- tor-project - lists.torproject.org

Tor Browser team meeting notes, 8 April
by Georg Koppen 08 Apr '19

08 Apr '19

Hi everyone! Our weekly meeting just finished. The log can be found at http://meetbot.debian.net/tor-meeting2/2019/tor-meeting2.2019-04-08-17.31.l… and the entries from our pad are in full copy below: Discussion: -8.5a11? (GeKo: we aim for this week) -next meeting? (GeKo: next week won't work well for a bunch of us and the Monday thereafter is public holiday in some countries, so we aim for 4/23 same time, same place) - #29837 Include Tor Browser data from Google Play (GeKo: We'll think about that after we are done with TB 8.5) tjr (may miss) - Did a bunch of letterboxing work, and think I have an idea of what sets of window sizes we should pursue. - Will present it at the monthly meeting tomorrow, but have written up my notes and they are in that minutes doc - Sent an email link to it last week; ask me on irc (or gk, or Richard) for it. GeKo: Last week: - worked on localization tickets for mobile: #30016 and #30069 - tried to come up with a good theory about why our previous attempts on addressing the accessibility bug on Windows (#27503) failed - reviews: #22538 (acat's first bug!1!), #29768 (started reviewing #29328; sysrqb: if you have any ideas about my last comment, please add them) - wrote smaller patches: README update for x86 android target (#29980), no need for libgtk2.0 headers for WebRTC build (#30038) - i dug down the media container rabbit hole for #29859 and am sufficiently sure our workaround does not make matters worse - looked over tjr's proposals and added them to the tor-browser-spec repo - followed up on the potential proxy bypass outlined in #29916 but did not get a reply yet - sponsor27 prep - begin of the month team admin updates - review help with my tickets (thanks mcs and brade for already picking up some tickets) (GeKo: That got sorted out, boklm is picking up #30016 and sysrqb #28622, #29843, #29859, and that's it for now) This week: - finish #30069 and more work on removing no longer necessary Orfox patches - more tbb-8.5(-must) work and help where needed - hopefully substantial reviews for #28329 and #27609 (and friends) so that we can start building 8.5a11 - release prep and building 8.5a11 sisbell: Last week: - Investigated tor loading issue with latest version of loader from tor-android-binary. On some devices tor isn’t being found (OS5/note3, OS7/motog6). Working on Samsung s10 and emulator. - Opened and fixed 6 new issues on TOPL project. Mostly dealt with making TOPL more configurable (needed to customize tor installation) - Significantly improved startup time of Tor/TOPL by reimplementing startup. - tor-android-service: Created custom installer based on what I learned in investigating loading issues. By following library naming conventions, we can force installing of tor/PT libraries. - worked on integrating changes into tor-browser-build. Cleaned up build by using ndk filters in gradle, rather than adding/removing libraries with zip utility. This Week: - Get latest code building/working in Firefox project. - Check in code that is in sync from March 16th. Then update to latest tor-browser-build master. boklm: Last week: - Some reviews (#29980, #29966, #30038) - Made patch for #30039 (Add the target_append and target_prepend input_files options in rbm) - Started a patch for #29981 (Add option to build without using containers), and tried to get matching android builds with and without containers. It seems possible if we solve the stalling jarsigner issue. - Went to IFF This week: - Finish fixing #27137 and disable all currently failing tests - Make some patch for #26907 (Guard against failures during MAR file generation) - Work on #30089 (Use apksigner instead of jarsigner) and #29981 (Add option to build without using containers) - Help building 8.5a11 - Review #30016 (Include onboarding/start-up translations in localized builds) sysrqb: Last week: Worked on crash-fix for Kitkat (#29906) Worked on crash-fix when selecting the bootstrap settings button (#29982) Worked more on TBA bootstrap UI (#28329) - Waiting on update from animation designer Worked on fastlane integration (#26844) Responded to comments on F-Droid package submission (#27539) This week: More of the above release prep(?) Review TOPL+orbotservice branches Review #28622, #29843, #29859 (maybe #30069) mcs and brade: Last week: - Made progress on #29768 (Introduce new features to users in Tor Browser). - Worked on travel plans for the Stockholm meeting. This week: - Monitor #29768 (Introduce new features to users in Tor Browser). - Help with code reviews for tbb-8.5-must tickets. - #29045 (ask tor to leave dormant mode) - Start on #30000 (Integrating client-side authorization to onion services v3) - Tor employee/team feedback process. - We will be out of the office April 17-22 (taking some time off around Easter). pili: Last week: - At IFF - S27 ticket organisation This week: - Start putting together Google Season of Docs application - S27 Planning meeting - S27 Preliminary roadmap - Tor Browser release meeting this week pospeselr: Last week: - #27503 (windows screen reader investigation) - Nextcloud prep - travel planning This week: - #27503 acat: Last week: - Setting up stuff, paperwork, travel planning - #22538 This week: - #24622 antonela: Last week: - IFF - Reviewed #29768 This week: - Firefox Monthly meeting - I'll demo the new security settings, pospeselr could you catch any technical question could raise there? (GeKo: We'll have this covered either pospeselr or I, no worries :) ) - OTF Onions, setting up ux work - #28329 Georg

1 0

Network team meeting notes, 8 April 2019
by Nick Mathewson 08 Apr '19

08 Apr '19

Here are our logs: http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-04-08-17.00.html Below are our notes: = Network team meeting pad! = This week's team meeting is at Monday 8 April at 1700 UTC on #tor-meeting on OFTC. Welcome to our meeting! First meeting each month: Tuesday at 2300 UTC Other meetings each month: Mondays at 1700 UTC until 3 November 2019, when daylight saving time changes On #tor-meeting on OFTC. April schedule: * Tuesday 2 April at 2300 UTC * Monday 8 April at 1700 UTC * Monday 15 April at 1700 UTC * Tuesday 23 April at 1700 UTC (Monday 22 April is the Easter Monday public holiday) * Monday 29 April at 1700 UTC * teor will probably be on leave at the end of April May schedule: * Tuesday 7 May at 2300 UTC <-- teor may not be in this meeting. let's check with them if it makes sense to have it on Tuesday (This channel is logged while meetings are in progress.) (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! After each week's meetings, the contents of this pad will be sent to tor-project @ lists.torproject.org. After that is done, the pad can be used for the next week. == Previous notes == (Search the list archive for older notes.) 5 Mar: https://lists.torproject.org/pipermail/tor-project/2019-March/002244.html 11 Mar: https://lists.torproject.org/pipermail/tor-project/2019-March/002252.html 18 Mar: https://lists.torproject.org/pipermail/tor-project/2019-March/002263.html 25 Mar: https://lists.torproject.org/pipermail/tor-project/2019-April/002280.html == Stuff to do every week = * How are we managing CI failures from last week? See https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CIFailu… * Let's check the 0.4.0 release status page. See https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… (This page automatically shows the latest trac ticket status.) * Let's check and update the roadmap. What's done, and what's coming up? We're using a kanban board: https://storm.torproject.org/shared/_mx8PMGOHFBOximocl1gy3COvhLPr6k3Ja7JA1v… <-- filter by your name and check the 'in progress' column is correct. * Check reviewer assignments! How reviews from last week worked? Any blocker? Here are the needs-review tickets, by reviewer: https://trac.torproject.org/projects/tor/query?status=needs_review&reviewer… Here are the outstanding reviews, oldest first, including sbws https://trac.torproject.org/projects/tor/query?status=needs_review&componen… * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… Any blocker from last week? == Reminders == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next releases. * Remember to fill up the 'actual point' field when you close a ticket. We need those to calculate velocity. * Check other's people call for help in their entries. ------------------------------- ---- 8th April 2019 ------------------------------- == Announcements == - The master branch is now 0.4.1.x; 0.4.0 development will continue in maint-0.4.0. - US DST began a few weeks ago; let's be careful with schedules Then we need to prioritize 0.4.0 fixes and reviews in March and April, because stable is due on 15 April. - Anti-censorship team is up: Gaba moved s19 stuff into anti-censorship team own roadmap. That teams meets every Thursday. - Onion Services proposal tickets will go into roadmap possible this week (right now they are in the board in its own column). == Discussion == - Should we remove dgoulet from the April rotations? Yes == Recommended links == == Updates == NOTE NEW FORMAT! Name: Week of XYZ (planned): - What you planned for last week. Week of XYZ (actual): - What you did last week. Week of ABC (planned): - What you're planning to do this week. Help with: - Something you may need help with. PLEASE DO NOT BULK-DELETE THE OLD ENTRIES! Leave the "Planned" parts! Leave the parts for last week and this week! gaba: Last Week of 04/01 (actual): - process mails - tor scaling follow up - s27 roadmapping (onion services) - compile overall understand on plans/brainstorming/future-roadmap for the team (for grant strategy meeting next week) - capacity and cloning asn - send own travel expenses request for july meeting - move s19 tickets out of network team roadmap - talked with people about the bug This Week of 03/08 (planned): - capacity for s27 and timeline on the project - move s27 tickets into roadmap - grant strategy with grants team includes priorities for funding for network team teor: (offline except for the first meeting each month) Week of 1 Apr (planned): High-Priority: - Do wiki trac query status pages for each network team role - Backport merge fixes needed for CI with Chutney/Tor to Tor 0.2.9 - Do mainline merges and backport merges - 040 bugfix reviews - Hack out quick fixes to #29500 and #29437 Roadmap: - CI with Chutney/Tor: #29729 - Review nickm's parts of the CI with Chutney/Tor tickets: #29280 - Other roadmap reviews Other: - Assigned reviews - Do remaining reviews from last week - Add a travis test for stem (it's a copy of the chutney test, but using the stem command) Week of 1 Apr (actual): High-Priority: - Backport merge fixes needed for CI with Chutney/Tor to Tor 0.2.9 - Do mainline merges and backport merges - Did a CI failures status page: https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CIFailu… Roadmap: - CI with Chutney/Tor: #29729 and children - Other roadmap reviews Other: - Assigned reviews Week of 8 Apr (planned): High-Priority: - Do mainline merges and backport merges Roadmap: - CI with Chutney/Tor: #29729 and children - Other roadmap reviews Other: - Assigned reviews Notes: I won't be doing reviews or merges until Wednesday or Thursday, so I can get some roadmap coding done +1 Help with: Nick: Week of 1 April (planned): - Try to fix remaining 040-must issue: - Reopened Can't parse networkstatus consensus time (#28614) - 040 release? - Lots of review and merge - Control.c refactoring: try to better unify command-parsing logic - Prepare for presentation at Tufts on Saturday - Write a couple of users for publish/subscribe logic - Time permitting, adl/rup revisions Week of 1 April (actual): - Worked on and came to resolution or diagnostics for 040-must issues: - Reopened Can't parse networkstatus consensus time (#28614) - 29437 -- test-stem timeout. (This was HARD) - Lots of review and merge - control.c refactoring: unified command-parsing logic. perhaps eventually useful for config and state and parsecommon too? - Presented on Tufts about a student paper; helped clarify thoughts - PETS review Week of 8 April (planned): - PETS discussion - Finish control.c command-parsing refactoring - Finalize draft abbrevs list. - More review and merge - 040 release - Write a couple of users for publish/subscribe logic. - CI failure tickets: #29645 test.exe hangs on Appveyor CI #29922 util/time test failure on Jenkins - I would like to to take time off between 17 and 19 April. 22 April (monday) is a state holiday for me. Is that okay with everybody? +1000 dgoulet (missing meeting): - AFK. Mike: Week of 4/1 (planned) - Scalability planning & discussion - Plan lots of travel - Finalize plan for keeping circuits open (#28780) - #29034 patch - Catch up on code reviews Week of 4/1 (actual): - Lots of Tor scalability discussion & thought - Continued testing vanguard fixes - #29500 and #29900 rabbithole and discussion - DMV bureaucracy+life issues Week of 4/8 (planned): - Scalability planning & discussion - Plan lots of travel - Vanguards release - Finalize plan for keeping circuits open (#28780) - #29034 patch - Catch up on code reviews catalyst: week of 04/01 (2019-W14) (planned): - bug triage rotation - reviews - clean up pubsub rework of bootstrap reporting - look into control.c protocol and events refactoring - travel planning/req week of 04/01 (2019-W14) (actual): - bug triage - reviews - submitted travel request - preliminary control.c protocol formatting splitting (#30007) - a little more bootpubsub work week of 04/08 (2019-W15) (planned): - reviews - finish up control.c protocol splitting (#30007) - get bootpubsub ready to review (#29976) asn: Week of 04/03 (planned): - Continue work on #28634. Still some rough edges to iron out, so that we reach something mergeable. In particular, I need to finish the bandwidth overhead analysis. - Start working on April roadmap items. Is it S31 or S27? Week of 04/03 (actual): - Did some more of #28634. Finished the bandwidth overhead analysis and did a bit more testing. Ticket is still in needs_review. - Started work on #29209 s31 deliverable. We decided with Nick we are first gonna try to hide crypt_path_t. It's hard work to hide any parts of that structure but I started with crypt_path_t->crypto. I think I will have something reviewable in a day or two. - Did some digging in the hackerone tickets with the help of Nick. Waiting for OTF email to proceed. - Did reviews and merges. Week of 04/08 (planned): - Will focus on the #29209 s31 deliverable this week. I hope to have it done by the end of the week, so that I can focus on s27 for the rest of the month. ahf (offline): Week of 4/3 (planned) Anti-censorship team: - Intro meeting for phw with cohosh and gaba. - Get #29206 and #29207 design finished. Already six points above target for those. - Implement #29736 in Broker and (Go) Proxy code. Network team: - Solve 040-must ticket: #29930 Week of 4/3 (actually) Anti-censorship team: - Continued work on #29736. Network team: - Small reviews. - Reproduced #29930 and think we know *why* it is happening. Misc: - Ready for our Sweden trip: travel approval and booked transport. - Configured a relay with some patches from asn to test. - 1:1 with Gaba: Now that phw have started I will return to network-team full-time 1st of May. - Some Harvest issue that got solved by gaba and sue. Week of 4/8 (planned) Anti-censorship team: - Continue with #29736. Network team: - Solve 040-must #29930 (figure out why the file is still open). Misc: - Figure out PETS logistics. - I will probably be away some of Wednesday.

1 0

Tor Browser Release Meeting: Wednesday 10th April @ 1800UTC
by Pili Guerra 08 Apr '19

08 Apr '19

Hi everyone, Here’s the usual reminder of our fortnightly Tor Browser release meeting and the details: Wednesday 10th April @ 1800UTC at #tor-meeting. Please note the updated UTC time now that Europe has changed to summer time. Thanks! Pili — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

1 0

S27: Onion Services project - Meeting notes
by Pili Guerra 05 Apr '19

05 Apr '19

Hi everyone, We had a meeting this week to start mapping out our work for the S27 (Onion Services) project. Here's a recap and the outcomes and action items from our conversation. Network team - Will start working on Objective 2, Activity 2: Notify users about typo errors when entering .onion addresses (https://trac.torproject.org/projects/tor/ticket/30022) to solve any potential browser team dependencies in this area. - asn to contact Bill (EFF) and Jenn (Securedrop) to start coordinating work on Objective 2, Activity 5: POC for Human-memorable addresses for .onion services (https://trac.torproject.org/projects/tor/ticket/30029) and start planning future collaboration/work in this area - Next priority after this will be Objective 2, Activity 4: Better client-side errors (https://trac.torproject.org/projects/tor/ticket/30025) Browser Team - Will start working on Objective 2, Activity 1: Integrating client-side authorization to onion services v3 (https://trac.torproject.org/projects/tor/ticket/30000) as soon as the work on TBB 8.5 blockers is completed - We will also need to contact CF and/or FB regarding their use of alt-svc to check whether there are any bugs that need fixing to provide an optimal experience. Feel free to update any incorrect details and/or continue this conversation here. You can find the full conversation logs here: http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-04-02-15.01.log… Thanks! Pili — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

1 1

March 2019 report and April 2019 plans for the metrics team
by Karsten Loesing 05 Apr '19

05 Apr '19

Hello Tor, hello world! Below you'll find the highlights of Tor metrics team work done in March 2019 as well as a few expected highlights for the current month, April 2019. On behalf of the Tor metrics team, Karsten March 2019: Attempted to upgrade TorDNSEL [1] from GHC 7.6 to 8.0 in order to migrate this service from Debian Jessie to Stretch. This attempt is currently stalled due to difficulties with replacing the deprecated and removed Data.HashTable with the hashtables package. If you're a Haskell developer willing to help us with this, please let us know! [1] https://gitweb.torproject.org/tordnsel.git/ Published a technical report on Tor Metrics Data Collection, Aggregation, and Presentation [2] which concludes our work for Sponsor 13 [3]. [2] https://research.torproject.org/techreports/metrics-evaluation-2019-03-25.p… [3] https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor13 Discussed an extended data format for exit lists [4]. [4] https://trac.torproject.org/projects/tor/ticket/29624 Deployed changes to the daily updater for Tor Metrics visualizations which run as a Java-only process now rather than separate Java/Python/R processes executed by Ant [5]. [5] https://trac.torproject.org/projects/tor/ticket/29166 Presented Tor Metrics at the Scottish Networking Event [6]. [6] http://scone.cs.st-andrews.ac.uk/wiki/ Attended IETF 104 [7] and presented an Internet Draft on Guidelines for Performing Safe Measurement on the Internet [8]. [7] https://www.ietf.org/how/meetings/104/ [8] https://datatracker.ietf.org/doc/draft-learmonth-pearg-safe-internet-measur… April 2019: Either upgrade TorDNSEL enough to run on Debian Stretch, or write a replacement in Python. If both plans fail, possible alternatives range from accepting ownership of the Stretch VM to accepting that Tor's exit list scanner gets shut down without replacement. Continue analysis and visualization of worst-case performance and failure cases as measured by OnionPerf [9, 10, 11, 12, 13]. [9] https://bugs.torproject.org/29743 [10] https://bugs.torproject.org/29744 [11] https://bugs.torproject.org/29772 [12] https://bugs.torproject.org/29773 [13] https://bugs.torproject.org/29787 Next metrics team meeting times (with short-term changes announced on the metrics-team@ mailing list): * Thursday, 11th April 2019 15:00 UTC * Thursday, 18th April 2019 15:00 UTC * Thursday, 25th April 2019 15:00 UTC

1 0

Notes from April 4 2019 Vegas team meeting
by Karsten Loesing 05 Apr '19

05 Apr '19

Notes for April 4 2019 meeting: Gaba: 1) network team: 1.1) Updated roadmaps with s27 (onion services) and s19 stuff. And reorganize some people's allocation of time. 2) anti-censorship team: 2.1) Onboarding for Philip this week with Alex and Cecylia 2.2) New roadmap for anti-censorship team. 3) metrics: 3.1) Sent last report for s13 (data collection improvements) to OTF 4) ooni: 4.1) Almost the whole team is at IFF. 5) other: 5.1) Follow on scalability drafts from Mike. [GeKo: Where are those drafts? Is it possible to have a look at them? Gaba: Mike will send them to the mailing list soon GeKo: Ah, okay. Looking much forward to that, thanks.] 5.2) Sent request for approval and booked flight to STO. Mike: 1) Working on scalability strategy mail for tor-scaling 2) Working on vanguards bugs 3) Still dealing with misc bureaucratic issues due to stolen wallet Sarah: 1) Had technical difficulties with Monero wallet that are now resolved and have raised ~$4K from that cryptocurrency so far. 2) Prepping for grants meeting next Monday to plot out next few months and combine work into bigger projects. 3) Sending our first Sponsors Newsletter to grant officers so that they can better understand the bigger picture. 4) Al submitted a proposal to the Indela Fund for LFI. 5) Various administrative tasks to complete state registrations. Georg: 1) Busy with 8.5 stabilization Erin: 1) Started this week: phw and new browser dev, acat 2) Moving forward with OONI dev recruiting next week (after IFF) 3) General HR stuff Nick: 1) Got to finish reviews, and get ready for a Tufts "Student Symposium in Cybersecurity Policy" tomorrow and maybe staying for Saturday. 2) network team is quite overloaded with 040, CI, tech debt, code review, and funded stuff. Please don't divert network team personnel without careful consideration. When one team member is diverted, their distraction increases the workload and pressure on everybody else. Alison: 1) Super busy with LFI 2) Most of the team is at IFF 3) Thinking about new funding ideas for LFP 4) Gave some talks last week -- Western Colorado University and Temple Law 5) Prepping for RightsCon 6) Have not had any time to work on feedback yet but hoping to get to it soon Steph: 1) We were accepted as a vendor at def con. Coordinating us having a badge with the help of Anto, ahf, and a volunteer we met last year 2) Preparing for onion services campaign 3) Coordinating talk for swiss unis 4) Reviewed copy for new tb features Pili: 1) At IFF 2) Spoke to EFF, Guardian Project and Tails about Google Season of Docs and we'll move forward with a joint submission 3) S27 bug triage and initial roadmapping 4) Booked dev meeting travel 5) Website triage 6) Getting lots of nice feedback and comments from people at IFF isabela: 1) Had the board meeting last friday 2) reviewed sponsor8 final report (submitted) 3) reviewed Indela proposal (submitted) 4) reviewing another general grant proposal and final report for metrics 5) met w/ sue and jon to sync on dev meeting prep work Karsten: 1) Miscellaneous tiny things, including planning travels, writing feedback, commenting on various tickets, responding to volunteers, and so on. Sue: 1) Short Period 990 sent to Board for Review 2) Sida Attestation Audit Report sent to Board for Review 3) Uploaded Audit report to Federal Clearning House 4) General Accounting processes (invoicing, disbursements, reconciliations)

1 0

March 2019 report for the Tor Browser team
by Georg Koppen 05 Apr '19

05 Apr '19

Hello! In March the Tor Browser team made four releases, Tor Browser 8.0.7[1], 8.0.8[2], 8.5a9[3], and 8.5a10[4]. Tor Browser 8.0.7 and 8.5a9 picked up regular Firefox security bug fixes and new Tor versions (0.3.5.8 and 0.4.0.2-alpha respectively). 8.5a9 was the first alpha release featuring two out of the four major projects which I mentioned in my previous monthly report: our security slider redesign[5] and cross-compilation of 32bit Linux bundles[6]. Additionally, that alpha shipped with the new mobile bootstrap and bridge configuration screens as well as pluggable transport support. Tor Browser 8.0.8 and 8.5a10 were emergency releases picking up bug fixes found during the Pwn2Own contest.[7] During March we finished our Tor Launcher migration as well which will be available in the first alpha of the 9.0 series. Additionally, we made further progress on dropping Orbot but are not there yet, alas. That item is the last big blocker for our next alpha and the upcoming 8.5 stable release. The full list of tickets closed by the Tor Browser team in March is accessible using the `TorBrowserTeam201903` keyword in our bug tracker.[8] For April we plan to release another alpha with all the `tbb-8.5-must-alpha`[9] tickets fixed and later this month the final 8.5 release. For tickets on our radar for the stable release see the `tbb-8.5-must`[10] and `tbb-8.5`[11] keywords. Apart from releases, this month will be the first month we start with Sponsor27 work. The first item we'll work on is integrating client-side authorization support into Tor Browser, a long-requested and important feature.[12] We also plan to help with providing snowflake support for mobile Tor Browser users which is covered under our Sponsor19.[13] All tickets on our radar for this month can be seen with the `TorBrowserTeam201904` keyword in our bug tracker.[14] Georg [1] https://blog.torproject.org/new-release-tor-browser-807 [2] https://blog.torproject.org/new-release-tor-browser-85a9 [3] https://blog.torproject.org/new-release-tor-browser-808 [4] https://blog.torproject.org/new-release-tor-browser-85a10 [5] https://bugs.torproject.org/25658 [6] https://bugs.torproject.org/26323 [7] https://www.mozilla.org/en-US/security/advisories/mfsa2019-10/ [8] https://trac.torproject.org/projects/tor/query?status=closed&keywords=~TorB… [9] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… [10] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… [11] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… [12] https://bugs.torproject.org/30000 [13] https://bugs.torproject.org/28672 [14] https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~Tor…

1 0

February 2019 User Feedback Report
by wayward 03 Apr '19

03 Apr '19

Hey, team! Welcome to the February 2019 user feedback report! I hope your winter is as close to over as mine is. For more information on what users and community members were talking about this month, check out the February/March 2019 User Feedback pad [1]. TL;DR: There didn't seem to be much user feedback that we haven't seen in previous months. Users seem to be experiencing relatively few new issues with TB 8.0.6 compared to past releases. - Reddit is mostly buzzing with the same questions we usually see. I'm also seeing quite a bit of confusion from Android users who aren't sure which Android app they should use (Orfox? TBA? Orbot?). - Tor is still broken for screen readers. [2] Now, on to the feedback! Scroll further down to see a summary of Reddit posts, some points from Google Play Store reviews, a list of the most common Stack Exchange tags from the month, and a collection of some notable issues and bugs mentioned by users in January. --- Most common questions on Reddit: - Which Android/iOS app should I use? - Do I need to download both 'Orbot' and 'Tor Browser for Android' on Android? - Why can't I connect/why aren't my bridges working? --- TBA Reviews & Feedback on Google Play Store: The average review score is still at 4.2 stars. It seems like users are still unsure how and when to use bridges in TBA. We can address these questions in the future TBA manual. --- Most common stack exchange tags: tor-browser-bundle: 18 this month configuration: 16 this month relays: 8 this month tor-install: 6 this month anonymity: 5 this month connection: 5 this month --- Notable bugs, fixes, & issues mentioned by users: #27503 [2] - Disabling accessibility on Windows breaks screen readers - OPEN #29175 [3] - Tor 0.3.5.x mishandles empty socks5 auth - CLOSED #27604 [4] - Relocating the Tor Browser directory is broken with Tor Browser 8 - OPEN #27249 [5] - Tor 8.0a won't let user log in to Disqus - OPEN #27543 [6] - QR code on http://web.whatsapp.com is only shortly visible in Tor Browser 8 - CLOSED, but mentioned by a user on the blog [7] - reopen? #28802 [8] - Integrate PTs and bridge support into Tor Browser - NEEDS REVIEW --- That's it for the month of February! If you want to know more, please do check out the February/March 2019 User Feedback pad [1] or reach out to me via email (waywardwyrd at riseup dot net) or IRC (wayward). Thanks for reading! I'll see you all back here next month! - wayward ------ Annotations: 1. https://storm.torproject.org/shared/x1INkZCd4pYQHZ_Y3Vr9_lQxjMj5FjsZ9754h1N… 2. https://trac.torproject.org/projects/tor/ticket/27503 3. https://trac.torproject.org/projects/tor/ticket/29175 4. https://trac.torproject.org/projects/tor/ticket/27604 5. https://trac.torproject.org/projects/tor/ticket/27249 6. https://trac.torproject.org/projects/tor/ticket/27543 7. https://blog.torproject.org/comment/280063#comment-280063 8. https://trac.torproject.org/projects/tor/ticket/28802

7 11

Tor Browser team meeting notes, 32 March
by Georg Koppen 01 Apr '19

01 Apr '19

Hello! Our weekly meeting just finished and here come the meeting notes, both the IRC log http://meetbot.debian.net/tor-meeting2/2019/tor-meeting2.2019-04-01-17.32.l… and the contents from our pad: Week of March 32, 2019 Discussion: -reload a page automatically once we receive a .onion alt-svc? (GeKo: sysrqb will talk more about that to Cloudflare folks and then open a ticket with the particular ask/bug) pospeselr: Last week: filed some tpo website bugs rebased patch for #29319 #27503 (windows screen-reader) work This week: #27503 reviews GeKo: Last week: - reviews for #29872, #29868, #27484, #29971, #25623, #29825, and #29950 - wrote patches for #29916 (Group policies can bypass proxy settings), #29859 (playing Twitter videos freezes browser), #29903 (no WebGL click-to-play on standard security level), #29943 (move our AB_CD locales to AB-CD), and #29973 (clean-up Torbutton patch for security settings redesign) - rebased my patch for #29307 (Debian Jessie -> Stretch for Windows) This week: - release preparations for new alpha - begin-of-the-month team updates - reviews, reviews, reviews - work on better locale support for mobile (#26782) - work on tbb-8.5* tickets as needed mcs and brade: Last week: - Reviewed patch for #29825 (Intelligently insert the Security Level button) - Finished #27484 (Onboarding: unintuitive not-navigation buttons). - Made progress on #29768 (Introduce new features to users in Tor Browser). - Attended Onion Services kickoff meeting. - Tor employee/team feedback process. This week: - More work on #29768 (Introduce new features to users in Tor Browser). boklm: Last week: - Updated patch for #25623 (Disable network during build) - Made patches for: - #29868: tor-browser-build fails in container-image-windows-i686 attempting to install package python-future - #29949: Update processes/ReleaseProcess for new website - #29971: obfs4 fails to build in nightly builds - #29950: Error when using runc dev version - Worked on #27137 (fixing the navigation-timing test) This week: - Finish fixing #27137 and disable all currently failing tests - Review patch for #29966 (Building container images fails because Wheezy moved to archive.debian.org) - Make some patch for #26907 (Guard against failures during MAR file generation) - help with release build - will spend some time at IFF sisbell: Last week: - Read TorControlPort from file: (thaliproject#92) -cleaned up the startup code that relied on reading the log streams to know when tor has started: faster/more reliable startup. Fixed issue of not running in daemon mode. - Fixed problem with control port auto setup (thaliproject#89) - Opened a couple of issue at tor-android(#13,#14) - we need a resolver to determine tor executable location prior to setup - #27609 - integrated TOPL into tor-android-service (tor-android-service#16) - uses latest api for bridge configuration - Fixed merge conflicts in tor-browser-build orbot project - Verified PT/tor placed correctly in tor-browser app - Lots of debugging as to why tor-browser does not extract tor native libs to non-writable location, This Week: - Tor Browser does not install tor native libs (but does install Firefox ones). Everything looks good inside apk packaging [Needs more investigation - limited for now] - Create a resolver and submit PR for tor-android. This should get us around the problem above for now and allows us to launch tor from native libraries in writable location. - Working browser app Summary: Integrated TOPL/tor-android-service. Need one change for latest tor-android library to integrate TOPL. Tor-browser-build working correctly. Native unpacking not working as expected. sysrqb: Last week: #29859 - Video on twitter #27539 - Move forward on deploying on F-Droid #29906 - Looking into crash on Kitkat Discussion about supporting localization (resulting in #29942 and moving us one step closer to using fastlane) Triaged some tbb-mobile tickets, tagging some with ux-team keyword #29238 - Pushed branch for preventing crash on upgrade #29955 - Opened ticket for deciding how we deprecate Orfox and migrate users This week: Push new branch for #28329 Finish some of the smaller bugs (#29238, etc) Follow up on F-Droid deployment (there are comments from F-Droid maintainers) pili: Last week: Infracon S27 Kick off S8 Final report was submitted \o/ Tor Browser Release meeting This week: IFF S27 Triage Still trying to find time to plan/run a capacity calculation meeting :( antonela: Last week: - #29768 - Introducing new features - maybe done? - Security Setting Tor Browser manual update - Done - #28622 - TBA icon - Done - Made TBA localization meeting This week: - IFF tjr - Been getting a lot of programming done on letterboxing bucet selection, but too early to show. Georg

1 0

Network team meeting notes from 25 March 2019
by teor 01 Apr '19

01 Apr '19

Hi! A reminder: The next network team meeting is at 2300 UTC on Tuesday 2 April. Daylight saving changed recently, so these meetings might be at a different local time for you. Here is our full April schedule: * Tuesday 2 April at 2300 UTC * Monday 8 April at 1700 UTC * Monday 15 April at 1700 UTC * Tuesday 23 April at 1700 UTC (Monday 22 April is the Easter Monday public holiday) * Monday 29 April at 1700 UTC Our logs are at: http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-03-25-17.00.html Our meeting notes are below: ======= This week's team meeting is at Monday 25 March at 1700 UTC on #tor-meeting on OFTC. Welcome to our meeting! First meeting each month: Tuesday at 2300 UTC Other meetings each month: Mondays at 1700 UTC until 3 November 2019, when daylight saving time changes On #tor-meeting on OFTC. March schedule: * Tuesday 5 March at 2300 UTC * Monday 11 March at 1700 UTC * Monday 18 March at 1700 UTC * Monday 25 March at 1700 UTC April schedule: * Tuesday 2 April at 2300 UTC * Monday 8 April at 1700 UTC * Monday 15 April at 1700 UTC * Tuesday 23 April at 1700 UTC (Monday 22 April is the Easter Monday public holiday) * Monday 29 April at 1700 UTC * teor will be on leave at the end of April (This channel is logged while meetings are in progress.) (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! After each week's meetings, the contents of this pad will be sent to tor-project @ lists.torproject.org. After that is done, the pad can be used for the next week. == Previous notes == (Search the list archive for older notes.) 25 Feb: https://lists.torproject.org/pipermail/tor-project/2019-March/002236.html 5 Mar: https://lists.torproject.org/pipermail/tor-project/2019-March/002244.html 11 Mar: https://lists.torproject.org/pipermail/tor-project/2019-March/002252.html 18 Mar: https://lists.torproject.org/pipermail/tor-project/2019-March/002263.html == Stuff to do every week = * Let's check the 0.4.0 release status page. See https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… (This page automatically shows the latest trac ticket status.) * Let's check and update the roadmap. What's done, and what's coming up? • We're using a kanban board: https://storm.torproject.org/shared/_mx8PMGOHFBOximocl1gy3COvhLPr6k3Ja7JA1v… <-- filter by your name and check the 'in progress' column is correct. * Check reviewer assignments! Here are the needs-review tickets, by reviewer: https://trac.torproject.org/projects/tor/query?status=needs_review&reviewer… Here are the outstanding reviews, oldest first: https://trac.torproject.org/projects/tor/query?status=needs_review&componen… Including sbws: https://trac.torproject.org/projects/tor/query?status=needs_review&componen… * Also, let's check for things we need update on our spreadsheet! Are there important documents we should link to? Things we should archive? * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… Core Tor/sbws is now part of the bug triage, CI, and reviewer assignment roles == Reminders == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next releases * Remember to fill up the 'actual point' field when you close a ticket. We need those to calculate velocity. * Add planned PTO to the calendar https://storm.torproject.org/shared/ISA5L5nH0Xu88iqSCx9ZjCXYSMKOBTdbUeWarbd… * Check other's people call for help in their entries. ------------------------------- ---- 25 March 2019 ------------------------------- == Announcements == - The master branch is now 0.4.1.x; 0.4.0 development will continue in maint-0.4.0. - US DST began a few weeks ago; let's be careful with schedules We need to prioritize sbws's reviews this month as Juga is wrapping up their work in March. Then we need to prioritize 0.4.0 fixes and reviews in March and April, because stable is due on 15 April. - Note different meeting time (Tues 2300 UTC) next week == Discussion == dgoulet is away, who can do the CI rotation this week? (nickm will pick it up) Should we remove dgoulet from the next set of rotations? There are now 7 bugs tagged 040-must, some of them are in progress. Last week, there were 13. (We started the week with 10, and discovered 3 more.) Who needs help with their 0.4.0 bug fixes? == Recommended links == On gitlab time-based releases, and why developers and users like them: https://about.gitlab.com/2015/12/07/why-we-shift-objectives-and-not-release… == Updates == NOTE NEW FORMAT! Name: Week of XYZ (planned): - What you planned for last week. Week of XYZ (actual): - What you did last week. Week of ABC (planned): - What you're planning to do this week. Help with: • - Something you may need help with. PLEASE DO NOT BULK-DELETE THE OLD ENTRIES! Leave the "Planned" parts! Leave the parts for last week and this week! gaba: • Week of 03/04 (actual): • - processes https://gitlab.com/gabelula/tor-documentation-processes • Week of 03/11 (planned): • - tor scaling meeting • - roadmap checking before leaving • - traveling on the 14th teor: (offline except for the first meeting each month) • Week of 18 Mar (planned): • Roadmap Coding (3 days per week): • - CI with Chutney/Tor: #29729, #29761 • - Backport fixes needed for CI with Chutney/Tor to Tor 0.2.9 • - Bandwidth stats for PrivCount: #29019, #17036, #29005 • - Rearrange the commits in a nice order on a bunch of new branches • Roadmap Reviews: • - Review nickm's parts of the CI with Chutney/Tor tickets • - sbws reviews • Other: • - Other assigned reviews • - Do mainline merges, and the remaining backport merges from last week • - Do remaining reviews from last week • - Leave admin • - Add a travis test for stem (it's a copy of the chutney test, but using the stem command) • Week of 18 Mar (actual): • Roadmap Coding (3 days per week): • - CI with Chutney/Tor: #22132, #28203, #29703, #29729 and children if needed • Roadmap Reviews: • - test proposed sbws design, suggest a new design, do sbws reviews, found some sbws bugs • Other: • - review and design work on prop#199 and sbws • - tried to make CI fail on undefined behaviour: #29528 and children • - review #29036, #29434, #29073, #29537, and more! • - tried to explain #29500 better • - Leave admin • - Work out how Tor's new feedback process works • - Work out the new travel rules • - review and merge mainline, torspec, and chutney; triage and merge backports • - assigned 040-must tickets to people, and created an 040 status page: • https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… • - did 040 bugfixes • Week of 25 Mar (planned): • Roadmap Coding: • - CI with Chutney/Tor: #29729, #20473 • - Backport merge fixes needed for CI with Chutney/Tor to Tor 0.2.9 • - Bandwidth stats for PrivCount: #29019, #17036, #29005 • - Rearrange the commits in a nice order on a bunch of new branches • Roadmap Reviews: • - Review nickm's parts of the CI with Chutney/Tor tickets: #29280 • - sbws reviews • Other: • - Hack out quick fixes to #29500 and #29437 • - Assigned reviews • - Do mainline merges and backport merges • - Do remaining reviews from last week • - Add a travis test for stem (it's a copy of the chutney test, but using the stem command) • Week of 25 Mar (actual): • Roadmap Coding: • - CI with Chutney/Tor: #29729 • Roadmap Reviews: • - sbws reviews, revisions, design work, and backports • Other: • - Assigned reviews • - Do lots of mainline merges and backport merges • - Do remaining reviews from last week • - Tried to get clang to actually fail on UBSan errors • - HR admin / peer feedback requests • Help with: • - I think #29528 should fail on 0.4.0 with the divide-by-zero undefined behaviour warnings. • But it passes. Does anyone know why? • teor says: we pass the right options to the compiler, but then it disables the UBSan warnings???? • Blocked: • I can't work out how to use practracker, so I can't do some merges • - #29884 Document how to edit practracker exception files • Dev work and merges are slow due to frequent CI failures: • - #29500 (circuit padding time) • #29437 (test-stem) • So I'm going to hack out quick fixes to these issues this week. • I haven't been doing 3 days of roadmap coding per week. • I will have more time after sbws and 0.4.0 bugs are over. Nick: • Week of 25 March (planned): • - 040-must items • - Time permitting, adl/rup revisions • - CI/pubsub hacking as needed • - split control.c into smaller pieces • - extra meetings • - 29223 standardized abbrevs • - Lots of review and merge. • Week of 25 March (actual): • - 040-must items: • - NSS issue #29241 -- tricky debugging, not-so-tricky fix. (It was only affected TLS1.2 + SHA384.) • - Libseccomp issue #29819 -- helped debug; it seems to be an upstream bug. • - Got pubsub branch merged • - split control.c into smaller pieces (#29894) • - Lots of extra meetings • - Lots of review and merge. • - PETS review. • - Helped review a proposal for a funder. • - Prepared for presentation on this saturday. • - Onion services kickoff meeting • - 29884, practracker enhancements • - misc coverity fixes • Week of 1 April (planned): • - Try to fix remaining 040-must issue: • - Reopened Can't parse networkstatus consensus time (#28614) • - 040 release? • - Lots of review and merge • - Control.c refactoring: try to better unify command-parsing logic • - Prepare for presentation at Tufts on Saturday • - Write a couple of users for publish/subscribe logic dgoulet (missing meeting): - AFK. Mike: Week of 3/18 (planned) - Scalability planning & discussion - Catch up with asn's wtf-pad work, finalize plan for keeping circuits open (#28780) - Taking friday off Week of 3/18 (actual): - Lots of Tor scalability discussion & thought - Continued testing vanguard fixes Week of 3/25 (planned): - Scalability planning & discussion - Client side vanguards issues - Plan lots of travel - Finalize plan for keeping circuits open (#28780) - #29034 patch - Catch up on code reviews catalyst: week of 03/18 (2019-W12) (planned): - try prototyping #28925 solution using pubsub but in a way not too difficult to back port to 0.4.0 - CI+Coverity rotation - reviews - checking for any remaining loose ends in pubsub review week of 03/18 (2019-W12) (actual): - reviews - chatted with asn and Riastradh about the prob_distr.c Coverity defects (#29805) and possible ways to resolve them - #28925 patch for 0.4.0 that wasn't too invasive (not using pubsub) - #29789 patch for practracker.py UTF-8 issues - CI+Coverity rotation -- opened tickets for a few new Coverity defects; no significant CI issues - chatted with nickm about ideas for splitting up control.c - resolved some comments on pubsub after reviewing new changes week of 03/25 (2019-W13) (planned): - reviews - work with nickm some on splitting up control.c juga: Week 18 March (planned) - Continue with Work out how sbws can report excluded relays in the bandwidth file (#28563) - Work on Ignore bandwidth file lines with "vote=0" (#29806) - Create a blog post about work done and future work (#29724) - Continue with DirAuths should expose bwauth bandwidth files (#21377) Week 18 March (actual) - Missing diagnostic keys in relay lines (#29854) - sbws should show relays for diagnostics (#29853) - Minor fixes from observed behaviour in the public network (#29891) - Include new monitoring KeyValues in the bandwidth-file-spec (#29754) - Revisions Week 24 March (plan) - Document next steps (#29723) - Create a blog post about work done and future work (#29724) - Continue with DirAuths should expose bwauth bandwidth files (#21377) - Create 1.1.0 release (and create maint branch) (#29750) - Deploy 1.1.0 in one dirauth (part of #29290) - Revisions - Possible new bugs Needs help with: - When i'll have a blog post draft, i'd like omeone in net-team to review it (probably teor, mikeperry, nickm and/or arma) - Question left in #21377 asn: Week of 03/18 (planned): - Continue work on #28634. - Do merges/reviews. - Get #28636 finalized. - Fix prob_distr coverity issues. Week of 03/18 (actual): - Worked more on #28634 (design a WTF-PAD machine) but got intercepted by various 040-related and prob-distr tickets and didn't manage to spend as much time as I wanted here. - #28636 finalized and merged! - In #29693 did analysis on the current prob distr stochastic tests and reduced their false positive rate. We have #29847 for future work here. - Fixed coverity issues on prob_distr with the help of catalyst and riastradh: #29805 - Reviewed #28652, #22029, #28983. Week of 03/25 (planned): - Started the week sick. - Hoping to have time to concentrate on #28634. My goal here is something simple, with low bandwidth overhead, that will fool the basic classifiers from the USENIX paper, as well as a basic analysis on future steps. - Do reviews/merges etc. ahf: Week of 3/18 (planned): Sponsor 19: - Second review of #29734. - Continue with #29207. Misc: - Network team bug triage. - Get Gitlab to run :-S - Talk with Erin, Cohosh, and Gaba about what we do with performance review for anti-censorship team. Week of 3/18 (actually) Sponsor 19: - Review of #29734. - Began review of #29297. - Small progress on #29207. Misc: - Got Gitlab to run on https://dip.torproject.org - next step is to get LDAP login integrated. - Think we found a solution for doing useful feedback for the anti-censorship team too! - Patches for 040-must tickets: #29691, #29136, #29874. - Try to solve the Coveralls/Cache issue on Travis in #29036. Week of 3/25 (planned) Anti-censorship team: - Catch up on S19 tickets this week and less network-team things. - Spend a day on making progress with Gitlab. - PHW starts next week(!) Network team: - Follow up on 040-must tickets that are in review. - Weekly reviews. ======= T -- teor ----------------------------------------------------------------------

1 0