- tor-project - lists.torproject.org

Tor Browser team meeting notes 29 April 2019
by Georg Koppen 30 Apr '19

30 Apr '19

Hello! Below come the notes from our weekly meeting which we had yesterday at 1730 UTC. The IRC log can be found at: http://meetbot.debian.net/tor-meeting2/2019/tor-meeting2.2019-04-29-17.31.l… and the items from our pad are Discussion: - Tor Browser team meeting slots for the dev meeting? (GeKo: I'll ask for five, 2 roadmapping, 1 retrospective, 1 Tor Browser vision, 1 team capacity) - migration to esr68 (GeKo: we started to think about it; will nail down more detailed plan with action items either next week or the week thereafter) sisbell: Last Week: - #30280 - Wrong SHA-256 - due to use of jcenter which can proxy different artifact repositories. Removed jcenter from dependencies (ready for review). Also removed use of jcenter from TOPL(#109)/android-tor-service(#23) projects (GeKo: are we good with that bug or is there something left that needs to get fixed before review)(sisbell: it's ready for review, no more work) - #30162 - Bootstrap process stuck - implemented fix that takes ownership of tor process so that tor will shut itself down when the control connection dies (TOPL#59). Also implemented a fix for reusing an open tor control connection (TOPL#111). - #30166 - Custom bridges. The content of the textfield for user-defined bridges is overloaded (it acts a filter for pre-defined bridges OR it contains bridge information directly). Introduced fixes to make this work with TOPL(#115) + tor-android-service(#26). - Verified #30162 and #30166 work against an Orbot build. - Self-feedback This week: - Add #30162 and #30166 fixes into tor-android-build. Test and fix any issues. mcs and brade: Last week: - #30000 (Integrating client-side authorization to onion services v3). - experimented with HTTP CONNECT for the browser/tor connection. This week: - #30000 (Integrating client-side authorization to onion services v3). - Finalize travel plans for the Stockholm meeting. - Out of the office Thursday May 2 and Friday May 3. GeKo: Last week: - work in localization/branding land (wrote patches for #30136 and #30069), helped with special characters in Android strings issue (#30054) - reviews (#29981, #30086, #30115, #28369, #30166) - dealing with bug bounty issues - looked into snowflake for android over the weekend (#28672) but that's more involved than a (couple of) weekend activity(-ies), thus 301 -> boklm This week: - getting back to tjr's letterboxing email - preparing 8.5 (GeKo: We still stick to the idea of building 8.5 this week) - more work on tbb-8.5-must/tbb-8.5 items - reviews - start begin-of-the-month admin work acat: Last week: - Revised patch for 30115: NoScript's XSS popup breaks circuit display in some cases - Looked into 26605: investigate window.requestIdleCallback() for possible timing leaks - Looked into 26607: verify that subpixel accuracy of window scroll properties does not add fingerprinting risk - Looked into 30304: Browser locale can be obtained via DTD strings [tjr: what did you find?] acat: Well, it leaks browser locale, yes (I understand there's currently no other known way to get browser locale from website) The suggested approach in https://bugzilla.mozilla.org/show_bug.cgi?id=467035, creating hidden iframe loading the xml and reading localized text works in Tor Browser. The simple fix suggested in bugzilla (reverting https://hg.mozilla.org/mozilla-central/rev/7ace0805c2d3) breaks about:tor, the DTD for localization cannot be read which makes sense, since the reason of that patch is to unbreak addons (legacy, I assume) it would work fine if about:tor was privileged (no URI_SAFE_FOR_UNTRUSTED_CONTENT), but I think we don't want that so I'm still investigating/understanding the relevant code and trying to find the best way of not breaking it I also want to test it in Android, because I suspect the code for handling some about:* pages is not the same there (mobile/android/components/AboutRedirector.js) This week: - Finish 30304 and 26607. - Backlog: 26599, 26602, 26601, https://bugzilla.mozilla.org/show_bug.cgi?id=1461454. boklm: Last week: - Updated patch for #29981 (Add option to build without using containers) - started testing patches for #30325 (Remove bison from the list of default packages on android and osx builds) and #30326 (Remove yasm from the list of dependencies for the firefox android build) - started disabling failing testsuite tests - sent (late) self-feedback This week: - finish disabling all failing testsuite tests - start looking at #28672 (Android reproducible build of Snowflake) - review #29307 (Use Debian Stretch for cross-compiling our Windows builds) and #29319 (Remove FTE support in Windows bundles) - help with 8.5 build/release - afk (holidays) on Wednesday and Thursday tjr - Started/tried backporting letterboxing to 60. Ran into a complex refactor I need to work around, sent an email no response - Someone also filed https://bugzilla.mozilla.org/show_bug.cgi?id=1546832 which is a bit of a problem. I'm not sure if it should block bringing it to TB Nightly. (GeKo: I don't think so) - Started working on mingw build stuff again. - Getting tests running on Try: finding lots of crashes.Indicative of real issues that could crash? Don't know!! antonela: Last week: - #27399, #29955, in progress - #30000, in progress This week: - #27399, #29955, in progress - #30000, in progress https://trac.torproject.org/projects/tor/ticket/30237#comment:1 pili: Last week: - All teams project planning - Submitted google season of docs application This week: - S27 - first report - work estimation and planning - start thinking about dev meeting sessions pospeselr: Last week: - Worked on wine bug #47035 for tor #27503 - got most of the way through this, should have a patch ready for review tomorrowish This week: - See if swapping in pre-built MIDL Accessibility2 related bits fixes our issues here - continued work on widl patches Georg

1 0

Network team meeting notes 23 April 2019
by Nick Mathewson 28 Apr '19

28 Apr '19

Hi! Our meeting transcript is at http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-04-23-23.01.html = Network team meeting pad! = This week's team meeting is at Tuesday 23 April at 2300 UTC on #tor-meeting on OFTC. April schedule: * Tuesday 23 April at 2300 UTC (Monday 22 April is the Easter Monday public holiday) * Monday 29 April at 1700 UTC May schedule: * Monday 6 May at 1700 UTC * Monday 13 May at 1700 UTC * Monday 20 May at 1700 UTC * Monday 27 May at 1700 UTC June schedule: * Tuesday 4 June at 2300 UTC * Monday 10 June at 1700 UTC Welcome to our meeting! First meeting each month: Tuesday at 2300 UTC Other meetings each month: Mondays at 1700 UTC until 3 November 2019, when daylight saving time changes On #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! After each week's meetings, the contents of this pad will be sent to tor-project @ lists.torproject.org. After that is done, the pad can be used for the next week. == Previous notes == (Search the list archive for older notes.) 25 Mar: https://lists.torproject.org/pipermail/tor-project/2019-April/002280.html 2 Apr: http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-04-02-23.00.html (we forgot to post the notes) 8 Apr: https://lists.torproject.org/pipermail/tor-project/2019-April/002289.html 15 Apr: https://lists.torproject.org/pipermail/tor-project/2019-April/002296.html == Stuff to do every week = * How are we managing CI failures from last week? See https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CIFailu… * Let's check the 0.4.0 release status page. See https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… (This page automatically shows the latest trac ticket status.) * Let's check and update the roadmap. What's done, and what's coming up? We're using a kanban board: https://storm.torproject.org/shared/_mx8PMGOHFBOximocl1gy3COvhLPr6k3Ja7JA1v… Filter by your name and check the 'in progress' column is correct. * Check reviewer assignments! How reviews from last week worked? Any blocker? Here are the outstanding reviews, oldest first, including sbws https://trac.torproject.org/projects/tor/query?status=needs_review&componen… * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… . * See discussion notes below. Any blocker from last week? == Reminders == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next releases. * Remember to fill up the 'actual point' field when you close a ticket. We need those to calculate velocity. * Check other's people call for help in their entries. * Remember to book travel for meeting as soon as possible. The rate lock deadline is 10 May, please ask for approval a few days before 10 May. ------------------------------- ---- 23rd April 2019 ------------------------------- == Announcements == - The master branch is now 0.4.1.x; 0.4.0 development will continue in maint-0.4.0. We need to prioritize 0.4.0 fixes and reviews in April, because stable was due on 15 April. == Discussion == Rotation updates: Bug triage - mikeperry to nick The Bug Triage role description and queries is on the wiki at: https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… Lessons I learned and unanswered questions during bug triage: WTF is this page? Can I kill it: - https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TicketT… teor says: this page describes how we triage tickets at the start or end of a release. We should update it and maybe rename it. WTF do we do about people using trac-as-support support? I guess - https://trac.torproject.org/projects/tor/ticket/30192#comment:2 Seems about right to me. Can I make binding decisions about what to do about components? Does the next triage ruler get to overturn? ;) - https://trac.torproject.org/projects/tor/ticket/30250#comment:1 IMO killing components isn't part of ticket triage. Looked at Core/Tor tickets opened in last 9 days (since I did this Easter Monday Eve) - Added points to a couple of my tickets that were created in this window. - Everything else created recently had points, but many older than 9 days did not. CI - teor to ahf https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CIFailu… I revised #30001, and it is merge_ready for 0.4.0 and later. This CI ticket was a process failure: it stalled in needs_revision for 2 weeks. How can we improve this process? We are making progress on the stem hangs in #29437. Here are the open tickets: #30235 Tor hangs when asked to change DisableAllSwap over the control port nickm, can you help with tor_mlockall() hangs? We keep getting practracker CI failures when we merge forward code from 0.4.0. Here are some possible fixes: #30051 - Add practracker as a pre-commit and pre-push git hook for frequent coders this ticket is in merge_ready Coverity - teor No new coverity defects this week Coverity doesn't provide instant feedback, so it's harder to discover bugs at review time. Here is a possible fix: #30225 Run clang's scan-build in Tor's CI 0.4.0 status: Mostly done or merge_ready. Should we remove the one remaining ticket from 040-must? #29930 Warning: can't unlink unverified-consensus on Windows meeting says: yes Review status: Stalled reviews - more than 1 week old - what should we do with them? catalyst: #27130 rust dependency updating instructions don't work #29732 Add full-fledged deterministic PRNG support for testing teor: #23588 Write fascist_firewall_choose_address_ls() and use it in hs_get_extend_info_from_lspecs() I will review this ticket before I go away (but after I do my feedback) mikeperry: #30109 Document that MapAddress is automatically strict, but does not handle redirects #30112 Fix outdated comments in dirserv_read_measured_bandwidths() #30147 Fix "high-impact" coverity false-positive warnings outside of tests #30148 Fix infrequent, unlikely memory leak on failure to create keys directory there is a proposal to look for funding to work on mobile onion services (from a partner that may need them) for 2020. It would be a 1 engineer for 1 year and it could include other onion services stuff. Do we look for funding for it? <--- It could be started after April 2020 if we look for funding now. --gaba There is too much information in this pad. This is a process failure. Can we split the pad up into: Everyone must do this task this week / know this thing this week / discuss this issue this week Discussion queue (topics that are important, urgent, and affect most people go at the top) Information list === teor's handover === ==== sbws ==== I am still spending a lot of time on sbws designs and design reviews: Let's use the tor proposals process for sbws: https://lists.torproject.org/pipermail/tor-dev/2019-April/013785.html Let's block all sbws merges until I get back, unless an urgent bug comes up. I don't think adding more load to the team is a good idea right now, so our best option is slowing sbws and other non-funded work. Here are the active sbws tickets: Is it acceptable that SBWS consistently reports 6200 relays, 1000 fewer than Torflow's 7200 universe? https://trac.torproject.org/projects/tor/ticket/29710 Work out why recent_measurements_excluded_few_count=733 and its children. https://trac.torproject.org/projects/tor/ticket/30227 Add additional bandwidth file headers in sbws 1.2, and children. https://trac.torproject.org/projects/tor/ticket/30255 We can make future hand overs easier by assigning two paid staff members to help out with sbws. ==== Mainline Merges ==== Now dgoulet is back, I have stopped doing mainline merges, except for urgent CI fixes: https://lists.torproject.org/pipermail/tor-dev/2019-April/013779.html ==== Backports ==== Let's block most backport merges until I come back. Who will do urgent CI backports? nickm 0.3.5 and later are affected by the stem failures, if we fix the tor_mlockall() bug, we should backport that to 0.3.5 But maybe we should test it first, so that might mean disabling stem in 0.3.5 and 0.4.0? ==== Reviews ==== Please don't put me on reviews until 27 May. (I will be dealing with backlogs when I get back.) I have un-assigned myself from all open tickets where I am the reviewer. ==== Rotations ==== See my rotation handover below. Please don't put me on rotations until 27 May. (I will be dealing with backlogs when I get back.) I can't do bug triage on 29 April, because I'll be away. We don't have rotations for May yet. ==== Roadmap ==== I don't think I will make any progress on PrivCount while I am away. Can we please assign someone else to help me with PrivCount? [Nickm wants to do privcount stuff; anybody else?] === END teor's handover === == Recommended links == "Select male faculty, they said, effectively ran the Institute and were showered with private donations, while women were forced to fire essential staff and were shut out from power." This article is an excellent analysis of the mechanics of power and discrimination: https://www.nytimes.com/2019/04/18/magazine/salk-institute-discrimination-s… On allyship in newsrooms but also in work places: https://source.opennews.org/articles/how-be-ally-newsroom/ == Updates == NOTE NEW FORMAT! Name: Week of XYZ (planned): - What you planned for last week. Week of XYZ (actual): - What you did last week. Week of ABC (planned): - What you're planning to do this week. Help with: - Something you may need help with. PLEASE DO NOT BULK-DELETE THE OLD ENTRIES! Leave the "Planned" parts! Leave the parts for last week and this week! gaba: Last week (actual): - grant strategy meeting - self-feedback - test new nextcould instance This week (planned): - moving s27 tickets into roadmap and timeline for next few months Help with: - teor: (online for 23 April, then on leave until 21 May) Week of 15 Apr (planned): Notes: - I won't be doing reviews or merges until Wednesday or Thursday, so I can get some roadmap coding done. High-Priority: - Diagnose test-stem failures in CI #29437 and children - Post 0.4.0.4-rc backport merges - Any mainline merges - Self-Feedback and maybe Team Lead Feedback Roadmap: - CI with Chutney/Tor: #29729 and children - Other roadmap reviews Other: - Assigned reviews Week of 15 Apr (actual): Notes: - I didn't do reviews or merges until Tuesday. High-Priority: - Diagnose test-stem failures in CI #29437 and children - Post 0.4.0.4-rc backport merges - Self-Feedback Roadmap: - CI with Chutney/Tor: #29729 and children - Other roadmap reviews Other: - Assigned reviews Week of 22 Apr (planned): High-Priority: - Team Lead Feedback - Peer Feedback x 3 - Timesheets for April - I noticed some things when I did feedback, I need to write emails about them Roadmap: - Other roadmap reviews Other: - Assigned reviews - Review #23588: Onion Service v3 IPv6 minimal implementation Optional: - Respond to Mike's scaling email - Update CI for stem and sbws based on chutney's CI - Turn the bug triage queries into a trac page Week of 22 Apr (actual): High-Priority: - Team Lead Feedback - Peer Feedback x 1 Roadmap: - Other roadmap reviews Other: - Rebased #23588 and made practracker happy - Added tickets to the proposal planning pad Help with: - Contact me on Signal if you need me to do anything before I go away. - When I get back, can someone else do #29024 with me? I don't know enough about snowflake. #29024 More integration tests for tor+snowflake, possible in chutney Nick: Week of 15 April (planned): - Short vacation: Today is a state holiday for me; I'll be taking off next Monday instead since that better aligns with other people's holidays. - Short vacation: I'm also taking off from Wednesday through Friday. I'll see personally addressed email and Signal; all lists will go into my "after-vacation" folder. - Review & merge, especially 26288 (authenticated sendme) and 29209 (cpath encapsulation) - Time permitting, either add a pubsub user, or work on an ADL thing. - I want to prioritize working on stuff that would block others. Week of 15 April (actual): - review & merge! - Vacation as planned. - PETS discussions - Finish and circulate list of abbreviations. - Revisions on 28223 (unparseable microdewsc diagnostics) - While on vacation, worked a bit on an experimental Rust thing to implement a trusted module to help out a sandboxed Tor. This is the only way we can realistically have a sandbox going forward. Does this fit into any sponsor? Week of 22 (planned): - Review & merge! - Look at 29136 per request from Damian - Look at 30235 per request from Teor - Pending peer review issues - BUG triage. Pick up from Mike - Revise ticket 30091 [unified parsing in control.c] per review - Revise ticket 29223 [abbreviations] per review - More refactoring on control.c, if we can land 30091. - Plan refactoring on config.c - If time permits: More pubsub users - If time permits: ADL prototype. dgoulet (missing meeting): - AFK. Mike: Week of 4/15 (planned) - Work on child tickets of #28634 - Help asn with/review #28634 machine definitions - Vanguards blog post (pending debian packages) - Book travel Week of 4/15 (actual): - Child tickets of #28634; several now in needs_review - Discussed machine definition plans with asn - Self performance review - Bug triage Week of 4/23 (planned): - Scalability planning & discussion - write wiki page of experiments; sketch out current research kanban; attend meeting - Book lots of travel (I hope ;) \o/ - Maybe work on needs_revision #28636 items (probably not) - Maybe catch up on code reviews (probably not) catalyst: week of 04/08 (2019-W15) (planned): - reviews - finish up control.c protocol splitting (#30007) - get bootpubsub ready to review (#29976) week of 04/08 (2019-W15) (actual): - reviews - travel logistics - preliminary review on control.c command parsing refactor - cleaning up #30007 (control.c protocol splitting) -- rebased on new control-cmd branch; fought with Coccinelle some more week of 04/15 (2019-W16) (planned): - reviews - travel logistics - get #30007 into a reviewable shape - coordinate with nickm on control.c stuff as needed week of 04/15 (2019-W16) (actual): - reviews - travel logistics - self-feedback - reviewed some of control-cmd stuff week of 04/22 (2019-W17) (planned): - reviews - peer feedback (2) - finish up reviewing control-cmd - clean up control-proto (need to coordinate with nickm) asn: Week of 04/08 (planned): - Will focus on the #29209 s31 deliverable this week. I hope to have it done by the end of the week, so that I can focus on s27 for the rest of the month. Week of 04/08 (actual): - Pushed #29209 to needs_review. It's basically a limited version of the actual deliverable, where we hide a part of crypt_path_t. Left general thoughts about the task in the ticket. - Worked more on #28634 after Mike's review. Needs some more work before being back in needs_review. - Reviewed #28780 as part of Sponsor2. - Did more triaging and discussion on Sponsor27 - Fixed some bugs we got from hackerone. - Did reviews/merges. Week of 04/15 (planned): - Push #28634 back to needs_review. - Start doing initial Sponsor27 work, and brief up David. - Review/test more leftover WTF-PAD stuff. - Finish up travel arrangements for Stockholm/AllHands ahf (offline): Week of 4/15 (planned) Anti-censorship team: - Talk with cohosh about #29207/#29206 - Re-read Kat's report #2 and give some feedback. Network team: - Continue with #29930, #29645, and #30187 Misc: - Easter in Denmark coming up: will likely be less online Thursday and Friday this week. Week of 4/15 (actually) Anti-censorship team: - Talked with cohosh about remaining tasks to finish for #29207/#29206. - Send feedback to Kat. Network team: - Confirmed problem for #29930, discussed possibly solutions with Nick today. - Managed to reproduce #29645 in a very flaky manner on my desktop under very heavy load, but cannot figure out what causes it. Misc: - Went to holiday house for easter. - Got hiro setup as co-admin on Gitlab. Week of 4/24 (planned): Network team: - Submit patch for #29930 to remove warning when unlink() fails. - Try to reimplement tor_cond_wait() to use a ConditionVariable for #30187 Anti-censorship team: - Walk over WebSocket patches with cohosh and see how the stats collection code fits in for #29207 (and friends) Misc: - Book train to Stockholm - CI+coverity duty: I've seen the coverity issue that showed up today. juga: Week of 04/22 (plan): - Depending on which has higher priority, work on #29710 children or #30255 children (it seems this needs more discussion and or proposals) Help with: - Question 1: teor or network-team: which on do you think has higher priority, #29710 or #30255? - Question 2: teor or network-team: longclaw's sbws 1.1.0 has been running for more than 1 week, do we want to start running sbws 1.1.0 on basted or should #29710 and/or #30255 be solved first? [Nick will try to answer these questions if teor doesn't.]

1 0

Tails report for March 2019
by sajolida 26 Apr '19

26 Apr '19

https://tails.boum.org/news/report_2019_03/ -- sajolida

1 0

Notes from April 25 2019 Vegas team meeting
by Karsten Loesing 26 Apr '19

26 Apr '19

Notes for Apr 25 2019 meeting: Alison: 1. Tor Meeting planning - How do we feel about this agenda layout (from Tails)? https://trac.torproject.org/projects/tor/wiki/org/meetings/2019Stockholm/Da… - roadmapping - plenaries - soliciting feedback from teams 2. all LFI all the time Pili: 1) Catching up from vacations 2) S27 Roadmapping 3) Submitted Google Season of Docs application \o/ 4) Getting to grips with anticensorship proposal again Steph: 1) interview in mozilla internet health report out yesterday 2) event prep and coordination: def con, NYC fundraiser, swiss uni conference 3) newsletter coming soon 4) met with BPL librarians, may collaborate with FPF on a workshop 5) helping with community portal, reviewing illos and copy 6) experimenting with google nonprofit setup 7) press inquiry from meduza Nick: 1) Back from short break; catching up with code 2) working with gaba and team to make sure we do the most valuable S19 stuff before the contract closes. Georg: 1) back from vacation and catching up on All The Things 2) 8.5a11 got out and we hope to build 8.5 next week 3) dealing with bug bounty paperwork Sarah: 1) Helping with edits to anticensorship proposal that was approved. 2) Setting up back-end process to regularly invite donors to become monthly givers. 3) Applying to King County employee giving program. 4) Creating plan to solicit funds from for-profits. 5) Met with Michael Brennan from Ford. 6) Al submitted a proposal for $100K for general operating funds to Wallace Global Foundation isabela: 1) had a great meeting with Michael Brennan from Ford - will go back there to present my vision in June 2) working on DRL anti-censorship proposal review (we had a call w/ DRL this week too) 3) working on documentation for board meeting 4) reviewed 2 grant proposals to private foundations for general ops fund and comms fund Karsten: 1) Made progress on three new graphs on user-perceived performance: worst-case bandwidth, worst-case latency, more detailed failures and timeouts. 2) Moving forward with adding bandwidth files to Tor Metrics: currently working on metrics-lib parser and CollecTor protocol change. Mike: 1) Preparing for tor-scalability meeting tomorrow. Have initial experiments page with a couple experiments ready to send around today. 2) Sponsor2 work Antonela: 1) Working on #30000 for desktop. 2) Working on #27399, #29955 for TBA release. 3) Working on OONI ux labeled tickets to release Explorer. 4) Worked on torproject.org/download related tickets. 5) Coordinated user research with Nah in Colombia. She is traveling with gus. 6) Syncing with Caroline about reporting and next travels. 7) Worked with Al reviewing O3 for DRL. 8) I'm writing 8 peer-reviews. 9) Meetings and moar meetings this week. Gaba: 1) helping with DRL anti-censorship proposal - now figuring out security code audit (to bridgedb, tor browser?) that will be needed once grant is over (GeKo: I am fine with Tor Browser getting reviewed, (of course!); I think it would be really neat to have someone looking at BridgeDB code, though. Firefox code is getting heavily scrutinized already and the browser is a pretty big project, so the return we get from the audit might be bigger with BridgeDB.) 2) following scalability conversation 3) sponsor 27 4) checking on nextcloud 5) adjusting network team roadmap with nick 6) writing 8 peer reviews. Erin: 1) general HR stuff

1 0

Anti-censorship meeting notes, 25 April 2019
by Philipp Winter 25 Apr '19

25 Apr '19

Here are our meeting logs: http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-04-25-17.01.html Here is our meeting pad: ANTI-CENSORSHIP work meeting pad -------------------------------- Next meeting: Thursday April 25th 17:00 UTC Weekly meetings every Thursday 17:00 UTC on #tor-meeting at OFTC (channel is logged while meetings are in progress). == Goal of this meeting == Weekly checkin about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at Tor. == Links to Useful documents == THE Anti-censorship Roadmap (kanban board): https://storm.torproject.org/shared/knaG2lEzepdsCC21DYk4dD4hRtwcUGnXQvalH1s… <-- a subset of tasks from trac that the team is working on. (There is a bug in wekan, what we use for the board, that make it hard to load. You have to click in 'all boards' and then in the board to get it to load) Roadmap by topic: https://storm.torproject.org/shared/KXkqlNP8ouNks_ey5khZKUSbNj9ZoidXmEp80OD… Gettor Roadmap: https://storm.torproject.org/shared/rhsSl_3Pb253HPqoCdFiAdmXQ57NUG_BLvBCxqF… Roger's thoughts on anti-censorship's priorities: https://storm.torproject.org/shared/kU83M2pQehsnQZPzR_mwmYslAijqKgYNOEak57T… Komlo's thoughts on anti-censorship's plan: https://pad.riseup.net/p/CensorshipTeam-Planning-keep PTO Calendar: Ask gaba for the link and keep it up to date with when you are not going to be around. ------------------------------ ---- 25th April 2019 ---- ------------------------------ == Announcements == * FTE is about to be retired: <https://bugs.torproject.org/29319> * We will have to discontinue its support in BridgeDB. * What else is affected? == Discussion == * Code that needs review: * gettor: * https://trac.torproject.org/projects/tor/query?status=needs_review&componen… * obfuscation: * https://trac.torproject.org/projects/tor/query?status=needs_review&componen… * The TapDance researchers are eager about the idea of making a * TapDance pluggable transport for Tor * The infrastructure is already there (deployed on routers at * Merit ISP and UColorado) * It's already been stress-tested with ~10,000 Psiphon users at * a time * The client is written in Go already and the dependencies * shouldn't cause problems * https://github.com/refraction-networking/tapdance * https://github.com/sergeyfrolov/gotapdance/ == Actions == == Updates == FORMAT! Name: Last week: - What you worked on last week. Next week: - What you are planning to work on next week (related to anti-censorship work). Help with: - Something you may need help with. phw: This week (2019-04-25): - Discussed GetTor roadmap with gaba and hiro. - Filed https://bugs.torproject.org/30247 to better understand GetTor usage. - Filed https://bugs.torproject.org/30264 to discuss how to proceed with default bridges. - We may want to add more default bridges. Some are saturated, other aren't. - Cohosh suggested to use potential new default bridges for experiments in: https://bugs.torproject.org/29279 - Started writing code for https://bugs.torproject.org/9316 to export BridgeDB metrics. https://gitweb.torproject.org/user/phw/bridgedb.git/log/?h=bug9316 - Mostly finished https://bugs.torproject.org/28655 - https://gitweb.torproject.org/user/phw/bridgedb.git/log/?h=bug28655 - Estimated how many bridges would be affected by this patch. - Sent BridgeDB logs to Karsten, so he can propose a metrics format. - Metrics team currently overloaded. This is on hold for a few weeks. - Tried to understand the NewNode protocol. - Helped with revising new anti-censorship proposal. Next week: - Will be on vacation all week. Cohosh will run the meeting on Thursday. Help with: - Feedback on https://lists.torproject.org/pipermail/tor-dev/2019-April/013786.html - Is the data collection method safe and sound? - I plan to approach the research safety board with this too. hiro: GetTor Status https://nc.riseup.net/s/na23xE4MJH2rsoD If review is ok, planning to deploy tomorrow. Gaba: Last week: * discussed gettor roadmap and include it in the anti-censorship * roadmap This week (04/25): * helping with new anti-censorship proposal for sponsor to work * on bridges (it will require a security audit for the code) ahf (might be missing the meeting as I'm at a BornHack meeting) Last week (2019/4/18): - Talked with cohosh about remaining tasks to finish for #29207/#29206. - Send feedback to Kat about report #2. - Mostly off due to Easter holiday here in DK. This week (2019/4/25): - Got Hiro setup with Gitlab too, she got the remaining LDAP sync to work. - Preparing for handover for cohosh of #29207/29206. - Less network team things this week it seems. kat5 (will miss the meeting Apr 25): Last week (April 15): - Reviews/notes - queries re: author list This week (April 22): - There is a GetTor roadmap! Yay! - Adding GetTor content from the rodamap dcf: 2019-04-25 Last week: - AMP cache prototyping - posted a patch for meek-client-torbrowser termination (#25613/#15125) - reported a bug about Tor Browser starting two copies of meek (#30249) - commented on disk space monitoring plans (#29863) - commented on BridgeDB statistics (#9316) - Metrics Timeline maintenance Next week: - merge uTLS for meek-client (#29077) - AMP cache prototyping - remove serene's accounts from snowflake commit/admin (#30138/#30142) Help with: - review on meek-client-torbrowser exit behavior (#25613/#15152, same branch) cecylia (cohosh): last updated 2019-04-25 Last week: - snowflake - got caught up by sukhe on windows snowflake build (#25483) - started looking into the firefox webrtc API - talked more about disk space monitoring (#29863) - started dogfooding - went to decoy routing meeting and talked with them about making a TapDance PT for Tor Next week: - snowflake - take a look at metrics team notes on #21315 - revise proxy geoip patch (#29734) - continue with windows build problem (#25483) - work on client connectivity issues (#30258) - continue snowflake dog food - review of #15125 and #25613 Help with: catalyst: week of 4/11 (planned): - more sponsor31 work; maybe also #29976 as prep work for more bootstrap reporting improvements week of 4/11 (actual): - handed off #29276 (Make a release of BridgeDB) to phw - more sponsor31 work (control-fmt review #30091; control-proto stuff #30007) - travel logistics week of 4/18 (planned): - mostly sponsor31 stuff week of 4/18 (actual): - reviewing #30091 (sponsor31 control-cmd refactor) week of 4/25 (planned): - more sponsor31 work - maybe get back into #29976 (hook up bootstrap to pubsub) and #27104 (intermediate application circuit bootstrap progress) arlolra: 2019-04-25 Next week: - snowflake webextension

1 0

Tor Browser team meeting notes, 23 April
by Georg Koppen 25 Apr '19

25 Apr '19

Hello! Due to Easter we had our weekly meeting on Tuesday this week (same time, same location, though). The IRC log can be found at http://meetbot.debian.net/tor-meeting2/2019/tor-meeting2.2019-04-23-17.31.l… and our pad items are pasted below: Discussion: - tbb-8.5-must tickets and 8.5 release (GeKo: We plan to get the building for 8.5 started next week) GeKo: Last week: - mostly offline, trying to do some vacation This week: - backlog processing - getting back to reviews - back to work on Tor Browser 8.5 blockers starting with missing localization for mobile (#30069) - I am still missing self-feedback from some of you (not naming names) sysrqb: Last week: - Alpha release - TOPL review (#30199, #27609) - Reviewed Google Play analytics, opened tickets for reported crashes - Opened and began investigating #30239 This week: - Finish investigating and start writing patch for #30239 - Work on animation for #28329 antonela: Last week: - Tried to be offline. This week: - #25658, what is left here? Anything needed on my side? (GeKo: I think we are good here for 8.5; we should pick up the missing site-permissons in May, I think) - #28800, still in April? - https://trac.torproject.org/projects/tor/ticket/28800 (GeKo: no, that's more for May) - #27399, #29955 could we sync on it? (GeKo: yes, let's do that in the next days) - #30000, in progress - DRL review, O3 GeKo, could we sync about this objective to be in the same page? Deadline is Friday (GeKo: sure) acat: Last week(s): - 24622: Torcrazybutton can't decipher website s3.amazonaws.com - 30115: NoScript's XSS popup breaks circuit display in some cases - 30171: Always accepting third party cookies seems to break first party isolation - 26607: verify that subpixel accuracy of window scroll properties does not add fingerprinting risk - 26608: investigate <link rel="preload">) This week: - Follow up 26607 - More fingerprinting (if there is nothing with more priority) 26599: investigate CSS masks feature for fingerprinting potential 26602: investigate whether CSS clip-path adds a fingerprinting risk 26601: investigate whether SVGGeometryElement introduces a fingerprinting vector 26605: investigate window.requestIdleCallback() for possible timing leaks [Tom] Looking at bugzilla, https://bugzilla.mozilla.org/show_bug.cgi?id=467035 and https://bugzilla.mozilla.org/show_bug.cgi?id=1461454 may be active fingerprinting vectors I'd suggest reviewing the status of (GeKo: I'll look into that and file at least tickets if needed) mcs and brade: Past two weeks: - #29768 (Introduce new features to users in Tor Browser). - #30104 (browser onboarding: 8.5 security level image includes English text). - Posted patch for #29045 (ask tor to leave dormant mode). - #30000 (Integrating client-side authorization to onion services v3). - set up and experimented with v2 and v3 onion services that have client authorization enabled. - Helped with triage of incoming tickets. - Code reviews. - Completed our self-evaluations for the Tor employee/team feedback process. - Took some time off for Easter. This week: - #30000 (Integrating client-side authorization to onion services v3) - Finalize travel plans for the Stockholm meeting. tjr - Sent mail about letterboxing - Next step: I'd like to get a Yay or Nay on the proposed solution. (It's very similar to the current rounding of 200x100) (GeKo: I look closer at it this week) Can people test in Nightly using the pref string, or should I bake the logic in there so people only have to toggle the pref on? - Then try to backport to 60 for TB Alpha testing? boklm: Past two weeks: - helped build 8.5a11, published it and followed comments on the blog - did some cleanup on dist.tpo (#30204) - some reviews - updated patch for #29981 (Add option to build without using containers) - made patch for #30089 (Use apksigner instead of jarsigner) This week: - Finish fixing #27137 and disable all currently failing tests - Make some patch for #26907 (Guard against failures during MAR file generation) - Travel plans for the Stockholm meeting pili: Last week: - vacation This week: - Submitted google season of Docs application - ideas reviews still welcome: https://trac.torproject.org/projects/tor/wiki/doc/GoogleSeasonOfDocs2019 - S27 roadmapping - Need to think about how to deal with orbot tickets (GeKo: I think we should call a meeting with n8fr8 and nail things down, finally) pospeselr: Last weeks: - #27503 investigation (widl is at least partially to blame here) - filed several bugs with wine devs with min repros demonstrating invalid tlb generation - submitted a patch for one of the issues - misc nextcloud admin'y things - reviewed the 'Decks' app This week: - working on widl patches sisbell: Last week: - #30162: Tor bootstrap process stuck. Investigated. Confirmed this is due to previous tor process running. Opened some issues in TOPL regarding fixes - #30272: Opened this issue - startup doesn’t handle loss of connection like airplane mode -#30166: Custom bridge - fixed issue - TOPL Pull request approved and merged into their master. This Week: - Fixes for #30162 - there are a few issues surrounding this to improved startup - #30168 : Cleanup tor-browser-build for TOPL fixes. Specifically fix Orbot issue #199 - Move resources from orbotservice to main app - Do self-review Georg

1 0

Tor Browser Release meeting: Today Wednesday 24th April @ 1800UTC
by Pili Guerra 24 Apr '19

24 Apr '19

Hi everyone, This is your reminder for our Tor Browser release meeting today at 1800UTC on #tor-meeting. This week we’ll be discussing the final details for the 8.5 stable release. Please join us! Thanks! Pili — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

1 0

For-profits using Tor
by Sarah Stevenson 23 Apr '19

23 Apr '19

Hello! I’m seeking some assistance in building a list of all for-profit companies that utilize Tor. Please take a look at this pad and add any you may be aware of and add your name if you have a contact at that company. https://pad.riseup.net/p/o87cPxlVMnQVog-Jz2Oh <https://pad.riseup.net/p/o87cPxlVMnQVog-Jz2Oh> Thanks in advance! Sarah Sarah Stevenson Fundraising Director The Tor Project sstevenson(a)torproject.org Public Key: 93B3 AC08 4257 FA3D D4BB 8E95 CC08 5DBA C015 612A

1 0

Notes from April 18 2019 Vegas team meeting
by Karsten Loesing 20 Apr '19

20 Apr '19

Notes for Apr 18 2019 meeting: Nick: 1) afk on a short break; back on Tuesday. Roger: 1) new plan for tor-security schleuder list? [delayed until nickm and geko are around] 2) sysadmin team, what is the 'chain of command' from vegas team to them? or maybe rather, who should be representing them here? similar question for anti-censorship team. Suggested plan is that Gaba will talk to phw, and Isa will talk to Anarcat, to help them know how they can raise issues as needed. 3) sue: did the pets invoice get paid? (yes) 4) sarah: moritz was having a heck of a time finding https://donate.torproject.org/cryptocurrency from https://donate.torproject.org/. We might want to streamline that path. [Yes, thanks for pointing that out. We are working on a better path. - Sarah] Sarah: 1) Grants team is responding to questions from DRL about approved anti-censorship project. 2) Evaluations. 3) Working on plan for inviting past donors to become monthly donors. 4) Finishing up first Sponsors Newsletter and will create a version for major donors. 5) Strategizing grant proposals for the next few months. 6) Working with Giant Rabbit on several projects to improve the donate pages. 7) Working with PayPal about suspected blocking of exit relay IP addresses. Arturo: 1) Lots of progress and work on OONI Explorer: https://github.com/ooni/explorer/projects/3 2) Almost done with setting up a system to share OONI pipeline metadb with third parties: https://github.com/ooni/sysadmin/issues/272 3) The OONI monthly report is out, check it: https://lists.torproject.org/pipermail/tor-project/2019-April/002298.html 4) Next week Maria is going to be in Nigeria presenting OONI at the Digital Rights and Inclusion Forum (DRIF): https://drif.paradigmhq.org/ Gaba: 1) grants team - strategy planning and DRL questions. 2) feedbacks 3) ooni monthly meeting 4) capacity planning and time allocation 5) google season of docs follow up while pili is on leave 6) anti-censorship: talking with kat what to do for reports (if it makes sense 3rd report or expand the 2nd) 7) sponsor 27 (onion services) planning 8) follow up on tor scalability 9) working on nextcloud to test it Steph: 1) Coordinating NYC fundraiser 2) def con arrangements 3) Have agreed to be a spokesperson available for the Internet Health Report launching next week 4) Campaigning for Ola 5) Working on internal doc and website page around dark web myths 6) meeting with Brooklyn Public Library on Monday Karsten: 1) Discussed possible visualizations of worst-case performance (#29772). 2) Worked on getting bandwidth files into Tor Metrics (#21378). Sue: 1) General accounting processes Alison: 1) 100% focused on LFI, which starts next month isabela: 1) writing self-feedback 2) organizing a batch of invites for people (at least 8 cuz we got 8 nos) on waiting list to be invited to the dev meeting 3) following developments of Ola's case and supporting whenever Tor can support 4) working on grants for general ops, reviewing letter to sponsors, helping with planing the next batch of proposals opportunities Mike: 1) Triaging/wrapping up Sponsor2 things for 041 2) Working on tor-scalability experiment list + needed metrics for April 26th meeting Erin: 1) last phase of screening for OONI dev 2) self-feedback is due tomorrow (Friday, 19-April) 3) general HR stuff

1 0

Anti-censorship meeting notes, 18 April 2019
by Philipp Winter 18 Apr '19

18 Apr '19

Here are our meeting logs: http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-04-18-20.01.html Here is our meeting pad: ANTI-CENSORSHIP work meeting pad -------------------------------- Next meeting: Thursday April 18th 20:00 UTC Weekly meetings every Thursday 20:00 UTC on #tor-meeting at OFTC (channel is logged while meetings are in progress). == Goal of this meeting == Weekly checkin about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at Tor. == Links to Useful documents == THE Anti-censorship Roadmap (kanban board): https://storm.torproject.org/shared/knaG2lEzepdsCC21DYk4dD4hRtwcUGnXQvalH1s… <-- a subset of tasks from trac that the team is working on. Roadmap by topic: https://storm.torproject.org/shared/KXkqlNP8ouNks_ey5khZKUSbNj9ZoidXmEp80OD… Gettor Roadmap: https://storm.torproject.org/shared/rhsSl_3Pb253HPqoCdFiAdmXQ57NUG_BLvBCxqF… Roger's thoughts on anti-censorship's priorities: https://storm.torproject.org/shared/kU83M2pQehsnQZPzR_mwmYslAijqKgYNOEak57T… Komlo's thoughts on anti-censorship's plan: https://pad.riseup.net/p/CensorshipTeam-Planning-keep PTO Calendar: Ask gaba for the link and keep it up to date with when you are not going to be around. ------------------------------ ---- 18th April 2019 ---- ------------------------------ == Announcements == * We now have a team wiki page: https://trac.torproject.org/projects/tor/wiki/org/teams/AntiCensorshipTeam * We now have a mailing list: https://lists.torproject.org/cgi-bin/mailman/listinfo/anti-censorship-team * We now have a sysmon deployment that monitors anti-censorship infrastructure * Thanks to gman999! * Monitors BridgeDB, snowflake machines, GetTor, default Tor Browser bridges. * cohosh and phw are getting alerts over email. * Anyting else that you want monitored? == Discussion == * What GetTor-related material should we include in Sponsor 19 & in anti-censorship team roadmap? * hiro wants to be the new mantainer of GetTor. * Do we have a backup maintainer? * For the roadmap, the update from hiro has a list ( https://nc.riseup.net/s/na23xE4MJH2rsoD ) of what could be included: * automation * monitoring * deploy new code * Report Writing * report 1: status of anti-censorship at Tor * report 2: plans for anti-censorship at Tor <-- final report * anything else? * Let's start the meeting sooner to make it easier for non-NA participants? * moving it to 1700 UTC * Retire default bridges that went offline? * Metrics team want us to be careful (while we still do not have a guide but soon we will) on data collection. Let's check with them once there is a review #21315 * dcf: purging unsanitized Snowflake logs - see https://bugs.torproject.org/30125#comment:7 * #30125 will sanitize the snowflake logs. I'd like us to commit to a deadline for doing something with the old pre-sanitization logs, or else deleting them. * What specific statistics or visualizations do you want from the old logs? We can make sure to retain the information to make those possible, before deleting the originals. * Lets review roadmap briefly. Is there anything that you are working on that is not in the in-progress column? https://storm.torproject.org/shared/knaG2lEzepdsCC21DYk4dD4hRtwcUGnXQvalH1s… * Code reviews assignment? == Actions == == Updates == FORMAT! Name: Last week: - What you worked on last week. Next week: - What you are planning to work on next week (related to anti-censorship work). Help with: - Something you may need help with. phw: This week (2019-04-18): - Created team wiki page and had mailing list created -> sign up! - Lots of work on #28655. Looks good! Need better unit tests. - Worked with gman999 on infrastructure monitoring. Also looking good! - Had a chat with dgoulet and sysrqb about BridgeDB specifics. - Chat with hellais about updated version of "vanilla tor" test. Next week: Help with: - Feedback on https://trac.torproject.org/projects/tor/ticket/9316#comment:16 - Let me know if you want any machines or services monitored! - hiro: Can you help us with #30152? Yes I can help with this. Anarcat has been setting up a different prometheus instance to monitor services. This could be part of that effort. --hiro hiro: GetTor Status https://nc.riseup.net/s/na23xE4MJH2rsoD Gaba: This week (04/15): * checking on gettor ahf (gonna be missing at the meeting, but will read backlog): Last week (2019/4/4): - Meeting with gaba, cohosh, & phw Monday - Went over roadmap items in new roadmap docs. - Lots of tiny network team tasks. - Continued work on #t/#29206. This week (2019/4/11): - Mostly network-team tasks so far. Was off Wednesday. - Gitlab/LDAP access have been established. - Continue to hack on #29736 (and transition it off to cohosh too) - Gaba and I talked at our 1:1 Friday that I'll return to network team tasks only in May. kat5: Last week (April 8): - Started GetTor content - Copy editing - Conditionalized URLs - Figured out what's left This week (April 15): - Reviews/notes - queries re: author list Help with: - What else we want to report on (continuing discussion w/ gaba and phw from email) dcf: 2019-04-18 Last week: - reviewed Snowflake broker robots.txt patch (#29565) - reviewed further Snowflake log sanitization (#30125) - reviewed Snowflake broker proxy geoip patch (#29734) - helped debug a Snowflake broker outage (#30205) - AMP cache prototyping - worked on improving meek-client-torbrowser termination (#25613) Next week: - have meek-client-torbrowser signal exit by closing child process stdin (#25613) - AMP cache prototyping - comment on #29863 Help with: cecylia (cohosh): last updated 2019-04-18 Last week: (was out a bit due to flooding and then course-related things) - snowflake - merged and deployed #30125 (log sanitization) - became familiar with the rbm tor browser build system - closed #29565 (robots.txt) - dealt with #30205 (problem with log rotation during #30125 deployment) - community stuff - had a call with CGIProxy Next week: - snowflake - take a look at metrics team notes on #21315 - revise proxy geoip patch (#29734) - take a look at windows reproducible build problem (#25483) - work on client connectivity issues (#25429) - snowflake dog food Help with: - are we at an ok place to deploy what we have set up for #29863? catalyst: week of 4/11 (planned): - more sponsor31 work; maybe also #29976 as prep work for more bootstrap reporting improvements week of 4/11 (actual): - handed off #29276 (Make a release of BridgeDB) to phw - more sponsor31 work (control-fmt review #30091; control-proto stuff #30007) - travel logistics week of 4/18 (planned): - mostly sponsor31 stuff

1 0