Hi,
since last report, these has been the tasks i have worked on:
Simple Bandwidth Scanner (sbws) [0]:
---------------------------------
- add number of failures to relay bandwidth lines (#160, #176)
- obtain relay ed25519 master key and add it to relay bandwidth lines (#174)
- add logging to a file by default (#183)
- use keyserver pool to retrieve gpg key (#185)
little-t-tor
--------------
- started to work on: bandwidth testing circuits should be allowed to
use our guards (#19009)
- started to work on: relays should regularly do a larger bandwidth
self-test (#22453)
- update descriptor on bandwidth changes only when uptime is less than a
day (#24104)
- report version of bwscanners in votes (#3723)
Bandwidth List format specification:
--------------------------------------
- add KeyValues counting errors in Bandwidth Line (#26200)
- update descriptor on bandwidth changes only when uptime is less than a
day (#26301)
Tor directory protocl:
------------------------------
- add a bandwidth-file line to votes in dir-spec.txt (#26222)
Best,
juga
[0] https://github.com/pastly/simple-bw-scanner
Hi!
We had two Tor Browser releases this month, Tor Browser 7.5.4[1] and
8.0a7[2] picking up Firefox 52.8.0esr which contained a couple of
security bug fixes. Apart from that we were able to fully concentrate on
the Tor Browser transition to Firefox 60 ESR and on our Tor Browser for
Android work.
Since May 30 we have Linux nightly builds available which are based on
Firefox 60 ESR[3] and we meanwhile finished the transition for macOS as
well[4]. That does not only include updating the toolchains to new
Firefox requirements but getting our own extensions, Torbutton[5] and
Tor Launcher[6], to work the new browser version, too.
We worked as well on the network code and new feature audit to make sure
we don't miss criticial changes for Tor Browser and patch them if necessary.
On the mobile side we were fighting with an unexpected crash bug due to
a Firefox patch closing a serious vulnerability.[7] We hope to have this
problem resolved soon. Moreover, we made progress on having a first
branch based on Firefox 61 ready[8], which will be the base for our
first Tor Browser for Android alpha release.
The full list of tickets closed by the Tor Browser team in May is
accessible using the `TorBrowserTeam201805` keyword in our bug tracker.[9]
For June we need to get outstanding build issues for the new Tor Browser
for Windows resolved.[10] In parallel work to stabilize the code to be
ready for the first alpha based on Firefox 60 ESR is under way, adapted
to the new Firefox Photon user interface. If we get all the remaining
pieces done in time the first ESR 60-based alpha will be out at the end
of this month.
For mobile we should have first test builds ready this months and close
remaining proxy bypass bugs, if there are any. Additionally, we are
working together with the UX team to get the UI adapted to match what
we'll ship for desktop.
All tickets on our radar for this month can be seen with the
`TorBrowserTeam201806` keyword in our bug tracker.[11]
Georg
[1] https://blog.torproject.org/tor-browser-754-released
[2] https://blog.torproject.org/tor-browser-80a7-released
[3] https://lists.torproject.org/pipermail/tbb-dev/2018-May/000849.html
[4] https://trac.torproject.org/projects/tor/ticket/24632
[5] https://trac.torproject.org/projects/tor/ticket/26100
[6] https://trac.torproject.org/projects/tor/ticket/25750
[7] https://trac.torproject.org/projects/tor/ticket/26320
[8] https://trac.torproject.org/projects/tor/ticket/26233
[9]
https://trac.torproject.org/projects/tor/query?status=closed&keywords=~TorB…
[10] https://trac.torproject.org/projects/tor/ticket/26203
[11]
https://trac.torproject.org/projects/tor/query?status=accepted&status=assig…
Hello, everyone!
Here’s a quick hiring update:
1. We’ve (finally) found our Android OS developer, who will be starting later this month!!
2. We’re closing in on finding our amazing magical person for the User Research Coordinator position and will hopefully be making an offer in the next couple weeks!
3. Still accepting applications for the Localization Project Manager, a part-time position. (https://www.torproject.org/about/jobs-localization-projectmanager.html.en)
4. New opening for a Fundraising Director! This one we really need your help with — please apply, forward, share, tweet, whatever! This is such an important job and we’d really like to find someone totally awesome for it, so please help us spread the word. (https://www.torproject.org/about/jobs-fundraising-director.html.en) (PDF attached and plain text pasted below.)
Hope you’re all having a great week! :)
Cheers,
Erin Wyatt
HR Manager
ewyatt(a)torproject.org
GPG Fingerprint: 35E7 2A9F 6655 45F9 2CB6 6624 BA0C 9400 F80F 91CE
Internet Freedom Nonprofit Seeks Experienced Fundraising Director
June 5, 2018
The Tor Project, Inc., a 501(c)(3) nonprofit organization that provides technical infrastructure for privacy protection over the internet, is seeking a dynamic, creative, and organized Fundraising Director to help us grow and expand our funding base. The Fundraising Director will be responsible for planning, directing and coordinating all fundraising activities, with an emphasis on diversifying our funding sources. The ideal candidate will have at least five years of leadership experience working in the fundraising department of nonprofit organization. This person must be able to straddle the worlds of technology and fundraising. The Tor Project is funded in part by government research and development contracts, and in part by individual, foundation and corporate donations. The ability to talk about the Tor Project's work to all different types of current and potential donors is essential.
This senior level position will report directly to the Executive Director and will be part of the organization's leadership team. The Fundraising Director will set and guide the strategy for all of our fundraising, including increasing contributions from government, foundation, corporate, and individual donors. This is a new, hands-on position for a highly skilled fundraising professional.
Responsibilities:
• • Work with Tor Project program staff to understand and communicate effectively about the range of our projects and accomplishments.
• • Grow a major gifts program, including identification, cultivation, and solicitation of major donors.
• • Oversee the flow of our donation system, from initial ask to thank you.
• • Oversee grant seeking, including research, proposal writing, and reporting requirements.
• • Interact with our current government and foundation program officers, making sure they are receiving necessary reports and keeping them apprised of our work.
• • Oversee our annual crowdsourced funding campaign.
• • Supervise and collaborate with our grant writer.
• • Write and edit grant proposals, grant reports, year-end report, conference one-pagers and other fundraising-specific writing.
• • Plan fundraising events, as appropriate.
• • Determine appropriate Tor Project booth presence at conferences and events.
• • Ensure that the time of the Executive Director is used efficiently for fundraising.
Qualifications:
• • Demonstrated track record of success in raising major gifts and writing complex proposals for various audiences, including foundations.
• • Knowledge and experience in fundraising techniques, particularly major gift fundraising. Must be comfortable making pitches and personally asking people for money.
• • Excellent verbal, written, and editing skills, including the ability to produce high quality work quickly and under deadline pressure.
• • Ability to develop fundraising budgets and prepare financial reports.
• • Comfortable with highly technical topics and ability to explain them clearly and accurately to non-technical audiences. Must embrace the mission of the Tor Project.
• • Strong generalist understanding of the basic mechanics of how the internet works, as well as issues related to privacy, security, censorship, and surveillance.
• • Excellent computer skills, including familiarity with donation tracking systems. (We use the open source CiviCRM.)
• • Experience with, or willingness to learn how to use, communications and collaboration technologies such as PGP, IRC, Jitsi, Signal, WordPress, and etherpads.
• • Hard working and highly organized with superior attention to detail.
• • Willingness to take responsibility and initiative.
• • Highly collaborative, preferably with experience working with and as part of remote teams in different time zones.
• • Prior experience working on U.S. government grants and contracts is a plus.
• • Willingness to travel to international meetings at least twice a year.
• • The successful candidate should be eager to be an inspiring mentor and colleague to the board and staff of the Tor Project.
The Tor Project's workforce is smart and committed. Experience working with open source communities and/or a dedication to Internet freedom are added pluses. The Tor Project currently has a paid and contract staff of around 35 developers and operational support staff, plus many thousands of volunteers who contribute to our work. The ideal candidate will be energetic, unflappable and flexible, and will thrive in a highly-technical collaborative environment.
This is a full-time, hands-on position, which can be done remotely or in our office in Seattle, WA. Flexible salary, depending on experience. The Tor Project has a competitive benefits package, including a generous PTO policy; 14 paid holidays per year (including the week between Christmas and New Year's, when the office is closed); health, vision, dental, disability, and life insurance paid in full for employee; flexible work schedule; and occasional travel opportunities.
To apply, send a cover letter and your resume to hr at torproject dot org with the subject "Fundraising Director." Tell us why you think you're the right person for this job, and please include links to writing samples. No phone calls please!
The Tor Project, Inc., is an equal opportunity, affirmative action employer.
Hello everyone,
Recently in a Tor UX meeting I brought up the idea of creating a
Tor-Friendliness scanner, or a program that evaluates and ranks the
"Tor-friendliness" of a web site and provides recommendations to
improve. This idea seemed pretty well received by those attending the
meeting, so I'd like to get stated on creating this. However, in order
to do this I would need to precisely define "Tor-friendliness."
That's when this discussion
(https://lists.torproject.org/pipermail/tor-project/2018-January/001606.html)
was brought to my attention. It seems conversation about this has died
down. I would like to revive this conversation and work towards creating
an understanding of the definition of being "Tor-friendly."
Currently I am reading the Tor Browser Design Document to understand the
Tor Browser more fully, and to understand how it works to thwart
tracking and fingerprinting, etc. If there are other approaches I should
consider to help me understand what "Tor-friendliness" is, please let me
know! Otherwise, I would love to hear about what people think
constitutes "Tor-friendliness" so I can build a tool that tests for
these things.
Thanks,
Kevin Gallagher
--
Kevin Gallagher
Ph.D. Candidate
Center For Cybersecurity
NYU Tandon School of Engineering
Key Fingerprint: D02B 25CB 0F7D E276 06C3 BF08 53E4 C50F 8247 4861
Hi!
We just finished our weekly Tor Browser meeting. The chat log can be
found at:
http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-06-04-18.00.log…
The notes from our pad are:
Monday, June 4, 2018
Discussion:
sysrqb: Do we want to use the 'status:' updates during the week like
the network team? [GeKo: It seems we like this idea. Need to check with
the network team to not mess with their status updates]
sysrqb: General question: is there an update/timeline on the new
tp.o website? [GeKo: not sure actually]
igt0:
Last Week:
- Updated #1459420 patch (HLS Player doesn't use the centralized
Proxy Selector)
- Still struggling with the Orfox crash, I also contacted Till
from Mozilla (sysrqb: could you give a hand? yes)
- Delivered my talk in the JSConfEU about fingerprinting
techniques and mitigations. [GeKo: Are there slides/a recording
available somewhere?]
This Week:
- More Orfox debugging
- tweak Tor Button to make it work on mobile and initial mobile
UI preparation (we need to think about what we can reuse)
mcs and brade:
Last week:
- Reviewed and tested rebased external helper app patch (part of
#25543).
- Fixed #26235 (Help menu does not open in Tor Browser nightlies
based on ESR60).
- Started working on #22074 (Review Firefox Developer Docs and
Undocumented bugs since FF52esr).
This week:
- File a Bugzilla bug for #25909 (disable updater telemetry)
- Continue with #22074 (Review Firefox Developer Docs and
Undocumented bugs since FF52esr).
GeKo:
Last week:
- continued MAR signing key testing
- finished macOS patches for new toolchain (including all the
other components, not only firefox), nightlies should be available
rather soon
- made progress on the network review
- reviews (#25859, #25650, #26204, #26235)
- sent out 1:1 feedback scheduling mails
This week:
- finish MAR signing testing and come up with a plan for the
changes we need for the next update and how we address them (#26050)
- network review
- more code reviews
- help with the windows changes for esr60
- begin of the month admin stuff, ticket prioritization for next alpha
- I'll be afk on 6/6
sukhe:
Last Week:
- Worked on #26204, #25837, #26073, #26216 (in progress), #26205 (in
progress). Looked at Windows builds of Firefox 60ESR
- Rust build question: what's the purpose of prev_version? Is
there a reason we are using the source tar and not the git?
I am asking because panic-abort.patch fails to apply for the
Windows 32bit build.
I am building on top of master with
https://github.com/azadi/tor-browser-build-1/tree/bug-26204
and
https://gitweb.torproject.org/user/gk/tor-browser-build.git/commit/?h=bug_2…
merged
[boklm: prev_version is the binary version we use for
bootstrapping the build. panic-abort.patch was made on rust 1.25.0 and
it seems it will need to be rebased on version 1.26.1.]
This week:
- Resume #26126, #26205, #26203 (Windows builds)
tjr
- Ethan, Tim and Gary are back! Had their first couple days. Will sync
up with them this week. (Arthur says: yay!)
- Expect a Tor/Mozilla sync meeting to get scheduled after all-hands,
probably late day Berlin time / early morning USA time
- MinGW Work
- x64 Sandbox work:
https://bugzilla.mozilla.org/show_bug.cgi?id=1461421
- x64 Sandbox with jemalloc:
https://bugzilla.mozilla.org/show_bug.cgi?id=1466192
- Jacek will start on mingw-clang sometime soonish in
https://bugzilla.mozilla.org/show_bug.cgi?id=mingw-clang and children
boklm:
Last week:
- reviewed #26204, #26249, #9711, #25832, #25894, #25554,
#25548, #26195, #26003
- updated #25860 (Clean up OpenSSL's configure options for Windows)
This week:
- finish reviewing #24632 (Update macOS toolchain for ESR 60)
- update HEASLR patch (#12968) and try to inspect the binary to
check if we are good
- start looking at #26050 and #26234 (update "watershed" for
ESR60-based Tor Browser)
- fill upstream binutils ticket for #26148
- continue work on some ansible roles for testsuite VMs setup
(#26149)
pospeselr:
Last week:
- run without /proc patch uplift updates
- seems like #23247 test failures were some intermittent issue
with the ESR60 tryserver, rebased agains latest and test failures went away
- localization approach of pulling strings from tor-button
strings list won't work as is (due to string formatting specifiers)
- problem is modifying that first line which either shows:
- the various HTTPS and encryption properties (uses string
formatters) OR
- scary connection not encrypted message (hard coded string)
- for onion https connections we would need to throw away the HTTPS
info altogether and only display a constant 'onion encryption' message
for the 1st line
- if anyone has thoughts on this I'm all ears
- started work on #26039
(<profiledir>/preferences/extension-overrides.js will not be loaded in
ESR 60)
- took off Friday (and Monday was Holiday)
This week:
- finish up #26039 patch
sysrqb:
- Last week:
Monday was US holiday
Continued work on TBA patches
Looked at Orfox bug
Began dogfooding nightly
- This week:
Rebasing and testting TBA patches on top of Arthur's Tor Browser
patches (#26233)
Looking at Orfox bug some more
arthuredelstein:
- Last week:
Finished a branch for #26233 (Rebase to Firefox 61)
Started work on #14952 (HTTP2 audit and patch)
- This week:
Try to get a patch for review for #14952
Work on #25555 (optimistic socks) and #26128 (noscript/security
slider, possibly in collaboration with sukhe)
Georg
Notes for May 31 2018 meeting:
Georg:
1) First Tor Browser nightlies based on Firefox 60 ESR are out; we work
on getting macOS and Windows builds in shape as soon as possible
2) Where are we with the meek/moat/domain fronting situation? Did Amazon
or anywhere else signal they seriously want to help us?
3) Mike: What's the state of Goolgle ReCAPTCHA blocking Tor users
outright? Are there new results from the measurement side (IIRC I just
saw one/two mails weeks ago)V
Alison:
1) Returned from Uganda. Antonela and I will be writing up and sharing
our report soon.
2) While in Uganda we encountered a bug in Facebook that prevents
connections over Tor, even with the onion service.
3) Library Freedom Institute starts next week! You can follow along with
our curriculum and see what resources we produce here:
https://github.com/alisonLFP/libraryfreedominstitute
4) Next Saturday I'm speaking at the French librarians' conference in La
Rochelle, France
5) LFP is signing the contract this week to coordinate the Glass Room
Experience in the US
6) Doing lots of Mexico City planning including working on the open
days. Meeting with Gus later to talk about hosting a few sessions for
new people, including Tor trainings/installation in both English and
Spanish, and some other things that can help get people involved.
Steph:
1) Newsletter going out today
2) Published a post with Ed at PI
3) Who can help with frontdesk?
4) Answered questions for a journalist
Karsten:
1) Finished open reviews and wrapped up tasks worked on by iwakeh. The
metrics team will be 1 person only in June before growing back to 2 in
July with irl.
2) Put out five releases to switch from Gson to Jackson as JSON library,
also as an exercise to hand over CollecTor/Onionoo operation from iwakeh
to irl.
Hi!
We had our last weekly meeting in May yesterday due to a US holiday on
Monday and here come the usual notes. The chat log can be found at:
http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-05-29-18.00.log…
The notes from the pad are:
Tuesday, May 29, 2018
Discussion:
-nightly releases, preparations for the alpha
mcs and brade:
Last week:
- Reviewed #25750 (update Tor Launcher for ESR 60).
- Reviewed #23247 (Communicating security expectations for .onion).
- Tested the new circuit display on macOS.
- Took a lot of time off for family events.
This week:
- For a couple more days, we still have limited availability for Tor
work.
- Begin #22074 (Review Firefox Developer Docs and Undocumented bugs
since FF52esr).
sysrqb:
Last week:
- Finished TorLauncher updates for 60ESR (#27570)
- Tested which unit tests fail/break with TBA patches (#25741)
- Started rebasing tor-browser patches (using Arthur's branch,
#25543) onto FF61 (#26233)
This week:
- Continue rebasing tor-browser patches onto FF61 (#26233)
- Help igt0 with troubleshooting orfox
igt0:
Last Week:
- Helped out Arthur to wrap up the 26100;
- Kept pocking Gecko trying to figure out why the latest ESR
release is crashing(I also asked for help from the JSAPI team
https://bugzilla.mozilla.org/show_bug.cgi?id=1463741)
This Week
- Still need to figure out why Orfox is crashing
- Look again in Tor Button for Mobile (What it needs to be done
in the esr60)
- Finish my JSConf slides and present it.
boklm:
Last week:
- made patches for:
- #22242 (Selfrando embeds the RUNPATH in Linux binaries)
- #26165 (make it possible to use gcc:var/setup without
hardening wrapper)
- #25860 (Clean up OpenSSL's configure options for Windows)
- #25859 (Clean up zlib's build script)
- #12968 (Specify HEASLR (High Entropy Address Space Layout
Randomization) in MinGW-w64)
- updated patch for #25862 (move mingw helper scripts to firefox)
- updated and rebased patch for #16472 (binutils update)
- looked at the list of things to do for #26050 (achieve update
"watershed" for ESR60-based Tor Browser)
This week:
- file upstream binutils ticket for #26148
- review some tickets (#25832, #25894, #25975, #9711)
- continue work on some ansible roles for testsuite VMs setup
(#26149)
tjr
- We know where the (one?) crash in x64 sandbox is and are working on a fix
- Scheduled some all hands meetings, scheduling more this week.
- Working on getting Jacek as a contractor for mingw-clang
GeKo:
Last Week:
- reviews, reviews, reviews
- debugged various issues with our proposed patch for nightly
linux builds based on esr60 (#26073)
- wrote a fix for about:tor not shown in upcoming nightlies (#26129)
- helped antonela with builds for user testing (arthur asks: what
were results? did circuit display ever work?) [GeKo: not sure about the
results but we fixed the issue with the circuit display and .onion icons
not showing up)
- worked on setting up new signing (sub) keys (MAR and Tor Browser)
- debugged issues with our switch for macOS to the new toolchain;
the good news is I get Tor Browser built (wrote patch for #9711 and
started with #26195)
- went over the patches we want to have on ESR60 for the
mingw-w64 build: tjr: are there patches left we want to uplift? [GeKo:
currently not but we want to have backport at least one patch to get the
browser compiled for mingw-w64:
https://bugzilla.mozilla.org/show_bug.cgi?id=1448748; we'll probably
want to pick https://bugzilla.mozilla.org/show_bug.cgi?id=1411401 and
https://bugzilla.mozilla.org/show_bug.cgi?id=1389967 as well, once they
are ready]
This Week:
- finish MAR signing key testing
- finish macOS switch to new toolchain (including all the other
components, not only firefox)
- make progress on the network review
pospeselr:
Last Week:
- finished up #23247 patch (for tor-browser and ESR60), though
when applied against ESR60 tryserver tests start failing left and right
- investigated said failures, but haven't fixed yet
This Week: [GeKo: + start to work on #26039]
- fix #23247 test failures
- resolve localization issue
- taking Friday off, flying to Kansas for wife's bike race
arthuredelstein:
Last Week:
With igt0, finished up revisions for
https://trac.torproject.org/projects/tor/ticket/26100
Finished up revisions for https://trac.torproject.org/25543
(update tor-browser.git for esr60)
Posted my WIP patches for feeback on
https://bugzilla.mozilla.org/show_bug.cgi?id=1330467
This week:
Work on more ff60-esr tickets: (#26128, #14952, #25555)
Rebase branches for mozilla-beta (#26233) (sysrqb: great, thanks!)
sukhe:
Last Week:
- Worked on #26073. I think it's done but I will wait for it to
be merged.
- Meeting with Hooman: #25483
This Week:
- Will work on #26216 and #26203
- If there is a higher priority ticket for the nightly, please
let me know. [GeKo: no, #26203 is the highest prio for now]
Georg