censorbib.nymity.ch/#Wang2020a> <https://censorbib.nymity.ch/#Nasr2020a> Cheers, Philipp

1 0

Anti-censorship meeting notes, 30 Apr 2020
by Philipp Winter 30 Apr '20

30 Apr '20

Hi all, Here are our meeting minutes: http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-04-30-17.59.html And here is our meeting pad: Anti-censorship work meeting pad -------------------------------- Next meeting: Thursday April 30th 18:00 UTC Weekly meetings, every Thursday at 18:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress). == Goal of this meeting == Weekly checkin about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at Tor. == Links to Useful documents == * Our anti-censorship roadmap: https://gitlab.torproject.org/torproject/anti-censorship/roadmap/boards * Our roadmap consists of a subset of trac tickets. For 2020 Q1, the trac keyword is anti-censorship-roadmap-2020Q1 * Next planning session: last week of April * The anti-censorship team's wiki page: https://trac.torproject.org/projects/tor/wiki/org/teams/AntiCensorshipTeam * Past meeting notes can be found at: https://lists.torproject.org/pipermail/tor-project/ * GetTor's roadmap: https://gitlab.torproject.org/groups/torproject/anti-censorship/gettor-proj… * Tickets that need reviews: from sponsors we are working on: * https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor30 * https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor28 * Anti-censorship related tickets that we want other teams to fix: * https://pad.riseup.net/p/tor-anti-censorship-tickets-keep ------------------------- --- April 30th 2020 -- ------------------------- == Announcements == * We created anti-censorship-alerts(a)lists.tp.o for service outage alerts. * Feel free to subscribe. * https://lists.torproject.org/cgi-bin/mailman/listinfo/anti-censorship-alerts * Alerts for * gman999's sysmon instance * prometheus instance * nagions instances * gettor's email autoresponder * bridgedb's email autoresponder * Also, send email there if any of our services are broken. == Discussion == * We should monitor indicators that tell us if we're on the right track * # of bridge users * # of bridge users from bridges that were privately distributed * # of bridges/snowflakes * volume of traffic on snowflake / meek bridges * snowflake https://metrics.torproject.org/rs.html#details/5481936581E23D2D178105D44DB6… * meek https://metrics.torproject.org/rs.html#details/8F4541EEE3F2306B7B9FEF1795EC… * Make it easier for people to report bugs -> gives us an idea of what users are struggling with * Blog more and hear from users in comments * Read frontdesk emails & get a sense of the variety of questions and how many get resolved * Track a project's "activity" by keeping track of its commits * Check what other people are tracking, in different contexts, and see if we can apply their indicators * Track # of user-reported tickets * Number of countries where vanilla Tor Browser works / doesn't work, where Tor Browser + default bridges work/doesn't work, and + obfs4. == Actions == * Please add your April 2020 work highlights to our monthly team report: * https://pad.riseup.net/p/CANAMyvGfb-wtKfzN2R_ == Interesting links == * https://ssd.eff.org/en/module/understanding-and-circumventing-network-censo… * Surveillance Self-Defense: Understanding and Circumventing Network Censorship * https://protonmail.com/blog/anti-censorship-alternative-routing/ * Protonmail will introduce a new "alternative routing" feature. * No technical details. May be domain fronting. == Reading group == * We will discuss "MassBrowser: Unblocking the Censored Web for the Masses, by the Masses" on April 30 * https://censorbib.nymity.ch/#Nasr2020a * https://massbrowser.cs.umass.edu/ * Questions to ask and goals to have: * What aspects of the paper are questionable? * Are there immediate actions we can take based on this work? * Are there long-term actions we can take based on this work? * Is there future work that we want to call out, in hopes that others will pick it up? == Updates == Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week (related to anti-censorship work). Help with: - Something you may need help with. phw: This week (2020-04-30): * Emailed a bunch of people to get an idea of meek-azure's financial situation. * Offboarding activities. * Addressed feedback for our lightweight censorship analyser (#30794). * Asked for new mailing list for anti-censorship service alerts. * Asked for Nagios alerts to be sent there (#34028). * Reviewed #33666, #33835, and #34035. * Continued work at wolpertinger. Added code to read serge's extrainfo descriptors. * Started taking a look at ICLab's measurements of our default bridges. * More talking to sysadmins to finally move our monitoring forward. Next week: * Help with: * #30794 Gaba: () Last week (2020-03-30): * not much related to anti-censorship This week (planned): * anti-censorship retrospective cecylia (cohosh): last updated 2020-04-30 Last week: - so many reviews - refactored some GetTor code (#34035) - rebased pion-webrtc update patch in tbb (#33576) - looked at datachannel timeout in client (#34042) - squished some new snowflake bugs (#34049) - update node wrtc package (#34053) - updated snowbox to work with new repo setups - updated snowflake web proxy - started building snowflake for android (#28672) - squashed some GetTor bugs (#34061, #34062, #34027) - kept up with sponsor 28 evaluation phase This week: - test snowflake for android on mobile device - set up some kind of NAT topology testing suite (#25595) - figure out what we need to do to revive the twitter responder in GetTor (#33036) - look at old GetTor mirrors (#33893) - investigate #33669 - clean out and update any old tickets lying around - help with sponsor 28 PI meeting slides Needs help with: - review of GetTor fixes (#34061, #34062) juggy : Temporary hiatus due to finals prep This week: - Researched XUL and dug into previous conversations around integrating Tor Launcher into Tor Browser, why porting to Web Extensions might not work, etc. Next week: - Implement audio captchas in moat, figure out how to reduce audio captcha request size - Keep studying BridgeDB Help with: - arlolra: 2020-04-30 Last week: - some sporadic review Next week: - follow ups to #33365 - start on #31201 Help with: - follow up review of #33365 dcf: 2020-04-30 Last week: - merged snowflake turbotunnel branch and redeployed bridge (#33745, thanks arma and cohosh) - removed client-side buffering from snowflake, and related refactorings (#33897, #33982, #33984, #33994, #33995, #33996, #33997, #34002, #34049, #34050, thanks cohosh and arlolra) - filed a ticket to reduce snowflake client connection timeout (#34042) - made a branch for updating to turbotunnel snowflake in Tor Browser (#34043) Next week: - patch to reduce connection timeout (#34042) - convert snowflake turbotunnel merge (#34043) into a Tor Browser ticket - check with Kyle about snowflake fingerprinting results - share access to the snowflake broker CDN configuration (#30510) Help with: cjb: 2020-04-30 Last week: - gonna be afk with kids Next week: Help with: agix:2020-04-30 Last week: - Incoperated phw's feedback on #33835 and #31528 Next week: - finalize #33835 and #31528 - Pick up a new ticket Help with: - catalyst: 2020-04-16 last week: - more work on #5304 (PT outbound bind address) - started looking at #29128 (assemble bridge line) this week: - more background research and work on s28/s30 tickets thymbahutymba: 2020-04-02 Last week: - CI/CD pipeline for multiarch docker images, which has a problem with the apt tor version even though the apt repository have been changed into the Dockerfile. Next week: Help with:

1 0

Community Council activity summary, October 2019 - March 2020
by Taylor Yu 29 Apr '20

29 Apr '20

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi all, Here is a brief summary of the Community Council's activities from October 2019 through March 2020. March 2020 The Council participated in the membership audit process. February 2020 The Council talked with some people from the relay operator community about extending the code of conduct for relay operation. It probably makes more sense to make a separate guidelines document about ethical relay operation. January 2020 The Council started a dialog with grants and communications teams about making sure the potential donors and guest bloggers are aligned with our community values. December 2019 no significant actions November 2019 The Council reviewed an existing community health concern. October 2019 The Council received an email containing suggestions for revising the Code of Conduct. One immediately actionable suggestion was to fix an incorrect email address for the Community Council. An appropriate email alias was created to work around the problem. - --- end of summary --- This summary will also be posted on the Council's wiki page. If you have any feedback about this summary format, or any other feedback to the Council, please contact us at tor-community-council(a)lists.torproject.org. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQGcBAEBCAAGBQJeqjBDAAoJEKMvF/0AVcMFQoML/iKK2UbDWpbBQjweas22EROF MDSIgoBD35ywGV7qlWUNO/sZCFhgs/c4HSsmC2xCvUD1FjF/J9YBDzIHmCX6Ew4o TkK39/yAo3P+IbRFDxcNcEPaGT/8MqlpMUC6lvic5CmygLxRJeBi49j4bdXcI1to 7M0Omi2cbK7RFUQCxk6VrmSuE+C/NwUbEZPzCRQgzDXPFtoecIip6EtbupciDFFz ePRItO6mlyqpBoqex+f5TrxDfhuvmqGpD4ld93azsWWO2dFK9M8pMt+cNnxA/lMl KCoIzVO/Cy/jcQ8IkRz+TeVROQrJtpxjRCVoS55bDJYhtT3sGgLGjv0QK8N0xx9Q RC4k3rFOEpUmYaVALChSL5isxIS86m+paxvHBH5avCqBWD2vYz3UiFgNZRHzRJut DkmTQNgJzKzfpmm9KER9yleNDvb4OeboTficC6pVipAr4xmY4mgXmbrqduO75gEi m+Eo02YD+qVWJKqh0mKyDbqDd6VXYKyodfJqqwGVXA== =hYTD -----END PGP SIGNATURE-----

1 0

February Fundraising Report
by Sarah Stevenson 28 Apr '20

28 Apr '20

Below you will find the Fundraising Team's February report. Please let us know if you have any questions! ## Grants DRL: We have been working on submitting two full proposals to DRL, one for usability (joint project with Tails & Guardian Project) and another for scalability. We will submit these at the beginning of March. Zcash Foundation: Zcash Foundation granted us $50,000 to work on the Specification phase of the Walking Onions proposal[1]. Thank you Chelsea for making this connection, and to Nick for helping to write the proposal and advocate for the work. We still need funding for the proof-of-concept and implementation phases of Walking Onions. If you know someone, or some entity, that might be interested in supporting this work, please let us know! Nathan Cummings Foundation: A joint proposal with FPF we submitted was declined. DIAL Open Source Center: We submitted a small proposal to DIAL to help support the Walking Onions work. OTF: We are working on a third round of OTF revisions on the Tor Browser proposal. We submitted a Learning Lab application to help publicize the onion services work in Sponsor 30. OTF also agreed to fund an in-person meeting to do some work on DDoS protections as it pertains to high profile onion services. We submitted some informal requests to the Judith Neilson Institute for Journalism & Ideas and the Omidyar Foundation. We also met with the Internet Society Foundation. ## Donate Buttons on Website We closely monitor organic donations made via donate.torproject.org. By ‘organic’ we mean non-monthly donations generated primarily via donate links throughout our webpages. It is important to track this income because it accounted for $231,472 in FY18, $239,479 in FY19, and $334,418 so far in FY20. Small changes to our web pages can affect this income. This graph[2] shows average daily online income per month. This clearly illustrates the importance of our EOY campaign and the call to action on about:tor. There are a few other events to note in the past year. The new website launched in March 2019. The first iteration did not include a prominent donate button and the average daily income decreased until we made the donate button yellow April 26th. Then average daily income increased modestly, and increased significantly after May 26th when we added the donate link to about:tor. Since that addition, we have been averaging $600 per day in organic donations (except during the campaign when the average was significantly more.) At the end of February 2020, we saw a sharp decline in these organic donations. We suspected the redesign of /download was partially responsible. Antonela quickly added the yellow donate button back to that page and we saw donations go back up to about where they were in early February. This prompted us to take a look at other modifications and we decided to highlight the donate language on /thank-you and the donate language on about:tor will be updated upon the next release. We are also beginning plans to update donate.torproject.org and are working with Giant Rabbit to be able to make those changes ourselves. ## Events We are still planning for the major donor event in San Francisco March 26th and foundation lunch in New York April 13th. Hopefully covid-19 will not alter those plans. ## Newsletter/Email list We are still seeing around 10,000 people join our email list each month and now have over 179,000 subscribers. Since the list was so large, it was taking around 24 hours to send an email message to the whole group. Giant Rabbit made some changes to our system and now a bulk email is delivered in around 3 hours. Each new subscriber gets a welcome email a day or two after they join the list and then are offered a sticker pack for a $17 donation a few weeks after that. [1] https://grants.zfnd.org/proposals/1642205075-walking-onions-scaling-the-tor… <https://grants.zfnd.org/proposals/1642205075-walking-onions-scaling-the-tor…> [2] https://trac.torproject.org/projects/tor/attachment/wiki/org/teams/Fundrais… <https://trac.torproject.org/projects/tor/attachment/wiki/org/teams/Fundrais…> Sarah Stevenson (she/her) Fundraising Director The Tor Project sstevenson(a)torproject.org Take back the internet with Tor. https://donate.torproject.org/ Public Key: 93B3 AC08 4257 FA3D D4BB 8E95 CC08 5DBA C015 612A

2 2