- tor-project - lists.torproject.org

Tor Browser Release Meeting today: Wednesday 5th June @ 18UTC
by Pili Guerra 05 Jun '19

05 Jun '19

Hi everyone, This is your reminder for the Tor Browser Release meeting happening today @18UTC on #tor-meeting. See you there! Thanks! Pili — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

1 0

S27: Onion Services project - Next meeting Tuesday 21st May @ 1500UTC
by Pili Guerra 04 Jun '19

04 Jun '19

Hi everyone, Just a reminder that we’ll be meeting this week to discuss progress on the Onion Services project. Please join us this Tuesday 21st May @ 1500UTC on #tor-meeting if you’d like to participate. Thanks! Pili — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

1 1

Anti-censorship team monthly report: May 2019
by Philipp Winter 03 Jun '19

03 Jun '19

BridgeDB ======== * We submitted our "gather BridgeDB usage statistics" proposal to the Tor research safety board. You can find the proposal it here: <https://lists.torproject.org/pipermail/anti-censorship-team/2019-April/0000…> We are still waiting to hear back from the board. * We filed <https://bugs.torproject.org/30441> to understand why BridgeDB is handing out so many offline bridges. It looks like this problem is a combination of several smaller problems. We wrote a tool that scans the obfs4 port of all bridges that our bridge authority knows about, and started contacting the operators of bridges whose obfs4 port was unreachable. Have a look at the ticket for details. GetTor ====== * We deployed the refactored GetTor codebase: <https://bugs.torproject.org/28152> Pluggable transports ==================== * We built a service that allows bridge operators to scan the obfs4 port of their bridge. The service is now deployed and available at <https://bridges.torproject.org/scan/>. Give it a try and tell us what we can do better! - The ticket is available here: <https://bugs.torproject.org/30472> - The code is available here: <https://github.com/NullHypothesis/obfs4PortScan> - This effort is part of improving the UX of setting up an obfs4 bridge: <https://trac.torproject.org/projects/tor/ticket/30471>. * We revised our obfs4 setup instructions: <https://trac.torproject.org/projects/tor/wiki/doc/PluggableTransports/obfs4…> - This effort is part of improving the UX of setting up an obfs4 bridge: <https://trac.torproject.org/projects/tor/ticket/30471>. * We assessed the HTTPS Proxy pluggable transport; i.e., understood its advantages, disadvantages, and what it would take to deploy it. Our assessment is available at <https://trac.torproject.org/projects/tor/ticket/29278#comment:6>. Censorship analysis =================== * We are in touch with a research group that is studying the GFW's active probing system. We noticed that the GFW does not probe recent Tor versions. One explanation is that the cipher list in Tor's TLS client hello (this is what the GFW uses to identify Tor) changed. - See <https://bugs.torproject.org/30500> for the ticket. * We recently saw a drastic increase of Tor users from Iran. We don't yet understand the reason for this. - See <https://bugs.torproject.org/projects/30636> for details. Snowflake ========= * We made progress with snowflake's WebExtension. - See <https://bugs.torproject.org/23888> for details. * We started working on detailed measurements of the snowflake blocking in China. We saw Google's STUN servers starting to be blocked in China, as well as blocking stop for individual proxies. - See <https://bugs.torproject.org/30368> for the ticket. * Fixed several bugs in the client and snowflake proxy-go instances. * Starting locally collecting geo-IP metrics on snowflake proxies. * Fought a broker outage and implemented a fall-back mechanism for using snowflake certificates - See <https://bugs.torproject.org/30512> and <https://bugs.torproject.org/30509>. Miscellaneous ============= * We finished a technical report as deliverable for Sponsor 19. The report provides a comprehensive overview of the state of Tor's anti-censorship efforts and we will soon publish it in a blog post. * We attended the kick-off meeting for Sponsor 28. As part of this project we will keep improving snowflake, improve and evaluate the obfs4 protocol, and extend our pluggable transport specification. - See the following page for Sponsor 28-related work: <https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor28>

1 1

Tor Browser team meeting notes 3 June 2019
by Georg Koppen 03 Jun '19

03 Jun '19

Hi! Our weekly meeting just ended (I am sure it was the shortest meeting ever :) ). The IRC log can be found at: http://meetbot.debian.net/tor-meeting2/2019/tor-meeting2.2019-06-03-17.31.l… and below are the items from our pad mcs and brade: Last week: - Helped with code reviews. - Commented in #30639 (Tor tries to connect over IPv6 in IPv4 networks) - Investigated the update portion of #30565 (corrupted Linux 64bit browser). - Thought about the updater-related work for #30429 (ESR 68 Rebase — updater patches). - Worked on #30000 (Integrating client-side authorization to onion services v3). - Continued to work on the Onion Services client auth prompt (#30237). - Provided some info for the May Sponsor 27 report (Onion Services). This week: - More work on the Onion Services client auth prompt (#30237). - Maybe: #29197 (remove use of overlays from Tor Launcher) - Maybe: #30429 (ESR 68 Rebase — updater patches). GeKo: Last week: - shorter week due to public holiday on Thursday - release prep and release building + signing for 8.5.1 - HackerOne bug triage - lots of toolchain work with patches for Linux toolchain (#30736, #30490, #30701, #30734); more work ins needed as at least Stylo build is breaking for unknown reasons (see: https://trac.torproject.org/projects/tor/ticket/30321#comment:1) - work on aarch64 build (#28119), need to revise the patch - backport of Mozilla bug 1552993 - wrote patches for ro locale (#30469) - reverted fix for #29641 - reviews (#30635, #30480, #30549) - going over more reports about 8.5 bugs/missing features This week: - another shorter week due to public holiday on Thursday - 9.0a2 prep and build and signing (hopefully) - more HackerOne work - toolchain improvements - rebase and #10760 reviews - finish fix for #28119 tjr - Not much. Was out 3 days recently. - Organized Letterboxing bugs: https://bugzilla.mozilla.org/showdependencytree.cgi?id=1407366&hide_resolve… - There is a letterboxing bypass (1556016) that I don't *think* is exploitable in the default configuration, mostly due to luck - The mingwclang x86 malloc/free mismatch had some work done by glandium. I need to test if it fixed it https://bugzilla.mozilla.org/show_bug.cgi?id=1547519 - Organized RDD tasks - https://bugzilla.mozilla.org/show_bug.cgi?id=1553720 - Landed a patch disabling RDD and AV1 due to undiagnosed failures. This will have to be fixed by ESR 76 but hopefully much sooner. acat: Last week: - Some reviews. - Fix torbutton duplicate locales in 10760. - Ported onboarding for ESR68 (28822) This week: - Remaining work on 30429 (Rebase Tor Browser patches for Firefox ESR 68) - Finish! 30304 - Browser locale can be obtained via DTD strings sysrqb: Last week: Synchronized built-in bridges on Android with desktop (#30635) Investigated and created a patch for opening a URL from another app with tor browser when it wasn't previously running (#30573) Created a patch for implementing private tabs-only mode on Android (#24920) Began rebasing Android patches on 68esr This week: Release Continue rebasing for 68esr Fastlane (#26844) F-Droid (#27539) boklm: Last week: - was afk Thursday and Friday - helped build new release - reviewed #30492 and #28119 - worked on #28672 (Android reproducible build of Snowflake), trying to get go-webrtc to build This week: - help with publishing 8.5.1 - try to finish #28672 (Android reproducible build of Snowflake) - look at remaining failing testsuite tests - update patch for #30549 (Add script to remove expired sub-keys from a keyring file) after review - some reviews antonela Last week: - worked on onion auth #30237 - worked on tb8.5 bugs #30631, #30560 This week: - TBA user research going on in Uganda and Kenya Georg

1 0

Network team meeting notes, 3 June 2019
by Nick Mathewson 03 Jun '19

03 Jun '19

Hi! You can find the logs from our weekly meeting at http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-06-03-17.00.html Here are the contents of the meeting pad: ================= = Network team meeting pad! = This week's team meeting is at Monday 3 June at 1700 UTC (last Monday was a US public holiday) on #tor-meeting on OFTC. June schedule: * Monday 3 June at 1700 UTC (The 28 May meeting was at the patch party time) * Monday 10 June at 1700 UTC * Monday 17 June at 1700 UTC * Monday 24 June at 1700 UTC Welcome to our meeting! First meeting each month: Tuesday at 2300 UTC Other meetings each month: Mondays at 1700 UTC until 3 November 2019, when daylight saving time changes On #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! After each week's meetings, the contents of this pad will be sent to tor-project @ lists.torproject.org. After that is done, the pad can be used for the next week. == Previous notes == (Search the list archive for older notes.) 6 May: https://lists.torproject.org/pipermail/tor-project/2019-May/002316.html 13 May: https://lists.torproject.org/pipermail/tor-project/2019-May/002325.html 20 May: https://lists.torproject.org/pipermail/tor-project/2019-May/002335.html 28 May: https://lists.torproject.org/pipermail/tor-project/2019-May/002338.html == Stuff to do every week = * How are we managing CI failures from last week? See https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CIFailu… * Let's check the 0.4.1 release status page. See https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… (This page automatically shows the latest trac ticket status.) * Let's check and update the roadmap. What's done, and what's coming up? We're using a kanban board: https://storm.torproject.org/shared/_mx8PMGOHFBOximocl1gy3COvhLPr6k3Ja7JA1v… Click on 'all boards' and then the network team one. Filter by your name and check the 'in progress' column is correct. * Check reviewer assignments! How reviews from last week worked? Any blocker? Here are the outstanding reviews, oldest first, including sbws https://trac.torproject.org/projects/tor/query?status=needs_review&componen… * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… . * See discussion notes below. Any blocker from last week? == Reminders == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next releases. * Remember to fill up the 'actual point' field when you close a ticket. We need those to calculate velocity. * Check other's people call for help in their entries. When you are overloaded, it is ok to say "no" to things. And it is ok to reschedule things. ------------------------------- ---- 03 June 2019 ------------------------------- == Announcements == == Discussion == Rotation updates: (CI/coverity nickm->teor; bug triage dgoulet->mikeperry) coverity (Waiting on update after merging coverity fixes: Coverity does not seem to have noticed 30150 yet.) jenkins (seems ok) Travis Stem failure is happening very frequently. Test_rebind failure less so. teor says: I need CI to be stable so I can do backports and CI changes. test-stem is failing (#29437), can we allow_failures for that job? test_rebind is failing (#28229), should we remove it, or put it in a separate job and allow_failures? Proposed solution: allow_failures for test-stem. Disable test_rebind on OSX only Add a section to our CI status page for disabled CI Add a section to doc/HACKING/ReleasingTor.md reminding releasers to manually check the status of whatever the disabled CI would have checked. CI person should periodically look at these jobs. Appveyor Bug triage Should we deploy sbws to half the bandwidth authorities? Should we raise AuthDirMaxServersPerAddr to 4? https://lists.torproject.org/pipermail/tor-dev/2019-June/013859.html https://lists.torproject.org/pipermail/tor-dev/2019-June/013852.html == Recommended links == == Updates == NOTE NEW FORMAT! Name: Week of XYZ (planned): - What you planned for last week. Week of XYZ (actual): - What you did last week. Week of ABC (planned): - What you're planning to do this week. Help with: - Something you may need help with. PLEASE DO NOT BULK-DELETE THE OLD ENTRIES! Leave the "Planned" parts! Leave the parts for last week and this week! gaba: Last week (actual): . followed on documents for new sponsor (28) . monthly report for sponsor 27 (onion services) This week (planned): . check sponsor V work until now . stockholm meeting planning . closing sponsor 19 Help with: teor: (offline at the usual meeting time) Week of 28 May (planned): - Urgent: - Keep on working on Tor / Stem CI - Fallback directory mirror list rebuild - 041-must Week of 28 May (actual): Urgent: - Kept on working on Tor / Stem CI - Fallback directory mirror list rebuild - made some progress - sbws diagnostics - 1:1 and workload planning and things Important: - relay operator queries Other: - Fixed a confusing address parsing bug with a nice refactor (#30721, can be Sponsor 31) Deferred: - #16564 (reject bridge descriptors on non-bridge authorities) Week of 3 June (planned): Urgent: - Kept on working on Tor / Stem CI ??? - Fallback directory mirror list rebuild - HR stuff Important: - chutney merge backlog (blocked on stable Tor CI) - merge add chutney to tor's CI (blocked on stable Tor CI) - backport backlog (blocked on stable Tor CI) Deferred: - #16564 (reject bridge descriptors on non-bridge authorities), needs complex unit tests Week of 3 June (actual): Urgent: - HR stuff Important: - sbws triage: - it is probably safe to deploy sbws to one more authority (we now have 2, we can have 3) - identified 3 blockers for deploying sbws to more than 3 authorities Nick: Week of 28 May (planned): - More for on PT transition bugs (29875, 24367). Fix? - More for on 041-must/should items - Chutney CI work with teor, tbd - Try to figure out stem CI issue with teor, tbd - Followup on issues from retrospective Week of 28 May (actual): - PT transition bugs (29875 and 24367) -- diagnosed and developed a fix. [This took a while to figure out, since there were at least two bugs at work here. First, we didn't treat bridge changes as meaning that we might not be able to build circuits. Second, we didn't ignore guard entries based on _former_ bridges when counting how many guards we had.] - Staring and poking at stem+CI issues, but didn't get too far. - Numerous bugfixes/investigations: - 29670 -- Could not create SOCKS args string - 30686 -- Better warnings when minherit/madvise fails - 30674 -- Find out why ubsan/asan CI didn't catch #30629 - 30629 -- We seem to be reading some freed events on exit - 30614 -- Use MAP_INHERIT_NONE/ZERO if available instead of crashing on assertion failure - 22619 -- SessionGroup = Reading config failed - Lots of reviews, some with tweaked branches. Lots of merges Week of 3 June (planned): - Release 0.4.1.2-alpha - Possibly, release 0.4.0.6 - Open tickets from team retrospective - Try to finish 041-should items - Try to solve CI failures. Mike: Week of 5/28 (planned): - Laptop issues - Scalability meeting - Peer feedback - Register for PETS - Circpad relay-side warn log bug (https://trac.torproject.org/projects/tor/ticket/30649) - Maybe circpad documentation? Week of 5/28 (actual): - Laptop issues - Scalability meeting and followup - Some work on circpad relay-side warn log bug (https://trac.torproject.org/projects/tor/ticket/30649) Week of 6/02 (planned): - More scalability followup (KIST+EWMA -> wiki; metrics updates; Mozilla all hands meeting planning) - Peer feedback - Register for PETs - #30649 - Circpad documentation? catalyst: week of 05/27 (2019-W22) (planned): - reviews - revise #29976 - other bootstrap work? week of 05/27 (2019-W22) (actual): - holiday 05/27 - medical 05/29 - reviews - revised #29976 (now merge_ready) - looked at #30639 some week of 06/03 (2019-W23) (planned): - reviews - rearange bootstrap tickets more logically - teor's on CI rotation but i can try to help with CI stuff, especially our persistent spurious failures asn: [Will be on dinner during meeting. Might be able to get in in the end.] Week of 05/27 (planned): - Finish reviews. - Finish backlog. - Move on with s27 o2a1. Hopefully get it close to review. Week of 05/27 (actual): - Posted a #30381 branch for review. It was imperative to get this done quickly so that we do not block the TB team. Also had to revise the proposal. - Revised #28634 proposal based on ML feedback. - Did reviews/merges but still got more to do. - Brainstormed HS DoS solutions with dgoulet and posted on mailing list: https://lists.torproject.org/pipermail/tor-dev/2019-June/013862.html - Helped with S27 monthly report. - Some travel planning for allhands. Week of 06/03 (actual): - Finalize s27 o2a1. - Help organize our AllHands experience. - Fix #30578 circpadding bug (041-must). - Do more work on HS DoS. - Some more travel prep for allhands. ahf Week of 29/5 (planned): Network team: - Continue with S19 tasks. - Begin review process of #29736 patches with cohosh while I finish the last bits. Misc: - Need to prepare a presentation for an event in Switzerland next week that Steph asked if I was up for. Going to be away some of the 5th of June while traveling for this event and the presentation is the 6th. - End of month tasks. - Away on Friday due to the "Ascension Day" (all the Danish holidays will be over soon!). Week of 29/5 (actually): Network team: - In S19 land: rebased and cleaned up patches for Snowflake tickets #29736, #29207, and #29260. - Progress on #28930. - Hacked a bit on the shared library PT idea during Ascension Day. Misc: - Began working on a non-XML-RPC based Trac Client to create tickets with. - Worked on presentation for the Switzerland event. - Out for the Ascension Day holiday. Week of 3/6 (planned): Network team: - Hack on #28930. - Talk with traffic-obfuscation list people about #28849 - Talk to Cecylia and dcf about patches for #29736 and friends. Misc: - End of month tasks. - At a conference Wednesday and Thursday in Switzerland doing a presentation on Tor. juga(offline): Week of 05/20 (planned) - Add Tor version to the bandwidth file (#30196) Week of 05/20 (actual) Week of 06/03 (plan) - Continue with #30406: Refactor header constants in sbws to use Stem's one dgoulet: Week of 05/28 (actual): - Implemented #15516. See tor-dev@ discussion https://lists.torproject.org/pipermail/tor-dev/2019-May/013837.html - Implemented #30382 (SOCKS5 extended errors, unofficial-prop304). Need unit tests. Under review by asn. - New version of #29034. - Got #30365 merged (prop289 proposal closed and merged into tor-spec.txt). - Discussion with arma and asn on HS DoS defenses. - Implemented #30687 (generic token bucket). Needed for #15516. - Merges and reviews. - Spent a bit of time on figuring out #30638 without success. - Tor-scaling meeting. Week of 06/03 (planned): - Finalizing s27 tickets (#15516, #30382). - Continuing to understand #30368. - Get prop#304 merged into tor-spec.txt

1 0

minutes from the tor sysadmin meeting
by Antoine Beaupré 03 Jun '19

03 Jun '19

These are the minutes from the TPA meeting held today. # Roll call: who's there and emergencies No emergencies, anarcat, hiro, ln5 and weasel present, qbi joined halfway through the meeting. # What has everyone been up to ## anarcat * screwed up and exposed Apache's /server-status to the public, details in [#30419][]. would be better to have that on a separate port altogether, but that was audited on all servers and should be fixed for now. [#30419]: https://trac.torproject.org/projects/tor/ticket/30419 * moved into a new office which meant dealing with local hardware issues like a monitors and laptops and so on (see a [review of the Purism Librem 13v4][] and the [politics of the company][]) [politics of the company]: https://anarc.at/blog/2019-05-13-free-speech/ [review of the Purism Librem 13v4]: https://anarc.at/hardware/laptop/purism-librem13v4/ * did some research on docker container security and "docker content trust" which we can think of "Secure APT" for containers. the TL;DR: is that it's really complicated, hard to use, and the tradeoffs are not so great * did a bunch of vegas meetings * brought up the idea of establishing a TPI-wide infrastructure budget there as well, so i'll be collecting resource expenses from other teams during the week to try and prepare something for those sessions * rang the bell on archive.tpo overflowing in [#29697][] but it seems i'll be the one coordinating the archival work [#29697]: https://bugs.torproject.org/29697 * pushed more on the hiera migration, now about 80% done, depending on how you count (init.pp or local.yaml) 13/57 or 6/50 roles left * tried to get hiro more familiar with puppet as part of the hiera migration * [deployed][] and [documented][] a better way to deploy user services for the bridgesdb people using `systemd --user` and `loginctl --enable-linger` instead of starting from `cron` [documented]: https://help.torproject.org/tsa/doc/services/ [deployed]: https://trac.torproject.org/projects/tor/ticket/30472#comment:12 * usual tickets triage, support and security upgrades ## hiro * been helping a bit anarcat with Puppet to understand it better * setup <https://community.torproject.org> from Puppet using that knowledge and weasel's help * busy with the usual website tasks, new website version going live today (!) * researched builds on Jenkins, particularly improved scripts and jobs for Hugo and onionperf documentation * deployed new version of gettor in production * putting together website docs on dip * setup synchronization of TBB packages to with GitlabCI downloading from www.torproject.org/dist/ and pushing to the gitlab and github repositories ## weasel * usual helping out * day-to-day stuff like security things * can't really go forward with any of the upgrades/migrations/testing without new hw. ## ln5 * on vacation half of may * decided, with Sue and Isa, to end the contract early which should free up resources for our projects ## qbi * mostly trac tickets (remove attachments, adding people, etc.) * list maintainership - one new list was created # What we're up to next ## anarcat * expense survey across the teams to do a project-wide infrastructure budget/planning and long term plan * finish the hiera migration * need to get more familiar with backups, test restore of different components to see how they behave, to not have to relearn how to use bacula in an emergency * talk with Software Heritage, OSL, and IA to see if they can help us with archive.tpo, as i don't see us getting short-term "throw hardware at the problem" fix for this ## weasel * somewhat busy again in June, at least a week away with limited access * work on Ganeti/KVM clustering when we get the money ## ln5 * Stockholm meeting prepatations * Tor project development, unrelated to TPA ## hiro * planning to get more involved with puppet * more gettor tasks to finish and websites as usual * finish the websites documentation in time for mandatory Lektor training at the dev-meeting so that it's easy enough for people to send PR via their preferred git provider, which includes for example people responsible for the newsletter as lektor also have a Mac app! ## qbi * react on new tickets or try to close some older tickets * happy to do bite-sized tasks (<30min) # Cymru followup? Point skipped, no new movement. # New mail service requests We discussed the [request to run an outbound mailserver][] for TPO users. Some people have trouble getting their email accepted at third party servers (in particular google) using their @torproject.org email address. However, specific problems have not been adequately documented yet. [request to run an outbound mailserver]: https://bugs.torproject.org/30608 While some people felt the request was reasonable, there were concerns that providing a new email service will introduce a new set of (hidden and not-so-hidden) issues, for instance possible abuse when people lose their password. Some also expressed the principle that e-mail is built with federation in mind, so we should not have to run a mail-server as people should be able to just use their own (provider's) mailserver to send mail, even if Google, Microsoft, and those who nowadays try to own the e-mail market, would like to disagree. Even if users don't have a reasonable outgoing mailserver to use, maybe it need not be TPA who provide this service. It was proposed that the service would be better handled by some trustworthy 3rd party, and TPO users may, but need not, use it. We all agree that people need their emails to work. For now, we should try to properly document concrete failures. Anarcat will gently push back on the ticket to request more concrete examples One way to frame this is whether TPI wants to provide email services or not, and if so, if that should be done internally or not. Anarcat will bring this up at the next Vegas meeting. # Stockholm meeting planning By july, anarcat should have produced an overview of our project-wide expenses to get a global view of our infrastructure needs. The idea would then be to do some real-time, in-person planning during the Tor meeting in July and make some longer-term plans. Questions like email hosting, GitLab vs Trac, Nextcloud, how many servers we want or need, etc. It was proposed we do like in Brussels, where we had a full day focused on the TPA team. We still have to figure out if we have the space for that, which anarcat will followup on. There's a possibility of hosting at Sunet's offices, but the 10 minutes walk would make this a little impractical. It's likely we'll be able to find space, fortunately, and we'll try to figure this out this week. # Other discussions No other discussion was brought up. # Next meeting Next meeting will be held on monday july 1st, same hour (1400UTC, 1000 east coast, 1600 europe). Meeting agrees minutes will be sent without approval from now on. -- Antoine Beaupré torproject.org system administration

1 0

Notes from May 30 2019 Vegas team meeting
by Karsten Loesing 03 Jun '19

03 Jun '19

Notes for May 30 2019 meeting: Nick: 1) Team still focused on last days of s19 stuff and on 0.4.1 fixes/cleanup things. 2) Aiming for 0.4.1.2-alpha next week Pili: 1) Final push to get Community Portal live (silently) on Monday 2) S9 Phase 3 Work plans 3) Google Season of Docs enquiries Roger's items from last week: 0) frontdesk, seems like nobody is answering it? [i have on my list to review this whole thing - will probably get it done by dev meeting tho - isabela] [where is this 'nobody answering' for frontdesk? -gaba] [is RT] 1) cccamp tor talk? [there is a mail thread started this week about organizing Tor talks/swags for people from Tor attending cccamp -gaba] isabela: 1) Working on an agenda for a f2f meeting with MDF on June 6th - to help with our fundraising strategy 2) Booking presentation about Tor and my vision to Ford Foundation on June 18th 3) Working on a fundraising campaign for the summer (hopefully we can promote it at CCC camp and DefCon- might be called Dirty Tech Fund - here is a doc explaining it: https://docs.google.com/document/d/1_mvv8OQ3RIW_dtD5xZc18PD2pujHVgdSnapVS9O… 4) Met w/ Panos to sync on Stockholm meeting logistics 5) We should update internal on CCC and Tor 6) Bug Bounty contract w/ OTF has been signed / things should go back to normal w/ paying for bugs etc. Sarah: 1) Working on various fundraising campaigns. 2) Received ~$10k in cryptocurrency from PrivCoin.io. 3) Planning travel to NYC for MDF meeting and DEFCON in August. 4) Covering some social media and press requests while Steph is OOO. Arturo: 1) Attended the Global Media Forum in Bonn 2) Published a research report on Nigeria: https://ooni.io/post/2019-nigeria-internet-censorship/ Antonela: 1) more work in OTF O2A3, O2A1 2) worked on tbb-8.5-issues 3) finished docs for user research in Uganda and Kenya next week, coordinated it with gus and nah 4) working on community.torproject.org Mike: 1) Laptop + mail issues mostly solved, or at least hacked around enough to function 2) Scalability meeting tomorrow, agenda is to discuss experiments and simulators Gaba: 1) s27 report 2) meeting about metrics data portal with simply secure tomorrow 3) initial anti-censorship roadmapping after sponsor 28 (RACE) meetings last week 4) other small things like following up on projects/trac 5) added a section to the bottom of https://trac.torproject.org/projects/tor/wiki/org/meetings/2019Stockholm/Da… to include possible sessions from teams that could be done together Erin: 1) General HR stuff

1 0

Anti-censorship meeting notes, 30 May 2019
by Philipp Winter 30 May '19

30 May '19

Here are our meeting logs: http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-05-30-16.59.html Here is our meeting pad: ANTI-CENSORSHIP work meeting pad -------------------------------- Next meeting: Thursday May 30th 17:00 UTC Weekly meetings every Thursday 17:00 UTC on #tor-meeting at OFTC (channel is logged while meetings are in progress). == Goal of this meeting == Weekly checkin about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at Tor. == Links to Useful documents == THE Anti-censorship Roadmap (kanban board): https://storm.torproject.org/shared/knaG2lEzepdsCC21DYk4dD4hRtwcUGnXQvalH1s… <-- a subset of tasks from trac that the team is working on. (There is a bug in wekan, what we use for the board, that make it hard to load. You have to click in 'all boards' and then in the board to get it to load) Roadmap by topic: https://storm.torproject.org/shared/KXkqlNP8ouNks_ey5khZKUSbNj9ZoidXmEp80OD… Gettor Roadmap: https://dip.torproject.org/anti-censorship/gettor/boards <-- We are experimenting with gitlab for gettor and hiro is working on the board there. Each ticket is linked back to trac for now to keep historical context --> Roger's thoughts on anti-censorship's priorities: https://storm.torproject.org/shared/kU83M2pQehsnQZPzR_mwmYslAijqKgYNOEak57T… Komlo's thoughts on anti-censorship's plan: https://pad.riseup.net/p/CensorshipTeam-Planning-keep PTO Calendar: Ask gaba for the link and keep it up to date with when you are not going to be around. --------------------------- ---- 30th May 2019 ---- --------------------------- == Announcements == * As part of Sponsor 28 work, we will improve our PT spec * GetTor (hiro & gaba) are experimenting with boards in the Tor gitlab to manage it. == Discussion == * Discuss tickets that the anti-censorship team would like the network team to do (ahf) * How are we going to handle snowflake changes that require upgrades for clients/proxies that are not backwards-compatable? (cohosh) * Should we keep doing the obfs4 probe tests (it's been 2 months now) * Is the roadmap up to date with what you are working on? https://storm.torproject.org/shared/knaG2lEzepdsCC21DYk4dD4hRtwcUGnXQvalH1s… < == Actions == * Please add your highlights of May to our monthly report pad: https://pad.riseup.net/p/P7hQ98M9fI0ck2SwKJYd * It should give the community an idea of the important things we did, and insights we gained on the way == Updates == FORMAT! Name: Last week: - What you worked on last week. Next week: - What you are planning to work on next week (related to anti-censorship work). Help with: - Something you may need help with. hiro: This week (2019-05-16): - Revised gettor code with phw - Merge new code - Deploy gettor - See who has access to gettor repository in torgit - Sync torgit repository with dip - Port tickets from roadmap to dip Next week: - Add more tests to gettor - Work on twitter distribution channel Past week: - Rebase gettor PR with phw - Started testing framework phw: This week (2019-05-30): - Assessed httpsproxy (<https://bugs.torproject.org/29278#comment:6>) - Attended Sponsor 28 kickoff meeting with Roger and Cecylia - Added list of criteria we have for default bridges: - https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/DefaultBridges… - Wrote a patch for https://bugs.torproject.org/30512 with David's help - Reviewed https://bugs.torproject.org/5304 - Incorporated Matt's comments in my patch for https://bugs.torproject.org/28655 - General BridgeDB refactoring - Added missing changelog entries - Updated translations https://bugs.torproject.org/30157 - Some coordination with Kat regarding the Sponsor 19 report - Incorporated Cecylia's comments in my work for https://bugs.torproject.org/30472 - Started working on a docker image for obfs4 - Started working on a Stem script to test the TCP reachability of BridgeDB's obfs4 bridges - Discussing our roadmap with Gaba and Cecylia Next week: - As part of our Sponsor 28 work, we will revise our PT spec - Accumulate resources and figure our issues with the current spec - Then, think about fixing these issues - Wrap up https://bugs.torproject.org/30472 - Wrap up https://bugs.torproject.org/30512 Help with: - Check if default bridge criteria make sense to you: https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/DefaultBridges… Gaba: Last week: * talked with phw,cohosh and kat5 about roadmap This week (05/30): * look at s19 and what is that we are completing in May ahf (will be AFK due to Ascension Day here in DK) Last week: - Uploaded rebased patches for #29736, #29207, and #29260 at https://github.com/ahf/snowflake/tree/features/websocket_r5 - Been playing around with a method that I think will allow us to load shared libraries of PT's for Tor (on Linux only for now). - Hacking on #28930 - Got OK from dcf on #28849! Thanks! Next step is to talk to the PT adapter person. This week: - Hacking on #28930 - Prepare presentation for some conference next week in Switzerland. - Away Thursday/Friday for "Ascension Day". kat5: Last week (May 20): - Added more content from tickets - Added Tails content This week (May 27): - Marked finished sections complete - Final edits - Hand off for submission to DARPA - NEEDS HELP: - Sign-off from phw dcf: 2019-05-30 Last week: - reviewed go 1.12.5 upgrade (#30536) - reviewed Snowflake broker certificate cache (#30512) - reviewed removal of OnIceComplete (#30511) - responded to report of metrics anomaly in Iran (#30636) - AMP cache performance measurement Next week: - make graphs using the old unsanitized broker logs before the June 1 deletion deadline (#30693) - look at WebExtension changes in https://bugs.torproject.org/23888#comment:24 Help with: - #30513 would be nice (default Cc for Circumvention/Snowflake tickets) cecylia (cohosh): last updated 2019-05-30 Last (2) weeks: - snowflake - attended sponsor kickoff meeting - started implementing a (simple) sequencing/reliability layer for snowflake client traffic (#25429, #29206) - reviewed obfs4PortScan - reviewed #30511 - updated obfs4 probe test results (#29279) - updated snowflake probe test results (#30368) - merged guard against large reads (#26348) - read over s19 report Next week: - continue reliability layer for snowflake (#25429, #29206) - clean up and increase test coverage for snowflake (#29259) - continue hacking on windows build (#25483) - update default STUN configuration (#26348) - make necessary changes for broker stats (#21315) Help with: - feedback on #21315 (broker stats) - review of obfs4 results (#29279) catalyst: week of 5/16 (planned): - get #29976 ready for review - peer and team leader feedback - help ahf more with bootstrap stuff as needed weeks of 05/16 and 05/23 (actual): - peer and team leader feedback done - #29976 merge_ready week of 05/30 (planned): - open new tickets for improving bootstrap reporting - #30639 looks like it might be good to work on next? (raises some questions about how we tell Tor Launcher that bootstrapping has failed) arlolra: 2019-05-30 Last week: - snowflake webextension This week: - more snowflake webextension Help with: - take a peak at the popup in https://trac.torproject.org/projects/tor/ticket/23888#comment:24

1 0

Tor Browser team meeting notes 28 May 2019
by Georg Koppen 29 May '19

29 May '19

Hi everyone! Here come the meeting notes from our weekly Tor Browser meeting yesterday (this time held on a Tuesday due to Memorial Day in the U.S. on Monday). The IRC log can be found at: http://meetbot.debian.net/tor-meeting2/2019/tor-meeting2.2019-05-28-17.30.l… and the contents of our pad are: Discussion: - Tor Browser 8.5 fallout (GeKo: we track 8.5 bugs with the tbb-8.5-issues keyword in Trac; we got some bugs and nice discussions about our security settings redesign; we plan to address the most pressing issues in upcoming 8.5.1 and 9.0a2 releases) mcs and brade: Last week: - Worked on #30000 (Integrating client-side authorization to onion services v3). - Reviewed and commented on SOCKS5 error code Tor proposal (#30382). - Started to implement support for new SOCKS5 error codes in the browser. - Implemented a prototype of the client auth prompt (#30237). - Helped with bug triage, e.g., #30565 (Linux update problem). This week: - #30565 (Linux update problem). - #30000 (Integrating client-side authorization to onion services v3). - Continue design discussions and make more progress on the client auth prompt implementation (#30237). - Continue to give feedback on SOCK5 error code proposal (#30382). - Maybe: #29197 (remove use of overlays from Tor Launcher) - Maybe: #30429 (ESR 68 Rebase — updater patches). GeKo: Last week: -worked on patches for - bug 30469 (ro bundles; about to post my patches) - bug 30541 (WebGL privacy (mcs/brade: could you have a look at that one as well) (reply from mcs: yes)) - bug 29969 (bumping NoScript version) - bug 30492 (switching to OpenSSL 1.1.x) - bug 28119 (arm64 builds for Android (sysrqb: could you test the posted .apk?)) - bug 30585 (clang 8 for ESR 68) - bug 30490 (cbindgen for ESR 68) -reviews: #30549, #30635, #30480, #30451, #30565, #26844 -helped with releases and release fallout triaging -hackerone fun -feedback for s27 work: #30237, #30024 -finished first pass on acat's proposal (for #10760) -filed #30639 (IPv6 issues on IPv4 network); mcs/brade: could you comment on that ticket? reply from mcs: yes -started to look into GPOs interfering with Tor Browser proxy settings on Windows (#30575) This week: -more hackerone fun -hopefully finish #30490 -release prep for point releases and start building them (probably Thursday/Friday) -patch for mingw-w64/clang toolchain (#28716) -first round of review of acat's rebase efforts (#30429) -reply to acat's #10760 prop mail -afk on Thursday pospeselr: Last week: Current status of #27503: COM Proxy dll (the point of entry screen-readers use to talk ia2 to Firefox) is working except for certain classes of functions (types that take T**) So the remaining issue is in the 'TypeFormatString' (a binary blob which defines parameter marshaling behavior) generated by widl Good news: correct strings are generated when using a separate set of compiler flags (but the surrounding code won't work for us as it depends on SEH which mingw doesn't support) This week: Memorial-Day Monday Fix the final(?) widl issue affecting us Traveling to the wilderness (Kansas :p) Thursday through next Monday, back online next Tuesday (June 4) Will try and get these widl patches broken apart in a way that the wine devs will accept on Saturday acat: Last week: - Rebasing patches (#30429). - Investigated 30565 - saved logins and tabs lost after tor browser bundle upgrade (8.5) This week: - Review #30541. - Get tbb-tests to run and pass. - Port onboarding for ESR68? (28822) - A bit of backlog (e.g. finish 30304 - Browser locale can be obtained via DTD strings) pili: Last week: - S27 and Tor Browser Release meetings - Responding to Season of Docs inquiries - Spoke with OKThanks and Nathan from Guardian Project regarding branding of applications in the Tor ecosystem - Helped a Master's degree student with questions about Tor Browser future This week: - S27 monthly report - Responding to Season of Docs inquiries - Speaking with HTTPS Everywhere people about joint project sisbell: Last week: - #30607: Investigation in Tor not working on Android Q Beta. Works on x86 emulator. Investigated Embedded API (simple wrapper around command line). I’ll have device update to do testing in June. - #Worked on android-toolchain. Fixes around gradle starting. License fix for Android build tools. This Week: - # 30665 Firefox working with 68 ESR - try to get working in offline mode with android-toolchain, updated Rust 1.34.1 sysrqb: Last week: Opened some post-release bug Made more progress on fastlane setup (#26844) Began investigating reported bug where Tor Browser is sent a URL from another app (#30573) Read blog comments Opened ticket about leaking locale in HTTP header (#30607) Made more progress on F-Droid build This week: Continued investigation and worked on patch for #30573 Created patch for bridges on Android Work on F-Droid build Work on fastlane repo 68esr rebase boklm: Last week: - helped publish new releases - reviewed #25930 (Update gcc to 8.X) and #30491 (Move our macOS builds to Debian Stretch) - worked on #28672 (Android reproducible build of Snowflake): now able to build webrtc using our toolchain, but still using the clang bundled with webrtc - made patch for #30549 (Add script to remove expired sub-keys from a keyring file) to make it easier to do #30548 (Clean up keyring files) - updated patch for #30480 (Check that a signed tag object contains the expected tag name) This week: - try to finish #28672 (Android reproducible build of Snowflake) - some reviews (#30492 #28119) - look at remaining failing testsuite tests - out of office on Thursday and Friday (but should be able to get some internet to start a build in the morning) Georg

1 0

Network team meeting notes, 28 May 2019
by Nick Mathewson 29 May '19

29 May '19

Hi! You can find our meeting logs at http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-05-28-23.00.html Below are the contents of our meeting pad: = Network team meeting pad! = This week's team meeting is at Tuesday 28 May at 2300 UTC (Monday is a US public holiday) on #tor-meeting on OFTC. May schedule: * Tuesday 28 May at 2300 UTC (Monday is a US public holiday) June schedule: * Monday 3 June at 1700 UTC (The 28 May meeting was at the patch party time) * Monday 10 June at 1700 UTC * Monday 17 June at 1700 UTC * Monday 24 June at 1700 UTC Welcome to our meeting! First meeting each month: Tuesday at 2300 UTC Other meetings each month: Mondays at 1700 UTC until 3 November 2019, when daylight saving time changes On #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! After each week's meetings, the contents of this pad will be sent to tor-project @ lists.torproject.org. After that is done, the pad can be used for the next week. == Previous notes == (Search the list archive for older notes.) 29 Apr: https://lists.torproject.org/pipermail/tor-project/2019-April/002310.html 6 May: https://lists.torproject.org/pipermail/tor-project/2019-May/002316.html 13 May: https://lists.torproject.org/pipermail/tor-project/2019-May/002325.html 20 May: https://lists.torproject.org/pipermail/tor-project/2019-May/002335.html == Stuff to do every week = * How are we managing CI failures from last week? See https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CIFailu… * Let's check the 0.4.1 release status page. See https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… (This page automatically shows the latest trac ticket status.) * Let's check and update the roadmap. What's done, and what's coming up? We're using a kanban board: https://storm.torproject.org/shared/_mx8PMGOHFBOximocl1gy3COvhLPr6k3Ja7JA1v… Click on 'all boards' and then the network team one. Filter by your name and check the 'in progress' column is correct. * Check reviewer assignments! How reviews from last week worked? Any blocker? Here are the outstanding reviews, oldest first, including sbws https://trac.torproject.org/projects/tor/query?status=needs_review&componen… * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… . * See discussion notes below. Any blocker from last week? == Reminders == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next releases. * Remember to fill up the 'actual point' field when you close a ticket. We need those to calculate velocity. * Check other's people call for help in their entries. When you are overloaded, it is ok to say "no" to things. And it is ok to reschedule things. ------------------------------- ---- 28 May 2019 ------------------------------- == Announcements == == Discussion == Rotation updates: (CI/coverity mikeperry->nickm; bug triage catalyst->dgoulet) No new coverity issues Stale jenkins freebsd issue tagged and put on CI page (whose link is at the top of this pad) Bug triage queries are clean (or were earlier today) Should Tor controllers be able to change DisableAllSwap at runtime? Tor hangs a lot when stem sets "DisableAllSwap 1" on Travis (#30235) If it should work, we need to fix DisableAllSwap. (I think this is moot; I talked with teor about it around 48 hours ago? -nickm) ahf (27/05): arma wonders if we already run valgrind as part of our release checklist? if no, should it be added somehow? see #30629 IMO we should do this in CI if it's really necessary. But we should also figure out why our existing sanitizers didn't notice 30629. -nm Our control refactor caused at least two regressions: #30580 #30646. How can we make sure there aren't any others? == Recommended links == On allyship in newsrooms but also in workplaces: https://source.opennews.org/articles/how-be-ally-newsroom/ On roles in tech teams https://www.youtube.com/watch?v=KClAPipnKqw On feedback and how to do it well (focused on art school, but it also works for code): https://captainawkwarddotcom.files.wordpress.com/2017/05/peepasgotomay1.pdf == Updates == NOTE NEW FORMAT! Name: Week of XYZ (planned): - What you planned for last week. Week of XYZ (actual): - What you did last week. Week of ABC (planned): - What you're planning to do this week. Help with: - Something you may need help with. PLEASE DO NOT BULK-DELETE THE OLD ENTRIES! Leave the "Planned" parts! Leave the parts for last week and this week! gaba: Last week (actual): . retrospective . meeting with briar on funding for dormant mode . reading documents for new sponsor (28) This week (planned): . check sponsor V work until now . monthly report for sponsor 27 (onion services) Help with: teor: (online for 28 May, offline at the usual meeting time) Week of 21 May (planned): - Something fun, interesting, and engaging - Catch up on backlog - Sponsor 19 - 041-must - Fallback directory mirror list rebuild Week of 21 May (actual): - Urgent: - Started fallback directory mirror list rebuild process with Gus (#28793) - Worked on more travis stem timeout issues (#29437) - It looks like stem hangs on its own CI, not just Tor's CI - We should have a controller trace soon, to help us find out which side is hanging - Important: - Catch up on backlog - Retrospective and other meetings - HR stuff x3 - Other: - Moderation on tor-relays - Answer easy questions and do quick tickets - Started on #16564 (reject bridge descriptors on non-bridge authorities) - Rewrote the CI for stem, found some bugs (#28170) Nick: Week of 20 May (planned): - Review and merge as top priority - S19 work as second priority. - 041 work as needed - try to triage and assign 041 tasks - try to release 0.4.1.1-alpha - Work on privcount integration, time permitting Week of 20 May (actual): - Review and merge, lots of it - Lots of meetings - Released 0.4.1.1-alpha - Tried to figure out some older bugs - 041-must and 041-should issues - 26848 (make sure sendme cells reflect some random data) - Started investigating PT transition bugs (29875, 24367), not much progress Week of 28 May (planned): - More for on PT transition bugs (29875, 24367). Fix? - More for on 041-must/should items - Chutney CI work with teor, tbd - Try to figure out stem CI issue with teor, tbd - Followup on issues from retrospective dgoulet: (will be afk for meeting) Week of 05/20 (actual): - Reviews and merges (See timeline). - Finalized all #26288 children meaning finalizing #30428 madness and #30365 to integrate authenticated SENDMEs in tor-spec.txt. Review on #26846 done by nickm. - Worked on s27 #30382 and wrote proposal 304 for it. Week of 05/28 (planned): - Sponsor 27 tickets. #30382, #15516 if I can get to it (DoS related). - Posted on tor-dev@ prop304. Code is done as well, need review from asn to continue further. - s27 related is #29034 that I finally got time to do. It is in needs_review and it should allow us to close 3 tickets in the pipe. [what is the situation with #29607? --gaba] Mike: Week of 5/20 (planned): - Bugfixing - Peer feedback, doh! - Spend time getting back up to speed on CI/Coverity - Work on circpad documentation; start mailing researchers Week of 5/20 (actual): - Laptop issues - Mailed researchers re circpad Week of 5/28 (planned): - Laptop issues - Scalability meeting - Peer feedback - Register for PETS - Circpad relay-side warn log bug (https://trac.torproject.org/projects/tor/ticket/30649) - Maybe circpad documentation? catalyst: week of 05/20 (2019-W21) (planned): - reviews - bug triage rotation - #29976 week of 05/20 (2019-W21) (actual): - reviews - bug triage - #29976 pull request week of 05/27 (2019-W22) (planned): - reviews - revise #29976 - other bootstrap work? asn: Week of 05/13 (planned): - Continue coding #30381 so that we unblock the TB team. - Keep on working on the DoS stuff by the side. - Got lots of reviews for this week. Got a few more last midweek, so I got stuff to do here. Week of 05/13 (actual): - Pretty big delta from the "planned" week since we got overflowed by WTF-PAD tasks last week given the 041 freeze. Spent most of the week testing, revising and rebasing #28634, #28780 and #29085. Everything is merged now, so hooray us! - Finished all peer feedback. - Did a meeting with hackerone and paid out a bug hunter for old bugs. - Bug triage duty: The bug triage queries are empty again. - Was sick on Friday. Week of 05/20 (actual): - Will be medically away for most of the week. Will try to be back on Friday but still unclear. Will also try to attend the retrospective. ahf (offline maybe? or in the sofa at very least 8) Week of 20/5 (planned): Network team: - Follow up on revision requests of #5304 and #28930 - Finish #28930 - Finish my last bits on some Snowflake patches that I have kept postponing (will probably spend all of Thursday or Friday on that). Week of 20/5 (actually): Network team: - Progress on #28930. - #5304 and #28849 is still pending review, but no changes last week. - Got most of my #29736 patches cleaned up and uploaded to GH. - Messed around with a way of loading .so compiled PT's into Tor. Hope to have a prototype ready before next week. Misc: - Tried to write a bot using the Trac XML-RPC API with the help from Hiro, but we haven't managed to make it work yet. Week of 29/5 (planned): Network team: - Continue with S19 tasks. - Begin review process of #29736 patches with cohosh while I finish the last bits. Misc: - Need to prepare a presentation for an event in Switzerland next week that Steph asked if I was up for. Going to be away some of the 5th of June while traveling for this event and the presentation is the 6th. - End of month tasks. - Away on Friday due to the "Ascension Day" (all the Danish holidays will be over soon!). juga(offline): Week of 05/13 (planned) - Continue with #30311, #30406, #30373 as needed Week of 05/13 (actual) - Continued with #30406: Refactor header constants in sbws to use Stem's one Week of 05/20 (plan) - Add Tor version to the bandwidth file (#30196)

1 0