- tor-project - lists.torproject.org

GitHub Phishing Emails
by teor 06 Apr '20

06 Apr '20

Hi, Just letting everyone know that I've received a spam email that looks like a GitHub notification. But it's fake. Please don't click links in emails like this! T -- teor ----------------------------------------------------------------------

1 0

Anti-censorship meeting notes, 02 Apr 2020
by Philipp Winter 02 Apr '20

02 Apr '20

Hi all, Here are our meeting minutes: http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-04-02-17.59.html And here is our meeting pad: Anti-censorship work meeting pad -------------------------------- Next meeting: Thursday April 2nd 18:00 UTC Weekly meetings, every Thursday at 18:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress). == Goal of this meeting == Weekly checkin about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at Tor. == Links to Useful documents == * Our anti-censorship roadmap: https://gitlab.torproject.org/torproject/anti-censorship/roadmap/boards * Our roadmap consists of a subset of trac tickets. For 2020 Q1, the trac keyword is anti-censorship-roadmap-2020Q1 * Next planning session: last week of April * The anti-censorship team's wiki page: https://trac.torproject.org/projects/tor/wiki/org/teams/AntiCensorshipTeam * Past meeting notes can be found at: https://lists.torproject.org/pipermail/tor-project/ * GetTor's roadmap: https://gitlab.torproject.org/groups/torproject/anti-censorship/gettor-proj… * Tickets that need reviews: from sponsors we are working on: * https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor30 * https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor28 * Anti-censorship related tickets that we want other teams to fix: * https://pad.riseup.net/p/tor-anti-censorship-tickets-keep ------------------------- --- April 2nd 2020 -- ------------------------- == Announcements == * == Discussion == * == Actions == * == Interesting links == * https://www.eff.org/pages/speaking-freely-ada-palmer * "The expurgation system was basically 'you may have this book, but you must go to page 210 and cross out paragraph 3—that paragraph is forbidden, but the rest of it you may have.' * "What you produce at the end doesn’t actually obliterate the content—you can put a light behind it and see the text, it’s not that hard—but what it means is that every time you turn the page and see the blacked-out parts, you’re reminded of power, reminded that there is an authority out there, lurking. And one of the most telling examples of this is that the content censored isn’t always what we’d think of as the most meaningful." == Reading group == * We will discuss "Detecting Probe-resistant Proxies" on April 2 * https://censorbib.nymity.ch/#Frolov2020a * Questions to ask and goals to have: * What aspects of the paper are questionable? * Are there immediate actions we can take based on this work? * Are there long-term actions we can take based on this work? * Is there future work that we want to call out, in hopes that others will pick it up? == Updates == Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week (related to anti-censorship work). Help with: - Something you may need help with. phw: This week (2020-04-02): * Merged and deployed #30317 (Update howto on https://bridges.torproject.org/ to take mobile Tor Browser into account) * Merged and deployed #33631 (BridgeDB doesn't allow bridges to change their distribution mechanism) * Implemented #29686 (filenames conflict on case-insensitive filesystems) * Implemented #30941 (Need better instructions for requesting bridges via email) * Released and deployed BridgeDB version 0.10.0. Next week: * Write a summary of our current BridgeDB distribution mechanisms and brainstorm new ones * Make BridgeDB report internal metrics (#31422) * Will have to tackle #32740 (Implement a feedback loop between BridgeDB and OONI) Help with: * https://trac.torproject.org/projects/tor/ticket/29686 * https://trac.torproject.org/projects/tor/ticket/30941 Gaba: () Last week (2020-03-30): * not much related to anti-censorship This week (planned): * anti-censorship retrospective cecylia (cohosh): last updated 2020-04-02 Last week: - Review of #19026 and #30941 - worked with gsoc applicants on proposals - patch for #33693 - commented on turbo tunnel merge ticket (#33745) - merged #23226 and closed a bunch of old/outdated GetTor tickets - did some debugging of proxy issues (#33666) - restarted recurring snowflake health tests (#32545) - removed 11 unnecessary projects from tor browser (#33761) This week: - Resume obfs4 tests (#31701, #32657) - finish a slightly different variation of proxy webrtc test (?) (#32938) - see if i can help push snowflake for android along (#28672) - continue working on proxy issues (#33666) - take a look at reviving the twitter responder in GetTor (#33036) - review GSoC proposals Needs help with: - merge of #33693 and #33761 (tb-team) - review of #33666 juggy : This week: - Worked on #10831 (made a sample webpage with audio captchas enabled) Next week: - Get #10831 reviewed and make improvements - Keep studying BridgeDB to write architectural overview Help with: - Reviewal of #10831 arlolra: 2020-03-26 Last week: - merged #33665 Next week: - maybe the proxy parts of #19026 - start on #31201 Help with: - review of #19026 but also answer the question there dcf: 2020-04-02 Last week: - filed ticket for snowflake turbotunnel merge (#33745) - reviewed snowflake dummy address change (#33693) - reviewed snowflake dependency reduction (#33761) Next week: - branches for snowflake turbotunnel merge - share access to the snowflake broker CDN configuration (#30510) Help with: cjb: 2020-03-26 Last week: - gonna be afk with kids Next week: Help with: antonela: 2020-03-26 - working with Babatunde's interviews (OTF Fellowship) from Nigeria and Cameroon. Shared preliminar notes with Tunde and Nah (#32811) - started to work on this user research document, we still stick to the plan of running it during April (#31870) Help with: - nothing yet :) agix:2020-04-02 Last week: - Patched #31528 - Patched #33647 - Read "Detecting Probe-resistant Proxies" - Started on #19997 Next week: - Work on #19997 Help with: -Questions regarding #19997: Are IPv6 addresses still removed from check.torproject.org? How many bridges can currently be requested by a user from a particular Tor exit address? catalyst: 2020-04-02 last week: - fixed a mis-merge in my #5304 rebase; still evaluating existing work - mostly unrelated CI stuff and reviews this week: - more work on #5304 and other s28/s30 tickets thymbahutymba: 2020-04-02 Last week: - CI/CD pipeline for multiarch docker images, which has a problem with the apt tor version even though the apt repository have been changed into the Dockerfile. Next week: Help with: Hiro: (last updated before 2020-01-09) Started restoring Twitter Responder. When retrieving tweets I need to check for new tweets only otherwise Gettor will end up responding to old back log and already answered messages. <-- is this #27330 ? Next Week: - Work on gettor specs <-- Is this #3781? - More with review of strings and website content and translation

1 0

Tor Browser Team Meeting Notes, 30 March 2020
by Nicolei Ocaña 02 Apr '20

02 Apr '20

Has the meeting log for this date been emailed yet? Thanks in advance. -- N

1 0

OONI Monthly Report: March 2020
by Maria Xynou 02 Apr '20

02 Apr '20

Hello, Throughout March 2020, the OONI team worked on the following 2 (two-week) sprints: * Flounder Sprint (2nd March 2020 - 15th March 2020) * Ariel Sprint (16th March 2020 - 29th March 2020) Our work can be tracked through the various OONI GitHub repositories: https://github.com/ooni Details and highlights are available in this report below. ## OONI Probe mobile app We released OONI Probe mobile 2.3.0! * Android: https://github.com/ooni/probe-android/releases/tag/v2.3.0 * iOS: https://github.com/ooni/probe-ios/releases/tag/v2.3.0 Highlights include: 1. You can re-test URLs. This new feature can be useful if you want to collect more evidence on potential blocking, or if a test fails. 2. You can test many more websites in one go! By disabling the “Limit test duration” option (of the website settings), you can test all of the URLs included in the Citizen Lab's global and country-specific test lists. This release also fixed a bug that led to WhatsApp false positive test results (once WhatsApp made changes to its infrastructure), and includes a series of other improvements documented here: https://github.com/ooni/probe-android/releases/v2.3.0 To address certain infrastructure issues that emerged following the release of OONI Probe mobile 2.3.0, we released OONI Probe mobile 2.3.1 with a fix: https://github.com/ooni/probe-android/releases/tag/v2.3.1 We also released OONI Probe mobile 2.3.2 with further UX improvements and bug fixes: https://github.com/ooni/probe-android/releases/tag/v2.3.2 In March 2020, we also started working on adding support for automated testing: https://github.com/ooni/probe-android/pull/304 Finally, we planned the backlog and roadmap of OONI Probe mobile to better determine the next steps of OONI Probe mobile development: https://github.com/ooni/probe/issues/977 ## Research on push notifications In order to add support to the OONI Probe mobile app to send push notifications, we have been researching the use of Countly as a potential frontend and backend solution for push notifications. As part of this, we: * Enabled analytics on countly: https://github.com/ooni/probe/issues/1002 * Tested countly to see whether we can use push notifications for sending OONI Run links: https://github.com/ooni/probe/issues/1055 * Checked how to set-up and use the countly rich notification plugin: https://github.com/ooni/probe/issues/1056 * Explored whether the countly community edition is sufficient to meet our needs: https://github.com/ooni/probe/issues/1057 We also researched how to design the push notification backend, as documented through the following ticket: https://github.com/ooni/backend/issues/339 ## OONI Probe desktop app Throughout March 2020, we continued to make improvements to the OONI Probe desktop app in preparation for the upcoming public launch. More specifically, we: * Made a new release candidate for the OONI Probe desktop app (including newly translated strings for the circumvention tool tests): https://github.com/ooni/probe-desktop/releases/tag/v3.0.0-rc.6 * Made UX improvements to the Dashboard and measurement pages: https://github.com/ooni/probe/issues/1047 & https://github.com/ooni/probe/issues/1042 * Integrated the animation for the circumvention tool tests: https://github.com/ooni/probe/issues/1063 * Investigated the failures in the auto-update system and added better exception logging: https://github.com/ooni/probe/issues/1008 * Aligned the middlebox test results in the Test Results page: https://github.com/ooni/probe/issues/1049 * Fixed the markdown in the Psiphon measurement pages: https://github.com/ooni/probe/issues/1051 * Edited the copy in the Websites card: https://github.com/ooni/probe/issues/1048 * Fixed OONI Explorer links: https://github.com/ooni/probe/issues/1041 * Fixed the z-index and draggability of Hero on measurement pages: https://github.com/ooni/probe/issues/1033 * Fixed the scrolling on measurement pages: https://github.com/ooni/probe/issues/959 * Fixed the sorting of columns in the Tor test details page: https://github.com/ooni/probe/issues/1007 ## Creating official Linux packages for OONI Probe To better support the Linux OONI community (which contributes the largest volume of measurements from stable vantage points), we aim to create official Linux packages for OONI Probe. To this end, we started doing some initial Debian packaging for Linux in March 2020 and we created a prototype (see: https://github.com/ooni/probe-cli/pull/117) which is available here: https://github.com/ooni/probe/issues/1061 ## OONI Probe measurement engine OONI Probe has relied on the MaxMind database (https://www.maxmind.com/) for IP geolocation, but they recently changed their license. In March 2020, we continued to work on replacing the MaxMind ASN database following the license change: https://github.com/ooni/probe-engine/issues/336 ## Making the OONI Probe apps rely entirely on the OONI Probe golang engine We continued to make progress on making the OONI Probe mobile and desktop apps rely entirely on the golang based probe-engine. To this end, we completed the work in the following tickets: https://github.com/ooni/probe-engine/issues/348 https://github.com/ooni/probe-engine/issues/350 https://github.com/ooni/probe-engine/issues/351 https://github.com/ooni/probe-engine/issues/353 https://github.com/ooni/probe-engine/issues/362 https://github.com/ooni/probe-engine/issues/399 https://github.com/ooni/backend/issues/369 https://github.com/ooni/probe/issues/1030 ## Improving censorship circumvention tool methodologies We are improving our censorship measurement methodologies by including metrics that are related to measuring the performance of circumvention tools. We aim to add support for running the NDT speed and performance test over circumvention tools (Tor, Psiphon, obfs4proxy). This will allow us to determine at what throughput (for example, a 1Mbit download) the tool is able to perform on the network in question, and to better characterize the circumvention tool’s performance. In March 2020, we started off by replacing NDT with the next generation ndt7 speed test in the OONI Probe Command Line Interface (CLI). This work is available through the following pull request: https://github.com/ooni/probe-cli/pull/119 ## Expanding OONI Probe measurement methodologies As part of our ongoing efforts to expand OONI Probe measurement methodologies, we made improvements to the implementation of our SNI experiment, which involved addressing feedback shared by an engineer at Jigsaw (Vinicius Fortuna): https://github.com/ooni/probe-engine/issues/309 ## Prototype of system for probe URL selection Throughout March 2020 -- during the OONI Team Meeting and during our weekly backend and frontend development calls -- we did a lot of brainstorming in order to determine what an MVP for the URL selection prototype should look like. Our plan for the MVP is documented in the following github ticket: https://github.com/ooni/backend/issues/361 We also documented several issues related to the creation of the prototype: https://github.com/ooni/backend/issues/320 https://github.com/ooni/backend/issues/361 https://github.com/ooni/backend/issues/321 https://github.com/ooni/ooni.org/issues/431 https://github.com/ooni/ooni.org/issues/430 https://github.com/ooni/backend/issues/322 https://github.com/ooni/backend/issues/221 https://github.com/ooni/backend/issues/207 https://github.com/ooni/probe/issues/930 https://github.com/ooni/explorer/issues/392 https://github.com/ooni/explorer/issues/391 ## Data analysis and pipeline work necessary for extracting per site metrics In March 2020, we started experimenting with ClickHouse to evaluate whether it could be suitable for the more advanced batch analysis required for extracting website metrics. So far, the results are quite promising. The cursory findings of this research are documented here: https://github.com/ooni/backend/issues/380 We also did a lot of database tuning and troubleshooting related to adding counter tables which support aggregating per website metrics: https://github.com/ooni/backend/issues/371 Furthermore, we: * Wrote an analysis script to close active database connections and fix a connections issue: https://github.com/ooni/pipeline/pull/306 * Made progress on keeping the fast-path rows in the measurement table: https://github.com/ooni/backend/issues/233 ## OONI Probe orchestration logic for circumvention tool testing As part of our work on developing OONI Probe orchestration logic that is specific to circumvention tool testing, we: * Added backend support for provisioning circumvention tool test configurations to probes: https://github.com/ooni/orchestra/issues/68 * Made it possible to instruct probes in near real-time to test a specific circumvention tool with a particular configuration: https://github.com/ooni/probe/issues/889 ## OONI Explorer Throughout March 2020, we made a few improvements to OONI Explorer. More specifically, we: * Fixed the anomaly indicator to ensure that the search results are consistent with the anomaly status in the measurement pages: https://github.com/ooni/explorer/issues/360 * Made measurement pages resilient to the absence of nullable data: https://github.com/ooni/explorer/issues/414 * Handled cases where tcp_connect test keys are missing: https://github.com/ooni/explorer/pull/412 * Wrote copy for the new Psiphon test results: https://github.com/ooni/explorer/issues/419 * Wrote copy for the new Tor test results: https://github.com/ooni/explorer/issues/418 * Opened tickets based on community feedback: https://github.com/ooni/explorer/issues?q=is%3Aopen+is%3Aissue+label%3A%22u… ## Quality assurance and testing of OONI software As part of our ongoing efforts to increase the quality of OONI software components, we carried out the following activities in March 2020: * Created an end-to-end testing strategy for OONI Explorer: https://github.com/ooni/explorer/issues/159 * Added end-to-end tests for the OONI Probe desktop app: https://github.com/ooni/probe/issues/1062 * Tested the OONI Probe mobile app 2.3 release: https://github.com/ooni/ooni.org/issues/398 We also made the improvements to the probe-engine, as documented through the following tickets: https://github.com/ooni/probe-engine/issues/310 https://github.com/ooni/probe-engine/issues/315 https://github.com/ooni/probe-engine/issues/317 https://github.com/ooni/probe-engine/issues/327 ## OONI infrastructure As part of our efforts to improve our server infrastructure and the performance of reliant tools, we: * Dealt with an incident affecting API slowdown and frequent 500 errors: https://github.com/ooni/backend/issues/371 * Dropped some unused hosts once they stopped receiving traffic: https://github.com/ooni/backend/issues/309 * Investigated slow OONI Explorer / OONI API queries: https://github.com/ooni/backend/issues/327 * Investigated why certain OONI Explorer measurements were unreachable: https://github.com/ooni/backend/issues/329 * Added supported for automatically building docker images as part of the CI process: https://github.com/ooni/backend/issues/346 * Performed VACCUM of the metadb: https://github.com/ooni/backend/issues/354 * Stopped doing full table scans in some places to improve API performance: https://github.com/ooni/backend/issues/356 ## OONI website In preparation for the upcoming public launch of the OONI Probe desktop app, we worked on re-designing the Install page of our website. A community member generously volunteered to write the code for implementing the new Install page based on our design mockups. This work is available here: https://github.com/ooni/ooni.org/pull/446 We also wrote and published the following: * Tor test description: https://ooni.org/nettest/tor/ * Psiphon test description: https://ooni.org/nettest/psiphon/ Furthermore, we made improvements to how images are handled in the OONI website: https://github.com/ooni/ooni.org/issues/390 ## Published report on the temporary blocking of the Farsi edition of Wikipedia in Iran We published a report on the temporary blocking of the Farsi language edition of Wikipedia in Iran: https://ooni.org/post/2020-iran-blocks-farsi-wikipedia/ OONI measurements showed that the Farsi edition of Wikipedia (fa.wikipedia.org) was blocked on at least 6 networks in Iran between 2nd to 3rd March 2020. We also found the Farsi edition of Wikinews (fa.wikinews.org) blocked in Iran, though we're being told that it's been blocked for several years now. Both Farsi Wikipedia and Wikinews were blocked by means of DNS tampering and SNI filtering. In our report, we share relevant data. ## Published blog post encouraging the testing of COVID-19 websites Ensuring a free and open internet during emergencies is important, but access to COVID-19 information has already been censored in China and Venezuela. We therefore published a blog post encouraging community participation in a global measurement campaign to increase testing coverage of COVID-19 relevant websites. This blog post (providing relevant instructions for testing) is available here: https://ooni.org/post/covid-19-ooni-measurement/ We also embedded a “COVID-19” button on the OONI website to enable OONI Probe testing of COVID-19 websites: https://ooni.org/get-involved/run/ ## Year in Review: OONI in 2019 We published a blog post sharing highlights from the OONI-verse over the last year, as well as some of the great ways that community members made use of OONI Probe and OONI data as part of their work. The “Year in Review: OONI in 2019” post is available here: https://ooni.org/post/ooni-in-2019/ OONI highlights from 2019 were also discussed in a separate blog post written and published by VPNCompare: https://www.vpncompare.co.uk/ooni-censorship-2020s/ ## Published blog post on OONI highlights between 2017-2019 We wrote a blog post that shares OONI highlights from 2017 to 2019 that were made possible thanks to OTF support. This blog post was published on the OTF website: https://www.opentech.fund/news/ooni-highlights-2017-2019/ We also cross-posted this blog post on the OONI website: https://ooni.org/post/ooni-highlights-2017-2019/ ## OONI Team Meeting We held a 4-day OONI Team Meeting between 10th to 13th March 2020. We were originally planning on facilitating this meeting in person in Rome. However, due to the escalating impact of COVID-19 (coronavirus) and the national lockdown of Italy (which started on 10th March 2020), we cancelled travel arrangements (for OONI team members not based in Rome) and facilitated the entire 4-day meeting remotely, online. During our team meeting, we refined our roadmap for the next 6 months and held various meetings/sessions that enabled us to discuss plans and next steps for the various projects in the OONI-verse. Below we share the sessions that we held during our 4-day team meeting. ### Day 1 * Discussion of team meeting agenda * Time for reflection: What worked well and what didn’t work well over the last 6 months * Test vectors and technical documentation * Expanding OONI Probe methodologies * Data analysis needs: Building capacity * Data analysis required for extracting website metrics ### Day 2 * What do you want OONI to be? * Adding support for OONI Probe push notifications * Brainstorming on URL prioritization * Server infrastructure: Next steps * Presenting website metrics on OONI Explorer * OONI Explorer: Next steps ### Day 3 * Improving OONI Run * OONI Probe Mobile: Next steps * OONI Probe Desktop: Next steps * Identifiers of measurements (OOID) and in defense of the report ID * OONI data processing pipeline design ### Day 4 * OONI Team Roadmap for 2020 * Fundraising priorities Most of Day 4 of the team meeting was spent creating a detailed roadmap for all of our projects until December 2020. We expect to revise our roadmap during our next team meeting which we plan to have in about 6 months from now (September or October 2020). ## Fundraising In March 2020, we were invited by the Ford Foundation to submit a proposal to seek support for hosting the next OONI Partner Gathering and other community-related work. We previously submitted a proposal to the OTF Community Lab to seek support for hosting the OONI Partner Gathering, and in March 2020 we addressed their latest feedback. ## Test list updates Throughout March 2020, we: * Updated the Venezuelan test list to include reportedly blocked coronavirus-related sites: https://github.com/citizenlab/test-lists/pull/591 * Updated the Global test list to include many coronavirus-related websites (particularly data maps): https://github.com/citizenlab/test-lists/pull/594 * Updated the Global & Saudi Arabian test lists to include LGBTQI sites shared by OutRight International: https://github.com/citizenlab/test-lists/pull/593 * Updated the Myanmar test list to include URLs from a new blocklist (shared by an OTF Information Controls Fellow): https://github.com/citizenlab/test-lists/pull/596 & https://github.com/citizenlab/test-lists/pull/597 ## Data analysis Throughout March 2020, we performed OONI data analysis for the following: * Azerbaijan Internet Watch: Analysis of measurements collected from Azerbaijan * Small Media: Analysis of OONI measurements collected from Lebanon & Rwanda, in support of relevant stakeholder submissions to the Universal Periodic Review (UPR): https://github.com/ooni/ooni.org/issues/435 Based on these analyses, we wrote reports explaining and interpreting the findings, which we shared with Azerbaijan Internet Watch and Small Media. ## Supported OTF Fellow Over the last year, we have hosted an OTF Information Controls Fellow who has been researching internet censorship in certain states of India. In preparation for the publication of their research report, we continued to review it, share suggested copy edits and other feedback. We also made improvements to the data visualizations included in their research report: https://github.com/ooni/ooni.org/issues/441 ## Google Summer of Code (GSoC) OONI is participating in Google Summer of Code (GSoC) under The Tor Project and the DIAL Open Source Center (OSC). In March 2020, prospect GSoC students interested in working on OONI projects over the summer reached out to us. Below are some of the projects that we suggested to the prospect GSoC students: * OONI Probe Desktop support for OONI Run and custom URLs, https://community.torproject.org/gsoc/ooni-probe-desktop-custom-urls/ * OONI Probe network experiments, https://community.torproject.org/gsoc/ooni-probe-experiments/ * OONI Explorer: Improvements to testing, https://community.torproject.org/gsoc/ooni-explorer-testing/ * OONI Explorer findings: Improvements related to social media sharing, https://community.torproject.org/gsoc/ooni-explorer-findings/ ## IEEE article discussing OONI OONI’s Arturo was interviewed by IEEE to explain and discuss OONI. IEEE subsequently published an article that presents OONI and discusses how our project measures internet censorship around the world. This article is available here: https://spectrum.ieee.org/tech-talk/telecom/internet/how-to-detect-a-govern… ## Community activities ### RIPE hackathon We contributed project ideas to the online RIPE hackathon: https://labs.ripe.net/Members/becha/hackathons-in-the-time-of-corona We also participated in the hackathon video-chat (23rd March 2020) and offered the #ooni-dev channel (on Slack and IRC) as a space for online communication and coordination during the hackathon. ### OONI Community Meeting On 31st March 2020, we facilitated the monthly OONI Community Meeting on our Slack channel (https://slack.ooni.org/) during which we discussed the following topics: 1. Updates on blocked Biafra websites in Nigeria 2. Testing a custom list of URLs with the OONI Probe CLI 3. The future of automatic OONI Probe testing on desktop and Raspberry Pis 4. Storage data format that is easier to consume 5. Faster event analysis ## Userbase In March 2020, 8,214,072 OONI Probe measurements were collected from 5,719 networks in 212 countries around the world. This information can also be found through our measurement stats on OONI Explorer (see chart on “monthly coverage worldwide”): http://explorer.ooni.org/ ~ The OONI team. -- Maria Xynou Research & Partnerships Director Open Observatory of Network Interference (OONI) https://ooni.org/ PGP Key Fingerprint: 2DC8 AFB6 CA11 B552 1081 FBDE 2131 B3BE 70CA 417E

1 0

Network Team Meeting Notes, 16 and 23 March 2020
by Alexander Færøy 01 Apr '20

01 Apr '20

Hello, Last week I messed up my pre-meeting schedule and didn't get around to send out the notes from the meeting the week before. Both of them are gathered in this email with summaries in the top and the pads in the bottom. Meeting notes 16/3 2020: Logs at http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-03-16-16.59.html 1) We went over roadmap. 2) Not much progress on 0.4.3 status. We might delay this release a little bit. 3) People were asked to cast votes on different policy docs. 4) We did some rotation of s28/s30 tickets in the team. 5) Nobody else had anything to add. Meeting notes 23/3 2020: Logs at http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-03-23-16.59.html 1) We went over roadmap. We were talking about how the board isn't kept well in sync with reality and Trac. 2) Reviews looked fine for this week. 3) We went over 0.4.3 status. 4) We shortly discussed CI problems on macOS. We are waiting a response from the Travis people. 5) Should we defer 0.4.3 status to early April? Nobody had any objections. 6) We need more people helping out with volunteers on IRC. There are many people coming in right now asking Tor dev questions. Please help them out if you see nobody else is :-) 7) We shortly talked about alternative support forums than IRC. 8) Nobody had anything else to add. ------------------------------------------- Pad from 16/3 2020: Nick: Week of 9 Mar (planned): - Continue work on walking onions spec: - Write initial draft spec for ENDIVE and SNIP formats. - Schedule the rest of the work - Prepare for new stable and alpha releases, targetting 16 March: - Finalize TROVE fixes? - Write draft advisories, get comments - Review and merge - Send an email to grants@ about stuff we should seek funding for. - Draft bug retrospective notes, using https://pad.riseup.net/p/tor-bugs-retro-042-keep as input. - Meetings: library size work (monday), NY meeting planning (thursday??) Week of 9 Mar (actual): - Walking onions spec: format specifications and initital schedule. - Opened TROVE-2020-004. - Tried to wrap TROVE issues. Got CVE identifiers for 002 and 004. - Sent out initial conclusions for retrospective. - Put entries on DoS pad. Week of 16 Mar (planned): - Releases, with fixes for TROVE-2020-002 and 003 and maybe 004. - Meeting about DoS planning on Tuesday - Walking onions spec work: Expanding ENDIVEs, maybe authority operations. - Review and merge. - PETS review - Write tests for 32588? - Work on other 043 stuff? Currently postponing on: - progress on C autoformatting - 043 tickets, including some that seem important: - Build issue 33437 - Windows issue 24857 catalyst: week of 03/09 (2020-W11) (planned): - reviews - refresh expired PGP key on various infrastructure - finish writing feedback week of 03/09 (2020-W11) (actual): - refreshed PGP key on LDAP - still fighting with updating my key on Schleuder - helped cohosh with some Debian packaging questions week of 03/16 (2020-W12) (planned): - reviews - looking over s28/s30 for which tickets it makes sense for me to work on - still somewhat behind on feedback - ahf: do you have time to help prioritize s28/s30 tickets with me? ahf: Week of 9/3 2020 (planned): - Focus on TROVE and Windows CPU issue with cache dir (#24857). - Try to close IRC and email a bit this week to focus :-) Week of 9/3 2020 (actually): - Resolved GPG issues with Tor infra thanks to Anarcat and David. - Got Windows dev environment up and working again after my desktop had some heat issues. - Traveled to do a conference before the CORVID lockdown happened, conference got cancelled, ended up teaching the class that day on Tor. Was fun. - Trying to figure out if we should do a video for the FOSS North talk I have with GeKo. - Managed to reproduce #24857 in a dev environment with Chutney on Windows (via WSL) - Talked with David about library size reduction work. Week of 16/3 2020 (planned): - Look at TROVE's. - Hopefully resolve #24857. asn Week of 09/03 (planned): - Finish CI work for OBv3. - Write blog post for OBv3 testing. - Prepare packages for OBv3. - More planning for DoS stuff. Week of 09/03 (actual): - CI done for OBv3. - Blog post written for OBv3. Talking with steph about publishing. - DoS planning Week of 16/03 (actual): - DoS meeting preparation and execution - Get the OBv3 blog post published - Finalize OBv3 further dgoulet: Last week (actual): - Review and merges. - DoS meeting to prepare agenda for this week. - HS tickets: #33458, #33400 - Tracing branch updated and in need review: #32910 - Patch and revision: #33491, #33361 - Tor as a library size: Wrote script to statically build tor and try to reduce as much as we can its size for mobile. Initial work: https://gitlab.torproject.org/dgoulet/tor-library-size [teor asks: have you tried link-time optimisation?] Week of March 16th (planned): - Building agenda for DoS meeting _and_ then DoS meeting - Library size work. Gaba: Last week (actual): - s30 & s55 Week of March 16th (planned) - DoS teor: (online first meeting of the month, offline at the usual meeting time) Week of 9 March (planned): (Pad was down) Week of 9 March (actual): - chutney relay reachability tests (#33232, #33378, #33379, #33615) - helping with outreachy and GSOC - code reviews & documentation reviews - helping relay operators - general work admin Week of 16 March (planned): Important: - Sponsor 55: Relay IPv6 - Outreachy / GSOC IPv6 projects - General Work Admin - Reviews Roadmap: - fixes to chutney relay reachability tests (#33615) - backport chutney CI diagnostics to 0.3.5 and later (#32792) - Relay IPv6 extends (#33220) Other: - Ticket triage, backport deciding, quick code reviews and ticket help Week of 16 March (actual): Important: - Sponsor 55: Relay IPv6 - Outreachy / GSOC IPv6 projects - General Work Admin Roadmap: - fixes to chutney relay reachability tests (#33615) - backported chutney CI diagnostics to 0.3.5 and later (#32792) Other: - reviewing TROVEs - Emails and IRC - Meetings Mike: week of 19 Feb (planned): - Investigate/reproduce circpad shutdown bugs (#30992 and chutney warns); plan some fixes - Mull over Research Janitor responsibilities and priorites - Maybe review metrics-team tickets week of 19 Feb (actual): - Still discussing Reasearch Janitor role priorities - Performance funding proposal work week of 24 Feb (planned): - Cashing in some banked overtime dayz (Monday+Tuesday) - Probably keep discussing Reasearch Janitor role priorities - Performance funding proposal work - Metrics-team flashflow experiment+sbws review - circpad bugs I hope? Coin toss for that vs metrics-team review (though the metrics work is pretty cold now anyway... maybe it can wait some more) jnewsome: week of 03/02 (2020-W09) (planned): - Phantom design and prototyping - Create Tor tickets for "build for shadow" - Add nightly CI workflow to shadow repo to test against tor@head week of 03/02 (2020-W09) (actual): - Rebased Shadow-Phantom onto tip of Shadow-master and got CI passing again (by disabling most of it) - Solidified plan for Shadow-Phantom's interposition strategy, sent a PR to use it and re-enable now-covered CI tests - Sent out proposal for shared-memory-IPC plan - Added a CI configuration matrix to shadow-plugin-tor to test against last few releases of Tor week of 03/09 (2020-W10) (planned): - Flesh out Shadow-Phantom libc/syscall coverage to run phold (simple network benchmark) - Migrate shadow and shadow-plugin-tor to tgen v1.0.0 - Create Tor tickets for "build for shadow" - Add nightly CI workflow to shadow repo to test against tor@head week of 03/09 (2020-W10) (actual): - Merged Shadow-Phantom libc/syscall refactor - Wrote and merged Shadow-Phantom refactor to modularize interposition mechanism - Wrote new ptrace interposition mechanism (little/no reliance on LD_PRELOAD) - Fixed dep-install step in Shadow-master and rebased Shadow-Phantom to include it week of 03/16 (2020-W11) (planned): - Clean up and merge ptrace interposition mechanism - Flesh out libc wrappers, targeting phold benchmark - Create Tor tickets for "build for shadow" - Add nightly CI workflow to shadow repo to test against tor@head Pad from 23/3 2020: Nick: Week of 16 Mar (planned): - Releases, with fixes for TROVE-2020-002 and 003 and maybe 004. - Meeting about DoS planning on Tuesday - Walking onions spec work: Expanding ENDIVEs, maybe authority operations. - Review and merge. - PETS review. - Write tests for 32588? - Work on other 043 stuff? Week of 16 Mar (actual): - Last-minute hacking and revisions on TROVE-2020-002 fixes. - Meetings about DoS planning. - Put out all releases - Wrote "expanding ENDIVEs" part of walking onions specs - Brainstormed on authority operations for walking onions spec. - Wrote PETS reveiws - Finally got to tests on 32588 Week of 23 Mar (planned): - Walking onions: specify authority operations and revise last week's work. - Finish as many 043 tickets as possible. - Aim for another 043 release (alpha? release candidate?) soon. - Answer volunteer questions as they come up - Review and merge. Currently postponing on: - progress on C autoformatting - 043 tickets, including some that seem important: - Build issue 33437 - Windows issue 24857 catalyst: week of 03/16 (2020-W12) (planned): - reviews - looking over s28/s30 for which tickets it makes sense for me to work on - still somewhat behind on feedback - ahf: do you have time to help prioritize s28/s30 tickets with me? week of 03/16 (2020-W12) (actual): - reviews - talked with ahf, phw, and others about s28/s30 prioritization - started looking at #5304 (Obfsproxy should respect OutboundBindAddress in torrc) - finally (hopefully?) resolved Schleuder issues with my PGP key. thanks dgoulet! - dug up some info on the python3-stem/sbws packaging issue in Debian (upcoming auto-removal due to lack of updates by packager) week of 03/23 (2020-W13) (planned): - reviews - more work on #5304 ahf: Week of 16/3 2020 (planned): - Look at TROVE's. - Hopefully resolve #24857. Week of 16/3 2020 (actually): - Looked a bit at David's work for static building for library size reduction. - Gitlab migration test run. - We decided to ditch the "virtual" foss north meeting and focus on the one in November instead. - sbws weekly meetings are now a thing. - Lots of small follow up items from the week before. - Worked on #24857 on Windows. Week of 23/3 2020 (planned): - Not made a plan yet. Gonna update this one after the meeting. asn: Week of 16/03 (planned): - DoS meeting preparation and execution - Get the OBv3 blog post published - Finalize OBv3 further Week of 16/03 (actual): - DoS meeting preparation and execution - Released OBv3 0.1.9! - Wrote OBv3 blog post: https://blog.torproject.org/cooking-onions-reclaiming-onionbalance - Wrote post on anonymous credentials + HSes: https://lists.torproject.org/pipermail/tor-dev/2020-March/014198.html Week of 23/03 (planned): - DoS post-meeting organization and work - OBv3 feedback response. - Network team work dgoulet: Last week (actual): - DoS meeting preparation and actual meeting. - Ticket work on #33458, #33642 and #33072. - Attempt to fix static OpenSSL build: #33624 - Schleuder fix madness. Week of March 23th (planned): - Onion service DoS profiling - Finish #33072 with teor's feedback - Reviews and Merges. Gaba: Last week (actual): - DoS Week of March 23rd (planned) - nothing related to network team teor: (online first meeting of the month, offline at the usual meeting time) Week of 9 March (planned): (Pad was down) Week of 9 March (actual): - chutney relay reachability tests (#33232, #33378, #33379, #33615) - helping with outreachy and GSOC - code reviews & documentation reviews - helping relay operators - general work admin Week of 16 March (planned): Important: - Sponsor 55: Relay IPv6 - Outreachy / GSOC IPv6 projects - General Work Admin - Reviews Roadmap: - fixes to chutney relay reachability tests (#33615) - backport chutney CI diagnostics to 0.3.5 and later (#32792) - Relay IPv6 extends (#33220) Other: - Ticket triage, backport deciding, quick code reviews and ticket help Week of 16 March (actual): Important: - Sponsor 55: Relay IPv6 - Outreachy / GSOC IPv6 projects - General Work Admin Roadmap: - fixes to chutney relay reachability tests (#33615) - backported chutney CI diagnostics to 0.3.5 and later (#32792) Other: - reviewing TROVEs - Emails and IRC - Meetings Mike: week of 19 Feb (planned): - Investigate/reproduce circpad shutdown bugs (#30992 and chutney warns); plan some fixes - Mull over Research Janitor responsibilities and priorites - Maybe review metrics-team tickets week of 19 Feb (actual): - Still discussing Reasearch Janitor role priorities - Performance funding proposal work week of 24 Feb (planned): - Cashing in some banked overtime dayz (Monday+Tuesday) - Probably keep discussing Reasearch Janitor role priorities - Performance funding proposal work - Metrics-team flashflow experiment+sbws review - circpad bugs I hope? Coin toss for that vs metrics-team review (though the metrics work is pretty cold now anyway... maybe it can wait some more) jnewsome: week of 03/09 (2020-W10) (planned): - Flesh out Shadow-Phantom libc/syscall coverage to run phold (simple network benchmark) - Migrate shadow and shadow-plugin-tor to tgen v1.0.0 - Create Tor tickets for "build for shadow" - Add nightly CI workflow to shadow repo to test against tor@head week of 03/09 (2020-W10) (actual): - Merged Shadow-Phantom libc/syscall refactor - Wrote and merged Shadow-Phantom refactor to modularize interposition mechanism - Wrote new ptrace interposition mechanism (little/no reliance on LD_PRELOAD) - Fixed dep-install step in Shadow-master and rebased Shadow-Phantom to include it week of 03/16 (2020-W11) (planned): - Clean up and merge ptrace interposition mechanism - Flesh out libc wrappers, targeting phold benchmark - Create Tor tickets for "build for shadow" - Add nightly CI workflow to shadow repo to test against tor@head week of 03/16 (2020-W11) (actual): - Cleaned up and merged ptrace interposition mechanism in shadow-phantom - Identified libc apis and syscalls that will be needed for phold benchmark - Sent monthly update to tor-project@ week of 03/23 (2020-W12) (planned): - Finish and merge refactoring and unit testing RDTSC emulation - Collaborate on shadow-phantom shared memory API - Start writing more libc api's to support phold benchmark -- Alexander Færøy

1 0

next gitlab meeting
by Gaba 01 Apr '20

01 Apr '20

Hey! We are still working on any available time on having a migration from trac :) There has been some blockers on the way BUT Alex is moving forward with it. We are going to be meeting on Wednesday April 1st at 1700 UTC in #tor-meeting in irc.oftc.net The agenda will be - where we are at - what was able to get resolved and how and what is not going to get resolved - next steps cheers, gaba [0] context: https://nc.torproject.net/s/3MpFApQ7cwfrPZE -- Project Manager: Network, Anti-Censorship and Metrics teams gaba at torproject.org she/her are my pronouns GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

2 1

S27 meeting today: Tuesday 31st March @ 15UTC
by Pili Guerra 31 Mar '20

31 Mar '20

Hi everyone, This is your weekly reminder of our S27[1] (Onion Services) meeting today. This will likely be the last meeting on this sponsor for a while as we wrap up the implementation of this project. I look forward to seeing you there! Thanks, Pili [1] https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor27 <https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor27> — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

1 0

Network health meeting notes, 30 Mar 2020
by Georg Koppen 31 Mar '20

31 Mar '20

Hi! Yesterday, we had our last weekly meeting in March 2020 in #tor-meeting. The IRC log can be found at: http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-03-30-18.00.log… Here come the items from our pad (both statuses and discussion points): Discussion: -Do we have criteria for badexit flag in case of non-malicious behavior? See for instance thread on tor-relays <https://lists.torproject.org/pipermail/tor-relays/2020-March/018276.html>ff. Should we essentially overrule dir-spec here, defining what a(n) (good) exit is? [GeKo: it seems we are in favor for creating some policy according to which we badexit relays even though they formally fulfill the dir-spec requirements; I put that on my plate and loop the folks on the network-health list in] Statuses: GeKo: Last week: -sbws work (mainly reviewing #30905) -more work on issues encountered with our bad relay scanners (dug a bit more into #33663; might be a check/exitscanner bug) -more work on resource load failures caused by Cloudflare (for the Coil folks) -badexiting relays for #32864; follow-up This week: -review follow-up patches for #30905, finishing #33009 -work on #33758 (more fixups/investigations for issues with bad relay scanners) -work on #33696 (integrate badexiting into badconf-entry.py script) -more work on exit relay blocking problem (#33500 etc.) -monthly team admin stuff -ggus: the eff got back to us how should we proceed? [GeKo: ggus goes over the mail and sets up a pad where we then can collaborate] Gus: Last week: - Worked with Steph on tweet/announcement: https://twitter.com/torproject/status/1243251875601952771 This week: - Review EFF Legal FAQ Georg

1 0

Tor Browser Release meeting this week: Wednesday 18th March @ 18UTC
by Pili Guerra 30 Mar '20

30 Mar '20

Hi everyone, We’ll be having our Tor Browser release meeting this week. This week we’re moving the time of this meeting to its summer time schedule: Please join us on Wednesday 18th March @ 18UTC on #tor-meeting. Thank you! Pili — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

1 1

Tor Browser Team Meeting Notes, 23 March 2020
by Matthew Finkel 30 Mar '20

30 Mar '20

Hello everyone, We held our weekly meeting on 23 March, 2020. The meeting log is available at http://meetbot.debian.net/tor-meeting2/2020/tor-meeting2.2020-03-23-17.59.l… During that meeting we improving our release process and which responsibilities can be distributed differently across members of the team. ================================ Week of March 23, 2020 Discussion: Please tag transition/migration tickets for S58 Retrospective Dockshackathon this week - Is there anything missing in the Tor Browser Manual we could add during this week? Release management pospeselr: Last week: - #19251 code review - #33534 (release notes/tickets review) - Made it halfway through FF74 tickets, should have the ticket short list by EOD This week: - #33534 -> rest of FF74 and FF75 mcs and brade: Last week: - Code reviews. - Revised patch for #19251 (onion services error page). - Helped with #33672 (Force include https-everywhere in incremental mar update). - Responded to Thomas Klausner (NetBSD) on tbb-dev (Tor Launcher questions). This week/upcoming: - Review latest patch for #21952 (Onion-Location). - Review latest patch for #28005 (.onions in HTTPS-E). - Review rebased updater patches (#33533). - Revisit #30732 (“Your Firefox is critically out of date" banner). - Revisit #32418 (on every start TB complains that it can't update). - Investigate #29630 (TorBrowser creates empty directory in "/tmp”). sisbell: Last Week: #33685: zlib support for Android (in review) #31499: Update libevent 2.1.11: tested across platforms, don’t need osx path with latest (in review) #28765: Libevent for Android: update rbm,conf so we include options across all platforms (windows, Mac, linux). Verified building for each. (In review) #28766: tor build for android, includes zlib support (in review) Fenix: #33557: Android Toolchain for Fenix: fix bin path #33561: Upgrade openssl to use Android NDK 21 This Week: Follow up on reviews of Android Tor Support (priority) Fenix: #33564, #33565, #33562 -libevent, zstd, lzma for NDK 21 #33626: Add TBB project for GeckoView Jeremy Rand: Last week: - Got some test reports via r/Namecoin. Much of it was constructive. - Lower productivity than usual due to isolation precautions to avoid COVID-19. This week: - Relay r/Namecoin test reports to tor-talk mailing list, file bugs where appropriate, ask for additional clarification from testers where appropriate. - Try asking for more test reports via Twitter, maybe elsewhere in my social graph. boklm: Last week: - Made a patch for #33672 (Force include https-everywhere in incremental mar update) - Rebased patch for #25102 (Add script to sign nightly build mar files, generate update-responses xml and publish the new version) - Helped with new releases - Monitored blog comments This week: - Some reviews - Work on proposal for quilt workflow - Work on testsuite setup - Work on setup of automatic rebasing of tor-browser patches on mozilla-central - Help with getting rebased patches from #33533 building in tor-browser-build pili: Last week: - trac triage - Tor Browser release meeting - Started putting together Sponsor58 page for transition to Fenix: https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor58 - Started tagging S58 tickets: https://trac.torproject.org/projects/tor/query?sponsor=^Sponsor58&col=id&co… This week: - trac triage - S58 - Docshackathon - S27 March report sysrqb: Last week: - Release prep for 9.0.7 - Firefox bug - Chatted with sisbell about Fenix - Made progress on macOS signing/notarization - Investigated https-everywhere downgrade question This week: - Releasing 9.0.7, release prep 9.5a9, releasing 9.5a9 - Finally looking at acat's rebasing work? acat: Last week: - Revised #28005 (Officially support onions in HTTPS-Everywhere to use securedrop testing update channel.) - Revised #21952 (Onion-location) - Updated Onion-Location spec to match current implementation. This week: - Possibly revise #28005, #21952. - Try to get #33533 working in tor-browser-build (will try boklm suggestion) - Get browser unit tests working for #33533? ================================ Thanks, Matt

1 0