- tor-project - lists.torproject.org

PSA: flood attack against OpenPGP certificates underway
by Antoine Beaupré 30 Jul '19

30 Jul '19

Hi, Since the Tor project uses OpenPGP and GnuPG extensively in its operations, I figured it was important to let the community know of an ongoing attack against the keyserver infrastructure and GnuPG. The longer story is available on dkg's blog here: https://dkg.fifthhorseman.net/blog/openpgp-certificate-flooding.html ... but a summary is that at least two prominent OpenPGP users have seen their public key flooded with thousands of signatures, to the point where their keys are now completely unusable. I recommend you consider taking the following immediate actions, either: 1. in the short term, disable automated key refreshes on your keyring (either through Parcimonie or manual scripts calling `gpg --refresh` in some other way), or; 2. switch to the new keys.openpgp.org keyserver, by setting the following in your `gpg.conf`: keyserver hkps://keys.openpgp.org/ The first action should only be used in the short term, to allow you to evaluate your options. It might mitigate the problem (unless you somehow allow the nasty keys to enter your keyring some other way), but it will mean you will not be aware of the precious revocation certificates users post when their key is compromised, so it's not an acceptable solution in any way. The second action has been tested as mitigating the problem, but has several downsides as well: a. it does not store UIDs unless they are verified and asked for explicitly (workaround: keys can be shipped in-band with Autocrypt or found through other mechanisms like WKD, Web Key Discovery) b. it does not store UID signatures at all, which will impact the web of trust (workaround: same as point a, and you should send signed keys by email anyways to verify ownership of the UID, using tools like caff, pius, gnome-keysign or monkeysign) c. GnuPG cannot read refresh keys from keys.openpgp.org (workaround: use the custom patch shipped in Debian experimental, see Debian bug #930665) d. it does not currently receive updates from the SKS pool (workaround: upload key updates to keys.openpgp.org directly as well as the SKS pool) Note that keys.openpgp.org has been seeded with the global SKS keyserver datastore, so it contains all the keys you would expect to be present on the latter, except they are sanitized to avoid this problem. I encourage users to: 1. upload their keys to the keys.openpgp.org keyserver 2. either switch to keys.openpgp.org by default or carefully review their key fetching configuration to make sure it is not vulnerable to this attack 3. review dkg's article and make sure your own keys are not affected by this problem If you have fetched an hostile key and GnuPG has become unusable, you can recover by deleting the key with: gpg --delete-key C4BC2DDB38CCE96485EBE9C2F20691179038E5C6 Note that this may take anywhere from 20 minutes to an hour. And then fetch dkg's key via WKD: gpg --locate-keys dkg(a)fifthhorseman.net or his website, <https://dkg.fifthhorseman.net/dkg-openpgp.key>. The other known key affected by this problem is Robert J, Hansen's key, with the fingerprint "CC11BE7CBBED77B120F37B011DCBDC01B44427C7". As far as I know, torproject.org infrastructure has not been affected in any way by this attack. We carefully monitor keys we allow in our keyring which should be sufficient to mitigate this attack. A. PS: to check if your key is affected *without* importing it into your keyring, you can use the following command: FINGERPRINT=0x8DC901CE64146C048AD50FBB792152527B75921E # for example mine KEYSERVER="http://pool.sks-keyservers.net/" URL="$KEYSERVER/pks/lookup?op=get&search=$FINGERPRINT&options=mr&fingerprint=on&exact=on" curl -sSL "$URL"| gpg --list-packets | grep -c '^:signature packet:' This counts the number of signatures on your key. A reasonable number is less or around a thousand. dkg's key has now around 55 000 signatures on his key, which (naturally) causes some trouble in all OpenPGP implementations. -- Antoine Beaupré torproject.org system administration

6 8

Tor Browser team meeting notes, 22 and 29 July 2019
by Georg Koppen 30 Jul '19

30 Jul '19

Hello! Here come the notes from our last two meetings, held on 22 and 29 July. The IRC logs can be found at: http://meetbot.debian.net/tor-meeting2/2019/tor-meeting2.2019-07-22-17.29.l… http://meetbot.debian.net/tor-meeting2/2019/tor-meeting2.2019-07-29-17.30.l… And the pad items for both meetings are: Week of July 29, 2019 Discussion - team capacity and ticket estimations - We seem to get a bunch of messages on frontdesk@ with no subject and no content other than a generic sent by mobile phone make signature. Could these be coming from TBA somehow? [sysrqb: i think no. At least I don't think we added frontdesk@ anywhere on Android][GeKo: Pili tries to investigate this issue by asking back how users got to send those messages to our system] - esr68 switch for nightlies (https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~tbb…) [GeKo: The plan is to get Linux nightlies going early next week, building support for the other platforms on top of that] pospeselr: just got back home last night and still out of it so will probably miss this meeting Last Week(s): - vacation - investigated cause of #31251 (Security Level menu hangs off of the toolbarbutton element when it should hang off of the toolbarbutton's child element with toolbarbutton-icon class) - solution here seems to be a relatively simple refactor This Week: - catch up on backlog - sync up with antonela on design for network settings in preferences (do we have a ticket # for this?) [GeKo: Yes, I just created one: #31286] - fix #31251 - review how screen reader UX is for the security level UI and files bugs if necessary Ongoing: - bug the wine devs to get our widl patches in mcs and brade: Last week: - #30429 (ESR 68 Rebase) — provided feedback on a few patches that acat rebased already. - #30429 (ESR 68 Rebase) — started rebasing updater patches. - Upgraded our primary Tor development computer from macOS 10.13.x to 10.14.x and dealt with fallout. This week/upcoming: - #30126 (Make Tor Browser on macOS compatible with Apple's notarization). - #29197 (Remove use of overlays from Tor Launcher). - #30429 (ESR 68 Rebase) — rebase updater patches. - Respond to Antonela's comments in #30237 (Onion Services client auth prompt). GeKo: Last week: - afk This week: - sending out remaining feedback summaries - dealing with backlog - helping with #30126 - review of esr68-rebased patches (#30429 and related tickets) - helping with linux toolchain patches/issues for esr68 migration (see: #30320 and #30321 + respective child tickets) - work on setting up android signing environment - help with release for Google's 64bit requirement starting on Aug 1 (see: #31260 and #31192 for discussions) sisbell: Last Week: - Created esr68 branch and merged gk branch with new toolchain code. - Fix for rust config to handle android - Fix for using tor built clang rather than ndk one - Patch for removing emulator requirement from Firefox build - Investigation of breaking issues with mozconfig This Week - Start applying previous esr60 patches to esr68 [need assets, etc] - Generate firefox gradle dependencies list pili: Last week: - S27 July report - GSoD final candidate selection - Playing around with gitlab - roadmap review This week: - S27 July report - Future funding proposal for Browser team - S27 work completion report - Figuring out browser team task distribution - Following up on fundraising banner localization - coordinating Orfox transition boklm: Last week: - afk This week: - Review gk's linux-esr68 branch, and try to make it ready to merge for nightly - Help with build for the TBA 64bit release tjr - Found a better solution for the alloc/dealloc bug, requested review https://bugzilla.mozilla.org/show_bug.cgi?id=1547519 sysrqb: Last week: Recovery from travel A little work on 68esr rebase/testing Mail/backlog/etc This week: Backport patch for supporting x86 and aarch64 architectures (31260) Investigate x86_64 support? Help investigate aarch64 crash (31140) 68esr branch testing (and rebasing onto acat's most-recent branch) acat: Last week: - Addressing review comments of rebased esr68 patches, rebasing to new gecko-dev esr68 branch. This week: - Push rebased esr68 branches. - Review/test Android ESR 68 rebased patches (#31010). - Backlog: upstreaming patches antonela: Last week: - vacations This week: - post-vacations - we ran a Tor Browser Usage survey during the dev meeting. Sharing results with lists this week. - should work on Network settings -> General settings (#29197) ----------------------------------------------------- Week of July 22, 2019 Discussion: - 9.0 Nightly blockers: https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~tbb… - Is there anything else that is missing from that list? - tjr: Building project debootstrap-image - container-image_jessie-amd64-2.tar.gz - bash: cannot set terminal process group (8): Inappropriate ioctl for device - anyone recognize this? Pili: Last Week: - reading and uploading notes from dev meeting - digitizing roadmaps - recovering from dev meeting This week: - Start looking at team capacity vs workload - Roadmap review - I need some help identifying whether some of the August items have tickets for them already: - Switch meek uTLS? - #29430 - Use uTLS for meek TLS camouflage in Tor Browser - https://trac.torproject.org/projects/tor/ticket/29430 ? -Rip out meek? - ? [from mcs: I think this is covered in #29430] - Tor button migration - #28745 - THE Torbutton clean-up - https://trac.torproject.org/projects/tor/ticket/28745 ? - Network settings in General settings - #31286 - Include bridge configuration into about:preferences - https://trac.torproject.org/projects/tor/ticket/31286 - Toolbar button for New Identity - ? [brade: #27511] - Tor Launcher for ESR68 - #29197 - remove use of overlays from Tor Launcher - https://trac.torproject.org/projects/tor/ticket/29197 ? - #30506 - Follow Firefox ESlint rules for torbutton and tor-launcher integrated code - https://trac.torproject.org/projects/tor/ticket/30506 ? tjr - Figured out at least one solution for the alloc/dealloc max https://bugzilla.mozilla.org/show_bug.cgi?id=1547519 mcs and brade: Last week: - #30126 (Make Tor Browser on macOS compatible with Apple's notarization). - We need some help from gk; see comment:11 in the ticket. - #29197 (remove use of overlays from Tor Launcher) - We hope to do this by load XUL fragments instead, but that requires some ESR68 features. - This is on hold until we make some progress on #30429. This week/upcoming: - #30429 (ESR 68 Rebase — look over a few patches that acat rebased already). - #30429 (ESR 68 Rebase — updater patches). - #29197 (Remove use of overlays from Tor Launcher). - #30126 (Make Tor Browser on macOS compatible with Apple's notarization). - Respond to Antonela's comments in #30237 (Onion Services client auth prompt). acat: Last week: - Worked on revision of #21830 upstream patch (locale detectable by button width) https://bugzilla.mozilla.org/show_bug.cgi?id=1396224 - Investigated #29563 (css line-height revisited [at least zoom and linux]) This week: - Address GeKo's comments on #30429 (desktop ESR68 rebased patches) - Review/test Android ESR 68 rebased patches (#31010). - Submit revision for https://bugzilla.mozilla.org/show_bug.cgi?id=1561322 - Try to fix #29563. - Follow up https://bugzilla.mozilla.org/show_bug.cgi?id=1433030 (Copying large text from web console leaks to /tmp) sisbell: Last Week: - #30461 - Update tor-android-service to use android toolchain (ready for review) - #30460 - Update TOPL to use android toolchain (ready for review) - #31174 - Update android toolchain (ready for review) - changes to tor-android-service (decoupled VPN module so we can exclude building, updated jSocks so we use binary rather than build) This Week - integration and testing for Firefox build Georg

1 0

Network team meeting notes, 29 July 2019
by Nick Mathewson 29 Jul '19

29 Jul '19

Hello! You can find the logs of our weekly meeting at http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-07-29-17.00.html Below you can find the contents of our pad. = Network team meeting pad! = This week's team meeting is at Monday 29 July at 1700 UTC on #tor-meeting on OFTC. We have changed the day from Tuesday to Wednesday. July schedule: * Wednesday 3 July 2300 UTC - Changed Day! * Monday 8 July at 1700 UTC * (In-person meeting 12-14 July) * Monday 22 July 1700 UTC * Monday 29 July 1700 UTC Welcome to our meeting! First meeting each month: Wednesday at 2300 UTC Other meetings each month: Mondays at 1700 UTC until 3 November 2019, when daylight saving time changes On #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! After each week's meetings, the contents of this pad will be sent to tor-project @ lists.torproject.org. After that is done, the pad can be used for the next week. == Previous notes == (Search the list archive for older notes.) 3 June: https://lists.torproject.org/pipermail/tor-project/2019-June/002343.html 10 June: https://lists.torproject.org/pipermail/tor-project/2019-June/002354.html 17 June: https://lists.torproject.org/pipermail/tor-project/2019-June/002365.html 24 June: https://lists.torproject.org/pipermail/tor-project/2019-June/002373.html 3 July: https://lists.torproject.org/pipermail/tor-project/2019-July/002389.html 8 July: https://lists.torproject.org/pipermail/tor-project/2019-July/002390.html In-person meetings: https://trac.torproject.org/projects/tor/wiki/org/meetings/2019Stockholm/No… 22 July: https://lists.torproject.org/pipermail/tor-project/2019-July/002401.html == Stuff to do every week = * Let's check the 0.4.1 release status page. See https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… (This page automatically shows the latest trac ticket status.) * Let's check and update the roadmap. What's done, and what's coming up? We're using a kanban board: https://storm.torproject.org/shared/_mx8PMGOHFBOximocl1gy3COvhLPr6k3Ja7JA1v… Click on 'all boards' and then the network team one. Filter by your name and check the 'in progress' column is correct. * Check reviewer assignments! How reviews from last week worked? Any blocker? Here are the outstanding reviews, oldest first, including sbws https://trac.torproject.org/projects/tor/query?status=needs_review&componen… Any blocker from last week? == Reminders == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next releases. * Remember to fill up the 'actual point' field when you close a ticket. We need those to calculate velocity. * Check other's people call for help in their entries. When you are overloaded, it is ok to say "no" to things. And it is ok to reschedule things. ------------------------------- ---- 22 July 2019 ------------------------------- == Announcements == reminder: catalyst will be AFK Jul 29 through Aug 18 nickm will be AFK August 12 through August 16 ahf will be AFK all of August for BornHack and CCC Camp, but will be on IRC every now and then == Discussion == - we are moving the kanban board from storm into dip.torproject.org == Recommended links == == Updates == Name: Week of XYZ (planned): - What you planned for last week. Week of XYZ (actual): - What you did last week. Week of ABC (planned): - What you're planning to do this week. Help with: - Something you may need help with. PLEASE DO NOT BULK-DELETE THE OLD ENTRIES! Leave the "Planned" parts! Leave the parts for last week and this week! gaba: Last week (actual): . vacation This week (planned): . catching up from last week . following up from tor meeting Help with: teor: (offline at the usual meeting time) Week of 8 July (actual): Urgent: - Taking time off before long-haul travel and Stockholm meeting - Travel preparation - Ticket triage - Proposal responses Backlog: - code reviews - add tor controller trace logging to diagnose stem hangs (#30901) - disown or quick fix the rest of my tickets: - I should only be owner on tickets I will work on in the next month - fix sponsor on tickets? - CI for pluggable transports (#29267) <-- this is priority over #29224 and 29227 in the roadmap --gaba - Update EndOfLifeTor.md with our latest end of life process (#30839) - document disabled CI (#30745) - triage remaining backport backlog Nick: Week of 22 July (planned): - Review and merge - Try to release 0.4.1.4-rc - Backports for 0.4.0.x? - More 29211 work (config.c): can I get all the backend code written? - Reply wrt proposal 295 - Reply wrt proposal 306 - More practracker fixes, time permitting Week of 22 July (actual): - Progress on 29211 (config.c) -- solved multiplicity issues and started on refactoring validation. - Small fundraising conversations - Review, merge, etc - Added entries for S31 to roadmapping spreadsheet - Released 0.4.1.4-rc - Fixed a bunch of surprise jenkins warnings :/ Week of 29 July (planned): - More 29211 work (config.c): validation and subsystems integration. - Revise a bunch of earlier 29211 code - Revise a bunch of earlier practracker code - More practracker work - Help with any remaining roadmapping issues - Review and merge. - Backport things to 0.4.0.x? Mike: Week of 7/22 (actual): - Recovery from stockholm + PETS - Looked at #30992 logs (circpad warn) -- still not sure how the wrong hop thing is happening.. :/ Week of 7/29 (planned): - Peer reviews - Expense reports - Try to determine severity of wtf-pad log warn bugs - Define roles for Research Director position - Try not to work more than max hours for July catalyst: week of 07/08 (2019-W28) (planned): - travel prep - Stockholm meeting week of 07/08 (2019-W28) (actual): - travel prep - Stockholm meeting week of 07/15 (2019-W29) (actual): - travel - time off to recover from travel week of 07/22 (2019-W30) (planned): - Season of Docs selection due 07/23 - expense reports - follow up from Stockholm meeting - hand off some reviews to teor - working partial days this week asn: Week of 07/01 (actual): - Pushed #26294 branch to needs_review. - Some more thoughts on the DoS thread. - Some more thoughts on scaling thread. - Lots of hackerone activity/triaging/rewarding (#31022, #31001, plus one more not yet filed) - Finished review/merge backlog. Week of 07/08 (planned): - Triaged a few wtf-pad related tickets but need more work: #30649, #31098. - Tor meeting in Stockholm. - Allhands expenses ahf Week of 22/7 (planned): - Do reimbursement - Go over all notes from Stockholm that seems relevant to me. - Follow up on pre-Stockholm items: - Continue figuring out some info on a potential Danish funder. - Continue with #5304 and #28930 Week of 22/7 (actually): - Did reimbursement - Went over all notes from Stockholm. - Followed up on pre-Stockholm items: - Continue figuring out some info on a potential Danish funder (postponed until they are back from vacation). - Continued work with #5304 and #28930 Week of 29/7 (planned): - Finish off #5304 and #28930 before going on vacation. - Review Roger's DEFCON slides. - Do you need any help from me before I leave? dgoulet: (offline) Week of 07/01 (actual): - s27 DoS work: #15516, #24963/#24964 - Tor-dev update on the DoS experimentation: https://lists.torproject.org/pipermail/tor-dev/2019-July/013923.html Week of 07/08 (planned): - Stocklholm. - Need to address urgently a series of pending bad-relays email.

1 0

Tor Browser Release Meeting this week
by Pili Guerra 29 Jul '19

29 Jul '19

Hi everyone, It’s time again for the Tor Browser release meeting: Wednesday 31st July at 18:00UTC in #tor-meeting. See you there! Thanks, Pili — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

1 0

Anti-censorship meeting notes, 25 July 2019
by Philipp Winter 25 Jul '19

25 Jul '19

Here are our meeting notes: http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-07-25-16.59.html Here is our meeting pad: ANTI-CENSORSHIP work meeting pad -------------------------------- Next meeting: Thursday July 25th 17:00 UTC Weekly meetings, every Thursday at 17:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress). == Goal of this meeting == Weekly checkin about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at Tor. == Links to Useful documents == * Our anti-censorship roadmap: https://storm.torproject.org/shared/knaG2lEzepdsCC21DYk4dD4hRtwcUGnXQvalH1s… * Our roadmap consists of a subset of trac tickets. * Note that there's a bug that causes the roadmap to load slowly. To work around it, first click on "All boards", and then on "ROADMAP Anti-censorship team" * The anti-censorship team's wiki page: https://trac.torproject.org/projects/tor/wiki/org/teams/AntiCensorshipTeam * GetTor's roadmap: https://dip.torproject.org/anti-censorship/gettor/boards * Hiro is currently experimenting with gitlab. * Tickets that need reviews: https://trac.torproject.org/projects/tor/query?status=needs_review&componen… --------------------------- ---- 25th July 2019 ---- --------------------------- == Announcements == * == Discussion == * https://dip.torproject.org/anti-censorship/state-of-censorship/blob/master/… * Snowflake servers being blocked by Safe Browsing (#31230) == Actions == * == Interesting links == * == Updates == FORMAT! Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week (related to anti-censorship work). Help with: - Something you may need help with. hiro: (gettor days are Thursday) This week: Next week: Past week: phw: This week (2019-07-25): - Deployed in-progress BridgeDB metrics patch to see if it suits our needs + Stumbled upon numerous bugs, many of which in BridgeDB - Started working on PT spec improvements + https://trac.torproject.org/projects/tor/ticket/29285#comment:5 has become canonical list of spec issues + For now, based on our 1.0 spec, and hopefully find a way to merge it with the 2.x spec + https://dip.torproject.org/phw/torspec/tree/feature/29285 (work in progress) - Will attend OTF summit in Taipei + Hopefully will push forward the "help NGO with private bridges" topic - Filed #31228 for having a single Tor instance support, say, more than one obfs4 instances - Resurrected #29480 to expose BridgeDB's assignments file again + Would allow bridge operators to see what bucket their bridge is in - Updated obfs4 setup guide with notes on how it takes a while for a bridge to see traffic Next week: Help with: - Help me improve https://dip.torproject.org/anti-censorship/state-of-censorship/blob/master/… Gaba: (updated ) Last week (): This week (): * ahf Last week: - Worked on #28930 This week: - Finished refactoring parts of #28930. Trying to figure out if we should begin the discussion on how PT's can report back on bootstrap info. - Continued to work on a tool to convert Trac tickets into Gitlab tickets. cecylia (cohosh): last updated 2019-07-25 Last week: - More PETS and travelling and recovering from travel - worked on #31100 - review of #27385 This week: - snowflake dogfood - check in on pion proxy, and work on windows build (#28942 and #28942) - sequencing layer for snowflake (#29206) - prepare for CitizenLab Summer Institute Help with: - review of #31100 catalyst: week of 07/11 (actual): - Stockholm meeting week of 07/18 (actual): - recovering from travel week of 07/25 (planned): - recovering from travel - mostly sponsor31 - preparing for extended leave starting 07/29 arlolra: 2019-07-25 Last week: - just some patch reviews (#31126, #31203) Next week: - revisions to #30310 - start looking at the suggestions in #31109 - add a build step / documentation for code reuse in cupcake - review of #31170 Help with: - review of #27385 dcf: 2019-07-25 Last week (since 2019-06-27): - merged a compatibility fix for the Snowflake websocket server (#30998) - closed a packaging issue in go-webrtc (not our bug, https://github.com/keroserene/go-webrtc/issues/89 ) - made a Firefox account for Snowflake add-on (#30931) - reviewed port of proxy-go to pion (#28942) - reviewed draft of Snowflake session layer (#29206) - published sanitized pre-sanitization Snowflake broker logs (#30731) - reviewed proxy-go test code (#30867) - reviewed the CoffeeScript removal patch (#30933) - fixed bugs in query string parsing in Snowflake proxy, thanks arlolra for review (#31126) - started dealing with Snowflake infrastructure domains being blocked by Safe Browsing (#31230, #31231, #31100) - Tor meeting, attended these anti-censorship sessions: - https://trac.torproject.org/projects/tor/wiki/org/meetings/2019Stockholm/No… - https://trac.torproject.org/projects/tor/wiki/org/meetings/2019Stockholm/No… - https://trac.torproject.org/projects/tor/wiki/org/meetings/2019Stockholm/No… - https://trac.torproject.org/projects/tor/wiki/org/meetings/2019Stockholm/No… - https://trac.torproject.org/projects/tor/wiki/org/meetings/2019Stockholm/No… - mostly implemented a dark mode in the Snowflake addon (#31170) - posted/archived stuff related to the Kazakhstan HTTPS MITM - looked into the status of IPv6 for the Snowflake broker (#31203) - fixed bugs in Parse.byteCount in the Snowflake addon, thanks arlolra for review (#31203) - reviewed a Snowflake proxy localization patch (#30310) - reviewed a draft of the Emma lightweight censorship analyzer (#30794) - Metrics Timeline maintenance Next week: - mostly offline, however hopefully experimenting with QUIC AMP etc. - review #31100 Help with: - looks like dark mode will require icons that work on both light and dark (#31170)

1 0

Tails report for June 2019
by sajolida 24 Jul '19

24 Jul '19

https://tails.boum.org/news/report_2019_06/ Releases ======== * Tails 3.14.1 was released on June 20 (emergency release) to fix a critical security vulnerability in the JavaScript engine of *Firefox* and *Tor Browser*. https://tails.boum.org/news/version_3.14.1/ * Tails 3.14.2 was released on June 20 (emergency release). to fix a critical vulnerability in *Tor Browser*, a *sandbox escape* that we couldn't fix in time for 3.14.1. https://tails.boum.org/news/version_3.14.2/ * Tails 3.16 is scheduled for September 3. Code ==== - We published a new version of the verification extension with a non- minified Forge library, as per an updated Mozilla policy. (#16686) Documentation and website ========================= - We tested all our documentation against the beta version of Tails 4.0, based on Debian 10 (Buster) and started fixing it. Infrastructure ============== - Our web translation platform reached an important milestone: translations done there will now automatically appear on the Tails website within hours. Expect a more detailed announcement and documentation for translators soon! :) https://translate.tails.boum.org/ - As part of our ongoing effort to migrate to better maintained Puppet modules, we ported our infrastructure to puppetlabs-apt. (#15510) - We programmed an automated reminder to send our Code of Conduct to all our public mailing lists every 3 months. Funding ======= - We applied to the Mozilla Open Source Support to work on: - Improve Upgrades (#8415 and #15281) - Support Secure Boot (#6560) - Migrate to GitLab (#15878) https://www.mozilla.org/en-US/moss/ - We applied to the ISC Project to: - Explain better what Tails is (#9814) https://www.iscproject.org/technology-grants - We improved the visibility of the "*Other ways to donate*" on our donation page. (#16170) Outreach ======== Past events ----------- - Estrella Soria gave a workshop about Tails from a cyberfeminist perspective on June 18 in the Virgen de los Deseos social center in La Paz, Bolivia. https://twitter.com/tecnochamana/status/1141018007281573889 - Another Tails workshop was held in Guadalajara, Mexico on June 29, as part of the 'Cuidarnos en red(es)' day of Digital self-defense at Huizache: https://mastodon.social/@noticiasdeabajo/102279012433478653 Translations ============ ## All the website - fr: 90% (5054) strings translated - es: 52% (2911) strings translated - de: 41% (2303) strings translated - it: 35% (1961) strings translated - fa: 32% (1806) strings translated - pt: 26% (1464) strings translated Total original words: 58995 ## Core pages of the website https://tails.boum.org/contribute/l10n_tricks/core_po_files.txt - fr: 97% (1736) strings translated - es: 79% (1420) strings translated - de: 68% (1228) strings translated - it: 65% (1161) strings translated - pt: 46% (820) strings translated - fa: 35% (626) strings translated Total original words: 16629 Metrics ======= * Tails has been started more than 751 230 times this month. This makes 25 041 boots a day on average. * 8018 downloads of the OpenPGP signature of a Tails USB image or ISO from our website. -- sajolida

1 0

S27: Onion Services meeting this week: Tuesday 23rd July @ 15UTC
by Pili Guerra 23 Jul '19

23 Jul '19

Hi everyone, This is a reminder of the next Onion Services meeting happening this week on Tuesday 23rd July at 15UTC on #tor-meeting. We hope to see you there. Thanks! Pili — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

1 1

Network team meeting notes, 22 July 2019
by Nick Mathewson 22 Jul '19

22 Jul '19

Hi! The IRC logs from our weekly meeting are available at http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-07-22-16.59.html Below are the contents of our pad. = Network team meeting pad! = This week's team meeting is at Monday 22 July at 1700 UTC on #tor-meeting on OFTC. We have changed the day from Tuesday to Wednesday. July schedule: * Wednesday 3 July 2300 UTC - Changed Day! * Monday 8 July at 1700 UTC * (In-person meeting 12-14 July) * Monday 22 July 1700 UTC * Monday 29 July 1700 UTC Welcome to our meeting! First meeting each month: Wednesday at 2300 UTC Other meetings each month: Mondays at 1700 UTC until 3 November 2019, when daylight saving time changes On #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! After each week's meetings, the contents of this pad will be sent to tor-project @ lists.torproject.org. After that is done, the pad can be used for the next week. == Previous notes == (Search the list archive for older notes.) 3 June: https://lists.torproject.org/pipermail/tor-project/2019-June/002343.html 10 June: https://lists.torproject.org/pipermail/tor-project/2019-June/002354.html 17 June: https://lists.torproject.org/pipermail/tor-project/2019-June/002365.html 24 June: https://lists.torproject.org/pipermail/tor-project/2019-June/002373.html 3 July: https://lists.torproject.org/pipermail/tor-project/2019-July/002389.html 8 July: https://lists.torproject.org/pipermail/tor-project/2019-July/002390.html In-person meetings: https://trac.torproject.org/projects/tor/wiki/org/meetings/2019Stockholm/No… == Stuff to do every week = * Let's check the 0.4.1 release status page. See https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… (This page automatically shows the latest trac ticket status.) * Let's check and update the roadmap. What's done, and what's coming up? We're using a kanban board: https://storm.torproject.org/shared/_mx8PMGOHFBOximocl1gy3COvhLPr6k3Ja7JA1v… Click on 'all boards' and then the network team one. Filter by your name and check the 'in progress' column is correct. * Check reviewer assignments! How reviews from last week worked? Any blocker? Here are the outstanding reviews, oldest first, including sbws https://trac.torproject.org/projects/tor/query?status=needs_review&componen… Any blocker from last week? == Reminders == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next releases. * Remember to fill up the 'actual point' field when you close a ticket. We need those to calculate velocity. * Check other's people call for help in their entries. When you are overloaded, it is ok to say "no" to things. And it is ok to reschedule things. ------------------------------- ---- 22 July 2019 ------------------------------- == Announcements == reminder: catalyst will be AFK Jul 29 through Aug 18 nickm will be AFK August 12 through August 16 ahf will be AFK all of August for BornHack and CCC Camp, but will be on IRC every now and then == Discussion == Rotation updates: See https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… CI/coverity catalyst -> catalyst & teor coverity the defect browser was down last week; it seems to be back now (Waiting on update after merging coverity fixes: Coverity does not seem to have noticed 30150 yet.) Looking at coverity -- it seems our builds may have been stuck. I've cancelled the stuck builds. Also, they say they are going to have a planned outage to upgrade their backend, starting today and lasting about 3-4 days. Friday would be a good day to have another look. -nm stuff got unstuck on 28 Jun or maybe earlier? -catalyst Correct; we've been getting updates since then. I opened tickets for the first day's updates; there are more I hope to get to soon. jenkins some intermittent failures that could be network-related Travis teor did some work on stem failures, we need to add a control message trace to tor to diagnose (#30901) waiting for catalyst's advice, because they are refactoring this code Appveyor Bug triage ahf -> asn Things are looking OK asfaik. catalyst asks if we want to re-evaluate https://trac.torproject.org/projects/tor/ticket/31081 or stay with "make the spec match the code" Please give feedback on proposal 306: IPv6 "Happy Eyeballs" for Tor clients https://lists.torproject.org/pipermail/tor-dev/2019-June/013907.html == Recommended links == == Updates == Name: Week of XYZ (planned): - What you planned for last week. Week of XYZ (actual): - What you did last week. Week of ABC (planned): - What you're planning to do this week. Help with: - Something you may need help with. PLEASE DO NOT BULK-DELETE THE OLD ENTRIES! Leave the "Planned" parts! Leave the parts for last week and this week! gaba: Last week (actual): This week (planned): . tor meetup Help with: teor: (offline at the usual meeting time) Week of 8 July (actual): Urgent: - Taking time off before long-haul travel and Stockholm meeting - Travel preparation - Ticket triage - Proposal responses Backlog: - code reviews - add tor controller trace logging to diagnose stem hangs (#30901) - disown or quick fix the rest of my tickets: - I should only be owner on tickets I will work on in the next month - fix sponsor on tickets? - CI for pluggable transports (#29267) <-- this is priority over #29224 and 29227 in the roadmap --gaba - Update EndOfLifeTor.md with our latest end of life process (#30839) - document disabled CI (#30745) - triage remaining backport backlog Nick: Week of 15 July (actual): - Attend PETS reception - Take it easy post-meeting - Travel home - More work on refactorings for 29211 (config.c redesign) - Several practracker improvements - Catch up on email and expenses Week of 22 July (planned): - Review and merge - Try to release 0.4.1.4-rc - Backports for 0.4.0.x? - More 29211 work (config.c): can I get all the backend code written? - Reply wrt proposal 295 - Reply wrt proposal 306 - More practracker fixes, time permitting Mike (afk: jetlagged and recovering from 12 days travel+work) catalyst: week of 07/08 (2019-W28) (planned): - travel prep - Stockholm meeting week of 07/08 (2019-W28) (actual): - travel prep - Stockholm meeting week of 07/15 (2019-W29) (actual): - travel - time off to recover from travel week of 07/22 (2019-W30) (planned): - Season of Docs selection due 07/23 - expense reports - follow up from Stockholm meeting - hand off some reviews to teor - working partial days this week asn: Week of 07/01 (actual): - Pushed #26294 branch to needs_review. - Some more thoughts on the DoS thread. - Some more thoughts on scaling thread. - Lots of hackerone activity/triaging/rewarding (#31022, #31001, plus one more not yet filed) - Finished review/merge backlog. Week of 07/08 (planned): - Triaged a few wtf-pad related tickets but need more work: #30649, #31098. - Tor meeting in Stockholm. - Allhands expenses ahf Last N-weeks: - Send vacation info to the network team ML. - Traveled to Stockholm, had a good time with you all. Week of 22/7: - Do reimbursement - Go over all notes from Stockholm that seems relevant to me. - Follow up on pre-Stockholm items: - Continue figuring out some info on a potential Danish funder. - Continue with #5304 and #28930 dgoulet: (offline) Week of 07/01 (actual): - s27 DoS work: #15516, #24963/#24964 - Tor-dev update on the DoS experimentation: https://lists.torproject.org/pipermail/tor-dev/2019-July/013923.html Week of 07/08 (planned): - Stocklholm. - Need to address urgently a series of pending bad-relays email.

1 0

June 2019 report for the Tor Browser team
by Georg Koppen 19 Jul '19

19 Jul '19

Hello! In June we released 5 Tor Browser releases: 8.5.1[1], 9.0a2[2], 8.5.2[3], 8.5.3[4], and 9.0a3[5]. The last three were due to two chemspill releases Mozilla managed to do while they had their All Hands meeting in Whistler (Canada) and a group of Tor people attended as well, to discuss both further uplift + fingerprinting work and performance + scalability improvements. Tor Browser 8.5.1 was the first bugfix release in the 8.5 series which fixed minor shortcomings in 8.5 and defended against the readPixel() fingerprining vector[6]. Tor Browser 9.0a2 contained all the fixes that went into 8.5.1 and additionally bumped several components in our bundle (Tor on desktop to 0.4.1.2-alpha, OpenSSL on desktop to 1.1.1c) and in our toolchain and compilation environments (GCC to 8.3.0 for Linux, Debian Stretch for macOS cross-compilation), in preparation for the upcoming 9.0 release. Non-release related work mostly comprised progress on our work on onion service authentication support. First testing bundles are available.[7] Moreover, we rebased most of our patches for ESR 68 and they got a first round of review[8], and our toolchains for Linux[9] and macOS[10] are mostly ready. We made considerable progress on integrating Snowflake for Android into our reproducible build system[11], although we are still a bit away from getting this shipped to users as some glue code is so far missing.[12] Another highlight that month was our fixed accessibility support for Windows users, which Richard achieved after weeks of hard work (thanks!). It is included in the first alpha for July, 9.0a4. The full list of tickets closed by the Tor Browser team in June is accessible using the `TorBrowserTeam201906` keyword in our bug tracker.[13] For July, we attended the Tor dev meeting in Stockholm to think about upcoming work in the next month but, above all, to better coordinate all the ESR transition work under way. The whole team is currently working to get first nightly builds out[14] which are based on Firefox 68 ESR, which essentially means toolchain updates and patch rebase and review. We hope we'll have the latter finished by end of July so that we can ship the first nightly builds based on Firefox 68 ESR in early August. As usual it will probbably be Linux bunldes first with the other platforms being added as soon as the toolchains are in reasonable shape. So, stay tuned! All tickets on our radar for this month can be seen with the `TorBrowserTeam201907` keyword in our bug tracker.[15] Georg [1] https://blog.torproject.org/new-release-tor-browser-851 [2] https://blog.torproject.org/new-release-tor-browser-90a2 [3] https://blog.torproject.org/new-release-tor-browser-852 [4] https://blog.torproject.org/new-release-tor-browser-853 [5] https://blog.torproject.org/new-release-tor-browser-90a3 [6] https://trac.torproject.org/projects/tor/ticket/30541 [7] https://trac.torproject.org/projects/tor/ticket/30237#comment:19 [8] https://trac.torproject.org/projects/tor/ticket/30429 [9] https://trac.torproject.org/projects/tor/ticket/30321 [10] https://trac.torproject.org/projects/tor/ticket/30323 [11] https://trac.torproject.org/projects/tor/ticket/28672 [12] https://trac.torproject.org/projects/tor/ticket/30318 [13] https://trac.torproject.org/projects/tor/query?status=closed&keywords=~TorB… [14] Nightly blockers are tagged with `tbb-9.0-must-nightly` in our bug tracker: https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~tbb… [15] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig…

1 0

Anti-censorship meeting notes, 18 July 2019
by Philipp Winter 18 Jul '19

18 Jul '19

Here are our meeting logs: http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-07-18-17.00.html And here is our meeting pad: ANTI-CENSORSHIP work meeting pad -------------------------------- Next meeting: Thursday July 18th 17:00 UTC Weekly meetings, every Thursday at 17:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress). == Goal of this meeting == Weekly checkin about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at Tor. == Links to Useful documents == * Our anti-censorship roadmap: https://storm.torproject.org/shared/knaG2lEzepdsCC21DYk4dD4hRtwcUGnXQvalH1s… * Our roadmap consists of a subset of trac tickets. * Note that there's a bug that causes the roadmap to load slowly. To work around it, first click on "All boards", and then on "ROADMAP Anti-censorship team" * The anti-censorship team's wiki page: https://trac.torproject.org/projects/tor/wiki/org/teams/AntiCensorshipTeam * GetTor's roadmap: https://dip.torproject.org/anti-censorship/gettor/boards * Hiro is currently experimenting with gitlab. * Tickets that need reviews: https://trac.torproject.org/projects/tor/query?status=needs_review&componen… --------------------------- ---- 18th July 2019 ---- --------------------------- == Announcements == * Added Stockholm meeting notes to: https://trac.torproject.org/projects/tor/wiki/org/teams/AntiCensorshipTeam#… == Discussion == * https://dip.torproject.org/anti-censorship/state-of-censorship/blob/master/… * Is this a good start? == Actions == * == Interesting links == * https://www.swadeshimedia.in/spring-epfl-lightnion/ == Updates == FORMAT! Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week (related to anti-censorship work). Help with: - Something you may need help with. hiro: (gettor days are Thursday) This week: Next week: Past week: phw: This week (2019-07-18): * Working with obfs4 bridge operators who couldn't get their bridge to run. * Filed OONI ticket to have OONI measure reachability of STUN servers. * Started working on a repository that keeps track of what's necessary to connect to Tor in censoring countries. * https://trac.torproject.org/projects/tor/ticket/28531 * Filed a ticket to get a new default obfs4 bridge running. * https://trac.torproject.org/projects/tor/ticket/31164 * Filed a ticket to have www services of anti-censorship team monitored. * https://trac.torproject.org/projects/tor/ticket/31159 * Wrapped up creation of docker image. * https://trac.torproject.org/projects/tor/ticket/30708 * Filed ticket for an easy-to-use bridge setup meta package in Debian. * https://trac.torproject.org/projects/tor/ticket/31153 * Read Matic et al.'s NDSS'17 paper and sent summary to anti-censorship-team@. * https://lists.torproject.org/pipermail/anti-censorship-team/2019-July/00002… * Moved forward with understanding the "long tail" of network traffic (required for Sponsor 28). * Attended Tor dev meeting in Stockholm. * Sponsor 30 kick-off meeting. * Had a chat with Antonela about UX challenges wrt bridges. * Had a chat with Hiro about the future of GetTor. * Had a chat with Nathan and Benjamin about ORbot and OnionBrowser. * Had a chat with Tails folks about maintenance of obfs4proxy package. * Had a chat with David about PT v2.0 and snowflake. * Attended session on anti-censorship rapid response. * Attended session on how to attract more snowflakes. * Attended session about Tor's upcoming dev portal. * Roadmapping. Next week: Help with: Gaba: (updated ) Last week (): This week (): * ahf Last week: - Worked on #28930 This week: - Finished refactoring parts of #28930. Trying to figure out if we should begin the discussion on how PT's can report back on bootstrap info. - Continued to work on a tool to convert Trac tickets into Gitlab tickets. cecylia (cohosh): last updated 2019-07-18 (will try to attend but still at PETS) Last week: - Tor Meeting and PETS - deployed a proxy-go instance that uses pion/webrtc library (#28942) - updated snowflake bridge survival guide instructions for new proxy-go instances - starting sorting out webextension infinite loop bug (#31100) This week: - Still at PETS and then travelling/recovering from travel - finish up addressing issues with #31100 - more dogfood catalyst: week of 06/13 (planned): - mostly focusing on sponsor31 week of 06/13 (actual): - cleaned up (and relinquished) more of my owned tickets - mostly sponsor31 stuff (control.c refactoring) week of 06/20 (planned): - mostly sponsor31 week of 06/20 (actual): - mostly sponsor31 - helped ahf with some bootstrap stuff week of 06/27 (planned): - mostly sponsor31 arlolra: 2019-06-27 Last week: - a bit of snowflake webextension This week: - getting the webextension published (#30931) Next week: - review #30934 Help with: - fixing our websocket server implementation (#30998)

1 0