tor-project

tor-project@lists.torproject.org

17 participants
2326 discussions

July and August 2019 report for the Tor Browser team
by Georg Koppen 05 Sep '19

05 Sep '19

Hello everyone! We'll do the monthly reporting this time a bit different in covering the last two months instead of just the last one. During this period we made three releases: Tor Browser 8.5.4[1], 9.0a4[2], and 9.0a5[3]. The first two were regular maintenance releases picking up latest security improvements in Firefox 60.8.0esr and adding a fundraising banner. 9.0a4 started to ship with aarch64 support for Android for the first time and due to a bug in our version codes[4] we needed to release 9.0a5 afterwards to get a roll out actually happening on Google Play. It turns out supporting aarch64 properly is much harder than thought with an "old" Firefox ESR 60 branch, as we were and are still working on follow-up crashes on that platform which are now unfortunately affecting our stable users as well[5][6]. Besides that the whole team was essentially busy preparing our first alpha release based on Firefox 68 ESR and we are happy to announce that we are about to get it finally out (boklm is publishing the release while I am writing this status report). It's been a huge effort comprising rebasing all of our patches, adapting our toolchains across all platforms to new Firefox requirements and porting our extensions over to make them compatible with the new ESR series. The full list of tickets closed by the Tor Browser team in July and August is accessible using the `TorBrowserTeam201907`[7] and `TorBrowserTeam201908`[8] keywords in our bug tracker. For September we'll stabilize all aspects of Tor Browser 9: Above all we have reproducibility issues still open on many platforms[9][10][11] and most of our toolchains still need slight adjustments.[12] In addition to that a number of important issues besides toolchain and reproducibility improvements have already piled up for Tor Browser 9 and we plan to tackle them in the coming weeks as well. We have the `tbb-9.0-must-alpha` keyword in our bug tracker for those.[13] Additionally, for anyone following along at home, we have issues related to Firefox 68 ESR tagged with the `ff68-esr` keyword for easier assessment of the overall transition situation.[14] Besides ESR transition work we hope to find time to work on the updater for Tor Browser nightly desktop builds.[15] Not having an updater for this channel is currently a major blocker from getting early adopters to test out our nightly builds and iterate quicker over new features and designs. All tickets on our radar for this month can be seen with the `TorBrowserTeam201909` keyword in our bug tracker.[16] Georg [1] https://blog.torproject.org/new-release-tor-browser-854 [2] https://blog.torproject.org/new-release-tor-browser-9.0a4 [3] https://blog.torproject.org/new-release-tor-browser-9.0a5 [4] https://bugs.torproject.org/31260 [5] https://bugs.torproject.org/31140 [6] https://bugs.torproject.org/31616 [7] https://trac.torproject.org/projects/tor/query?status=closed&keywords=~TorB… [8] https://trac.torproject.org/projects/tor/query?status=closed&keywords=~TorB… [9] https://bugs.torproject.org/31618 [10] https://bugs.torproject.org/31538 [11] https://bugs.torproject.org/31564 [12] https://bugs.torproject.org/30320 [13] https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~tbb… [14] https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~ff6… [15] https://bugs.torproject.org/18867 [16] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig…

1 0

Anti-censorship team monthly report: August 2019
by Philipp Winter 04 Sep '19

04 Sep '19

Hi everyone, Here's what happened in circumvention land last month: BridgeDB ======== * Released version 0.8.0. This release incorporates patches from the following tickets: - <https://bugs.torproject.org/9316> BridgeDB now exports usage metrics. We're still working on getting these metrics published over Tor Metrics. - <https://bugs.torproject.org/26542> Fixed broken bridge distribution for vanilla IPv6 bridges. - <https://bugs.torproject.org/22755> Use stem instead of leekspin for integration tests. This doesn't affect users but simplifies the code base. - <https://bugs.torproject.org/31252> Add an anti-bot mechanism. * Fixed <https://bugs.torproject.org/17626>. BridgeDB gets confused when users reply to a "get help" email. The issue is that BridgeDB interprets commands anywhere in the email body, even if it's in quoted text. To fix this issue, we are ignoring commands whose email body line starts with a '>' character, which is typically used for email quotes. * Made BridgeDB sync its assignments.log file to our metrics infrastructure again. This file contains the mapping from a bridge's fingerprint to its assigned distribution pool. Once we are archiving these files again, bridge operators can check in what pool their bridge is. Snowflake ========= * Added a dark mode to the Snowflake proxy: <https://bugs.torproject.org/31170> * More work went towards Snowflake's metrics. We updated the /metrics handler and the associated specification. - <https://bugs.torproject.org/31376> - <https://bugs.torproject.org/31493> * Implemented a fix for the "proxy ID reuse" vulnerability: <https://bugs.torproject.org/31460> Thanks to serna for discovering this issue! * Made some progress towards Snowflake's sequencing layer: <https://bugs.torproject.org/29206> * Handled a vulnerability in Go's net/http module by re-compiling and re-deploying affected binaries: <https://bugs.torproject.org/31454> <https://bugs.torproject.org/31455> <https://bugs.torproject.org/31456> * Fixed a bug that caused Firefox-based Snowflakes to not do their work: <https://bugs.torproject.org/31100> Outreach ======== * Roger did a Defcon talk on the Tor censorship arms race to several thousand people, including a call-for-testers for obfs4proxy and Snowflake, and then spent the rest of the weekend answering Tor questions. We are now counting approximately 400 Snowflakes! * We've started reaching out to contacts like professors to try to regrow the set of "default" bridges in Tor Browser, which are the bridges that users get when they don't specify their own bridge. * We started our "set up obfs4 bridges" bridge campaign: <https://blog.torproject.org/run-tor-bridges-defend-open-internet> So far, we are counting 39 new bridges. Thanks to everybody who contributed! * Started interaction with IETF MASQUE working group by proposing the idea of turning it into a pluggable transport: <https://mailarchive.ietf.org/arch/msg/masque/Cxh1phx6vFgn19jyANmt2YwLDqQ> GetTor ====== * Updated outdated Tor Browser copies on GitHub and GitLab and improved automation to keep them updated in the future. Pluggable transports ==================== * We went to the FOCI workshop, and among other things talked to the person working on using a GAN to modify timing for meek traffic. He's thinking about grad school, so we tried to connect him to all the usual profs so he can do this more in grad school. * Made some progress towards a better obfs4 by improving the way it obfuscates its flow signature: <https://bugs.torproject.org/30716>. This is experimental work-in-progress. * David published Turbo Tunnel, which provides a sequencing and reliability layer for pluggable transports: <https://github.com/net4people/bbs/issues/9> Miscellaneous ============= * Improved and extended our obfs4 bridge setup guides: <https://community.torproject.org/relay/setup/bridge/>

1 0

Notes from Vegas Team meeting August 29th
by Erin Wyatt 04 Sep '19

04 Sep '19

Notes from August 29 2019 Vegas Team meeting: MAIN DISCUSSION ITEMS: + (Gaba) Nextcloud next steps: Thoughts on this options? - Tor have its own NC instance, and to migrate to that one - Tor continues using the 'shared' NC one of riseup. - Riseup setup a NC instance only for Tor and maintain it - Riseup setup a NC instance only for Tor that is maintained by Tor sysadmin team Discussion highlight(s): Gaba and anarcat are both afk today; table discussion until they're back. + (Mike) Weighing whether to focus on Sponsor2 vs. ESR Discussion highlight(s): Mike was not present at the meeting, so folks were unsure whether this was about the final report (which became due September 1 and will be overdue December 30th if not submitted) or another question/issue related to the work w/ the sponsor. We will follow up with Mike for clarification. + (Pili) Re: migration to gitlab - should we migrate the Orbot ticket component in trac to a project in gitlab for tracking Orbot issues? - Since Guardian Project have?/will have? their own gitlab instance, it doesn't seem necessary but I would like us to discuss before making a decision (possibly with them also as a second step.) - Also, what about HTTPSEverywhere? Discussion highlight(s): • General agreement that it's not necessary/helpful to migrate the Orbot ticket component, we will communicate this with them by email; we will contact Guarding Project and EFF re: questions around httpseverywhere. + (Gus) Re: blog template that is killing geko's soul little by little - https://trac.torproject.org/projects/tor/ticket/31114; hiro is the person to talk to; following up with hiro, pili, anto by email. ---------------->8 INDIVIDUAL NOTES: Gaba: We are moving to nextcloud and shutting down storm.torproject.org. Notes from "nextcloud at Tor" meeting here: https://lists.torproject.org/pipermail/tor-project/2019-August/002446.html Options that will be taken to the sysadmin team by Linus: • Tor have its own NC instance, and to migrate to that one • Tor continues using the 'shared' NC one of riseup. • Riseup setup a NC instance only for Tor and mantain it • Riseup setup a NC instance only for Tor that is mantained by Tor sysadmin team 5. S31 on 'refactoring' is moving forward. This week we will have check-in meeting. 6. Gettor is back - Hiro is having Thursday to work on it. 7. IPv6 proposal done 8. Small gardening tasks on roadmaps. 9. Still slowly working on migration plan. Mike: 0. Medical leave (no I'm not gonna die soon and if you think I will, I might still find a way to cut you after I'm gone ;) 1. Finishing sponsor2 circuit padding framework documentation Steph 1 Promoting next week’s DocsHackathon 2 Launched campaign to run bridges. Will promote through September 3 Received a round of edits for a page demystifying the dark web. Need to also update onion services pages on the community portal 4 Preparing donor materials including a 1.5 page overview + other pages for a complete deck 5 Went to NYU to meet about office space, just waiting for an ID! Also finding out if we can have a table at CSAW in November. 6 August newsletter coming out this week 7 EOY campaign planning 8 Campaigning for companies to run relays next on deck 9 Met about lessons learned from def con to prepare for upcoming cons 10 Podcast coordination 11 Seeing about having a Tor comic book to offer as a gift for donors Nick 1 042 series will freeze on Sep 15. Make sure we know about must-fix issues. If they are not marked 042-must, please mark them and say why. 2 team trying to wrap up 042 stuff, fix bugs, etc 3 0.4.1.5 seems relatively stable so far? Sarah 1. EOY campaign calendar and talking with stakeholders 2. Planning Boston event 3. Getting ready to launch major donor webpage 4. Working on various edits to donate.tpo pages 5. afk Friday 8/30 Philipp 1 Started obfs4 bridge setup campaign with Steph's help 2 Interacted with prospective default bridge operators after Roger sent a bunch of emails 3 Caught up on website fingerprinting literature and thought about how it should inform our obfs5 design 4 Progress with both BridgeDB and snowflake Georg 1 Busy with ESR 68 migration; first alpha based on that is hopefully coming out next week 2 Went to CCCamp and our talk went well 3 Trying to get back to email conversations I've dropped during the last couple of weeks Gus 1. Back from CCCamp 2. Working on Docs Hackathon preps (Sept 2nd - 6th) - https://blog.torproject.org/join-tors-docshackathon-next-week 3. (almost) Finished last week RT frontdesk gap; still ~900 in the queue Pili 1. Browser Team roadmapping 2. OTF Proposal for Browser Team 3. Lots of meetings this week - DRL proposal, websites maintenance, tor browser tasks re-org, tor browser release meeting 4. Docs Hackathon 5. S27 August report 6. Trying to find some time to work on my slides for a talk on Onion service web APIs isabela 1. Reviewing all stuff necessary for auditors 2. Reviewing proposals which deadline is on the 1st 3. Met w/ Alison here in nyc 4. Other meetings - kick off OONI transition discussion/planning; Sync w/ Beth; website long term maintenance meeting; 5. Planning different trips/meetings in September; YE campaign; Reviewing 'there is no darkweb' webpage content 6. start drafting reorg letter and personas letter Erin 1. handbook handbook. we think version 1 is almost done! 2. working on some stuff for the audit 3. general HR stuff 4. reminder - Monday is a US federal holiday Antonela 1 moving ux team material and reporting to an open repository > https://dip.torproject.org/torproject/ux/research 2 the ux team now have a kanban with our roadmap > https://dip.torproject.org/groups/torproject/ux/-/boards 3 working with TB9.0 network settings (#31286) and synced with phw on s30 iteration 4 speaking at MediaParty in BA > https://sched.co/UESp 5 making the first feminist security conference in argentina > https://notpinkcon.org/# 6 cross-team meetings, websites maintenance, community drl soi, ux roadmapping, docshackaton Karsten 1. Discussed two funding proposals related to metrics work. 2. Made some progress on getting Snowflake and BridgeDB data archived by CollecTor.

1 0

Tor Browser team meeting notes, 3 September 2019
by Georg Koppen 04 Sep '19

04 Sep '19

Hello! We held our weekly Tor Browser sync yesterday in #tor-meeting as usual. The log can be found at: http://meetbot.debian.net/tor-meeting2/2019/tor-meeting2.2019-09-03-17.29.l… The notes from the pad are: Discussion: [tjr] We currently have a team IRC highlight for 'tbb-team'. I recently joined #tor-bots and get regular highlights there for the owner changing to tbb-team. Is this a mild annoyance to anyone else? If so, I know renaming trac accounts is not possible, but maybe in gitlab we could have a different name for the account; or try to migrate our highlight? (Or maybe the answer is "Yes it's not ideal, but it's not worth changing.") GeKo: Last week: - release preparation for 8.5.5 and 9.0a6 - built release candidates for both series - signed the 8.5.5 bundles - reviewed loads of patches to get 9.0a6 into alpha shape (it seems we managed to do so!) - helped pili with time estimations for tickets and roadmapping for September - staring at Windows reproducibility issue (#31538) - helped with diagnosing Windows updater issue (#31567) (thanks to pospeselr for stepping up and diagnosing the issue) - provided patches to smaller issues (#30800, #27493 - filed already a number of issues against our ESR 68-based Tor Browser This week: - help with getting the releases out - continue to work on #31538 - macOS notarization? (GeKo will chat with mcs/brade after the meeting) - reviews - monthly reports (I'll combine July and August) mcs and brade: Last week: - #30126 (Make Tor Browser on macOS compatible with Apple's notarization). - Added a comment to the ticket that lists the remaining things that we need. - #29430 (Use uTLS for meek TLS camouflage in Tor Browser). - create Torbutton patch to avoid breaking circuit display. - #30429 (ESR 68 Rebase). - tested the updater on Windows. - created and helped with #31567 (NS_tsnprintf() does not handle %s correctly on Windows). - Discussed recent Mozilla updater security fix patches with gk. - Started to look at #31457 (disable per-installation profiles). This week/upcoming: - #31457 (disable per-installation profiles). - Work on other tbb-9.0-must-alpha tickets as time permits, e.g., #31491 (clean up the old meek http helper browser profiles). - More ESR68 updater testing. - We will be away from keyboard this Thursday and Friday (September 5th and 6th). - As we mentioned at the dev meeting, we have vacation planned for the week of September 23rd. tjr: - Some minor build uplifts to esr 68 - There is a path forward on the wasm for extensions thing: https://bugzilla.mozilla.org/show_bug.cgi?id=1576254 - Currently pretty far behind on things pospeselr: Last Week: - #31567 investigation (printf fun) - #31548 (verify mingw HEAD builds ff with working screen reader support) - #31286 work: - finished prototype UX, sent review build to antonela - started work to wire tor-launcher code into new about:preferences configuration This Week: - make a test Linux build with bridge UX for y'all to review (#31286) - labor day off - SF for browser privacy meet-up acat: Last week: - Fixed #31396 - Communication with noscript for security settings not working in nightlies - Reviewed latest #31010 changes. - Fixed some esr68 tbb-9.0-must-alpha bugs. - Investigated onboarding regressions (#28822). This week: - Fix onboarding regressions + address review comments (#28822). - #26345 - Disable tracking protection UI in FF67-esr - #31562 - The circuit display is not visible on error pages in Tor Browser based on ESR68 - #31575 - Firefox is phoning home during start-up in Tor Browser based on ESR 68 - #30662 - Make sure about:newtab is blank - #31601 - Don't let Mozilla recommend extensions again - Maybe others tbb-9.0-must-alpha boklm: Last week: - Reviewed mingw-w64-clang patches (#28716, #28238) - Made patch for #30384 (Use 64bit containers to build 32bit Windows Tor Browser) - Made small patches for #31606 (Update website update instructions in Tor Browser release process) - Helped with new releases build - Started looking at #31448 (gold and lld break linking 32bit Linux bundles we need to resort to bfd) - Looked a little at #31564 (Android bundles based on ESR 68 are not built reproducibly anymore) - Commented on #28942 (Evaluate pion WebRTC) and #28325 (Use go 1.11 module versioning support) - Reviewed #31264 (tar.gz output files contain non-reproducible timestamps) This week: - Finish publishing new releases - Investigate #31448 (gold and lld break linking 32bit Linux bundles we need to resort to bfd) - Review #30334 (build_go_lib for executables) - Other tbb-9.0-must-alpha toolchain tickets: #29013 - Review #31596 (Bump mingw-w64 version to pick up fix for #31567) pili: Last week: - OTF Browser Proposal - September Roadmap and estimations This week: - Final Orfox update!! sisbell: - #31568: Creating grade dependencies - determined cause of multiple artifact entries (proposed solution but needs to be implemented) - #30461: Update tor-android-service: redid config/build to use older version of project until we get latest updates merged into tor repo - #31293 - found that adding JVM settings overrides the no-daemon flag for gradle. This causes network interface failures in some build environments - #31564 - Reproducibility - tried various solutions, including upgrading, downgrading gradle plugin. All caused failures of Firefox build - Various Changes to Firefox build to get it building with full set of options This week: - For reproducibility - try downloading google source and see if we can patch it. - Fix for #31568 Georg

1 0

OONI Monthly Report: August 2019
by Maria Xynou 03 Sep '19

03 Sep '19

Hello, Below we share what the OONI team worked on in August 2019. ## Report on censorship events in Ethiopia We published a research report documenting new censorship events in Ethiopia, titled: "Resurgence of Internet Censorship in Ethiopia: Blocking of WhatsApp, Facebook, and African Arguments". The report is available here: https://ooni.io/post/resurgence-internet-censorship-ethiopia-2019/ This report is a follow-up to our previous study, which documented the blocking of WhatsApp and Telegram in Ethiopia in mid-June 2019: https://ooni.io/post/ethiopia-whatsapp-telegram/ ## Progress on OONI Probe desktop app We completed the integration of the new golang probe-engine into the OONI Probe CLI that powers the desktop app: https://github.com/ooni/probe-cli/pull/46 We also did some more research and testing on auto-update support: https://github.com/ooni/probe-desktop/pull/37. ## Progress on OONI Probe mobile apps We released the beta of OONI Probe Mobile v.2.2.0 (Android and iOS) for internal testing. The new version allows users to download JSON files from OONI Explorer, copy OONI Explorer URLs, and it includes support for the auto-deletion of measurement logs and JSON files that have already been uploaded. Android: https://github.com/ooni/probe-android/pull/249 https://github.com/ooni/probe-android/pull/250 https://github.com/ooni/probe-android/pull/251 https://github.com/ooni/probe-android/pull/253 https://github.com/ooni/probe-android/pull/254 iOS: https://github.com/ooni/probe-ios/pull/303 https://github.com/ooni/probe-ios/pull/304 https://github.com/ooni/probe-ios/pull/305 We also started doing a bit of research on integrating react-native which will allow us to maximize code-sharing between the OONI Probe desktop and mobile apps. ## New test development We implemented the OONI Probe Telegram test using the new golang engine, paving the way to making it easier to implement new tests in go: https://github.com/ooni/probe-engine/pull/41 ## Progress on revamping OONI Explorer In preparation for the launch of the revamped OONI Explorer, we continued to make a series of improvements to the beta (https://explorer-beta.ooni.io/) throughout August 2019. More specifically, we merged the following pull requests: https://github.com/ooni/explorer/pull/234 https://github.com/ooni/explorer/pull/239 https://github.com/ooni/explorer/pull/242 https://github.com/ooni/explorer/pull/244 https://github.com/ooni/explorer/pull/245 https://github.com/ooni/explorer/pull/247 https://github.com/ooni/explorer/pull/254 https://github.com/ooni/explorer/pull/262 https://github.com/ooni/explorer/pull/263 https://github.com/ooni/explorer/pull/265 https://github.com/ooni/explorer/pull/276 We also opened the following pull requests: https://github.com/ooni/explorer/pull/280 https://github.com/ooni/explorer/pull/279 https://github.com/ooni/explorer/pull/251 ## Pipeline work We fixed a major bug in the OONI data processing pipeline and ran the backfilling process: https://github.com/ooni/pipeline/issues/214 As part of our work on this, we also improved the quality of end-to-end tests in the pipeline: https://github.com/ooni/pipeline/pull/216 https://github.com/ooni/pipeline/pull/215 https://github.com/ooni/pipeline/pull/208 https://github.com/ooni/pipeline/pull/220 https://github.com/ooni/pipeline/pull/221 This allows us to have greater confidence in deploying changes to the data processing pipeline as we get ready to deploy the speed improvements and add support for ingesting metadata from new tests. We made progress in extracting metrics from the Telegram instant messaging test: https://github.com/ooni/pipeline/pull/177 As part of the fast-path branch, we made progress on reducing the time to process measurements and on the creation of events for the RSS feed: https://github.com/ooni/pipeline/pull/213 ## Infrastructure work We did some work on cleaning up old deprecated machines, making it easier to ensure that all our infrastructure is redeployable. See: https://github.com/ooni/sysadmin/pull/338 & https://github.com/ooni/sysadmin/pull/337 During the Chaos Communication Camp (where we met in person), we brainstormed on strategies to make our infrastructure more available. ## Community activities ### Chaos Communication Camp 2019 OONI's Arturo, Maria, and Federico traveled to Germany to attend the Chaos Communication Camp 2019 (CCCamp) between 21st-25th August 2019: https://events.ccc.de/camp/2019/wiki/Main_Page At CCCamp, we facilitated an OONI session: https://events.ccc.de/camp/2019/wiki/Session:OONI:_Measuring_internet_censo… We also held an OONI hackathon: https://events.ccc.de/camp/2019/wiki/Session:OONI_Hackathon During the hackathon, we engaged participants with OONI data analysis and we discussed the development of new OONI Probe tests. At CCCamp, we also hosted an OONI village (https://events.ccc.de/camp/2019/wiki/Village:OONI), where we distributed OONI t-shirts and stickers, collected community feedback on OONI tools and methodologies, and otherwise engaged participants with the OONI-verse. Our village was part of the About:freedom cluster (https://events.ccc.de/camp/2019/wiki/Village:About:freedom), consisting of multiple organizations defending digtial rights and promoting free software. ### OONI workshop in Venezuela Our partner, IPYS Venezuela, held an OONI workshop in Venezuela for local journalists (see: https://twitter.com/ipysvenezuela/status/1162365664008515585). As part of the workshop, they explained how to participate in censorship measurement research through the use of OONI Probe and OONI data. ### OONI data presented at the Latin America and Caribbean Internet Governance Forum Our partner, IPYS Venezuela, presented censorship findings from Venezuela based on OONI data at the Latin America and Caribbean Internet Governance Forum. Through the use of OONI Probe, IPYS Venezuela documented hundreds of censorship events in Venezuela throughout 2018. Further information is available via their report: https://ipysvenezuela.org/alerta/reporte-ipysve-la-escalada-de-la-censura-d… ### OONI outreach material for Bolivia Our partner, Internet Bolivia.org, published outreach material in Spanish to help promote the use of OONI Probe in Bolivia: https://drive.google.com/file/d/1IGQCxWDRrpgvNW02T67Aj4mo5emdgHl4/view ## Userbase In August 2019, OONI Probe was run 375,421 times from 5,272 different vantage points in 214 countries around the world. This information can also be found through our stats: https://api.ooni.io/stats ~ The OONI team. -- Maria Xynou Research & Partnerships Director Open Observatory of Network Interference (OONI) https://ooni.torproject.org/ PGP Key Fingerprint: 2DC8 AFB6 CA11 B552 1081 FBDE 2131 B3BE 70CA 417E

1 0

torproject.org content updates and next steps
by Pili Guerra 03 Sep '19

03 Sep '19

Hi everyone, There's been a lot of work over the past year (and before!) to migrate the website to lektor, to use a consistent styleguide[1], make it more modular[2] and structured it in a way that it is easier for people to find the underlying content for a page. With the potential move to gitlab, we can also make it easier for more people to submit change requests using the gitlab interface to update this content. We have been thinking about a good process for keeping our www.torproject.org website content up to date for a while. This is something that we can all own a small part of and we shouldn't have to rely on a single person for updates. We had a session about this in Stockholm[3] and we recently had another meeting to formalise the next steps to delegate ownership and updates for different sections of the websites. I believe we're now in a good position to start trying this process out for www.torproject.org and using it as a model for other future websites, e.g the upcoming developer portal. I have been reaching out to some of you individually to help us out with this and now I would like your input on which sections need updating and potential owners. The idea here is that different people can submit change requests to update content on the different website sections and the people in the webwml group, but mainly Community and UX team members, can review and merge these changes. We will also be updating the current webml group members to better reflect those people who are currently involved, so please reach out if you believe you are a member of this group and would like to remain involved. So, to wrap up :), please take a look at the following table[4] and feel free to update it or email me if there are any sections that need to be added and/or that you'd like to own in future. Thanks! Pili [1] https://styleguide.torproject.org/ [2] https://gitweb.torproject.org/project/web/lego [3] https://trac.torproject.org/projects/tor/wiki/org/meetings/2019Stockholm/No… [4] https://trac.torproject.org/projects/tor/wiki/org/meetings/2019Stockholm/No… — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

1 0

Anti-censorship meeting notes, 29 Aug 2019
by Philipp Winter 29 Aug '19

29 Aug '19

Here are our meeting logs: http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-08-29-16.59.html And here is our meeting pad: Anti-censorship work meeting pad -------------------------------- Next meeting: Thursday August 29nd 17:00 UTC Weekly meetings, every Thursday at 17:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress). == Goal of this meeting == Weekly checkin about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at Tor. == Links to Useful documents == * Our anti-censorship roadmap: https://dip.torproject.org/torproject/anti-censorship/roadmap/boards * Our roadmap consists of a subset of trac tickets. * The anti-censorship team's wiki page: https://trac.torproject.org/projects/tor/wiki/org/teams/AntiCensorshipTeam * GetTor's roadmap: https://dip.torproject.org/torproject/anti-censorship/gettor/boards * Tickets that need reviews: https://trac.torproject.org/projects/tor/query?status=needs_review&componen… --------------------------- ---- 29th August 2019 ---- --------------------------- == Announcements == * Our obfs4 bridge campaign is now live! * https://blog.torproject.org/run-tor-bridges-defend-open-internet == Discussion == * == Actions == * Let me know what we should include in our monthly report: https://pad.riseup.net/p/ThKAw7J-lXGU3AY3uBwp == Interesting links == * == Updates == FORMAT! Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week (related to anti-censorship work). Help with: - Something you may need help with. hiro: (2019-08-29)(gettor days are Thursday - snippets https://dip.torproject.org/snippets) - Add script to update download endpoints from gettor VM: https://dip.torproject.org/torproject/anti-censorship/gettor/blob/master/sc… - Configure github and gitlab so that getulum can push - Add script to export stats in CSV: https://dip.torproject.org/torproject/anti-censorship/gettor/blob/master/sc… - Delete old gettor instances on gettor VM - gettor should use ansible for deployment and updates: started coding recipes Next week - use archive.org as new distribution endpoint: upload files to archive.org - review specs: are specs up-to-date? should we change something in the specs? - review request channels: We are currently only using email. Is it worth to have a chat bot on twitter to distribute links? should we consider other chat platforms instead? - statistics for help emails are not summing up correctly - prepare repo and web for locales hiro: (2019-08-22)(gettor days are Thursday - snippets https://dip.torproject.org/snippets) This week: gettor-web: updates to documentation and website (current website is outdated) gettor: fix pipeline. Talk to browser team about the recommended version file format (so that our scripts do not break) check documentation how to make deployment easier. can it be done via jenkins? ci? Next week: gettor: use archive.org as new distribution endpoint: upload files to archive.org review specs: are specs up-to-date? should we change something in the specs? review request channels: We are currently only using email. Is it worth to have a chat bot on twitter to distribute links? should we consider other chat platforms instead? Past week: on vaca! phw: This week (2019-08-29): * Helped with launching Tor bridge campaign * Tested new obfs4 bridges and worked with some operators who ran into issues * Interacted with university folks who may be able to run new default bridges for us * RACECAR meeting to discuss progress on obfs4 improvements * Made some progress on obfs4 improvements (#30716) * Read up on website fingerprinting literature to understand status of ML-based attacks * Made me realise that obfs4's flow obfuscation was misguided * Experimenting with improving the way obfs4 shapes its flows * Re-built and re-deployed snowflake broker (#31454) * Re-built and re-deployed meek-server on BridgeDB (#31455) * Filed ticket to get rid of BridgeDB's silly chatspeak (#31528) * Started working on code to extract stable and unallocated bridges from BridgeDB for manual distribution * Worked with our new default bridge operator (#31164) Next week: * More work on obfs4 improvements Help with: * Gaba: (updated August 22nd) Last week (): * added september issues to the gitlab kanban board https://dip.torproject.org/torproject/anti-censorship/roadmap/-/boards This week (planned): * ahf - on leave Last week: - Worked on #28930 This week: - Finished refactoring parts of #28930. Trying to figure out if we should begin the discussion on how PT's can report back on bootstrap info. - Continued to work on a tool to convert Trac tickets into Gitlab tickets. cecylia (cohosh): last updated 2019-08-29 Last week: - deployed /metrics handler (#31376) and updated snowflake metrics spec (#31493) in preparation for CollecTor integration - implemented and updated snowflake webextensions with fix for session termination (#31385) - implemented and deployed a fix for the proxy ID reuse vuln (#31460) - moved snowflake metrics spec to snowflake repo (#31407) - fiddled with snowflake metrics spec to get it working for collecTor (#31493) - finally got around to updating snowbox - made progress on sequencing layer (#29206) - started reading up on NSF SaTC TTP This week: - make a patch for the proxy---broker communication (#29207) - stay updated on pion rbm build (#28942) - snowflake dogfood - continue work on sequencing layer (#29206) - revisit snowflake reachability scripts, check status of tests, and enhance (#30368) Help with: - review of progress on sequencing layer (#29206) - review of putting snowflake spec in git repo (#31407) - quick review of proposed protocol changes for proxy---broker (#29207) <-- not urgent, i can move forward with what i have catalyst: week of 08/22 (planned): - reorienting after leave - mostly sponsor31 stuff week of 08/22 (actual): - mostly sponsor31 stuff week of 08/29 (planned): - mostly sponsor31 stuff (control protocol refactoring that will hopefully lead to better bootstrap reporting) arlolra: 2019-08-29 Last week: - merged #30310 - helped with some review Next week: - add a build step / documentation for code reuse in cupcake - make an attempt at #31391 Help with: - dcf: 2019-08-29 Last week: - merged the meek-http-helper port to WebExtension (#29347) - read and summarized the Point Break paper from Usenix 19 https://lists.torproject.org/pipermail/anti-censorship-team/2019-August/000… - tried to reproduce a Snowflake packaging problem on Debian 9 (#31380) - reviewed serna's patch for broker-controlled Snowflake poll interval (#25598) - Helped deploy snowflake proxy webext-0.0.10 (#31385, #31200, https://archive.org/details/snowflake-webextension-0.0.10 ) - Redeployed my meek-server instances to mitigate a Go HTTP/2 DoS (#31455) - reviewed a patch to remove proxy IDs from broker /debug (#31460) - worked on an rbm build of Snowflake with pion-webrtc (#28942) - applied a documentation fix for file ownership in snowflake.tpo deploy (#31496) - filed a ticket to link Cupcake from snowflake.tpo (#31497) - Turbo Tunnel prototyping. Next week: - review Snowflake sequencing layer (#29206) - add snowflake to the Windows build with pion-webrtc (#28942) - Turbo Tunnel prototyping Help with: - redeploy meek-azure bridge for Go net/http DoS vulnerability (#31455) - needs attention from inf0 at Team Cymru (dcf has sent email) - someone to try to reproduce my checksums from https://bugs.torproject.org/28942#comment:43

1 0

Roadmap for hypothetical network health team
by Roger Dingledine 29 Aug '19

29 Aug '19

Here is an area list for a hypothetical future "network health" team. I say hypothetical because we have no near-term plans to form such a team -- but imo the task areas make sense together. Some of them are being handled by other teams right now, but some of them aren't getting as much attention as they need. (1) track community standards about what makes a good relay - publish up-to-date expectations for relay operators - set best practices for how to set relay families - detect and resolve bad relays - exitmap, sybil detection, hsdir traps (2) anomaly analysis / network health engineer [with network team] - establish baselines of expected network behavior - look for and resolve denial of service issues - track connectivity issues between relays - look for relays hitting resource limits (3) make sure usage/growth stats are collected and accurate - track network performance, relay diversity by various metrics - count users [with network team and metrics team] - monitor bridge growth and usage [with censorship team] (4) relay advocacy [with community team] - maintain docs for setting up and running relays and bridges - grow a cohesive community of relay operators so they have peers - keep relays on the right tor versions - relaunch a gamification / badge system for lauding good relay progress - strengthen relationships with non-profit orgs that run relays - help companies that want to offset their tor network load (5) maintain the components of the network - maintain directory authority relationships - keep bandwidth authorities working (including setting the right balance between speed and location diversity) - have enough tor browser default bridges, and keep them running smoothly [with censorship team] - update the fallbackdirs list

3 2

Campaign: Run a Tor Bridge
by Stephanie A. Whited 28 Aug '19

28 Aug '19

** *Hello Tor, * * You all know the importance of Tor bridges for circumventing censorship, and today we’re calling on our community to help censored users by running them. Bridges are relatively easy, low-risk, and low bandwidth to operate, but they have a big impact on people where the internet is under oppressive control. We now have new documentation for how to set them up. We have guides for several Linux distributions, FreeBSD, OpenBSD, and docker [1]. If you set up a bridge before September 30, you could be one of 10 bridge operators to be randomly selected for a Tor t-shirt. More details can be found in phw’s post [2]. If you cannot set up a bridge now, you can still help. You can share your support of running or using Tor bridges on social media with the hashtag #RunTorBridges [3] and a link to the post. Please also share the post with any friends or communities you think would be able to help. If there’s someone you think would be helpful for us to reach out to, please let me know. Thanks for your support. Best, Steph [1] https://community.torproject.org/relay/setup/bridge/ [2] https://blog.torproject.org/run-tor-bridges-defend-open-internet [3] https://twitter.com/hashtag/RunTorBridges?src=hashtag_click * -- Stephanie A. Whited Communications Director The Tor Project IRC: stephw PGP Fingerprint: E976 9771 7D46 2E63 9697 9F6D 6D6B 72C3 39A8 76AD <https://pgp.mit.edu/pks/lookup?op=get&search=0x6D6B72C339A876AD>

1 0

nextcloud: next steps
by Gaba 27 Aug '19

27 Aug '19

Hi! We have been evaluating Nextcoud [0] this year as a replacement for storm [1] and some of us have been using it and giving feedback [2][3] . The next step is to meet with all people interested in this transition (or not) to - discuss cons/pros of nextcloud for Tor and try to make a decision on moving forward. The meeting day will be: Tuesday August 27th, 1800 UTC at #tor-meeting in irc.oftc.net If you can't come to the meeting but you still want to say something please reply to this mail in tor-project@ or send me or Linus a private message. Thanks! gaba [0] https://trac.torproject.org/projects/tor/wiki/org/operations/services/nextc… [1] https://storm.torproject.org [2] https://trac.torproject.org/projects/tor/ticket/30869 [3] https://trac.torproject.org/projects/tor/ticket/29415 -- Project Manager: Network, Anti-Censorship and Metrics teams and OONI support gaba at torproject.org she/her are my pronouns GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

2 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

tor-project