- tor-project - lists.torproject.org

[TSoP 2018] Bandwidth scanner update - report #6
by juga 07 Aug '18

07 Aug '18

Hi, since the report #5, these has been the tasks i have worked on: sbws ----- - Create Debian package for sbws (#26848) - Initial autopkg test support - Continue with binaries should have manual pages (man) (#26926) - Continue with warn when there is not enough disk space (#26937) - Continue with check that the scaling is working [0] - Run sbws and Torflow from same box - Generate and graph sbws results with and without rtt - Generate and graph sbws results with a bigger time to download data and with default time - Parse raw torflow results - Graph raw torflow results and sbws - Start scaling sbws results in a similar way as torflow does Cheers, juga. [0] https://github.com/pastly/simple-bw-scanner/issues/182

1 0

Network team meeting notes, 6 August 2018
by Nick Mathewson 07 Aug '18

07 Aug '18

Hi, everyone! Logs here: http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-08-06-16.58.html Pad contents below: = Network team meeting pad! = Welcome to our meeting! Mondays at 1700 UTC on #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! Note the meeting location: #tor-meeting on OFTC! (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) After each week's meetings, the contents of this pad will be sent to tor-project @ lists.torproject.org. After that is done, the pad can be used for the next week. == Previous notes == 11 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001828.html 18 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001835.html 25 June: https://lists.torproject.org/pipermail/tor-project/2018-July/001863.html 2 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001866.html 9 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001884.html 16 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001888.html 23 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001926.html 30 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001928.html == Stuff to do every week = * Let's check and update the roadmap. What's done, and what's coming up? url to roadmap: https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Check reviewer assignments at https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Also, let's check for things we need update on our spreadsheet! Are there important documents we should link to? Things we should archive? * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… * Community guides, it's time to hand off to the next guide! * Let's look at proposed tickets! [but see discussion] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… == Reminders == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next releases ------------------------------- ---- 6 August 2018 ------------------------------- == Announcements == == Discussion == * Roadmap revision status -- please get back on that by today. https://pad.riseup.net/p/huDStrBDgqi5 * Backlog on reviews -- is anything stuck? * teor: our current rotations give each person 4 weeks on, then 3 weeks off. I'd prefer 1-2 weeks on, 1 week off. - Let's change starting in september, if there are no objections. * ahf on vacation from wednesday and to the 23rd: i have document planning duty this week, then community hero, then bug triage - anybody up for taking these over the next weeks until i am back? I will happily take yours when I'm back :-) - nick does bug triage on week of 8/20 - Need a CH for next week == Updates == nickm: Last week: * PETS backlog * Port RSA code to nss * various subtickets of 25510 (mobile API): * start tor with owning control port (24204) * fix a bug when restarting with version command * API to expose API implementor * Asked for more 25510 (mobile API) feedback * Prepared for 035 roadmap re-triage with Isabela -- sent email * Finished PETS discussion and meta-review * Diagnosed tricky 27003 regression in 034, due to interesting combination of effects. Needs another review; blocking release candidate. * Revised NSS+DH branch based on feedback from catalyst This week: * Release candidate? * Visiting inlaws Thurdsay through Monday; might miss next monday's meeting. * Revising roadmap. - Other TBD: possibly NSS+TLS depending on backlog status. Mike: Last Week: * Continued to update Open Research Topics post. * Can we link it and Chelsea's post on research.torproject.org? Can we replace the stuff that's there? * Fell into a deep rabbithole with vanguards bugfixing * Wrote https://github.com/mikeperry-tor/vanguards/blob/master/README_SECURITY.md - future blogpost on onion service security. * May contain some heresy. Please comment before it's too late! * Wrote a patch to eliminate the last class of unaccounted-for dropped cells in Tor that I would like in 0.3.4. It's just a CIRC_BW event thing for vanguards. Does not affect behavior normally, and does not change the format of CIRC_BW: https://trac.torproject.org/projects/tor/ticket/25573 * Is a merge commit forward from maint-0.3.4 to master still the way we're handling backports after the code reorg? Can I wait on the maint-0.3.4 review for making this? There are some annoying conflicts to deal with. * Have questions for asn/dgoulet: 1. I am noticing RPs being used that are not in my service's current consensus. Is this legit? Can clients use relays that are not in *any* consensus as RPs? (Like if I decide to use a bridge as an RP?) Will other relays prevent this? [This is legal -- clients and onion services aren't required to have the same consensus. A bridge should not serve as an RP or IP, but I'm not sure we prevent that. -nickm] 2. Can I safely close all of those circuits? What happens to clients when rend circs are ignored/closed? [Clients retry another RP if the service does not respond to a RP, but it's slow, because they have to do another intro as well. -teor] 3. Related: Is it better to close a rend circuit right after the extend to the rend point, or ignore the intro before the rend circuit gets built? [For the network? Ignore the intro. -teor] What happens if you never act on an intro request that you successfully ack (or don't ack)? [The intro point acks the intro, not the service. https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.txt#n1645 -teor] Is there any difference between either of those and what I'm actually doing wrt performance or security? Can you help me dig/test? (Is ignoring intro requests for certain rends the same as https://bugs.torproject.org/25882 ?) This week: * Sponsor2 report * Catch up on code reviews :/ * Vangaurds release? teor (offline): last week: - I was on the design meetings rotation, but I couldn't find any proposals to progress. I think we did ok with reviewing proposals and updating specs 2 weeks ago. - bwauth mentoring (mainly https://github.com/pastly/simple-bw-scanner/issues/182 ) - PrivCount in Tor: blinding and encryption (#25669, #23126, #26970) - New reviews (#23588) - Fast fixes (#26979, #26986, #23576) - Set up desk and chair - Tor meeting planning - reviewed 0.3.5 roadmap - helped recover consensuses from a Collector outage this week: - I am on the community hero rotation - revise macOS CI for Core Tor (#24629) - Work on PrivCount in Tor blinding and secret sharing branch (#25669) rest of 0.3.5: - Implement PrivCount in Tor noise generation (#26637, maybe #26398) - Merge PrivCount in Tor - Reduce my revision backlog komlo: - Last week: - Reviewed/commented on PrivCount tickets, let me know if we should schedule a meeting to talk over #26970 - This week: - Will finally get the chance to start on #26296, hoping to get a set of initial patches by this week/next week - Prep for RustConf - Send an email this week to aggregate Rust issues that I can check in with Rust people about, such as remaining issues for #25386 ahf: Last week: Sponsor 8: - Helped Arturo with building an embedable Tor .so. Marionette: - Talked with Roger + Georg shortly about Marionette. - Spend some time looking at changes to Marionette since Rome. - Participated in the PT meeting to discuss the above. Misc: - End of month stuff. - Reviewed: #27003, #26903, #26850, #20424, #26952 This week: - Finish all outstanding code reviews before going on vacation. - Write to John from Marionette about contact info etc. in case of troubles with their development efforts. - Make sure everything is good for my Mexico trip. - Go on vacation (8'th of august to 23'rd of august) to do BornHack. Will give a talk on Tor there :-) catalyst: last week (2018-W31): - benefits bureaucracy - reviewed NSS patches some more - reviewed #24649 (macosx builds, really also massive .travis.yml cleanup; thanks teor!) - prop#295 is waiting for Ashur to respond; when should we ping them next? [teor: another week or two?] this week (2018-W32): - ticket review - talk with ahf about #25502 (intermediate PT progress reporting) - create subtickets for #22266 (jump-to-80% problem) and sketch out designs - mikeperry, komlo: is it ok to use/adapt text from your research blog posts for the "big patches" guide? asn: Last week: - Did some triaging on 035/tor-hs tickets. - Looked at some vanguard related issues/code. - Did some more debugging on #26980. - Was on vacations for the better part of the week. This week: - Catch up on backlog from last week. - Do reviews. - Check some updates on ahmia TSOP. - Debug #26980 some more. - Read mike's vanguard updates.

1 0

[TSoP 2018] Ahmia status update ~ report #6
by Stelios Barberakis 07 Aug '18

07 Aug '18

Hello all, This is the biweekly status update for ahmia development, that arrives a bit late, since I should have sent it on Friday. The last two weeks I have been working on: === Ahmia-Site === * Added a "Did you mean" functionality. This utilizes Elasticsearch's fuzziness <https://www.elastic.co/guide/en/elasticsearch/guide/current/fuzziness.html> functionality, and more specifically phrase suggesters <https://www.elastic.co/guide/en/elasticsearch/reference/6.3/search-suggeste…>, to suggest actual terms when a mispell may have happened. For example: https://ahmia.fi/search/?q=snodwen or https://ahmia.fi/search/?q=tor+netork [1] * Changed the search criteria of elasticsearch searches, by 1) using weighted fields <https://www.elastic.co/blog/multi-field-search-just-got-better> and 2) adding 'anchor' and 'content' fields as well. That has improved the first (upper) results in some cases, and also increases the overall results fetched. [2] * Performed an overall html refactoring, to improve the code structure, fix some unmatched tags, etc [3] * A minor improvement on add onion page, makes clearer the response message, and doesn't redirect to new page. [4] * [Ongoing] I have been Integrating PageRank algorithm in order to improve results sorting based on website popularity. For each page we take into account the backlinks from the rest of the onion addresses to calculate its page rank coefficient. An appropriate formula needs to be done to combine this metric with the already elasticsearch relevance score [5] To be committed soon === Ahmia-Index === * Changed the bulk update request on ES aliases, to an iterative one, to prevent any error on the first requests from disrupting the rest of the requests [6] * Separated *add *and *remove *alias, functionality to make the first crawls of each month available from the beginning of the month. [7] [1] https://github.com/ahmia/ahmia-site/issues/25 [2] https://github.com/ahmia/ahmia-site/issues/29 [3] https://github.com/ahmia/ahmia-site/commit/ddcf1a32321a8506f99eaf8c402c0aec… [4] https://github.com/ahmia/ahmia-site/issues/27 [5] https://github.com/ahmia/ahmia-site/issues/30 [6] https://github.com/ahmia/ahmia-index/commit/08952b6609c7d0d8ee82afec4e64a1c… [7] https://github.com/ahmia/ahmia-index/issues/6

2 1

Regenerating storm github login token
by silvia [hiro] 06 Aug '18

06 Aug '18

Hi, We need to re-generate the token associated with the github-login mechanism for storm. So if you use github to login to storm.torproject.org you might have to re-authorise it. This will probably happen tomorrow 7th of August. Talk soon, -hiro

1 0

July 2018 report for the metrics team
by Karsten Loesing 03 Aug '18

03 Aug '18

Hello Tor, hello world! Below you'll find the highlights of Tor metrics team work done in July 2018. On behalf of the Tor metrics team, Karsten Published detailed specifications for reproducing the data behind Tor Metrics graphs [1]. [1] https://metrics.torproject.org/reproducible-metrics.html Published specifications [2] for querying and processing the per-graph CSV files added to Tor Metrics earlier this year. [2] https://metrics.torproject.org/stats.html Added two new graphs [3] to Tor Metrics showing circuit build times [4] and circuit round-trip latencies [5] both of which are based on existing Torperf/OnionPerf data. [3] https://bugs.torproject.org/25774 [4] https://metrics.torproject.org/onionperf-latencies.html [5] https://metrics.torproject.org/onionperf-buildtimes.html Extended Relay Search results tables to show a summary row [6] and made a couple of smaller fixes to improve the aggregated search feature [7, 8]. On relay details pages there are no longer false positive "not recommended" banners on relays that are running newer experimental versions [9] and more properties are linked to be able to perform easy follow-up searches for related relays [10]. [6] https://bugs.torproject.org/25050 [7] https://bugs.torproject.org/25238 [8] https://bugs.torproject.org/25864 [9] https://bugs.torproject.org/25159 [10] https://bugs.torproject.org/25533 Updated metrics-bot to now allow posting tweets up to 280 characters, which is good news for those autonomous systems with longer names [11]. Additionally, updated codebase to increase JavaDoc coverage and to comply with Tor Metrics Java styleguide [12]. [11] https://bugs.torproject.org/26762 [12] https://bugs.torproject.org/24692 Released Onionoo version 6.1-1.15.0 [13] which adds a new "os" parameter to filter relays and bridges by operating system, extends the "as" and "country" parameters by a special country code and AS number to return relays that were not found in the GeoIP database, and deprecates the "host_name" field in details documents in favor of the new "verified_host_names" and "unverified_host_names" fields for more accurate DNS results. [13] https://lists.torproject.org/pipermail/tor-dev/2018-July/013324.html Released CollecTor version 1.7.0 [14] which recognizes the new bridge authority, Serge. [14] https://lists.torproject.org/pipermail/tor-dev/2018-July/013320.html Fully integrated Relay Search into Tor Metrics [15]. [15] https://bugs.torproject.org/25392

1 0

Notes from August 2 2018 Vegas team meeting
by Karsten Loesing 03 Aug '18

03 Aug '18

Notes for August 2 2018 meeting: Mike: 1) Working on the next vanguards release and an associated document on other aspects of onion service security (Steph: This may be just a release announcement blog post, sometime next week. We could also turn the security document into its own post, but other people should read it first)(Sounds good - keep me posted -steph). Sarah: 1) Attending Bridge fundraising conference Wednesday 8/1 and Thursday 8/2. Networking to find a grant writer. 2) Meeting with Giant Rabbit on 8/3 to talk about updates to the Donate pages. 3) Beginning to put together a fundraising calendar. Monthly giving push - month of September. YE campaign starting on Giving Tuesday 11/27 and running through 12/31. 4) Monday 8/6 meeting with Dan and Nat at OTF. Steph: 1) chairing NYC meetup tonight 2) talking to Derechos Digitales about a joint campaign 3) leading a media training workshop for LFI on Saturday 4) working on website copy and tba copy 5) meeting with Giant Rabbit on Fri about updating donate page 6) sent newsletter Tues 7) published support portal translation post, need to get back to a couple of others Nick: 1) Meeting with Isa on Friday and team on Monday to talk about revising roadmap. 2) Got feedback from hellais on mobile APIs: need feedback from other mobile folks asap. Alison: 1) flying to NYC tomorrow 2) LFI weekend! 3) more Mexico City meeting planning -- sending out agenda email soon 4) working on docs for TB 8.0 5) developing support portal feedback workflow Roger: 1) We picked a team for proposing to RACE. FYI, that proposal will fill up all my time for the next 6 weeks. 2) I'm in the final sprint for the anti-censorship funding via penn. This time for sure! Is there somebody I can hand the baton to, for ramping things up? I am burnt out on this proposal and also all full up on the RACE proposal. 3) I got ahf to start working on the Marionette eval for a start. This is important and we shouldn't drop it just because everybody has their roadmaps and none of them include anti-censorship. 4) I asked Mike about sponsor2 report status. Mike? [I am finishing up vanguards things, and then plan to do a quick push to shore up the WTF-PAD code first. I can make an outline for the report in the meantime, if you would like that - Mike] 5) FYI, PETS 2019 is now scheduled: July 15-20 2019, Stockholm. I hereby start a rumor that we might hold our next Tor meeting right before it. People who wanted to learn this already should be on the (public) meeting-planners list. Shari: 1) deep into hiring for several positions 2) got two grant proposals in 3) meeting planning, including for next meeting in Stockholm in July 2019 4) personnel stuff 5) trying to dig myself out from dealing with above Karsten: 1) Published specifications for querying and processing the per-graph CSV files added to Tor Metrics earlier this year. https://metrics.torproject.org/stats.html 2) Finally completed 1 out of 2 deliverables for our Sponsor 13. Arturo: 1) Sarath has joined the OONI team, yay! 2) Made a lot of progress on OONI Probe desktop apps 3) Reviewed and provided feedback to the tor_api.h: https://trac.torproject.org/projects/tor/ticket/25510 4) We published a report on social media disruptions amid Mali's 2018 presidential election: https://ooni.torproject.org/post/mali-disruptions-amid-2018-election 5) We published a research report examining internet censorship in South Sudan: https://ooni.torproject.org/post/south-sudan-censorship/ 6) We hosted our monthly community meeting 7) We interviewed several community members to collect feedback on the revamp of our mobile apps 8) Next week Maria is presenting OONI at the Annenberg-Oxford Media Policy Summer Institute and is providing a workshop for journalists and advocates 9) We wrote onboarding documentation to share with every new person that we onboard from here onwards

1 0

July 2018 report for the Tor Browser team
by Georg Koppen 01 Aug '18

01 Aug '18

Hi! This July was one of the few months without any Tor Browser release. We therefore spent all our efforts into fixing bugs in our first desktop alpha based on Firefox 60 ESR and getting it towards a stable shape. Additionally, we focused on preparing our first alpha for Tor Browser on Mobile. For the desktop we continued with our feature[1] and network code[2] review of the changes introduced with the switch to Firefox 60 ESR. Moreover, we focused on getting the onboarding designed and implemented together with our new about:tor page[3] and updated icons[4]. We are excited to test those improvements in the upcoming alpha and adjust them according to user feedback! On Mobile we mostly dealt with our blockers for the upcoming alpha release: rebasing patches[5], possible proxy bypass bugs[6], and user onboarding[7]. We finished the first item and made significant progress on the latter two which makes us optimistic that we get out the first alpha this month, finally. The full list of tickets closed by the Tor Browser team in July is accessible using the `TorBrowserTeam201807` keyword in our bug tracker.[8] For August, as indicated above, we plan to get new alpha releases out, both for mobile and desktop. This will likely happen in the week of August 13. Preparations for that will occupy our focus for the coming two weeks. Thereafter we plan to deal with the fallout while still focusing on the remaining review work for Tor Browser desktop and integrating the mobile Tor Browser build into our reproducible builds environment.[9] All tickets on our radar for this month can be seen with the `TorBrowserTeam201808` keyword in our bug tracker.[10] Georg [1] https://trac.torproject.org/projects/tor/ticket/22074 [2] https://trac.torproject.org/projects/tor/ticket/22176 [3] https://trac.torproject.org/projects/tor/ticket/25695 [4] https://trac.torproject.org/projects/tor/ticket/26655 [5] https://trac.torproject.org/projects/tor/ticket/26401 [6] https://trac.torproject.org/projects/tor/ticket/21863 [7] https://trac.torproject.org/projects/tor/ticket/25696 [8] https://trac.torproject.org/projects/tor/query?status=closed&keywords=~TorB… [9] https://trac.torproject.org/projects/tor/ticket/26693 [10] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig…

1 0

Network team meeting notes, 30 July 2018
by Nick Mathewson 31 Jul '18

31 Jul '18

Hi! We had a short meeting today. You can see the logs at http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-07-30-16.58.html and the notes below: = Network team meeting pad! = Welcome to our meeting! Mondays at 1700 UTC on #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! Note the meeting location: #tor-meeting on OFTC! (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) After each week's meetings, the contents of this pad will be sent to tor-project @ lists.torproject.org. After that is done, the pad can be used for the next week. == Previous notes == 11 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001828.html 18 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001835.html 25 June: https://lists.torproject.org/pipermail/tor-project/2018-July/001863.html 2 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001866.html 9 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001884.html 16 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001888.html 23 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001926.html == Stuff to do every week = * Let's check and update the roadmap. What's done, and what's coming up? url to roadmap: https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Check reviewer assignments at https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Also, let's check for things we need update on our spreadsheet! Are there important documents we should link to? Things we should archive? * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… * Community guides, it's time to hand off to the next guide! * Let's look at proposed tickets! [but see discussion] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… == Reminders == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next releases ------------------------------- ---- 30 July 2018 ------------------------------- == Announcements == == Discussion == == Updates == asn: [Will be commuting during meeting time. Might be online depending on net connectivity.] Last week: - Was at PETS. Gave a rump session talk about the latest blog posts. - Talked with a few people about WTF-PAD and started a thread about the info I gathered: https://lists.torproject.org/pipermail/tor-dev/2018-July/013360.html - Opened a few HSv3 tickets from stuff found during HOPE: #26980, #26931 We really need to find some quiet time to work through all these tickets. - Had someone point me to the "httpsproxy" PT and wondered why Tor is not providing any feedback: https://trac.torproject.org/projects/tor/ticket/26923 I'm not entirely sure what it does, but dcf seems to think it's a good idea. - Found a bug with vanguards + v3 and wrote a patch: https://trac.torproject.org/projects/tor/ticket/26932 - Talked with Aaron about their upcoming paper on statistics of the Tor network. Lots of wacky stats in there, we should find time to investigate to improve network health. - Collected feedback from various HOPE/PETS people about security concerns people have with onion services. Discussed with Mike the potential of doing a "still open issues with onion services" blog post. - Helped with onion service proposal. This week: - Send the latest revision of client auth spec to tor-dev. Haxxpop is there anything else you feel is missing? - Try to find time to debug #26980 (#25552 bug). - Perhaps look a bit more on WTF-PAD and histograms. - Will be mostly offline from Wednesday to the end of the week. Nick: Last week: - At PETS. Livetweeted the talks, evangelized Tor stuff, tried not to get too far behind. This week: - Catching up on backlog from PETS. - Trying to get RSA+NSS to work (#26818) - Working on issues under #25510 (mobile API) - Community rotation - Prepare re-triage for September milestone - As needed, help with proposals due on July 31. - Help with coverity, which is about to react to our changing its definition of our BUG macro. This will likely cause a bunch of warnings to fix themselves, but might cause a bunch more to show up. - Finalize PETS meta-reviews - Make a list of PETS talks and presentations that we should take more action on. - Confer with Teor about what I should do with privcount stuff next - AFK ON THURSDAY. - AFK next week on Thursday & Friday. ahf: last week: Misc: - On vacation some of the time - Read email / IRC backlog from vacation and HOPE period. Sponsor 8: - Looked into the state of where we are with building Tor as a shared library together with Arturu. This week: Sponsor 8: - Look into Nick's NSS work. - Work on changing PT code to handle protocol messages via the event loop. - Disable our stats collection service since we decided not to use it anymore. Misc: - Look at Tor related PETS stuff. - Finish review backlog. - End of month tasks. catalyst: last week (2018-W30): - made some progress on review of NSS tickets - patch for #26785 (conditionally disable an unrecognized gcc warning) - talked about some torspec stuff with teor - followed up some more about prop#295 (cell crypto) on email thread this week (2018-W31): - ticket review - maybe more talk about prop#295 - benefits bureaucracy haxxpop: last week: - Review asn's client auth torspec branch. I think everything is good now. We can merge it if everyone already agreed. this week: - I will revise my client auth code to meet the new torspec (if the asn's torspec branch is already merged)

2 1

Tor Browser team meeting notes, 30 July 2018
by Georg Koppen 30 Jul '18

30 Jul '18

Hey! Our weekly Tor Browser meeting finished a couple of hours ago. Here come the meeting notes. The IRC log can be found at: http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-07-30-17.59.log… The entries from our pad are: Monday July 30, 2018 Discussion: -storm vs. some etherpad [GeKo: We try to figure out first if we can solve storm issues server-side/by cutting the meeting notes from the previous meetings] -github coordinator for the team? (see: https://lists.torproject.org/pipermail/tbb-dev/2018-July/000897.html) [GeKo: We might want to have more disucssion on tbb-dev first before moving forward] -next meeting [GeKo: 8/13 will be the next one] GeKo -Last Week -reviews (most importantly related to #26401 and Tor Browser for Mobile, e.g. #26528) -went deeper down the rabbit hole of indeterminism caused by rust >= 1.26 (#26475); still need to go deeper :( -made progress on network code review (#22176) -finally sent feedback to fingerprint randomization paper which is the basis for the GSoC project Arthur and I are mentoring (https://lists.torproject.org/pipermail/tor-dev/2018-June/013220.html) -This Week -more work on #26475 -more network code review (#22176) -work on #26409 (language prompt is shown twice) -reviews -releases? [GeKo: We move both meeting to the week from 8/13 to finish remaining pieces] -begin of the month admin stuff -PSA: I have to be AFK from 8/2-8/12, alas (this is one of the things I could not postpone as the planning for it where already done before Mozilla moved the ESR release, I am sorry for that) boklm: Last week: - attended PETS - made patch for #26861 (Bump available ulimit in runc container in tor-browser-build) - worked on #26981 (Update marionette_driver used in tbb-testsuite for esr60) - started reviewing the patches from sisbell integrating android build into tor-browser-build - filled an upstream binutils ticket for #26148 This week: - fix the testsuite for Tor Browser 8.0 - some reviews, if needed mcs and brade: Last week: - Attended the sandboxing futures meeting (Mark). - Worked on #25695: Activity 5.1: Redesign Tor Browser homepage ("about:tor”). - Created three child tickets to track implementation. - Posted a patch for the first child ticket: #26960 (implement new about:tor start page). - Spent a little time on #26514 (intermittent updater failures on Win64 (Error 19)). - Tried to build ESR52 updater using ESR60 mingw-w64 toolset but the build failed. - Georg gave us a possible fix for the build, so now we can try again. This week or soon: - Rebuild and test the result for #26514 (intermittent updater failures on Win64 (Error 19)). - Fix #26985 (Tor Launcher help button icons missing). - Make the simple text change suggested in #25509 (misleading proxy prompt in Tor Launcher). - Start on #26961 (implement new user onboarding). - Review our notes from #22074 (undocumented bugs since FF52esr) and file additional tickets if necessary. - Revisit #26381 (about:tor page does not load on first start in localized Windows bundle). - After the Tor Browser nightly builds include the network team's fix for #26876, do some testing for #26251 (Adapt macOS snowflake compilation to new toolchain). igt0: Last week: - Half of the week sick - Started to take a look in the about:tor for mobile(https://trac.torproject.org/projects/tor/ticket/25696#comment:13) - Experimented with different UI layouts for #26884. This week: - Send a patch to #26884 - Start the about:tor for mobile sisbell: Last week: - Added arm target for rust - Created first version of Android build that works with RBM (needs review) This week: - Move code to git repo at torproject #26974 - Work on adding mobile branding to Android #26975 - Testing of APK - Working on bugs and improvements needed for Android build (based on feedback/review) tjr - Started landing mingwclang build in -central - Working on Fuzzyfox - Worked on 26476 with sukhe some more pospeselr: Last week: - moved house (Monday/Tuesday), no more crazy building manager! - got my torproject gits working, reposted patches for #26540 (pdfjs disablerange fix) as gitweb diffs - investigating #26874 (UNC path issues) - made travel arrangements for rustconf in Portland (gk: is this something TPI would reimburse) [GeKo: I think we can make an argument for that, I suggest asking travel@tpo] This week: - fix for #26874 - other hi-pri tbb-fingerprinting - revisit #26540 patch, move smuggled first party domain onto the nsIHttpChannel interface sysrqb: Last week: First TBA patch landed Looked at Fennec networking code some more (#22170 and Bug 507641) Looked at igt0's work on Fennec update mechanisms Began looking at Orfox patches of AccountManager that were dropped during earlier ESR rebases (#26858) Had first meeting about sandboxing tor browser This week: Finish #22170 with auditing TBA networking code for proxy-safety Create a branch for patching AccountManager (#26858) if needed Rebase branch for minimizing TBA permissions (#24796) Review other child tickets of Proxy-Safety and created patches and/or close (#21863) sukhe: Last Week: #9145 (gcc/hardware acceleration): merged #26949: STIX repository: merged #26476: tjr and I continue to debug this. we now have a "Tor" build on TaskCluster and the next step is to compare the logs to see what differs. #25485: I need help with this one, someone who is familiar with C++: what's the simplest program that will use the latest ABI? simply linking to our libstdc++ is not enough [GeKo: boklm stepped up to have a look as well] #12968: boklm: seems like https://ffmpeg.org/pipermail/ffmpeg-cvslog/2015-September/094027.html also set SHFLAGS. this is the only thing that differs from our commit. how do we set those? otherwise I tried building with the gcc patch and we get the same error. [GeKo: boklm stepped up to have a look as well] This Week: #26476, #25485, #12968 -- hopefully arthuredelstein: Last week: AFK for vacation Wrote some comments on sandboxing Previous week: HTTP2 patch, #14592 (almost ready) Met with the Tor uplift team Worked on #26520 (NoScript is broken with Tor Launcher disabled) Wrote a patch for #26490 "When first launching 8.0a9 the screen.height starts at 612px" (still testing) Worked on #21787 "Make sure exposing the calendar information does not leak the locale". Started to look at #24056 "UI locale is detectable by button width" and #26604 "investigate whether date and time <input> types leak the user's locale" Better monitoring for TBB locales: https://torpat.ch/locales This week: Finish #14592 (HTTP2) AFK on Wednesday Test #17252 "Confirm TLS session resumption/ID are isolated to the URL bar domain, and re-enable them" Look at https://trac.torproject.org/projects/tor/ticket/26506 "NoScript not working on TBB/ESR60 on Windows" Finish other fingerprinting-related bugs I started. Following week: AFK Wed, Th, Fri. Georg

1 0

Network Team Meeting Notes, 23 July 2018
by teor 30 Jul '18

30 Jul '18

Hi, Here are the network team meeting notes for 23 July 2018. Sorry for the delay, a few of us were away last week. = Network team meeting pad! = Welcome to our meeting! Mondays at 1700 UTC on #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! Note the meeting location: #tor-meeting on OFTC! (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) After each week's meetings, the contents of this pad will be sent to tor-project @ lists.torproject.org. After that is done, the pad can be used for the next week. == Previous notes == 11 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001828.html 18 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001835.html 25 June: https://lists.torproject.org/pipermail/tor-project/2018-July/001863.html 2 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001866.html 9 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001884.html 16 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001888.html == Stuff to do every week = * Let's check and update the roadmap. What's done, and what's coming up? url to roadmap: https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Check reviewer assignments at https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Also, let's check for things we need update on our spreadsheet! Are there important documents we should link to? Things we should archive? * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… * Community guides, it's time to hand off to the next guide! * Let's look at proposed tickets! [but see discussion] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… == Reminders == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next releases ------------------------------- ---- 23 July 2018 ------------------------------- == Announcements == * This week is PETS; a bunch of us are away. * Sponsors 3 and Q are full up. Please don't bill more hours to them. * Privcount work is now sponsor V IIUC. == Discussion == komlo: Would someone who is attending PETS be able to do a session/shoutout for our research posts? https://blog.torproject.org/tors-open-research-topics-2018-edition and https://blog.torproject.org/how-do-effective-and-impactful-tor-research and == Updates == Nick: * Last week: * Worked on NSS: Made progress on RSA. Didn't finish. * Helped discuss 295 a little * Revised various tickets * Review, merge, etc * Prepared for PETS * CI rotation: Fixed a couple of bugs, and investigated open coverity issues. Found a solution template for the division-by-zero thing; wrote a proposed patch to change the behavior of BUG() under coverity. * This week: * At PETS. Mike: * Last week: * Wrapped up vanguards addon, wrote blog post, monitored it * Wrote research post * Helped Chelsea with a second research post based on her talk at Waterloo * Did some code review * This week: * Try to implement requested features of vanguards addon (bridge compatibility, excludenodes compatibility, deb pkgs) * Can anyone help me with deb packages + getting vanguards into our deb repo? * Update the two guards proposal. ahf (on vacation during the meeting): * Last week: - Vacation + at hope. * This week: - return from HOPE and get back to s8 tasks. teor (offline): last week: - prop#295 - improved relay crypto - reviewed proposal - https://lists.torproject.org/pipermail/tor-dev/2018-July/013331.html - tor-spec fixes related to the proposal (#26869) - tor-spec and cell padding (#26228, #26871) - Bwauth work - Bwauth code and spec reviews and fixes (#26740, #3723, #26851) - Try to validate sbws bandwidth measurements https://github.com/pastly/simple-bw-scanner/issues/182 - Let's make a debian package for sbws, even if it's not ideal (#26848) - CI - Tried to work out why Travis builds are leaving a coredump behind (#26787/#26788) - SKIP some failing tests on Windows (#26830, #26853) - Support tor on OS X 10.9, because that's what Tor Browser supports (#26876) - Other Ticket Reviews (#17873) this week: - I'm on coverity/CI duty this week - coverity appears up to date (thanks ahf, nickm) - I'll be watching CI to see if #26830, #26853, and #26787/#26788 work - Book Mexico travel - Work out timesheets - Fix and test an onion service ed25519 id mismatch bug (#26627) - Finish PrivCount in Tor blinding and secret sharing branch (#25669) - work out what to do about Rust i128 miscompilation if I get time: - Implement PrivCount in Tor noise (#26637) - Work out if I need to test C code from Rust (#26398) - Work on a per-relay / per-consensus / per-counter noise spec for PrivCount in Tor (part of #25153) - Reduce my other review and revision backlogs asn: Last week: - Was at HOPE. Talked to many people. Did all the things. - Helped Isa with the onion proposal. - Finalized #25552 branch. It's now merged. - Reviewed #26437, #26780, #26712. - Finalized and published vanguard blog post with Mike. - Found a few HSv3 bugs with David. This week: - Attend PETS. Give rump session talk about the latest research blog posts. - Move forward with things decided and discussed during HOPE. - Do some triaging of the HSv3 bugs found with David during HOPE. - Help Isa more with funding proposals? catalyst: last week (2018-W29): - bug triage rotation - reviewed #26787 (Travis CI unexpected corefile during distcheck) - reviewed #26485 (warn relay ops about weird version strings) - reviewed relay crypto prop#295 again - reviewed some of teor's spec changes relating to prop#295 - wrote more spec changes in response to finding existing spec ambiguities while reviewing prop#295 this week (2018-W30): - code reviews - more progress on prop#295 and large patches doc dmr last week - helped out a bit with various tor-spec tickets: #26870, #26228, #26871 [kinda], #26859, #26860 - filed an IP-address-not-scrubbed ticket: #26882 - debugged a bit for #26709 this week - actually post log for #26709 - follow up a bit more on spec tickets - probably a few more bookkeeping things

1 0