- tor-project - lists.torproject.org

Anti-censorship team monthly report: September 2019
by Philipp Winter 01 Oct '19

01 Oct '19

Hi everyone, Here's what the anti-censorship team has been up to in September: Snowflake ========= - Snowflake will be part of the upcoming Windows version for Tor Browser: <https://bugs.torproject.org/25483> - Moved from the Chrome WebRTC standalone library to the Pion/WebRTC library in our proxies and clients. obfs4 ===== * Published a prototype of sharknado: a flow obfuscator for obfs4 (and other pluggable transports). Sharknado is a net.Conn wrapper that injects padding traffic to thwart traffic classification attacks. Here's some more info: <https://bugs.torproject.org/30716#comment:10> * Improved obfs4 bridge setup guides. Thanks to several volunteers who spotted issues in our guides and contributed new guides! * Updated our obfs4 Docker image to the new Debian buster. Made our image's "latest" tag point to the latest version, which is currently 0.2: <https://bugs.torproject.org/31692> Thanks to a volunteer, we now have a list of usability issues that we will tackle soon: <https://bugs.torproject.org/31834> BridgeDB ======== * Removed the email link to frontdesk@tpo from BridgeDB's landing page and added links to our documentation: <https://bugs.torproject.org/28533> Released BridgeDB version 0.8.2 after the merge. * Worked on syncing BridgeDB's usage metrics over to the metrics team: <https://bugs.torproject.org/19332> * Made lots of progress on updating BridgeDB's requirements.txt file: <https://bugs.torproject.org/29484> Got to a point where all unit tests pass with up-to-date libraries. * Started working on a specification for BridgeDB's usage metrics: <https://bugs.torproject.org/31780> * Started experimenting with a language switcher for BridgeDB: <https://bugs.torproject.org/26543> * BridgeDB's assignments.log file are now archived by CollecTor again: <https://collector.torproject.org/archive/bridge-pool-assignments/> This allows bridge operators to see over what mechanism their bridges are distributed: HTTPS, email, moat, or manual. <https://bugs.torproject.org/29480> GetTor ====== * GetTor now uses the Internet Archive and a Google Drive folder to distribute Tor Browser links. Give it a shot by sending an email to gettor(a)torproject.org and write "windows", "osx", or "linux" in the email's body. * Updated documentation and added nagios check to monitor GetTor's email responder. Outreach ======== * Worked with new obfs4 bridge operators who set up a bridge as part of our bridge campaign: <https://blog.torproject.org/run-tor-bridges-defend-open-internet> So far, we are counting 82 new bridges. Thanks to everyone who participated! * Provided an NGO with private obfs4 bridges for distribution among its users. We are working with a set of operators to set up new, reliable, and fast private bridges, so we can help other NGOs: <https://bugs.torproject.org/28526> Miscellaneous ============= * Deployed a set of new default obfs4 bridges thanks to Tobias Pulls from Karlstad University: <https://bugs.torproject.org/31164> * Fixed a number existing papers and added a WebSci'18 paper to CensorBib: <https://censorbib.nymity.ch> * Fixed outdated documentation on "BridgeDistribution" in tor's man page: <https://bugs.torproject.org/31807>

1 0

gitlab next steps
by Gaba 30 Sep '19

30 Sep '19

Hi! We met today to talk about the migration from trac into gitlab. The agenda and notes are in the pad (https://pad.riseup.net/p/e-q1GP43W4gsY_tYUNxf) and in the body of this mail. You can look at the logs for the meeting in: http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-09-17-18.01.html Next meeting will be on October 1st. CONTENT OF THE PAD: References: mail with context: https://lists.torproject.org/pipermail/tor-project/2019-July/002407.html planning document: https://nc.riseup.net/s/SnQy3yMJewRBwA7 migration code: https://dip.torproject.org/ahf/trac-migration ticket: https://trac.torproject.org/projects/tor/ticket/30857 Agenda September 17th * Revisit agenda * Update that where we are at * Stuff that seems that still needs to be resolved or decided upon: * IRC ticket number bot * redirection from bugs.torproject.org to gitlab ticket (legacy project resolve links?) * structure for projects * anonymous users/ user registration * Preserving existing trac data * data migration process * Next steps Notes Logs: http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-09-17-18.01.html On ticket numbers: 1) IRC bot for tickets (zwiebelbot) - get ticket's title and a link to the ticket when we write #TICKET-NUMBER. In gitlab tickets are per project. possible solutions: 1. write a plug-in for the bot that is running zwiebelbot to fetch the data via gitlab's api. we will lose the short hand ticket id syntax (#xxx) and have to use project-name#xxx instead with that 2) redirect from bugs.torproject.org/#TICKET-NUMBER to the right issue in gitlab possible solutions: 1. a part of the migration from tickets from trac to all the different gitlab project, we save a mapping between the old ticket ID's and their new project paths, which would allow us to update the redirection service with a tool that looks at htis mapping and does the redirect 2. all tickets first get migrated to a single project where there's a one to one mapping between ticket IDs in trac and gitlab so bugs.tpo/N point to dip.tpo/legacy/N for future issues (not legacy) we will have bugs.torproject.org/project/NNN 3) the question is how to keep ticket numbers consistent across the migration if we want to have tickets split between mut roject Nick's Absolute Requirements: 1. If there is #NN in trac, and there is tor#NN in gitlab, then they must be the same bug. 2. If there is tor#MM in gitlab, and it is the same as some bug #NN in trac, then MM must equal NN. NEXT STEP: AHF will experiment with aproach 2.2 on moving tickets from legacy project into its own. (ahf will move forward) Structure for projects: Proposed structure: Group TEAM X - all team members have ownership on this group. Project X1 - the ones related to repositories. Example: snowflake or little-t tor. Group XX1 - example pluggable transports for anti-censorship team Project Y - at organization level, example scalability that may touch all teams. NEXT STEP: rename the group 'torproject' to tpo (gaba will do it) NEXT STEP: add the rule "do not have two elements in the project naming tree with the same name, even if they are not ambiguous" NEXT STEP: add the rule "short names when possible for projects or groups" Anonymous users/ user registration: Options: (1) cypherpunks - people not ok with this one as there are trolls (2) salsa custom signup form - some people say this is not totally effective (3) akismet + recaptcha - not really an option because it blocks tor users and tracks people (4) write a custom captcha plugin - some people say this is not totally effective (5) open registration - spam is a huge issue here Proposals: 1) i suggest we manually register gitlab accounts for known good contributors and open up contributions from github issues (from catalyst) 2) open registration with some spam-limiter, and moderate accounts (from nick) 3) consider experimenting with the salsa custom signup form NEXT STEP: We need more research on how to deal with spam in gitlab. NOTHING DECIDED YET. (gaba will check) Preserving existing trac data: NEXT STEP with a list of things that you will not see in gitlab from trac Data migration process: NEXT STEP: write down a more concrete plan for migration. What do we test for? When we do it? Who is helping? - (gaba will do it) Issues about migration will be deal here: https://dip.torproject.org/ahf/trac-migration -- Project Manager: Network, Anti-Censorship and Metrics teams gaba at torproject.org she/her are my pronouns GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

3 5

Damian's Status Report - September 2019
by Damian Johnson 29 Sep '19

29 Sep '19

Hi all. Non-technical aspects of life have kept me occupied the last few months but I should soon have more time to get back into the thick of things. https://blog.atagar.com/september2019/

1 0

Notes from Vegas team meeting September 26
by Erin Wyatt 27 Sep '19

27 Sep '19

SEPTEMBER 26 2019 Items Discussed: + Gaba: - Ongoing discussion: We checked with Gitlab to see if we could get a license for the ultimate tier (https://about.gitlab.com/pricing/#self-managed) and we could get it for free because we are an open source project. thoughts? Features comparison: https://about.gitlab.com/pricing/self-managed/feature-comparison/ <https://about.gitlab.com/pricing/self-managed/feature-comparison/> * Discussion: Many people are wary of hosting or depending on proprietary software, but we use proprietary software for other things. Some team really want and need it, others are not so sure. Most want to try and see how it goes and all present at the meeting agreed to proceed; a few are very hesitant and followed up the meeting by email for further discussion, so we shall have further discussion. + Georg: - Planning for Mozilla All Hands, FOSDEM, ShmooCon. Who goes where? [For where we are with this item regarding planning see notes from last week.]; all of them moving along. * Discussion: general (continued) discussion about the conferences; We need to decide on a main track talk to submit to FOSDEM asap. Re: schmoocon - waiting to hear if we have a boot. + Pili: - Should we participate in Hacktoberfest as project maintainers? (https://hacktoberfest.digitalocean.com/faq/) * Discussion: questions about what would be required of us. Answer: we can tag issues in github with hacktoberfest if we want to encourage people but otherwise people can just participate without us getting involved. If we really wanted to go for it, we might want to run some sort of social media campaign about it e.g about contributing to open source projects but not sure we have the capacity for this right now. Which repos would be participating then? website? community? is this similar to the docshackaton? OONI will participate. + Antoine - just FYI: opened up grafana semi-publicly see the beautiful dashboards at https://grafana.torproject.org/ --------------->8 General Notes: isabela: 1. Tea time on #tor-internal - will follow up on edits of employee handbook w/ erin 2. Last week in Seattle I worked w/ Sue on auditors requests, also met w/ a major donor in Seattle 3. Helped review and submit 2 proposals for DRL (done last Friday) 4. Catching up with backlog of emails (to sponsors and donors) 5. Met with OutRight for possible partnership on trainings 6. Will be part of a webinar on 'there is no dark web' Gaba: 1. DRL scalability proposal submitted by Al last week 2. Sponsor 30 signed and officially starting. 3. Checking anti-censorship roadmap 4. Small tasks 5. Gitlab moving forward. New meeting next week. Alex: 1. Getting a lot of help from Nick and Gaba with the transition work that is happening. 2. Building an overview of all the deliverables for the team in the near'ish future. 3. Working on Tor PT related tickets and Tor 0.4.2 tickets. 4. Continue progress on Gitlab migration. Gus: 1. Pili and I submitted an outreachy proposal for Community Team, "Help Tor Project support our users" - https://www.outreachy.org/apply/project-selection/#tor-project 2. Wrapping up #DocsHackathon 3. A lot of work on support portal - migrating resources from old FAQ 4. Answering RT/frontdesk 5. Working on S9 partnership agreement with local trainers 6. Blog comments layout: asked a Drupal freelancer to take a look and give an answer to us until next Monday (oct 1) 7. If you're going to FOSDEM, please help to fill this wiki page: https://trac.torproject.org/projects/tor/wiki/org/meetings/2020Brussels Sarah: 1. Took three classes on CiviCRM last week. Prepping database for EOY campaign emails. 2. Sending Isa's vision update to donors who have not yet given this year. 3. Working to set up Uphold account so we can access Brave reward tips sent to us. 4. Continuing to plan for party in Boston on October 28th. Let me know if you know someone who should be invited. <-- what is the profile of people that could be invited? --> Ideally we are looking for people who could now or eventually be a major donor - $1K+ per year. Steph: 1. EOY prep 2. Outreachy initial application closed. Contributions begin Oct 1, then we choose interns after a contribution period. 3. Drafted 'there is no dark web' presentation for a Friday call with DC area folks 4. Editing the community portal 5. Newsletter draft in the works 6. Working with emma on a post for International Translation Day Antonela 1. Updating the UX Team roadmap. 2. S9 2.1 regular website maintenance/review. 2.2 community.tpo.org/user-research needs content review 2.3 Narriral contract ends this week. We organized the user research done in 2018 and Q1/Q2 2019, wrote reports and set up the process for future user research with communities. 3. S27 3.1 The UX part of O2A1, O2A3, O2A5 is done 3.2 progress with .onion errors (O2A2, O2A4) 3.x are our OTF sponsors reports public? If yes, should we share those with OTF lists or TPO lists (even better)? 4. TB9.0 4.1 network settings UI review, dunqan will work on the onboarding update (#31768) 4.2 working on new identity UI 4.3 doing UI QA with TBA and TB alphas 5. OONI Probe UI/UX tasks 6. Reviewing Tunde's OTF progress 7. Working on the EOY Campaign Antoine 1. just FYI: opened up grafana semi-publicly see the beautiful dashboards at https://grafana.torproject.org/ 2. worked around stability issue on the new ganeti cluster, which has now entered a production phase with two new web mirrors in place 3. continued Puppet refactoring, review and cleanup, as usual 4. will send announcement for LDAP sudo changes tomorrow, pending for 3 years now 5. grafana dashboards now have support for "per role" displays (e.g. "show me the bandwidth usage of all the web mirrors") Georg 1. Helped with paper review 2. A lot of esr68 transition work Mike: 1. Circuit padding doc work 2. Paper review 3. Circuit padding bugs/ticket comments 4. Need to not be distracted by urgent things for next 2-3 weeks (lol), or ESR code review won't finish :/ Arturo: 1. Launched the new OONI Explorer, yay! https://ooni.org/post/next-generation-ooni-explorer/ 2. Working on infrastructure cleanup 3. Preparing release of OONI Probe mobile 2.2.0 4. Investigating blocking of media sites in Egypt 7. A lot of progress on the data analysis fastpath that will allow near-realtime publication of data as well as generating alerts for blocking events Pili: 1. Planning roadmaps for October 2. Working on S27 month end and work completion reports 3. Worked on Outreachy project for Community Team 4. Working on handing over parts of the website to new owners 5. Dockshackathon wrap up tasks 6. Still evaluating whether we want to participate in Hacktoberfest and how 7. Tor Browser release meeting 8. Hope to get around to more Fosdem organisation soon Matt: 1. Ongoing discussions with Georg and Pili for transitioning Tor Browser team lead 2. 68esr transition work, with a focus on Android 3. Beginning to look at important Tor Browser tickets we should work before the end of the year Erin: 1. Working on handbook clarifications 2. Exploring possibility of moving Seattle to small/cheap space in lieu of closing Philipp 1. Added new default bridges and coordinated with operates of prospective private/default bridges 2. More work on improving obfs4's flow shape, and making obfs4 client store state 3. Worked with new obfs4 bridge operators (useful feedback on our guides is still coming in) 4. More progress with snowflake's new client/server protocol 5. Worked on BridgeDB Sponsor 30 deliverables 6. Helped with paper review Karsten: 1. Made several smaller improvements to the code base (#31649, #31599) Nick: 1. Various documentation/text tasks 2. Team is working on 0.4.2 stability 3. Talked with group working on gathering at Wendy's place.

1 0

Moving Web group to Tor Project group in gitlab
by Pili Guerra 27 Sep '19

27 Sep '19

Hi everyone, Just a heads up that I’m planning to move the Website group[1] in gitlab under the Tor Project group[2] in gitlab in the next few days. This will mean that if you have bookmarked any issues here, the link to these will change. Also, any links and/or bookmarks to locations on the wiki will also break. Are there any strong objections from anyone before I do this? Thanks! Pili [1] https://dip.torproject.org/web [2] https://dip.torproject.org/torproject — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

1 1

LDAP sudo passwords change
by Antoine Beaupré 26 Sep '19

26 Sep '19

Hello! What ==== In a month from now, the sudo configuration on torproject.org machines will change. While right now your normal LDAP password can be used to authenticate with sudo, but it will then require you to use the dedicated sudo password. When ==== For now, both the LDAP password and the new sudo password will work to authenticate to sudo. Starting in the third week of October (around October 14th), the LDAP password will no longer be accepted for sudo authentication. Note that this was previously announced in March 2016, but never enforced: https://lists.torproject.org/pipermail/tor-project/2016-March/000199.html How === The LDAP password is the one you got sent in encrypted mail when your account was first created on db.torproject.org. You should have changed that on the [web interface][]. This password is the one that also allows you to log into the management interface there and change for instance your mail forwarding configuration or your sudo password. [web interface]: https://db.torproject.org/login.html To set the sudo password: 1. go to the user management website above 2. pick "Update my info" 3. set a new (strong) sudo password If you want, you can set a password that works for all the hosts that are managed by torproject-admin, by using the "wildcard ("*"). Alternatively, or additionally, you can have per-host sudo passwords -- just select the appropriate host in the pull-down box. Once set on the web interface, you will have to confirm the new settings by sending a signed challenge to the mail interface. Please ensure you don't introduce any additional line breaks. Note that setting a sudo password will only enable you to use sudo to configured accounts on configured hosts. Consult the output of "sudo -l" if you don't know what you may do. (If you don't know, chances are you don't need to nor can use sudo.) Why === We prefer to use two authentication factors to access the more powerful "sudo" command, this is a security measure. We want a different password for anything that elevates your privilege, in other words. Who === This change is operated by the Tor Project sysadmins (TPA). If you have any questions or comments, feel free to respond to this message or followup in ticket #6367. -- Antoine Beaupré torproject.org system administration

1 0

Anti-censorship meeting notes, 26 Sep 2019
by Philipp Winter 26 Sep '19

26 Sep '19

Here are our meeting notes: http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-09-26-17.00.html And here is our meeting pad: Anti-censorship work meeting pad -------------------------------- Next meeting: Thursday September 26th 17:00 UTC Weekly meetings, every Thursday at 17:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress). == Goal of this meeting == Weekly checkin about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at Tor. == Links to Useful documents == * Our anti-censorship roadmap: https://dip.torproject.org/torproject/anti-censorship/roadmap/boards * Our roadmap consists of a subset of trac tickets. * The anti-censorship team's wiki page: https://trac.torproject.org/projects/tor/wiki/org/teams/AntiCensorshipTeam * GetTor's roadmap: https://dip.torproject.org/torproject/anti-censorship/gettor/boards * Tickets that need reviews: https://trac.torproject.org/projects/tor/query?status=needs_review&componen… --------------------------- --- 26th September 2019 --- --------------------------- == Announcements == * Snowflake for Windows is going into the next alpha release \o/! == Discussion == * Sponsor 30 is officially starting (gaba) * Info about the sponsor: https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor30 * Master ticket for Objective 2: https://trac.torproject.org/projects/tor/ticket/31268 * Next: * fill up doodle to confirm when we can meet (I assumed phw is going to be participating in the s30 meetings) * create tickets for work that needs to be done with each activity * Sponsor 28: update? * phw on #30716 - Improve obfs4's flow obfuscation * we want to improve obfs4's flow obfuscation and find a way to "regulate" per-packet entropy, so a high-entropy filter cannot easily block the protocol * our georgetown colleagues are evaluating obfs4 * cohosh continues work on snowflake * We are getting some more snowflake volunteers, it's probably time to update our CONTRIBUTING.md guidelines: https://trac.torproject.org/projects/tor/ticket/31847 == Actions == * Please summarise your month for our september report: https://pad.riseup.net/p/B8Um_zirxIsHD84D6iR_ == Interesting links == * == Updates == FORMAT! Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week (related to anti-censorship work). Help with: - Something you may need help with. hiro: (2019-09-09)(gettor days are Thursday - snippets https://dip.torproject.org/snippets) - gettor was down due to a VM reboot. Phw added a systemd script to reboot the service. - add archive.org - add gdrive - edit ansible scripts - edit scripts to upload files to various distribution endpoints Next week - reach out to irl about sending gettor stats to metrics - include reviews from code and website changes - review specs: are specs up-to-date? should we change something in the specs? - review docs: write documentation for web site and ansible playbooks. Help with: - probably more reviews. hiro: (2019-09-02)(gettor days are Thursday - snippets https://dip.torproject.org/snippets) - Coded ansible recipes for gettor so that the service can be easily maintained by more people: https://dip.torproject.org/torproject/anti-censorship/gettor-project/gettor… - Fixing some issues about git history taking too much space quota on gitlab and github Next week - use archive.org as new distribution endpoint: upload files to archive.org - reach out to irl about sending gettor stats to metrics - review specs: are specs up-to-date? should we change something in the specs? - review docs: write documentation for web site and ansible playbooks. Help with: - waiting to be told that's fine to upload files to archive.org? Can we start? - review new website. New website should be reviewed. https://dip.torproject.org/torproject/anti-censorship/gettor-project/gettor… phw: This week (2019-09-26): * Filed #31807 for outdated documentation of "BridgeDistribution" in tor's man page and wrote patch * Updated documentation for obfs4 docker image, advising people to use 'latest' tag * Moved exitmap-modules from private GitHub repository to dip.tp.o * Started working on language switcher for BridgeDB (#26543) * Tricky because it involved convoluted 3rd party library * Helped add new default bridges to Tor Browser -> will be in next alpha version * Worked with prospective operators of new private and default bridges * More work on obfuscating obfs4's flow signature (#30716) * Also made obfs4 client store state (only server would do that) * Still no progress on reducing per-packet entropy. It's tricky. * Filed #31834 to improve usability of obfs4 docker file * Had a chat with a researcher who was trying to understand (D)DoS attack against Tor Next week: * Make progress with obfs4 improvements * Figure out how to reduce per-packet entropy Help with: * Gaba: (updated September 25th) Last week (): * checking roadmap * sponsor 30 coordination This week (planned): * sponsor 30 triage of tickets ahf Last week: - Worked on #28930 This week: - Finished refactoring parts of #28930. Trying to figure out if we should begin the discussion on how PT's can report back on bootstrap info. - Continued to work on a tool to convert Trac tickets into Gitlab tickets. cecylia (cohosh): last updated 2019-09-26 Last week: - reviewed #31780 - worked with sah on errors swallowed ticket (#31794) - clean up logs (#30830) - finally got sequencing layer fully working with test deployment of server (#29206) - merged windows tbb build using pion branch of snowflake \o/ (#25483) - created a ticket for adding locks to the safe logger (#31843) - created a ticket for updating CONTRIBUTING.md (#31847) - created and presented a short demo of snowflake at ournetworks.ca last weekend This week (gonna try to clear out some backlog from sept): - make a patch for the proxy---broker communication (#29207) - snowflake dogfood and think about how to address bad snowflake health - revisit reachability scripts and set up for new obfs4 tests - squash commits for sequencing layer (#29206) and start working on upgrade strategy (#30704) - grant outline for meeting next week - refactor proxy-pair state machine (#31310) - help sah finish up #31794 and with code coverage tickets - see where we're at with #31384 - review #31391 - tag snowflake tickets with easy or starter Help with: - review of #30830, #31843 - i'll need a review of #29206 very soon, after i clean up the commits - review of #28942 catalyst: week of 09/19 (planned): - reviews - sponsor31 planning - coding style discussion - comment on draft network team review guidelines - #30984 week of 09/19 (actual): - reviews - sponsor31 planning - talking with people about proposed network team review processes week of 09/26 (planned): - reviews - sponsor31 doc coordination - checking in on Season of Docs work - #30984 arlolra: 2019-09-26 Last week: - mia Next week: - add a build step / documentation for code reuse in cupcake - pick up another ticket Help with: - review of #31391 dcf: 2019-09-26 Last week: - mostly not paying attention, sorry - Turbo Tunnel prototyping - posted summary of I2P paper from FOCI ( https://github.com/net4people/bbs/issues/12 ) Next week: - catch up on pion updates and rbm build - archive test pion builds from #28942 - Turbo Tunnel prototyping Help with:

1 0

Metrics team meeting notes, September 26h 2019
by Gaba 26 Sep '19

26 Sep '19

Hi! Metrics team meet every Thursday at 15:00 UTC in #tor-meeting. You can read today's meeting logs in: http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-09-26-15.02.html Below is a copy of the agenda from today: ** Public pad URL is: https://storm.torproject.org/shared/5h1Goax5eNusxjXJ_Ty5Wl7hFR1uqCReUiN8xdl… ** ** Next meeting: October 3rd, 15 UTC ** Agenda Thursday, September 26th, 15 UTC Let's give a last review of the proposal (to be submitted this Friday) Sponsor 30 finally starting https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor30 Roadmap - how are we doing? (gaba) : https://trello.com/b/Mu5fYg53/tor-metrics-roadmap --- -- Project Manager: Network, Anti-Censorship and Metrics teams gaba at torproject.org she/her are my pronouns GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

1 0

Notes from Vegas team meetings September 12 and 19
by Erin Wyatt 24 Sep '19

24 Sep '19

SEPTEMBER 12 2019 Items Discussed + Gus: - Update torproject.org/about/people page Discussion generally centered around who is maintaining people page and what is/should be our procedure for removing people from it (and tor-internal); future plan is for several people to share the access and responsibility for keeping the people page updated. + anarcat: - need help with services inventory cleanup, https://trac.torproject.org/projects/tor/ticket/31261 in particular i wonder what to do with https://trac.torproject.org/projects/tor/wiki/org/operations/ProductsandAss… and https://trac.torproject.org/projects/tor/wiki/org/operations/Infrastructure… seems like a dupe of a survey i did recently - how do we organize this? Discussion: these pages are essentially obsolete so closed ticket; future hope is to have a broad map of the tor ecosystem, what projects and who is responsible for each, but now there is no one to maintain that and keep it from becoming outdated/obsolete. - email update: we're go with giving people LDAP accesses, but it means we need support from Vegas (or HR?) for training people to use it https://trac.torproject.org/projects/tor/ticket/30608 Discussion: We will need some training and documentation on how to use it and a set of supported configurations; we are retiring jabber. + gaba: - We checked with Gitlab to see if we could get a license for the ultimate tier (https://about.gitlab.com/pricing/#self-managed)and we could get it for free because we are an open source project. thoughts? Features comparison: https://about.gitlab.com/pricing/self-managed/feature-comparison/ [no decision being made. conversation will continue next week] Discussion: generally centered around the considerations of using the paid/proprietary version vs. free/open Roger: - I need help sorting out future Tor talk invites: Mongolia, Austria, Austria, Rome, Phoenix, and an onion services advocacy phone call. [Discussion: more generally, we need to figure out if our plan to grow more Tor speakers is working as originally intended. The original idea was to get a bunch of Tor people more experience at smaller speaking gigs, so they can work their way up to the 5k+ audiences rather than just try to replace Roger directly. But I think we aren't thinking broadly enough, or people aren't prioritizing this sort of growth, or in any case we're not effectively using our talk invites. Discussion: Alison made a list previously, Gaba will take it over and update it; --------------->8 General Notes: Gus 1. DocsHackathon was awesome! There are some work to do: send email to participants, scoring PRs, merge PRs from last days, and, of course, the onion awards. 2. Writing blog post about our security training program with human rights defenders; to be published very soon. 3. This Friday going to talk with Bitcoin Magazine podcast folks 4. Sponsor9 phase 3 status: launched program with partners from visited countries in phase 1 and 2. Receiving confirmations this week. 5. Working on DRL funding with Tails and Guardian Project 6. Update torproject.org/about/people Sarah 1. Major donor - Champions of Privacy - page about to launch and first round of invitations to be sent. 2. EOY planning. 3. Planning visits for Isa. 4. Organizing donor party in Boston in October. 5. Working on securing additional matching funds for campaign. Steph 1. EOY planning 2. Blog posts: relay upgrade, bug smash wrap up, climate 3. Talking with artist to possibly make a comic book about Tor 4. #RunTorBridges campaign 5. Got office space at NYU! 6. Coordinating a podcast 7. Submitted a project for Outreachy https://www.outreachy.org/communities/cfp/tor-project/. Mentorship round begins Oct 1 8. Joined the banfacialrecognition.com campaign Anarcat 1. need help with services inventory cleanup, https://trac.torproject.org/projects/tor/ticket/31261 in particular i wonder what to do with https://trac.torproject.org/projects/tor/wiki/org/operations/ProductsandAss… and https://trac.torproject.org/projects/tor/wiki/org/operations/Infrastructure… seems like a dupe of a survey i did recently - how do we organize this? 2. email update: we're go with giving people LDAP accesses, but it means we need support from Vegas (or HR?) for training people to use it https://trac.torproject.org/projects/tor/ticket/30608 3. we should discuss SVN again eventually, but i'll bring it up next time 4. got my plate full again after vacation, lot's of non-visible work, but trying to respond to quick tickets in a timely manner as well 5. first phase of Puppet cleanup over, very happy about that 6-months project finally giving results 6. made a nice little dashboard to provide metrics alongside our monthly meeting minutes see https://help.torproject.org/tsa/meeting/2019-09-09/#index9h1 for a preview 7. nextcloud will be hosted and managed by riseup for now, in a separate instance Nick 1. I've taken on some extra stuff for folks, so please let me know if I am dropping anything. 2. Tor 0.4.2.x will enter feature-freeze on Sep 15. 3. Hoping to put out 0.4.2.1-alpha next week, and maybe also a new 0.4.1.x. 4. Alexander Færøy is now team lead for organizing network team stuff: I'm still doing design lead, technical lead, and release management stuff. 5. Worked somewhat on summarizing gitlab proposal; found some missing points in doing so; gaba is revising proposal. Gaba 1. nextcloud next steps. checking with riseup on having a nextcloud instance with them. 2. migrating from trac. discussing with people and will include feedback into proposal. We checked with Gitlab to see if we could get a license for the ultimate tier (https://about.gitlab.com/pricing/#self-managed) and we could get it for free because we are an open source project. thoughts? [discussion will happen again next thursday] 3. sponsor 31 report and next 3 months 4. sponsor V preparing report for roger to complete 5. scalability funding proposal moving ahead Roger: 1) I have finished my travel burst -- Tor dev, PETS, Defcon, FOCI, Usenix Security, Leuven, Underground Economy. So if you need something from me, this week is a good time. 2) I need help sorting out future Tor talk invites: Mongolia, Austria, Austria, Rome, Phoenix, and an onion services advocacy phone call. [Discussion: more generally, we need to figure out if our plan to grow more Tor speakers is working as originally intended. The original idea was to get a bunch of Tor people more experience at smaller speaking gigs, so they can work their way up to the 5k+ audiences rather than just try to replace Roger directly. But I think we aren't thinking broadly enough, or people aren't prioritizing this sort of growth, or in any case we're not effectively using our talk invites. The plan is that Gaba is going to get the original list of speaking volunteers from Alison, and we're going to revamp our approach to trying to match speakers to speaking invites.] Georg: 1) First alpha based on Firefox ESR 68 is out and nothing exploded 2) Focus on getting Tor Browser 9 into shape and everything compatible with the upcoming macOS 10.15 Antonela 1. OONI Explorer v2 will release this week, helping on what is needed 2. working with Narirral on user research material for communities 3. user research section content for community.tpo 4. meeting with Fundraising about DRL proposal, EOY Campaign, next funding for Onion Services 5. met Justin Cappos, put him in contact with anarcat and phw - NYU office is cool! 6. running a design review over the new Orbot 7. TB9 Onboarding, Net Settings, New identity & S27 Onion Services Erin 1. Handbook substance done, Al is reviewing and we'll issue it soon 2. General HR stuff Philipp 1. Collected private obfs4 bridges (and distribution instructions) for NGO 2. Set up a private monitoring system to monitor these bridges 3. Updated obfs4 docker image to Debian buster 4. RACE meeting to coordinate progress on obfs4 improvements 5. GetTor deployment and documentation improvements 6. More work on broker/proxy protocol improvements for Snowflake Pili 1. Mostly afk this week 2. Spoke at API Days Barcelona today on "How to use Onion Services to secure APIs" 3. Catching up with email backlog tomorrow and any urgent items ———————>8 ———————>8 ———————>8 SEPTEMBER 19 2019 Items Discussed + Sarah: - The theme for the EOY campaign is Take Back the Internet. We are looking for ideas of items (books, t-shirts, tech-related items) from famous people working on internet freedom that we can use for drawings throughout the campaign. Any ideas of items we can solicit for this? Discussion: We need an item that people really want and would share the opportunity to win it on social media; discussion of what items from internet-freedom-related and/or tech famous people would be cool + Gaba: - Bringing back this issue from last week: We checked with Gitlab to see if we could get a license for the ultimate tier (https://about.gitlab.com/pricing/#self-managed) and we could get it for free because we are an open source project. thoughts? Features comparison: https://about.gitlab.com/pricing/self-managed/feature-comparison/ Discussion: tabled until next week. + Georg: -Planning for Mozilla All Hands, FOSDEM, ShmooCon. Where are we and how do we coordinate that? • Pili is coordinating FOSDEM (we are submiting a stand and looking for somebody to give a talk in the main track) • Gaba sent a mail to Moz people to see how we are going to be at Mozilla All Hands (not reply yet) • Roger, Sarah and Steph may be coordinating ShmooCon? Discussion: tabled until next week. + Pili: - Should we participate in Hacktoberfest (https://hacktoberfest.digitalocean.com/faq/) as project maintainers Discussion: tabled until next week. + Anarcat: - SVN: do we still need it? can it migrate into Nextcloud? we (tpa) want to shutdown the server, see #17202 Discussion: We need it until we can replace it; we can’t replace it until we clean it up; accounting still has files on there; waiting to have NC be the official plan and have a start date, will make a plan to clean up and migrate then. ———————>8 General Notes: Steph 1) Blog posts: Climate strike published, Tor trainings almost ready (created an infographic), localization and relay posts in the works 2) Responded to media inquiry 3) Seeing if we can have a Tor comic book 4) Helping draft a presentation on onion services 5) Reviewing the community portal 6) Preparing for EOY campaign Sarah 1. Taking three training classes this week on different functionality of CiviCRM to maximize our usage as we grow. 2. Attended event on China and Russia exporting surveillance technology sponsored by OTF. 3. Met with The Giving Block to share ideas about fundraising and cryptocurrency. 4. Managed influx of donations of Stellar Lumen following Keybase airdrop. Everyone can sign up for future drops and donate to Tor: https://keybase.io/a/i/r/d/r/o/p/spacedrop2019. 5. Working with Jon on moving to a fulfillment company for swag. 6. The theme for the EOY campaign is Take Back the Internet. We are looking for ideas of items (books, t-shirts, tech-related items) from famous people working on internet freedom that we can use for drawings throughout the campaign. antoine 1. SVN: do we still need it? can it migrate into Nextcloud? we (tpa) want to shutdown the server, see #17202 2. organized the move from ooni.tpo to ooni.io with hellais, transition should start in two months (because of key pinning) 3. helping with the gitlab migration somewhat 4. sent the jabber shutdown announcement, no response Philipp 1. Provided NGO with private obfs4 bridges for their users. Hopefully we can learn from their experience and work with more NGOs in the future 2. More talking to new bridge operators 3. Merged pull requests that improved our setup guides and updated our obfs4 docker image 4. More progress on updating BridgeDB's libraries, also drafted BridgeDB metrics specification 5. More progress on pion WebRTC library and client/server snowflake protocol Nick 1. Released 0.4.2.1-alpha and 0.4.1.6 2. Working on S31 issues 3. Wrote some comments on employee manual 4. Working to try to stabilize 0.4.2.x series Gaba 1. Scalability proposals for funding 2. Gitlab meeting and discussing how to resolve a few issues with it 3. Sponsor V report starting 4. Sponsor 30 is finally on the way 5. Coordinating 1:1s in the network team 6. Events follow up Georg 1. Work on stabilizing Tor Browser based on ESR68 2. Thinking about network health part for the scalability proposal Pili 1. Helping with Outreachy organisation 2. S27 meeting and roadmap review 3. Tor Browser september roadmap wrangling 4. DRL Community SOI 5. S9 6. Docs Hackathon wrap up Antonela 1. S9 1.1 regular website maintenance 1.2 community.tpo.org/user-research is ready for content review 1.3 support.tpo.org FAQ's were updated 2. S27 2.1 working on .onion errors in browsers 3. TB9.0 3.1 new network settings are about to reach an alpha 3.2 working on new identity UI 4. Regular design deliverables: Gus blogpost cover, fundraising EOY needs, outreach material updates 5. Regular sponsor proposal review 6. Doing some clean in trac to have a lighter dip migration Karsten 1. Started archiving snowflake statistics, resumed archiving BridgeDB pool assignments, and prepared archiving BridgeDB request statistics. Erin 1. Handbook v1 issued! :D 2. Reminder: Tea Time w/ Isa Monday September 23 at 2200 UTC in #tor-internal

1 0

Network Team Meeting Notes, 23 September 2019
by Alexander Færøy 24 Sep '19

24 Sep '19

Hello, Here is a short summary of the network team meeting today: 1) We went over our Kanban board to ensure that it is up-to-date. 2) We went over the set of code reviews that needs to happen this week. Everyone should have gotten around 2.5 tickets in average according to asn. 3) We looked at the list of tickets for the upcoming 0.4.2 Tor release on Trac. This is a follow up item from the meeting we held last week. We decided that Gaba and ahf distributes the remaining 042 tickets amongst the team members and discuss the distribution next week if, for example, anybody wants to swap tickets with somebody else. The goal for 0.4.2 is to have an RC with no known bugs ready for around the 15th of November. Alpha releases will be coming out over the next couple of weeks as the team continues to eliminate bugs. 4) Continuation of the discussion last week around "What does an ideal PR looks like?" We continued to discuss this item and according to the network team meta-policy any member of the team can object to a policy. We decided to not continue with turning the current proposal into a team policy as some team members expressed enough concern to be willing to object to it. Mike expressed interest in working on an alternative proposal that we can discuss next week. The team decided this was our actionable item to this matter for now. 5) We discussed moving our retrospective next week. The retrospective is an internal network team discussions where we meet over a voice communication service and discuss the work that have happened in the team over the past month. We decided to move the meeting to the 1st of October at 20:00 UTC. 6) We discussed how to handle code reviews that are requested over the cause of the week. The network team have two volunteers who are distributing the code review load each Monday, but sometimes people have code they want reviewed during the cause of the week. We decided that people should either reach out to each other directly or use the "network-team" label in #tor-dev. If nobody responds, people can ask ahf to help them find somebody who can review their patches. Please remember that our next meeting is on Wednesday the 2nd of October at 23:00 UTC! --- end of summary --- You can read today's network team meeting log at: http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-09-23-16.59.html Below are the contents of our meeting pad: gaba: (updated on september 23rd) Last week (actual): . scalability funding proposal . other small tasks . gitlab migration This week (planned): . sponsor 30 project . gitlab migration . sponsor 31 follow up . 1:1:1s Help with: teor: (online first week of the month, offline at the usual meeting time) Week of 16 September (planned): Leave: - May need to take some leave for the climate strike on 20 September Urgent: - Take Time for: - gitlab signup / config - team policies: - commit bit and roles? - finish add tor controller trace logging to diagnose stem hangs (#30901) - try nickm's suggested a simpler implementation - split off bugs I found while writing the control trace code Roadmap: - Sponsor 31 possible coding tasks for me Other: Week of 16 September (actual): Leave: - Short week for climate strike Urgent: - Take Time for: - Roadmap: - Sponsor 31 config refactor - #31338 practracker bug - bug smash on logging bugs #31594 and children (maybe some of these are bugs on other sponsored work) - bug smash on #31408 - config include dir bug - help with onion balance v3 Other: - bug triage - backports - Climate Strike blog post & comments - try to recover failing dev environment a few times, then rebuilt a new one - review gitlab transition document Week of 23 September (planned): Urgent: - Take Time for: - gitlab signup / config - team policies: - faster reviews - commit bit and roles? - finish add tor controller trace logging to diagnose stem hangs (#30901) - try nickm's suggested a simpler implementation - split off bugs I found while writing the control trace code Roadmap: - Sponsor 31 outstanding bugs / tasks - Sponsor 31 possible coding tasks for me - follow up email Other: - finish off bug smash logging bugs Nick: Week of 16 September (planned): - Release 0.4.1.6 - release 0.4.2.1-alpha - Start 0.4.2 stabilization process - Read proposal 308 (counter galois onion) - Discuss C style polling with Teor and Taylor - Finish PETS review - Work on circuitpadding doc stuff? - Pending reviews Week of 16 September (actual): - Released 0.4.1.6 - Released 0.4.2.1-alpha - Sorted 0.4.2.x tickets that were not must/should/can into Unspecified and 0.4.3.x. I used the keyword 042-deferred-20190918 to mark them. - Squashed/answered a bunch of 042-must/should bugs: - 31107: unexpected versions cell - 31483: single-bucked issues (analyzed and deferred) - 31769: -Wextra-semi failures (seems to be ephemeral, analyzed) - 31338: --list-overbroad issues - 31759: line-width on annotate_ifdef_directives - 30916: assertion failure in dimap_add_entry() - 31466: rate-limiting ".exit is disabled" messge - PETS review - Started but did not finish circuitpadding doc edits - Answered emails, got to inbox 0. - Read proposal 308; seems well-formed but it'll need a reference implementation - Merges and reviews - Read new employee manual Week of 23 September (planned): - Keep an eye on blog comments - Finish edding circuit-padding document - Start a C style poll for the team - Meet about sponsor 31 on tuesday - attend ED tea time later Monday - Respond if needed to expected reviews on paper with Ian and Chelsea - Work on 042-must/should items - Review and merge Mike: Week of 9/16 (planned): - Funding proposals - Circpad doc tweaks and ticket #s -> git & trac - Patch for #31653 (0ms circuitpadding circuit failure bug) Week of 9/09 (actual): - Funding proposals - Circpad doc tweaks and ticket #s -> git & trac - Patch for #31653 (0ms circuitpadding circuit failure bug) - Funding proposals - Research discussion Week of 9/23 (planned): - Research discussion - Work with Nick to clean up final XXX's in circpad doc and merge/cite the quickstart guide - Cloudflare bot fight? - Maybe have time to start on Firefox review? <-- gaba: please or let pili know that you can't do it this week --> Need help with/at risk of dropping this month: <-- do you still need help with this? - Not doing any code reviews this month, unless on circpad patches. Got enough for Tor Browser - Circpad doc followup/fold-in? (nickm is helping here, thx!) - Firefox ESR code review - (I am working on this, but unlikely to finish it this month at this rate of interruption+distraction) - Firefox new feature review (Geko might be taking this, it sounds like. Thx!) - Funding proposal review, meetings, coordination, cross-checking estimations, strategy, etc. - Deep-thought-required research project followup - (Google masque, BGP, ECN, Rob's bw experiments, Dennis's Mozilla video, etc etc...) - Relay community drive/mgmt (and related LTS herding) catalyst: week of 09/16 (2019-W38) (planned): - reviews - coordinate sponsor31 documentation work - respond to C style thread - respond to review guidelines thread - review gitlab migration plans - #30984 week of 09/16 (2019-W38) (actual): - reviews - provided input to grant writing stuff - caught up on review guidelines thread - updated some CI failure notes week of 09/23 (2019-W39) (planned): - reviews - provide feedback about C style - more feedback to review guidelines thread as needed - more feedback re gitlab migration as needed - check in with swati on Summer of Docs project - #30984 asn: Week of 16/09 (planned): - Get close to finalizing #31648. This involves cross-testing the Python implementation of the HSv3 hashring with the little-t-tor one. - Maybe start working on HSv3 public key blinding using the hazmat crypto library in stem. Week of 16/09 (actual): - Pretty much done with #31648. I have unittest vectors ready for little-t-tor, and I cross-test my Python implementation with them. Only finishing touches need to be done (a few bugfixes, code docs, etc.). - Start looking at HSv3 public key blinding for onionbalance. This seems harder than anticipated due to the hazard crypto lib not exposing the necessary primitives, but I need to look deeper into this and possible solutions. - Figured out a more precise (personal) roadmap for onionbalance and related s27 work. - Lots of reviews and merges. - Talked with atagar about progress in #31369 and #31823. Week of 23/09 (planned): - Figure out how to do key blinding in onionbalance. - Forward progress in #31369 now that atagar has given me feedback ahf: Week of 16th of September (planned): - Follow up on "Good PR" discussion on network-team@ and turn it into a proposal - Keep the discussions on GL migration active and hopefully continue to make progress. - Finish #5304 - Figure out my task plan for the rest of the year'ish for tickets. Week of 16th of September (actually): - Been trying to come up with a solution to the anonymous users/moderation issue with Gitlab migration. - Came up with a solution to #31810 that I think wont need any spec changes and should solve it. - We had a very produtive Gitlab migration meeting where we identified some new ways of doing ticket migration that might be smarter for us. - Rebased changes from #28930 to head, started refactoring some of the common code that Tim had found. - Continuing to wrap my head around the new role and zoom out a bit of my former role. Week of 23rd of September (planned): - Do first round of 1:1:1 with Gaba and other people on the team. - Work on #31810 - Continue to work on #28930 - Friday is Gitlab day where I will continue with the migration project. dgoulet: - on vacation Week of 02/09 (actual): - Most of my time has been on #30200 parent tasks working on building and running an onion service health tool (#28841). - From the above, several tickets have been opened, see the child tickets of #30200. - I've mostly worked on the service side health. I've moved now on writing the tool analysis part for the client side. - One ticket I opened which was needed for my development branch in #30200 that affects the wider tor (and found a bug): #31608. It is good that we are all awayre of this imo. Week of 09/09 (planned): - Continue making sure #31549 is on track and doesn't stall. - Help write blog post about the above ^ in order to be as loud as we can about this big change in the network. - Continue on #30200 to dig into client side behavior (s27 stuff). swati (Updated on September 16) What I did last week: - Spent time learning how to use Asciidoc. - Set up the Atom Editor by installing plugins to be used for editing/writing Asciidoc documents. - Sent my questions regarding cloning/forking and the process followed. Gaba and Taylor answered my queries. - Forked and cloned the repo: https://github.com/torproject/tor/ - Saved a local copy of Tor Manual (doc/tor.1.txt) on my machine. - Added a Table of Contents and regrouped topics to create a better flow and structure. What I plan to do this week: - Continue working on the tasks planned for month 1 (https://developers.google.com/season-of-docs/docs/participants/project-tor) - Create a pull request and request the network team to review the first set of changes. Help with: - Might have questions about the categorization of configuration options and might need info about config files. - Need to get an account to use Trac (https://trac.torproject.org/) for creating tickets for pull requests. (gaba looking at it) All the best, Alex. -- Alexander Færøy

1 0