tor-project

tor-project@lists.torproject.org

17 participants
2325 discussions

Tor Browser team meeting notes, 3 July 2018
by Georg Koppen 05 Jul '18

05 Jul '18

Hi all! We had our weekly Tor Browser meeting on Tuesday, July 3. The IRC log can be found on http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-07-03-17.58.log… and here come the meeting notes, as usual: Tuesday July 3, 2018 Discussion: - What are people's plans for Mexico City? mcs is slightly concerned that not many Tor Browser team members are listed on the wiki page (it is optional to list your plans on that page though). - next meeting [GeKo: we'll meet on 7/16 again but feel free to coordinate an ad hoc meeting if needed] - sandboxing update and meeting scheduling pospeselr: Will be working roughly half-time for the week of July 16th - 20th, wife and I will be visiting Portland The week after, we're moving to a new apartment so who knows what my schedule will be like then Last Week: - fixup patch for #26039 (extension-overrides.js) - posted patch for #26456 (HTTP onion sites inheriting previous HTTPS page's cert) - posted patch for #26615 (backport patch #859782 to ESR60 TorBrowser) - investigated #26450 (first party isolation for ESR60 pdfjs) This Week: - more #26450 investigation - fingerprinting tickets - out Friday for awesome medical fun sukhe: Last Week: - #26216 (MAR generation broken); under review - #12968 (Specify HEASLR in MinGW-w64); working - #26484 (remove windows workaround for #26476); working - #26319 (don't package in mach package step); quick rebase This Week: - Complete #12968, #26484 - Partially online on Monday (national holiday) igt0: Last week: - Sent a patch to #26528 (App stores should not be allowed to use UpdateService) - Sent a patch to #26574 ( Save TBA updates in the internal android storage) This week: - Investigate (system) addons update process for mobile mcs and brade: Last week: - Helped with the Tor Browser 8.0a9 release (macOS code signing and updater testing). - Filed #26514 (intermittent updater failures on Win64 (Error 19)). - Code reviews. - More work on #26381 (about:tor page does not load on first start in localized Windows bundle) - Started to make Mexico City travel plans. This week / soon: - We will be afk Wednesday and Thursday for an Independence Day break. - Assist with #26506 (NoScript not working on TBB/ESR60 on Windows) - Look at #26477 (Meek is broken in ESR60-based Tor Browser) - Continue on #22074 (Review Firefox Developer Docs and Undocumented bugs since FF52esr) GeKo: Last Week: - Helped with the 8.0a9 release and monitored potential fallout - Got back to look at where we are wrt mobile work - Prepared meeting with Cliqz folks and did a talk in Munich and coordinated with them - worked on #26475 (ESR60-based .dmg images are not built reproducibly with Stylo enabled using rustc > 1.25.0) - more network code audit This Week: - review catch-up - begin of the month admin stuff - more work on #26475 - I'll be on vacation from July 8-July 16 tjr (most likely missing meeting) - Most likely outcome of Jacek's work is a mingw-clang build in the esr60 tree with --disable-stylo - I should get the mingw jobs actually merged into the esr60 branch this month - Unsure if he will be able to work on --enable-stylo [GeKo: If not, ping me and I'll put it back on my plate] - Once --enable-stylo is working we can get mingw-clang into -central again - the mingw-clang sandbox also crashes for an unknown reason :( boklm: Last week: - helped with publishing 8.0a9 - started looking at #25485 (Browser/TorBrowser/Tor/libstdc++.so.6: version `CXXABI_1.3.11' not found) - made patches for: - #26410: Stop using old MAR format in the next esr60-based alpha - #26515: Update Tor Browser blog post URLs - #26623: Make fpcentral recognize esr60 Tor Browser This week: - investigate testsuite and fpcentral test failures with version 8.0a9 - fill upstream binutils ticket for #26148 - continue work on some ansible roles for testsuite VMs setup (#26149) - do #26569 (Redirect pre-8.0a9 alpha users to a separate update directory) sysrqb: Last week: - Sandboxing stuff - TBA testing + proxy-bypass - Orfox release This week - Sandboxing - https://lists.torproject.org/pipermail/tbb-dev/2018-July/000874.html - Next batch of TBA tickets Does anyone have a Win10 machine with golang installed and can run this test as an unprivileged user and tell me the result?: https://github.com/Microsoft/hcsshim/blob/master/test/hns_test.go arthuredelstein: Last week: - Worked on #26237 patch (Back and Forward button should be on the left side of the toolbar) - Wrote patch for #26519 (Avoid Firefox icons in ESR60) - Investigated #25620 (NoScript is broken with TOR_SKIP_LAUNCH=1 in ESR 60-based Tor Br) - Opened #26579 (about:tor slow to low) - Worked on #25555 (optimistic socks) - Helped with Steph's blog post This week: - More 25555, 26237, 25620, HTTP2 stuff, blog post Georg

1 0

June 2018 report for the UX team
by Antonela Debiasi 05 Jul '18

05 Jul '18

Hello Tor! A lot of exciting things happened last month. We launched Tor Browser 8 Alpha! It includes a few of UX/UI improvements we have been working on this year, and I'd like to go a little bit deep here: (a) New Circuit Display https://trac.torproject.org/projects/tor/ticket/24309 Problem We found that users don't know if circuits work per tab or globally (Tor Browser has first party isolation by default). Also, many users expect the guard node to change when asking for a new circuit. Indeed, there is nothing on circuit display that tells the user the first node is a guard, what guards are, and how it works when Tor creates new circuits for the user. Hypothesis We are consistently moving site-specific settings into the URL bar. We thought that running the circuit display to the URL bar area will help users to relate the circuit and the domain. Improve the comprehension of how Tor has been building the circuit is also part of it project scope. Related with the guard node: if we highlight the Guard node label at the UI, users will be able to identify it easier and faster. Finally, the Community team is updating the Tor Browser Manual with more information about Guard nodes for users who want to [Learn More]. (b) .onion security indicators https://trac.torproject.org/projects/tor/ticket/23247 Problem Tor Browser doesn't communicate ideally to users that visit .onion sites. For example, users visiting .onion services under HTTP looks scary with lots of warnings. Also, we are missing the opportunity to educate users about .onion services. Hypothesis Adding an onion icon will help users to identify onion services. Moreover, keeping our security indicator icons close to default security indicators will help users to react accordingly to their past experiences. You can read more about this release here [0]. Please download it, try it and report us what do you think. Next steps include a new About:Tor Page[1], a Tor Browser onboarding[2] and a reviewed update Tor Browser flow[3]. Helen Nyinakiiza (nyinz) joined us as a User Research Coordinator last month. She is working on reporting the results of all the user testing sessions we ran in India, Spain, Uganda, and Colombia related with this release. Last month also, we had been in Colombia doing privacy and security training, spreading Tor tools and learning from our new and old users. During this period, we were able to conduct six digital security and privacy training and reach three cities in Colombia. Thanks Fundación Karisma, Congreso de los Pueblos, Hacklab Bogota, Colnodo and many others for receiving us! Our support portal got its soft launch[4]. Emmapeel joined us as a Localization Manager, and she will be helping us to sort all the localization efforts we need to release it in our Tier1 languages. If you find any bug or you want to report anything you can report those in various ways[5]. If you're going to help us with translations, then you're welcome here[6]. We have a lot of things on our plate. You are welcome to join us on Tuesdays at 1600 UTC in #tor-meeting if you want to get involved! On behalf of the Tor UX team, Antonela [0] https://blog.torproject.org/new-release-tor-browser-80a9 [1] https://trac.torproject.org/projects/tor/ticket/25695 [2] https://trac.torproject.org/projects/tor/ticket/24918 [3] https://trac.torproject.org/projects/tor/ticket/25694 [4] https://support.torproject.org [5] https://trac.torproject.org/projects/tor/wiki/doc/community/HowToReportBugF… [6] https://trac.torproject.org/projects/tor/wiki/doc/translation/Introduction#…

1 0

OONI Monthly Report: June 2018
by Maria Xynou 05 Jul '18

05 Jul '18

Hello Tor world, In June 2018, the OONI team established a new partnership with the Jordan Open Source Association and published two research reports. We also made progress on the new OONI Probe desktop and mobile apps, made improvements to the OONI API, and we came up with a new scheme for an OONI measurement ID. Further information is available below. # Established a new partnership We are excited to have established a new partnership with the Jordan Open Source Association! As part of our partnership, we aim to collaborate on the study of internet censorship in Jordan through the collection and analysis of OONI Probe network measurements. ## Recap of partnerships Overall, we have established new partnerships with the following 5 organizations over the last months: 1. Paradigm Initiative (Nigeria) 2. The Advocates for Human Rights and Democracy (South Sudan) 3. Karisma Foundation (Colombia) 4. Asociacion por los Derechos Civiles (Argentina) 5. Jordan Open Source Association (Jordan) # Report on internet censorship in Nigeria In collaboration with Paradigm Initiative, we published a research report examining internet censorship in Nigeria. The full report is available here: https://ooni.torproject.org/documents/nigeria-report.pdf The OONI network measurement findings are summarized here: https://ooni.torproject.org/post/nigeria-internet-censorship/ A summary of the report is also available: https://ooni.torproject.org/documents/nigeria-report-summary.pdf # Report on the unblocking of websites in Ethiopia In collaboration with Access Now, we published a research report examining whether and to what extent websites have been unblocked in Ethiopia, following the government's announcement on the unblocking of 264 websites. Our research report is available here: https://ooni.torproject.org/post/ethiopia-unblocking/ ## Recap of reports Over the last months, we have published reports covering censorship events in the following 5 countries: 1. Pakistan: https://ooni.torproject.org/post/how-pakistan-blocked-social-media/ 2. Iran: https://ooni.torproject.org/post/2018-iran-protests/ (Part 1) & https://ooni.torproject.org/post/2018-iran-protests-pt2/ (Part 2) 3. Sierra Leone: https://ooni.torproject.org/post/sierra-leone-network-disruptions-2018-elec… 4. Nigeria: https://ooni.torproject.org/post/nigeria-internet-censorship/ 5. Ethiopia: https://ooni.torproject.org/post/ethiopia-unblocking/ # OONI Probe Desktop We made a fair amount of progress on the OONI Probe desktop apps, mostly on the command line interface (CLI) front. See: https://github.com/ooni/probe-cli/pull/13 # OONI Measurement ID We came up with a strategy for adding a unique ID to past OONI Probe measurements and how to integrate this into our collector for future measurements. Up until now OONI measurements were identified by a report_id (which can be shared by a set of measurements in the same report file) and the input. With the newly proposed scheme, it will be possible to share a single identifier to identify a specific measurement. You can read more about this here: https://github.com/ooni/pipeline/blob/master/docs/ooni-uuid.md # OONI API We made some bug fixes to the OONI API and made a new release for it. See: https://github.com/ooni/api/pull/54 & https://github.com/ooni/api/blob/master/ChangeLog.md#ooni-measurements-104-… # Revamping the OONI Probe mobile apps We internally released the revamped OONI Probe Android app with the first three screens (Dashboard, Test Overview, Test running). See: https://github.com/lorenzoPrimi/ooniprobe-android/pull/2 https://github.com/lorenzoPrimi/ooniprobe-android/pull/1 https://github.com/lorenzoPrimi/ooniprobe-android/commits/release/2.0.0 # Community use of OONI data ## Blocking of political party site in Pakistan In the run up to Pakistan's elections, the site of the Awami Workers Party got blocked on 3rd June 2018. Through the use of OONI Probe and OONI data, Pakistan's Media Matters for Democracy reported on the blocking (and unblocking) of the site: http://digitalrightsmonitor.pk/generalelections2018-amidst-shrinking-online… ## Blocking of media websites in Venezuela Two media websites (lapatilla.com and el-nacional.com) were blocked in Venezuela this month. Our Venezuelan partner, IPYS Venezuela, reported on the blocking of these media sites based on OONI data: https://ipysvenezuela.org/alerta/nueva-forma-de-censura-en-internet-aparece… # Community activities ## ENOG 15 / RIPE NCC Regional Meeting OONI's Leonid attended the ENOG 15 / RIPE NCC Regional Meeting in Moscow, Russia, between 4th-5th June 2018 (https://www.enog.org/enog-15/). ## Citizen Lab Summer Institute (CLSI) 2018 We attended the Citizen Lab Summer Institute (CLSI) in Toronto, Canada, between 13th-15th June 2018 (https://citizenlab.ca/summerinstitute/2018.html). As part of our participation at the CLSI, we facilitated the following sessions: 1. Making OONI's censorship data more actionable (https://docs.google.com/document/d/e/2PACX-1vRhl3ErFOG5gRNdzVydrGIkpsIJ_C-p…) 2. Measurements from embedded devices (https://docs.google.com/document/d/e/2PACX-1vRhl3ErFOG5gRNdzVydrGIkpsIJ_C-p…) We also interviewed five community members and plan to publish their interviews within the next months (as part of the "OONI Community Interviews" series). ## Community meeting We held a community meeting on Slack (https://slack.openobservatory.org/) on Monday, 25th June 2018. As part of our June community meeting, we discussed the following: 1. Sub-categories and tags for test lists 2. OONI Probe Debian packaging 3. Challenges in sharing OONI Run links: Creating OONI-maintained URL shorteners? ## Updated test lists Based on URLs provided by community members, we updated the following test lists: 1. Cuba: https://github.com/citizenlab/test-lists/pull/357 2. Global: https://github.com/citizenlab/test-lists/pull/353 3. US: https://github.com/citizenlab/test-lists/pull/352 4. Egypt, Tunisia, Jordan, Saudi Arabia: https://github.com/citizenlab/test-lists/pull/358 5. Azerbaijan: https://github.com/citizenlab/test-lists/pull/361 # Userbase In June 2018, OONI Probe was run 240,541 times from 4,627 different vantage points in 214 countries around the world. This information can also be found through our stats: https://api.ooni.io/stats ~ The OONI team. -- Maria Xynou Research & Partnerships Director Open Observatory of Network Interference (OONI) https://ooni.torproject.org/ PGP Key Fingerprint: 2DC8 AFB6 CA11 B552 1081 FBDE 2131 B3BE 70CA 417E

1 0

Proposal for the people page: Pronouns
by Tom Ritter 04 Jul '18

04 Jul '18

There's a lot of us and many folks (or maybe just me) haven't met most people or are otherwise unsure about pronouns. Put them on the people page? Good idea? Bad idea? Too public? https://imgur.com/a/u6pIZnJ The crappy HTML I wrote to do this is to float left and float right the field. <td> <a id="tjr"></a> <div class="photo"><img src="../images/people/tjr.png" alt="tjr" width="128" height="150"></div> <div class="icon"><a href="https://twitter.com/tomrittervg"><img src="../images/twitter-small.png" alt="twitter" width="20" height="20"></a></div> <div class="icon"><a href="https://db.torproject.org/fetchkey.cgi?fingerprint=8ACD146EA94CEB12E4EA6915…"><img src="../images/pgp-key.png" alt="pgp key" width="20" height="20"></a></div> <div class="name"><a href="#tjr">Tom Ritter</a></div> <div class="field" style="float:left"><b>IRC:</b> tjr</div> <div class="field" style="float:right">he/him</div> <div class="description">Maintains <a href="https://consensus-health.torproject.org/">Consensus Health </a>, runs one of the bandwidth authorities, and contributes to Tor Browser.</div> </td> -tom

16 30

[Announcement] Antonela is our new UX team lead \o/
by isabela 04 Jul '18

04 Jul '18

Hello Tor! With me transitioning to ED some reorg will have to happen to accommodate tasks I was leading into other hands You might have already seen the 2 PMs job posts we have online: https://www.torproject.org/about/jobs.html.en Besides PMing things at Tor I was also leading the UX team. Back in May I asked Antonela if she would step up and take the leadership of the team. Antonela is amazing as you all know already she strongly shares the vision for the UX team that I have and has demonstrated amazing skills at actually executing it, not only on the design part of it (which she has being great at facilitating the collaboration of all stakeholders in the process) but at organizing projects related to the UX team vision, like leading the selection of illustrators and their projects or putting together user testing processes. I am very happy to say that Antonela said yes to my question and since then has already taken the leadership hat but we haven't yet announced it to the community so I am doing it now. If you wondering what are the other people in the UX team she will be leading, they are Helen (our User Research Coordinator), Emma (our Localization Project Coordinator), Alon (our illustrator) and will also help organize projects that Hiro (our Services Admin) is helping us with. I asked Antonela if she would share some words on her new role: --- start of Anto words --- I'm grateful for this opportunity. Finally, I found IT people who have the same concerns I have! We want informed and educated users. We want users who have the power to decide. We want to make technology that makes people free. The main UX team aim is to collect all those voices around the world, understand and empathize with them and make a technology that all can use. I hope we can continue working as a bridge, with all the teams around The Project, improving our technology for people without compromise their safety and privacy. --- end of Anto words --- So! Here is the official announcement \o/ join me on congratulating Antonela on this new role and supporting her too! #GoAnto! cheers, isabela

1 0

Network team meeting notes, 2 July 2018
by Nick Mathewson 03 Jul '18

03 Jul '18

Logs at http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-07-02-16.58.html Pad contents below: ==== = Network team meeting pad, 2 July 2018 = Welcome to our meeting! Mondays at 1700 UTC on #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! Note the meeting location: #tor-meeting on OFTC! (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) == Previous notes == 23 April: https://lists.torproject.org/pipermail/tor-project/2018-April/001747.html 30 April: https://lists.torproject.org/pipermail/tor-project/2018-April/001750.html 7 May: https://lists.torproject.org/pipermail/tor-project/2018-May/001760.html 14 May: https://lists.torproject.org/pipermail/tor-project/2018-May/001769.html 21 May: https://lists.torproject.org/pipermail/tor-project/2018-May/001806.html 11 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001828.html 18 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001835.html 25 June: https://lists.torproject.org/pipermail/tor-project/2018-July/001863.html == Stuff to do every week = * Let's check and update the roadmap. What's done, and what's coming up? url to roadmap: https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Check reviewer assignments at https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Also, let's check for things we need update on our spreadsheet! Are there important documents we should link to? Things we should archive? * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… * Community guides, it's time to hand off to the next guide! * Let's look at proposed tickets! == Announcements == * Tor 0.3.1 has reached end-of-life. * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next release! * The git master branch is now 0.3.5! == Discussion == Any volunteers for handling backports to stable? teor asks: what's the timeframe? Can people help out for particular releases? End of life for 0.3.2 is October, and 0.3.3 is February. (I don't know if that will work so well unless we coordinate. It would be messy if something were backported to e.g. 0.2.9 but not 0.3.2. -NM) Any volunteers for leading 0.3.5 triage process? teor asks: 0.3.5's feature freeze is September 15, so do we need triage done in July or August? (IMO now -NM. Working on with ahf.) Do we need a volunteer to focus on the remaining bugs in 0.3.4? (isis will make sure every must bug has a person who remembers they're working on it.) Where is the work-in-progress guide for big patches in Tor? Is this based on the Seattle notes or is there more info there? [komlo] [catalyst will send komlo a link. We're keeping this unpublished until we like it more, since it has potential to read as obnoxious if we get it wrong.] == Updates == Nick: * Last week: * Get 26479 and 26480 (appveyor failures) fixed so I can release 0.3.4.3-alpha. * Release 0.3.4.3-alpha. * Prepare for an 0.3.3.6 release * Continue refacatoring src/common * Make the dependencies in src/libs acyclic. * This week: * Plan an order of operations for splitting src/or. * Open tickets about remaining cases of #25386 (sanitizers, rustdoc). * Document src/lib. * Make requested post-merge cleanup changes in src/lib structure. * Release 0.3.3.8 * Finish PETS reviews teor (offline): last week: - Reviewed juga's patch to put bandwidth file headers in votes (#3723) - Other small bwauth suggestions and feedback - Helped answer some fallback questions - We have 30 new fallbacks, we need another 40 fallbacks for censored clients to bootstrap (Maybe it will take a few more weeks to get there.) https://trac.torproject.org/projects/tor/ticket/24805#comment:33 - Two successful experimental PrivCount data collections - And the research is done! this week: - Review PrivCount in Tor blinding and secret sharing branch - Implement PrivCount in Tor noise - Work on a per-relay / per-consensus / per-counter noise spec for PrivCount in Tor - Reduce my review and revision backlogs ahf Last week: Sponsor 8: - Better process handling for #25502 update: started to write the Windows related code, but ran into #26594 as a blocker. Spend some time trying to figure out what the issue was. Misc: - Reviewed #24104, #26594, first look at #24546. - Continued study of Chrome's Windows sandbox implementation. This week: Sponsor 8: - Finish Windows specific parts of #25502 (reading of output from subprocesses). - Memory profile work with Nick and David(?) Misc: - Look at the remaining Coverity issues from week 25 (bug #26521). - Rotation role: Bug triage. - Figure out Mexico logistics: We have no meetings before the team day? No meetings after the schedule on trac? (This is correct -NM.) - Hope to be able to lift Chrome's Windows sandbox out as a small C++ library to play around with. - I'm away most of Wednesday (US time). - Do phase 1 triage with Nick: https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TicketT… haxxpop: Last week: - Revise the PR according to dgoulet's comments This week: - Continue revising the PR komlo (offline): - Last week: - Prepare for some public talks (not much hands-on tor work) - This week: - Follow up and test out #24249 with https://github.com/eqrion/cbindgen. Overall, I think we definitely want to compile Rust->C types, as opposed to using bindgen as we would still need manual translation for libc types. More analysis on the ticket if anyone is interested. Mike: Last week: - Feeling a bit paralyzed by choosing which semi-urgent thing to prioritize (Sponsor2 work, Sponsor2 report, PETS Research Blog posts, vanguards experiments, vanguard packaging, vanguards blogposts, figuring out how the hell to pay PETS attendance, accumulated bureacracy since vacation). Treaded a bit of water trying to figure out which thing to do. This week: - Hopefully now have a plan: - Backburner Vanguard performance experiment and just choose consservative 2-3-8 params - Write a vanguards release blogpost draft, circulate to asn - Write PETS research blogpost draft, circulate to ??? - Ignore the bureacracy because fuck it. asn: Last week: - Finalized #25552. Been testing it for the past weeks and it's working great! Ensured that it addresses the issues onionshare has been seeing as well as #26549. - Reviewed #26479, #26480, #26425. - Discussed onion name systems with Mike and others. Now that v3s are getting more and more deployed, it's important to start fixing this big UX barrier. This week: - More reviews. - Catching up with leftover 035 deliverables. catalyst: last week (2018-W26): - CI rotation -- included some Jenkins issues like #26503 - reviewed some cross-compilation tickets (#25895, #25977) - made some progress on the big patches doc - helped with a few minor glitches from the refactoring commits (thanks for working on the refactor, Nick!) this week (2018-W27): - Coverity rotation - code review - more work on big patches doc - follow up on some Rust-related tickets as needed - dealing more with flaky internet access - July 4 off because holiday isis: last week: - took tuesday through thursday off to attend zcon0 - reviewed #25386 #24249 this week: - back to the create cell work - catching up on backlog - 1:1:1 meeting on tuesday at 10am PST - july 4 off

1 0

June 2018 report for the metrics team
by Karsten Loesing 02 Jul '18

02 Jul '18

Hello Tor, hello world! This month there's nothing substantial to report from the Tor metrics team. The reason is that iwakeh left the metrics team by the end of May and irl has just joined the team in July. It didn't make much sense for me to make changes in June without anybody reviewing them. Instead, I used the time for recovering from our end-of-May sprint, for cleaning up, and for having a vacation. I'm optimistic there will be more to report next month. On behalf of the Tor metrics team, Karsten

1 0

Notes from June 28 2018 Vegas team meeting
by Karsten Loesing 02 Jul '18

02 Jul '18

Notes for June 28 2018 meeting: Roger: 1) Should we collect and then maintain a list of who else in the world has Tor related funding? That way we can coordinate better at helping amplify their impact, and also remember to invite them to dev meetings, etc. [Answer: yes good idea in theory, but we'd need a responsible person to keep track of the list. We'll think on it.] Georg: 1) Our first Tor Browser alpha based on Firefox 60 ESR is out. The process was painful but the result seems to stick. \o/ 2) Got back to OTF regarding our bug bounty program Arturo: 1) Made some progress on coming up with a scheme for OONI measurement IDs. See: https://github.com/TheTorProject/ooni-pipeline/blob/master/docs/ooni-uuid.md 2) Investigating blocking of Tor in venezuela Shari: 1) We've been doing screenings for fundraising director candidates. 2) Lots of travel approvals for the Mexico City meeting. We need to come up with a more efficient way to do this! Contracts with the hotel have (finally!) been signed. 3) Worked on, and working on, more job descriptions and reading resumes. 4) Lots of little stuff in preparation for transitioning Isa; also getting caught up on a bunch of stuff. 5) FYI, I'll be doing this: https://shuttleworthfoundation.org/thinking/2018/06/26/thinking-Steward-Sha…; it wraps up in July Steph: 1) newsletter sending today or tomorrow (thanks, hiro!) 2) spoke on a panel with Trevor Timm (FPF) and David Greene (EFF) last week in Pittsburgh, people were very engaged 3) helped with 8.0a9 post and sharing 4) getting help from Tom and Arthur and others on a !(Tor + $Browser) post 5) connected with a comms person at mozilla who will check in with me about collaboration opportunities this fall 6) meeting today with gman999 and folks at NYU tandon about doing a talk 7) connected with access now and have been trying to get info about bridges out to folks in venezuela. thanks to antonela for helping with translations! 8) responded to inquiry about tor tab in brave Mike: 1) Nothing for the group, though curious how the patch count trend is going with Tor Browser, and other aspects of the Mozilla relationship. [GeKo: I could look the patch trend up. I think I posted metrics on a trac ticket for previous years, let me find it] Alison 1) still playing catch up after lots of travel 2) LFI is in week 4 and things are humming along. 3) HOPE talk organizing (we just got our timeslot confirmed this week) 4) finished community team roadmap 5) reading through support.torproject.org for soft launch 6) went to the ALA annual conference earlier in the week 7) Tor meetup in India was a success, trying to coordinate with those folks for what they need going forward 8) beginning planning for Kenya trip 9) Gus finished the week in Colombia (six trainings!) 10) Colin worked on the fallback directory mirror list 11) Tommy/Jaruga/Colin worked on user manual updates 12) Make sure to look at Cy's user issues report from May and let us know what you find useful: https://ethercalc.org/may_2018 Nick: 1) Busy with coding 2) All seems well. isabela: 1) back from Colombia where we (me, gus and antonela) did 6 trainings in 3 cities with over a dozen organizations (human rights defenders, social movements, women's groups, students etc). 2) working on sponsor9 phase 2 plan 3) dealing with many small things such as: expenses reports; catching up with emails; organizing sponsors reports and other stuff

1 0

Network team meeting notes, 25 June 2018
by Nick Mathewson 01 Jul '18

01 Jul '18

Whoops! Sorry for the delay. Our chat logs are at : http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-06-25-17.00.html And our pad contents are below: = Network team meeting pad, 25 Jun 2018 = Welcome to our meeting! Mondays at 1700 UTC on #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! Note the meeting location: #tor-meeting on OFTC! (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) == Previous notes == 23 April: https://lists.torproject.org/pipermail/tor-project/2018-April/001747.html 30 April: https://lists.torproject.org/pipermail/tor-project/2018-April/001750.html 7 May: https://lists.torproject.org/pipermail/tor-project/2018-May/001760.html 14 May: https://lists.torproject.org/pipermail/tor-project/2018-May/001769.html 21 May: https://lists.torproject.org/pipermail/tor-project/2018-May/001806.html 11 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001828.html 18 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001835.html == Stuff to do every week = * Let's check and update the roadmap. What's done, and what's coming up? url to roadmap: https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Check reviewer assignments at https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Also, let's check for things we need update on our spreadsheet! Are there important documents we should link to? Things we should archive? * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… * Community guides, it's time to hand off to the next guide! * Let's look at proposed tickets! == Announcements == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next release! * The git master branch is now 0.3.5! == Discussion == Any volunteers for handling backports to stable? Any volunteers for leading 0.3.5 triage process? (Labeling tickts, asking people to label tickets, etc)? How can we help Ooni integrate and test Tor? https://github.com/measurement-kit/measurement-kit/issues/86 (teor added a comment about tor_api.h) [I think that ticket may be stale: simone knows about tor_api.h and has been working with it, IIUC. -nm] How can we help Ooni integrate and test pluggable transports? https://github.com/measurement-kit/measurement-kit/issues/1426 Ooni tests reachability to the default Tor Browser bridge IPs and ports, but how can they embed the protocols? [This is trickier. At least four ISPs in two countries have blocked most of the January 2018 list of fallbacks. Do we want to do a fallback rebuild in the next few weeks? When is our next stable Tor release? Update Steps: https://trac.torproject.org/projects/tor/wiki/doc/UpdatingFallbackDirectory… Master ticket: https://trac.torproject.org/projects/tor/ticket/24786 Step 1: Ask Relay Operators to Opt-In: https://trac.torproject.org/projects/tor/ticket/24804 [I am fine with doing this on whatever schedule you like. -nm] [I have talked with teor, and will handle the rebuild if/when desired. -phoul] Roger's thoughts: "if it's easy to make a new list, let's try it" "if they block the new list, we've learned something" "oh i wonder how tor behaves when half its fallbackdir list is blocked. like, do we have to throw out the existing ones, in order to give people a list that isn't half blocked in india andvenezuela? that would be sad" [Clients need >30% of the list to be unblocked to bootstrap reliably. Currently 97% of the list is blocked at one of the ISPs. So if we can get 50 new or rotated fallbacks, let's update the list. We have 13 new or changed fallbacks on #24805. We could get up to 35 rotated fallbacks from large operators in the existing whitelist. (If we aim for 200 fallbacks rather than 150, we can bump to 200 * 5% = 10 per operator and get 15 extra fallbacks from large operators.) Let's see if we can get ~40 more relays opted-in by emailing tor-relays and large operators? -teor] Or should we write blog posts / tweets / etc. about bridges? (Or both?) [Both seems good. -nm] What are next steps on SimonHF's "trace" proposal? https://lists.torproject.org/pipermail/tor-dev/2018-June/013205.html == Updates == Nick: * Last week: * Split roughly half of src/common into src/libs (#26481) per refactoring plan (https://pad.riseup.net/p/cJUbdx0c7IzM-keep). My goal is to have src/common completely gone in 0.3.5, replaced by a set of libraries. * Review and merge various stuff * Solved #25386 (rust linking), except not really. :/ * Worked on open appveyor issues * Wrote a utility to handle changing moving include files and automatically fixing up whatever uses them. * Made "src" the top of our include path. Now one includes "or/or.h" rather than or.h. * Wrote a utility to make sure that modules aren't including other modules when they shouldn't. * This week: * Get 26479 and 26480 (appveyor failures) fixed so I can release 0.3.4.3-alpha. * Release 0.3.4.3-alpha. * Prepare for an 0.3.3.6 release * Continue refacatoring src/common * Make the dependencies in src/libs acyclic. * Plan an order of operations for splitting src/or. * Open tickets about remaining cases of #25386 (sanitizers, rustdoc). * Document src/lib. * Make requested post-merge cleanup changes in src/lib structure. Dgoulet: * Offline this Monday for a holiday! isis (offline): last week: - still very sick - travelled to england for a wedding and was even more sick there, took wednesday through friday off mostly - worked on the PQ KEX spec and worked out lowering the number of error correcting codes #24990 - reviewed #25386 #24249 #26196 - some maintenance on the bridge authority, started looking into getting a new server racked this week: - offline monday to travel back from europe - taking tuesday through thursday off to attend the zcash meetings and conference in montréal - probably 50% around tuesday through friday to do work and be online - maybe taking friday off because i'm not sure how useful i can be after that much travel and i'm also still sick komlo (offline): last week: - Sumitted some ideas for #24249 (Create automated mechanism for C/Rust types to stay in sync); would appreciate others thoughts here this week: - I have a few public talks coming up so will focus on getting those done and then will be back to more tor things. haxxpop (offline): last week: - nothing this week: - Read dgoulet's review on client auth and revise the PR according to the comments teor (offline): last week: - tried to work out why 0.3.3 breaks on cygwin (#26460) and SunOS (#26469) - read (some of) The Unicode Standard, and made the UTF-8 spec in prop#285 more precise (#26457) - Worked with juga to spec MaxAdvertisedBandwidth (#8494) - Other small bwauth suggestions and feedback - General ticket herding - Started a final experimental PrivCount data collection - Final report, contract admin, transition planning, etc. this week: - Move an experimental PrivCount node - Finish and analyse the final experimental PrivCount data collection - Final report, contract admin, transition planning, etc. - Do some more work on PrivCount in Tor, if I get time asn: Last weeks: - Went travelling. Was fun. - Revised #25552. - Pushed torspec branch to #26379. - Pinged my contact about DV certs for onions. This week: - Catch up with backlog - Do reviews. - Finalize #25552. - Start planning for 035 work and deliverables. ahf Last week: Sponsor 8: - Worked on better process handling for #25502 - looked into what is needed to do what I think is needed on all our platforms including Windows. - Looked at mio/miow from the Rust people. - Tried to write a small IOCP backend for libevent that fakes "readiness" in the same way that Mio does it. Misc: - Coverity duty: Lots of issues found. A lot of them are fixed in #26467, but two "classes" of bugs remain unfixed. Would like some help to figure out what the issue is there. - CI duty: Thanks to Nick and Taylor for diving into the Rust issue! - Wrote a very minimal Sandbox for MacOS (#26374) in https://github.com/ahf/tor/tree/wip-macos-sandbox. - Got introduced to the build process of Tor Browser. - Investigated Sandbox options for Windows. This week: Sponsor 8: - Continue with development of process handling code for #25502 Misc: - Finish off two remaining classes of Coverity issues for #26467. - Review: #17873, #24104, #24546. - Rotation roles: Community Hero. catalyst: last week (2018-W25): - fought with flaky internet connection - with Nick, tried to fix a lot of issues related to tests in the crypto crate that were causing CI to fail - made some progress on the big patches doc, with Nick this week (2018-W26): - CI rotation - more work on big patches doc - more Rust build fixes - code reviews - does someone more familiar with trunnel want to swap reviews on #3569 (refactor SOCKS parsing)? [Nick will] Mike: last week: - Updated and rebased #26214 - Tried to sign up for PETS, failed (banned by paypal, even over nontor) - Signed up for account for sending sponsor2 report - Began enumerating work items for said report - Still clearing the decks from vacation, etc (travel went longer than expected) this week: - Figure out sponsor2 report; decide how much more to try to get done before submitting it - Figure out PETS booking + research blog post topics - For real set up vanguard perf experiments dmr this week: - atagar and I would like to move #26197 forward (automatic mirroring to3 stem repo on github)

1 0

Tor Browser team meeting notes, 26 June 2018
by Georg Koppen 27 Jun '18

27 Jun '18

Hi! Even though the meeting yesterday was a bit bumpy due to OFTC issues here come the usual notes and link to the chat log. For the latter see: http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-06-26-17.59.log… The notes from the pad are: Tuesday, June 26, 2018 Discussion: -alpha release -next meetings (brade: July 2; discuss future meetings at that meeting or via email) (GeKo: I can't make it on Monday, sent a mail to tbb-dev for further planning (https://lists.torproject.org/pipermail/tbb-dev/2018-June/000867.html)) - sysrqb: do we have a process for including new bridges in TB? (GeKo: yes, https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Hacking#Adding…) - sysrqb: rustconf - 16-17 August, in Portland, OR, USA - should any of us go? (i'm thinking about going) (GeKo: sounds good to me!) pospeselr: Last Week: - finished #23247 (onion lock) - posted patch for #26039 (extension-overrides.js) - posted patches for #26355 (no install/update on Vista or lower) - discovered and investigated #26456 (HTTP onions tabs inherit certificate info from previous HTTPS pages) - #859782 (run without /proc) now fixed in FF62 - discovered an issue with pdfjs while working on #26039, disableRange option now seems to break pdfjs altogether, will file a bug in a hot sec This Week: - post fixups for #26039 - figure out and fix #26456 - file bug for pdfjs issue and investigate - backport patch #859782 to ESR60 TorBrowser sukhe: Last Week: - #9145 (enable hardware acceleration); under review - #26251 (build Snowflake for macOS); under review - #26319 (update mach build package); under review - #26186 (remove intl.locale.matchOS); merged This Week: - #26216 (MAR generation broken) - #12968 (Specify HEASLR in MinGW-w64) mcs and brade: Last week: - Continued with #22074 (Review Firefox Developer Docs and Undocumented bugs since FF52esr). GeKo: Did you already file bugs for the things you found in the Dev Docs? mcs: No, we will do that. - Worked on — but did not find the root cause of — #26381 (about:tor page does not load on first start in localized Windows bundle) (Arthur says: could you post your "headless" branch of tor-launcher? I'm curious if it fixes 26506 symptom) mcs: We will clean it up and post it. Arthur: thanks! :) - Helped with bug triage, code reviews, and testing of esr60 fixes and backports. This week: - Help with the Tor Browser 8.0a9 release, especially updater testing. - Continue on #26381 (about:tor page does not load on first start in localized Windows bundle) - Assist with #26506 (NoScript not working on TBB/ESR60 on Windows) - Look at #26477 (Meek is broken in ESR60-based Tor Browser) - Continue on #22074 (Review Firefox Developer Docs and Undocumented bugs since FF52esr). Note: We will have reduced hours next week due to the U.S. July 4th holiday. boklm: Last week: - helped build/publish the new releases - reviewed some patches: - #26362: Use old MAR format when generating the MAR files for the first esr60-based alpha - #23561: Fix NSIS builds for Windows 64 - #26424: Disable using UNC paths via preference - #26221: Backport patch for bug 1444532 to Tor Browser stable (7.5) - made some patches for: - #26428: temporary fix to avoid https-e submodule error - #26440: move vaulted vars to a separate directory - #26461: Generating incrementals fails if the release/signed or alpha/signed directory doesn't exist - #26450: disable dependency on firefox-langpacks in testbuild - #26489: dmg2mar script is broken due to added whitespace in "Tor Browser" - #26496: Set MAR_OLD_FORMAT=1 in dmg2mar - #26380: Remove tor browser sandbox from the download page - started working on a patch for #26323 (Build 32bit Linux bundles on 64bit systems) - booked flights for mexico meeting This week: - continue with 8.0a9 release - doing some reviews - fill upstream binutils ticket for #26148 - continue work on some ansible roles for testsuite VMs setup (#26149) PSA: I plan to be on vacation from 7/14-7/22 GeKo: Last Week -release preparations (including hotfixing a bunch of release blockers for the alpha over the weekend) -release signing -patches written for seatbelt profiles removes (#26438), unbreaking our Linux32 alpha builds (#26462) -reviews: #23247, #26428, #26440, #20628, #26451, #26039, #26461, #26186, #26430 This Week -help with the alpha release -bug triage after alpha release taking release fallout into account -more network code audit -work on tracking down the rust related reproducibility issue we found (#26475) -more reviews -getting up to speed again with the tor browser for android state and focusing on getting it moved forward towards the alpha release -prepare meeting with Cliqz folks PSA: I plan to be on vacation from 7/8-7/16 (inclusive) sysrqb: last week: - Rebased TBA patches onto 60.1.0, more testing (#26401) - Finished first-round proxy-safety audit (#21863) - Windows/OSX/Linux Sandbox investigation - Recovery from all-hands - Some thinking about Tor+IPv6 because mobile networks are adopting it faster than others - Created some more tickets from auditing #26401 This week - Setting up local proxy-bypass test environment for Android - Setting #26401 in needs-review, really this time - More sandboxing investigation, and hopefully writing an email - I'm making notes https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Sandbox igt0: Last week: - Investigated the Gecko Mozilla Update Service, the comment #9 describes my finds (#26242) - Commented out the ticket #26318 (Consider different installation methods) about a proposal how we can validate de app. - Started updating UpdateService to support F-Droid (I will open a ticket about it this week). This week: - Send patch to make UpdateService support F-Droid - Make UpdateService to use the app directory(sandboxed) instead of an external storage. arthuredelstein: Last week: - Investigated #26322 (Circuit display - UI bug - Long v3 name) - Wrote a patch for #26430 (New torbutton icons) - Patch for #26321 (Remove some menu items from torbutton and move to Fil/hamburger menu - Reviewed #26058 (Revert #18743 - "Sign in to Sync" icon not hidden) - Wrote patch for #20629 (More locales for Tor Browser) - Patch for 26451 (HTTPS-E update) - Opened and patched #26500 (Torbutton relay icon in the wrong place) - Opened and investigated #26506 (NoScript not working on TBB/ESR60 on Windows) - Investigated https://trac.torproject.org/projects/tor/ticket/26128#comment:13 (extension startup race affects noscript control) This week: - Keep looking at #26506, #26128 comment 13 issues - More UX issues in 8.0a we need to fix (some of which I will file today) - Optimistic SOCKS. HTTP/2 if there is time - Help verify build as needed tjr - mingw-clang (Jacek) goes swimmingly! We have a successful build in TaskCluster, and Jacek is cleaning up patches and getting them reviewed. - Unsure of how far along he is in his contract though - I have yet to dig into https://bugzilla.mozilla.org/show_bug.cgi?id=1470772 but plan to tomorrow - Are esr60-based builds going to have a Windows x86 release? Are esr60-clang-based builds? (GeKo: it sems 32bit Windows builds still seem useful, we keep them for now) - Answer: Yes. - I am working on fuzzyfox - I replied to tor-qa about alpha 9 on Windows. sisbell: Last week: -Got builds working in my environment: tor-browser desktop, rbm, Fennec This week: - Working on getting mobile tor browser build working Georg

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

tor-project