- tor-project - lists.torproject.org

Network team meeting notes, 9 April 2018
by Nick Mathewson 09 Apr '18

09 Apr '18

Hi! You can find our weekly meeting log over here: http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-04-09-16.59.html The contents of the pad are below: = Network team meeting pad, 9 April 2018 = "And before that I was Nautilus II. Oh, and I was called Jamie for a while... and I often like to go by Sir Duckworth. Changing names is fun!" -- Ben Clayton, _Narwhal Peanut Butter and Jelly_ Welcome to our meeting! Mondays at 1700 UTC on #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! Note the meeting location: #tor-meeting on OFTC! (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) == Previous notes == 5 March: https://lists.torproject.org/pipermail/tor-project/2018-March/001685.html 26 March: https://lists.torproject.org/pipermail/tor-project/2018-March/001695.html 3 April: https://lists.torproject.org/pipermail/tor-project/2018-April/001705.html == Stuff to do every week == * Let's check and update the roadmap. What's done, and what's coming up? url to roadmap: https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Check reviewer assignments at https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… == Announcements == * 0.3.4 triage has happened; most things with the 034-removed tag are now gone from 0.3.4; mostly into Unspecified. * Did I remove anything you loved? Search for "034-removed" to find out! * In particular, please have a quick look at the "034-removed" tickets in status needs_revision. * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing 0.3.4.x work. * Important dates: * Apr 15, 2018 -- 0.3.3.x stable is supposed to be ready! * May 15, 2018 -- 0.3.4.x feature freeze! * Remember: don't spend more than a day working on anything that isn't on the 033 or 034 milestones. * When doing the Bug Triage, we must not let ticket without a Milestone. Currently 26 without one...: https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… [asn: eek. I take blame for those last ones there! I was a bit confused on whether I should put them on 034 or Unspecified and then inertia took over..] [nickm: This has gotten harder, though, since we stopped using "034" as a catch-all for whatever is maybe-should. Should we talk about where these tickets _should_ go?] [dgoulet: I'll update the TicketTriage page about the 034-proposed keyword in case of doubt for Unspecified] DONE == Discussion topics == * How did all the rotations go last week? - isabela: i want to proposal a rotation retrospective via email so we can document better our feedback so far and adjust the process as needed * We need to finish all the 033 tickets. How are we going to do this? * Can we amend our meeting process to say "write updates on a the pad 'before' the meeting?" == Updates == Nick: Last week: * PETS reviews * SoP apps review * Reviewed and merged a lot * Mainloop refactoring tickets for sponsor8. * 0.3.4 triage * 1:1:1 meetings * ED hiring work This week: * Final 0.3.3 ticket cleanup * 0.3.3.x-rc? * Second-round ED interviewing? * 034-CPU work on bucket refill events (dgoulet, let's check in with your current thoughts about events?) [dgoulet]: Yes! Worked quite a bit on #25375, we can assess what's up. * Several smaller 034 tickets, time permitting * Scowl at jenkins, time permitting asn: [It's national holidays over here due to orthodox easter. I will probs be somewhere with my family having dinner during the meeting. Sorry about that!] Last week: - Spent more time discussing the 033 guard/dos bug: #25347. In the end I decided that we should NACK the original patch here, because of the potential security implications. My plan is to defer this ticket to 034 for now, except if someone else has a short-term plan for 033. - Reviewed #25581, #25516, #25296. - Reviewed #25705. Ticket needs some more attention now. Mike should we aim for 034 with this one? [Yes, 034 seems fine - Mike] - Assigned reviews with David. - Met with Arlo/dcf/Roger/Tommy to discuss the future of Snowflake. - Did bug triage duty This week: - Hopefully get time to work on the variou 034 deliverables (2-guards, vanguards, etc.) - Another Snowflake meeting on Thursday. - Review #25705. - Figure out what to do for #25347 in 034 timeframe. - Review SoP applications. dgoulet: - Last week: * Ticket triage, review and patchs (in 033 and 034). See timeline. * Worked on modularization: #25610. See ticket for the dev branch. * Addressed arma's review of #25226. * Initial work on #25375 (remove items from our per-sec. callback) * Was on Coverity duty. One warning but we can ignore it. Unfortunately, scan.coverity.com seems down right now so I can't log in. - This week; * Both my 033 tickets are in needs_review so we'll monitor them closely to get any fixes in quickly. * Continue work on roadmap items, most likely #25375 and #25610. * Need to start an HS discussion with a SoP candidate. * I'm the community hero this week. haxxpop: - Last week: * Tried to finish the service-side client authorization (but not finished yet) * I have defined some additional structs that is needed to finish the service-side but haven't implemented code to encrypt the descriptor using clients' pubkey - This week: * Finish the service-side by implementing code to encrypt the descriptor * Start the client-side when I finish the previous one Mike: - Last week: * Finalized Proposal 291. Roger: Please see Section 3.1; isis please see 2.4. * Worked on #25400, #25705. * Read some queue management RFCs and QUIC research papers. - This week: * Disucss #23978 with asn * Start thinking about #24487/maybe write a short proposal * I would like to make a decision on Prop 291, #24487, and related path issues soon. pastly: last week: - Write tests that cover 3.99 out of ~12 parts of sbws - Add command to compress old sbws data and delete really old sbws data - Add a backtrace when there's an exception in a worker thread to aide debugging - Merge bugfix from juga; merge features from juga - Use better source of randomness (thanks teor) - Claim that sbws uses Semantic Versioning, and document what the "public API" is for sbws this week: - MOAR TESTS - Definitely more unit tests to turn 3.99 into 12.00 - Hopefully merge and make even better some tests to enforce code style and static analysis outside of my personal editor. - MOAR DOCUMENTATION - Contributing.rst/style guide - Docstrings as I get to them in tests - Run an sbws client and/or an sbws server on a new machine if I can get python3 installed in my $HOME 3-4 weeks from now: - Get paperwork back saying sbws can be open sourced juga: - can't attend today, but back online at 19UTC - Last week: * report and fix (https://github.com/pastly/simple-bw-scanner/) #62, fix #56, #39, #52, #33 * talk more with pastly and teor about how to compare results in testnet * worked on 2nd part #25515 (not commited yet) * try to organize weekly meeting with pastly (https://ethercalc.org/xs6s6k1wfb13 ) teor, pastly,should we try Thursdays at 22UTC?, anyone else can join or say which are prefered times [pastly: Thursdays at 22:00 UTC works for me. teor will most likely be sleeping during this network team meeting. So we should email him or network-team@ about the existence of this meeting] - Next week: * write v3bw format (https://gitweb.torproject.org/torflow.git/tree/NetworkScanners/BwAuthority/…) with version in https://gitweb.torproject.org/torspec.git/tree/dir-list-spec.txt? * comment/fix #64 * more doc and bug fixes in sbws isabela: Last week: * syncs with team members that requested it * followed the censorship team meeting on snowflake work * finishing the clean doc for .onion state requested by Geko This week: * proritizing reports to sponsors * tb ux work * sitemap for torproject.org new site * draft .onion work for proposal tommy will be working on (deadlii catalyst: Last week (2018-W14): * community guide rotation: - #23846 (libtool build) - #25549 (appveyor) - following up on cell crypto session from Rome - #25511 (getinfo for utc/local time) * review rotation: - #25511 - #25679 (TOR_RUST_DEPENDENCIES) - #25341 (re-review after Rust 1.25 release) * made some progress on #25061 * recruiting people for Community Council * laptop stand seems to be helping with ergonomics, yay! This week (2018-W15): * bug triage rotation * review rotation - #24659 review is delayed because it will require me to take some time to learn new things about Rust, which i'm happy to do, but will need a large stretch of uninterrupted time that i should spend on #25061 (which is 033, while #24659 is 034). i'm happy to hand it off to someone with better Rust knowledge if it needs to get reviewed sooner * work on "approach two" of #25061 ("approach one" should probably be a technical-debt reduction ticket for 034?) * more cell crypto follow up if needed * Community Council election discussions if needed ahf Last week: Sponsor 8: - Snapshot taken of HS speed test data. - Worked with David to keep up with his DirAuth modularization work. - Wrap my head around our directory server code and how it is being used. Misc: - Reviewed #24854 - Revised patches for #24782 and #24854 - Worked on reviewing #24454: - Got a Tor ARM64 development environment up and running at home. - Able to test the proposed patches, we decided to postpone this to 0.3.4. This week: Sponsor 8: - Continue work on dir auth modularization with focus on making the dirserver code handle requests in different modules (dirauth specifically). Misc: - Review #20522 isis: last week: - made arrangements for seattle - did the next bit of refactoring to split crypto_rand* stuff out of crypto.[ch] #24658 - added note about bool type compatibility to the docs/guidelines #25727 - finished up the patches for #25517 - also the spec patch for #25517 - added some input on some rust related tickets #25714 #23846 - reviewed #25515 - started reviewing #25409 (sorry! not done yet, i totally spaced) - did a brief experiment with iwyu to clean up our header files and reduce modular dependencies on or.h https://include-what-you-use.org/ is this an avenue safe and worth pursuing? this week: - - fixing up #24986 - wrapping the rand stuff, finally #24660

1 0

Tor Browser team meeting notes, 9 April 2018
by Georg Koppen 09 Apr '18

09 Apr '18

Hi! Our weekly meeting just finished. The chat log can be found on http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-04-09-17.59.log… and our pad items are: Discussion: Are we good with the roadmap? (it got colors!) https://docs.google.com/spreadsheets/d/1joFGDiHaqlorGeXhytKakiSnWY9TqTDv5Xq… mcs and brade: Last week: - Made a triage pass over all of the open Tor Launcher tickets. [GeKo: would you say you are done with this round of bug triage? mcs: Yes.] - Reviewed the team roadmap. It looks good to us. - Reviewed the patch for #25126 (about:tor should work on small screens). - Helped with #25548 (Update macOS SDK for Tor Browser builds to 10.11). - Sent email to tbb-dev about some important ESR 60 updater changes. - Participated in the Android developer interviews. - Participated in the UX/Tor Browser "sync" meeting. - Attended the Snowflake meeting (Mark). This week: - Work on rebasing Tor Browser updater patches for ESR 60. - Continue to participate in the Android developer hiring process. - Revisit #25509 (Tor browser tells me "A local proxy is needed when connecting through a company, school, or university network") Can we get some input from the UX team? GeKo: Last week: - Worked on finishing the roadmap - Backport of security bugfix (bug 1448771) - review of #25304 - monthly admin stuff - first two android interviews - bug triage This week: - Reviews (#20302, #25420, #25746) - more bug triage - noscript update - more IRC interviewing - Finish #25481 - Picking up https://bugzilla.mozilla.org/show_bug.cgi?id=1390583 again (Stylo cross-compile for Windows bug) - We plan to release an alpha, who wants to try building? boklm: Last week: - Finished #25304: update gcc to 6.4.0 for the Linux build - #25420 has patches for review (Update gcc to 6.4.0 (Windows)) - #25746 has a patch for review (git_submodule option doesn't work when a submodule is not in the root directory) - started bisecting binutils reproducibility issue - started looking at testsuite issues This week: - continue work on toolchain updates - fix testsuite issues - reinstall nightly builds VM with more disk space tjr - I have been landing build fixes to MinGW x64 in TaskCluster, but have not gotten the browser to run. I have been focused on getting a version running that has symbols; which involved creating a separate debug-link file for gdb. However, the file I create has some sort of error in it, so I am building debug versions of gdb to try and understand why the generated file is unparseable. pospeselr Last weeK: - have a fix for js::GetNativeStackBaseImpl() (#20283), will have a patch up shortly on trac - verified nothing explodes when applied to mozila-central, ran all tree-herdertests, verified /proc read goes away This week: - ensure no other file system syscalls are hitting /proc in a way that would break things - revisit #25147 - something else? (GeKo #25458?) - review GK's patches (#21537, #25721) sysrqb: Last week: Began rebasing/cherry-picking Orfox patches onto mozilla-central The Guardian Project released an Orfox update Worked on updating https-everywhere add-on This week Continue moving Orfox patches onto mozilla-central Merge updated https-everywhere add-on (#25603) Antonela put me in contact with someone looking at/researching(?) Tor Browser and HTTP/2 sysrqb: arthur, I'll loop you in when i get a response, i don't have any more details yet [arthur: thanks!] arthuredelstein: Last week: Continue rebasing to mozilla-beta (future ESR60) (#25543). Almost there! Asked mcs and brade to help with the updater patches (thanks!). Revised https://trac.torproject.org/projects/tor/ticket/24309 (circuit display). The last thing I have to do is get the second instance of "Guard" to be purple. This turns out to be an NP complete problem! This week: Finish and polish the rebasing Start working on integrating rebased branch with the TBB build Finish up the circuit display sukhe: This week: Working on #25483 https://trac.torproject.org/projects/tor/ticket/25483 (Windows reproducible build of snowflake) isabela: - trying to finish clean doc with all .onion states - final reports to sponsor4 - remember sync this wed! - follow up on security controls and maybe a pick on about:tor igt0: Last Week: - Worked on #25743, I am able to reproduce however I am not able to fix since i think it is not a Tor problem igt0: Geko, maybe should we contact cloudfare? [GeKo: I'll look into that, yes] [sysrqb: seems like a Google Recaptcha bug/problem. i wonder if we can reproduce this on any other site directly serving recapcha. ] igt0: sysrqb: I tried on https://www.google.com/recaptcha/api2/demo when the JS is enabled it says that the browser is not supported - Fixed issues appointed in the #25126 This Week: - #25703 Georg

1 0

March 2018 report for the Tor Browser team
by Georg Koppen 09 Apr '18

09 Apr '18

Hi! In March we were quite busy keeping up with Mozilla's almost weekly security updates. Two releases, Tor Browser 7.5.1[1] and 8.0a3[2], got out during the Tor dev meeting (which was a new experience) and contained an update to Firefox 52.7.0esr + newer Tor versions (0.3.2.10 and 0.3.3.3-alpha, respectively). Additionally, they mostly shipped bug fixes (e.g. a fix for broken Windows Vista 64bit builds) with one notable exception: Moat, our new feature to request bridges via meek from BridgeDB, made it into 8.0a3 for wider testing. Tor Browser 7.5.2[3] and 8.0a4[4] shipped Firefox 52.7.2esr including the fixes for the bugs found during Pwn2Own. Tor Browser 7.5.3[5] and 8.0a5[6] in turn picked up Firefox 52.7.3esr. Apart from releases we made progress in our preparations to switch to Firefox ESR 60: we worked on rebasing our patches, integrating rust into our build setup, and updating our toolchains, to name just a few areas. On the mobile side we finally merged the Orfox patches into our tor-browser repo[7] and started to help with getting updated Orfox versions faster out to our users. The latter resulted in new Orfox versions based on Firefox 52.7.2esr and Firefox 52.7.3esr following the above mentioned Tor Browser releases. The full list of tickets closed by the Tor Browser team in March is accessible using the `TorBrowserTeam201803` keyword in our bug tracker.[8] For April we are excited to see a lot of progress in our work with the UX team: we are close to have an updated circuit display ready[9] and plan to make improvements to our security controls[10] and our about:tor start page[11]. Two additional major areas of work for April will be Tor Browser for Android and preparations for Firefox 60. For the former, we outlined a mini-roadmap containing all the items we need to have solved before we want to ship a first alpha (which is planned for July)[12] and are now following up on those tasks. The latter is more of patch rebasing and toolchain updates already seen in March. We hope to start early this time with reviewing the new features that landed between Firefox 52 and 60 to have more time for writing patches. But we'll see. All tickets on our radar for this month can be seen with the `TorBrowserTeam201804` keyword in our bug tracker.[13] Georg [1] https://blog.torproject.org/tor-browser-751-released [2] https://blog.torproject.org/tor-browser-80a3-released [3] https://blog.torproject.org/tor-browser-752-released [4] https://blog.torproject.org/tor-browser-80a4-released [5] https://blog.torproject.org/tor-browser-753-released [6] https://blog.torproject.org/tor-browser-80a5-released [7] https://bugs.torproject.org/19675 [8] https://trac.torproject.org/projects/tor/query?status=closed&keywords=~TorB… [9] https://bugs.torproject.org/24309 [10] https://bugs.torproject.org/25658 [11] https://bugs.torproject.org/25695 [12] https://lists.torproject.org/pipermail/tbb-dev/2018-March/000814.html ff. [13] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig…

1 0

March 2018 Transifex report
by Colin Childs 06 Apr '18

06 Apr '18

Hi everyone, Below is the monthly Transifex report for March, 2018: ### Report Attached are daily, weekly and monthly translation graphs. The Y axis is "source words”. 20.28k source words 1.83k source strings 3,495 collaborators 154 languages 53 Project resources 2 languages at 100% completion (across all 53 project resources): French (fr) Spanish (es)

1 0

Notes from April 5 2018 Vegas team meeting
by Karsten Loesing 06 Apr '18

06 Apr '18

Notes for April 5 2018 meeting: Roger: 1) Brave is integrating Tor into their browser and this means we're going to have some trademark questions to answer soon ("no, those are Tor Private Tabs. Of course they're less safe than Tor Browser. Why are you so confused?"). Also, they could be convinced to run relays and/or donate for running relays. We should hook up Steph and Shari with their press people. And we need somebody to take point on this relationship. [Conclusion: this isn't just Brave, it's Cliqz, Mozilla, Facebook, etc who are working to integrate Tor into their things. We're going to get together a team of people -- dev, press, relay capacity, etc to try to handle the question more generally.] 2) Steph: Status on Rightscon booth plan? Plans for three bonus Rightscon tickets? [steph: we're on track for a free, half day booth. waiting to hear about time slot.] 3) Mike: you sent the google recaptcha mail right? [GeKo: I got copied, so it seems "yes"] Mike: 1) Sent mail to a DoS engineer I know at Google. No reply. 2) tor-dev things Georg: 1) We are almost done with putting our final roadmap in place and started to work according to it 2) We worked with the UX team on the improved circuit display and security controls, exciting! 3) We did the first two interviews for the Android related position Nick: 1) Nothing much happening. Isabela and I are doing more regular meetings with team members who wanted them. 2) Will 0.3.3-stable come out on 15 April? Probably not, but 0.3.3-rc is possible. 3) Trying to read all Summer of Privacy applications later today; I'm behind there, and need to catch up. 4) Trying to triage all the 034 tickets with my team. Steph: 1) The DDG Privacy Challenge ends April 10. If we raise $500 this week (tues-tues), we get $2,000. $153 left to go as of April 5 14:00 UTC 2) Submitted for a half day booth at RightsCon, waiting to hear about time slot. 3) Helping with the next nyc meetup 4) Edited multiple blog posts 5) Finalizing donor material on onion services 6) Talking through going to Def Con so I can get a better feel for it to make future proposals. Alison: 1) did a workshop at the Texas Library Association conference in Dallas yesterday; it was good! 2) big priority today is getting a bunch of sponsor9 tasks done (organizing with our contacts, getting our materials together, etc). 3) code of conduct vote is still happening. please vote! 4) working on a new meeting time for the community team 5) waiting on sysadmins to create a new mailing list for meeting planning; once that's done I'll coordinate with the meeting planning group that formed in Rome 6) in the meantime I'm helping Jon some with Mexico City related tasks 7) preparing for a talk in June at the French librarian's congress in La Rochelle 8) more LFI prep, lots of curriculum development 9) reviewing community liaison applicants!!!! 10) helping some with next NYC Tor meetup 11) way behind on writing community team roadmap but it's on my list! 12) Tommy is actively seeking funding for global south meeting/meetup related stuff 13) privacy meetups in Pune, India (run by kushal) seem to be going well and are happening regularly 14) are people nominating volunteers for special swag and glory? make sure your team is doing this and telling kat5! [ux team is so little i am checking tho:isabela] 15) sukhe has been working with the Toronto Public Library to help further their Tor Browser program (they're doing a pilot in one library and then eventually want to be TB on all public computers, then run an exit!!!!!!!) 16) Phoul is working on a new proposal to deal with the endless frontdesk@ queue 17) Phoul is also making progress on all the Outreachy and Summer of Privacy tasks 18) I sent you all an email with the list of invitees from Rome. let's start preliminary planning who we want to invite to Mexico City. Arturo: 1) Published our research on how we are going to approach developing a methodology for investigating internet blackouts: https://ooni.torproject.org/post/investigating-internet-blackouts/Investiga… (announcement blog post: https://ooni.torproject.org/post/investigating-internet-blackouts/) 2) Published a blog post on the internet blackout in Sierra Leone following the elections: https://ooni.torproject.org/post/sierra-leone-network-disruptions-2018-elec… in collaboration with Campaign for Human Rights and Development International 3) Will soon publish March report 4) Did some research and wrote a statement for the Internet Sans Frontier press release on the shutdown of social media in Chad: https://internetwithoutborders.org/chad-is-blocking-social-media-and-messag… 5) Reached prototype quality version of OONI Probe desktop for macOS: https://github.com/openobservatory/ooniprobe-desktop. Golang is the winner of the language war for writing the CLI interface. 6) Some progress on the Tor-in-MeasurementKit integration: https://trac.torproject.org/projects/tor/ticket/23846 Karsten: 1) Wrote a first draft document containing approximately 2500 words with a graph specification of the relay users graph and sent it Tor folks outside of the metrics team for an initial review. 2) Discussed which Java frameworks to include in the white paper about CollecTor's data processing. Isabela: 1) Decided to 'wave my tail' to all sponsors - pinging people on different things such as status of proposals that are under review, or status of proposals we are executing or proposals we just finished. 2) Besides these personal emails I am also writing reports (big reports month this month) 3) catching up on tasks w/ ux team and services/infra - finishing organizing roadmaps on gitlab kanban (yeah we are doing that) and finishing old open tasks from ux work that are on my plate 4) many meetings, new ones are: 1:1:1 with nick and folks from network team who requested those; wednesdays ux team meetings in April will be focus on Tor Browser work; fridays on sponsor9 (aka website stuff) work; sync with tommy on fridays too to follow up on censorship team work and grant proposals. Shari: 1) on my way to San Francisco for a bunch of meetings through the weekend 2) getting Heather (new CFGO) acclimated 3) moving to next round on ED search 4) writing job description for development (fundraising) director 5) choosing new auditor and finishing 990 for 2016 (hopefully this week)

1 0

March 2018 report for the metrics team
by Karsten Loesing 05 Apr '18

05 Apr '18

Hello Tor, hello world! Below you'll find the highlights of Tor metrics team work done in March 2018. On behalf of the Tor metrics team, Karsten Wrote a first draft document containing approximately 2500 words with a graph specification of the relay users graph [1] and sent it Tor folks outside of the metrics team for an initial review. The relay users graph is our most popular graph and also one of the most complex ones. We'll be able to re-use parts of this specification, or link to it, from other graph specifications. All in all, we'll produce approximately 10 times as much text for all graphs and tables. [1] https://metrics.torproject.org/userstats-relay-country.html Discussed [2] which Java frameworks to include in the white paper about CollecTor's data processing. [2] https://bugs.torproject.org/25644 Started providing metrics timeline events as Atom feed [3, 4]. [3] https://metrics.torproject.org/news.atom [4] https://bugs.torproject.org/23854 Added more explanations to the website why metrics are important and what we do to make sure they're safe [5]. [5] https://metrics.torproject.org/about.html Released Onionoo protocol version 5.1 [6] which always adds a relay's own fingerprint to its "effective_family" and makes nickname fields "n" in summary documents and "nickname" in details documents required fields. [6] https://lists.torproject.org/pipermail/tor-dev/2018-March/013012.html Set up CollecTor's webstats module to sanitize web server logs [7] and modified metrics-web to process these logs [8] instead of the ones available on webstats.tp.o [9]. [7] https://metrics.torproject.org/collector.html#webstats [8] https://metrics.torproject.org/webstats-tb.html [9] https://webstats.torproject.org/

1 0

OONI Monthly Report: March 2018
by Maria Xynou 05 Apr '18

05 Apr '18

Hello,* * The OONI team made steady progress in March. We published a technical report explaining our new methodology for investigating internet blackouts, and we created a working prototype of the OONI Probe desktop app for macOS. We also released the first iOS testflight and continued to make progress in revamping our mobile apps. # Internet blackouts methodology ================================== We are experimenting with the creation of a new methodology that will be included in future OONI Probe mobile app releases, enabling community members to participate in internet blackout investigations. We published a technical report explaining how we are going to approach developing a methodology for investigating internet blackouts. This report is availablehere: https://ooni.torproject.org/post/investigating-internet-blackouts/Investiga… We also published a blog announcing the report and explaining why we're interested in developing this methodology: https://ooni.torproject.org/post/investigating-internet-blackouts/ Our strategy is going to involve using OONI Probe mobile deployments to gather rich network telemetry documenting when, where and how an internet blackout is happening by running network measurements from the edge of the network. # OONI Probe Desktop apps ============================== We made a lot of progress on the OONI Probe desktop apps. We now have a working prototype of OONI Probe Desktop on macOS. This uses the following software components that we developed: * Measurement Kit Golang bindings: https://github.com/measurement-kit/go-measurement-kit * OONI Probe golang CLI: https://github.com/openobservatory/gooni * OONI Probe Desktop electron app: https://github.com/openobservatory/ooniprobe-desktop Since this is just a prototype, we will not be publishing a .app (or .dmg) at this stage. If you are interested in hacking on it, you can follow the instructions inside of the ooniprobe-desktop Readme. Please be aware of the fact that it's still in its early stages of development. When the app will be out, you will likely have to do some cleanup (i.e. deleting the ~/.ooni directory). # Progress on revamping the OONI Probe mobile apps ======================================================= As part of our work on revamping the OONI Probe mobile apps, we re-wrote all of the copy and continued to make improvements to the design and UI. We also released the first iOS testflight including the following features: * Ability to run tests * Ability to re-run failed tests * Ability to filter test results * Basic test result screen # Updated test lists ======================== We carried out research (https://ooni.torproject.org/get-involved/contribute-test-lists/#test-list-r…) <https://ooni.torproject.org/get-involved/contribute-test-lists/#test-list-r…> to identify more URLs to test for censorship in Sierra Leone. Based on this research, we updated the Sierra Leone test list: https://github.com/citizenlab/test-lists/pull/320 We also updated the following test lists based on URLs provided by community members: * Azerbaijan: https://github.com/citizenlab/test-lists/pull/316 & https://github.com/citizenlab/test-lists/pull/311 * Russia & Ukraine: https://github.com/citizenlab/test-lists/pull/310 # Community use of OONI data ================================ ## OONI data cited in research reports ========================================= * Article19 report ("Iran: Government throttling of Telegram after lifting block"): https://www.article19.org/resources/iran-government-throttling-telegram-wen… * Citizen Lab report ("Bad Traffic: Sandvine's PacketLogic Devices Used to Deploy Government Spyware in Turkey and Redirect Egyptian Users to Affiliate Ads?"): https://citizenlab.ca/2018/03/bad-traffic-sandvines-packetlogic-devices-dep… ## OONI data used as part of Pakistan court case =================================================== For the first time (to our knowledge), OONI data was used as evidence of internet censorship in a court case. Last November, we reported on the blocking of news outlets, social media sites and IM apps amidst protests in Pakistan (https://ooni.torproject.org/post/how-pakistan-blocked-social-media/) <https://ooni.torproject.org/post/how-pakistan-blocked-social-media/%29>. Our report (and the OONI data it shares) was referenced in a recent court case in Pakistan that challenges the legality of the social media censorship events from last November. As an outcome, the Islamabad High Court has directed the government to provide a legal justification for the censorship events, and to submit written replies in response to the petition of local human rights advocates. More information about this case is available here: http://digitalrightsmonitor.pk/islamabad-high-court-takes-up-petition-filed… # Community activities ======================== ## NullCon ============ We traveled to India to present OONI at NullCon on 2nd March 2018. Information about our talk is available here: https://nullcon.net/website/goa-2018/speakers/leonid-evdokimov.php ## Internet Freedom Festival (IFF) ======================================== This year OONI was an IFF partner. As part of our participation at the event, we helped organize the social evening on 7th March 2018 (https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…) <https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…> and we hosted an OONI Partners Meetup (on 6th March 2018). During the OONI Partners Meetup, we facilitated a session explaining how to use OONI Explorer and interpret its data. We also (co-)facilitated and participated in the following: * Which questions would you like internet censorship data to answer? (https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…) <https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…> * Internet-based information controls and elections (https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…) <https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…> * Tool Showcase: OONI presentation (https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…) <https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…> * Localization Sprint: Engaging the translator community with OONI Probe (https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…) <https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…> ## Tor Meeting ================== We attended the Tor meeting which was held in Rome between 11th - 15th March 2018. As part of the meeting, we held an internal team meeting where we worked on our roadmap for the next 6 months. We also facilitated the following sessions: * Building communities to measure & respond to global censorship events (discussion of challenges & brainstorming on strategies) * OONI Tor vanilla + Tor launcher one click solve all censorship problems!! * OONI Internet blackout methodology * OONI Censorship Alert System * OONI data analysis More information about the latest Tor meeting and its sessions is available here: https://trac.torproject.org/projects/tor/wiki/org/meetings/2018Rome/Working… ## Community meeting ======================== We hosted the OONI community meeting on 27th March 2018. As part of the meeting, we discussed the following: 1. Standard form to add URLs for testing 2. Which features would you like to see in the OONI Probe mobile apps? 3. Using OONI Run 4. Using Discourse as a long-term replacement for mailing lists? Would it serve community neeeds better? # Userbase ============ In March 2018 OONI Probe was run 304k times from 5,091 different vantage points across 211 countries around the world. This information can also be found through our stats here: https://api.ooni.io/stats ~ The OONI team. -- Maria Xynou Research and Partnerships Coordinator Open Observatory of Network Interference (OONI) https://ooni.torproject.org/ PGP Key Fingerprint: 2DC8 AFB6 CA11 B552 1081 FBDE 2131 B3BE 70CA 417E

1 0

(FWD) [tor-relays] Ubuntu LTS about to ship with a soon-to-expire Tor version?
by Roger Dingledine 05 Apr '18

05 Apr '18

FYI, if you know any good Ubuntu contacts, or you are one: Ubuntu is about to release a long-term-stable with a version of Tor that will soon become obsolete. If you have any useful progress to make here, please make it on the ticket: https://trac.torproject.org/25715 Thanks! --Roger ----- Forwarded message from Roger Dingledine <arma(a)mit.edu> ----- Date: Wed, 4 Apr 2018 22:07:36 -0400 From: Roger Dingledine <arma(a)mit.edu> To: tor-relays(a)lists.torproject.org Subject: [tor-relays] Ubuntu LTS about to ship with a soon-to-expire Tor version? Do we have any good Ubuntu contacts here? I noticed today that Ubuntu Bionic LTS will come out this month: https://wiki.ubuntu.com/Releases and they are currently on track to include Tor 0.3.2.10: https://launchpad.net/ubuntu/bionic/+source/tor which is scheduled to go end-of-life before the end of 2018: https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… So we are on track for 4.5 years of sadness for Ubuntu users -- and since some of the most critical users of the Tor deb on Ubuntu are relay operators, this seems like a good time to try to rescue things. The best fixes I've thought of are to either: (A) Convince them to downgrade to Tor 0.2.9, which we will maintain for another few years. (B) Make a deal with them where they know that 0.3.2 will be abandoned soon, and that they'll move to our next LTS once it comes out. In the past we tried something like 'B' and it did not go smoothly. So I'm inclined to think 'A' is the better plan. See also this trac ticket where I'll aim to keep track of our progress: https://trac.torproject.org/25715 I'm also going to forward this note to tor-project@ in case there are better Ubuntu contacts there. Never a dull moment, --Roger _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays ----- End forwarded message -----

1 0

Notes from network team meeting, 3 April 2018
by Nick Mathewson 04 Apr '18

04 Apr '18

Hi! You can find our chat logs from http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-04-03-16.59.html Our pad notes follow below: = Network team meeting pad, 3 April 2018 = But above and beyond there's still one name left over, And that is the name that you never will guess; The name that no human research can discover-- But THE CAT HIMSELF KNOWS, and will never confess. -- T. S. Eliot, "The Naming of Cats" Welcome to our meeting! Mondays at 1700 UTC on #tor-meeting on OFTC. [**April 2's meeting is one day late, for holiday reasons**] (This channel is logged while meetings are in progress.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! Note the meeting location: #tor-meeting on OFTC! (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) == Previous notes == 5 March: https://lists.torproject.org/pipermail/tor-project/2018-March/001685.html 26 March: https://lists.torproject.org/pipermail/tor-project/2018-March/001695.html == Stuff to do every week == * Let's check and update the roadmap. What's done, and what's coming up? isabela will give a bit of orientation on irc url to roadmap: https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… 0.3.3 must fix bugs status: https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… Needs information - no owner #21394 - mike is reviewer and needs info #3940 - isis is reviewer and needs info #25316 Needs review and has no reviewer #24454 Needs review, has reviewer and no owner #24456 Also, have a look at the other tickets in the 0.3.3 milestone that are NOT currently labelled 033-must. Should any of them get that label? * Check reviewer assignments at https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… == Announcements == * Beginning general 0.3.4.x triage this week. * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing 0.3.4.x work. * Important dates: * Apr 15, 2018 -- 0.3.3.x stable is supposed to be ready! * May 15, 2018 -- 0.3.4.x feature freeze! * Cell crypto meeting in #tor-meeting2 at 1900 UTC on Tuesday. * 0.3.4.x triage has begin! == Discussion topics == * How did all the rotations go last week? * We need to finish all the 033 tickets. How are we going to do this? * We need to triage all the tickets in 034. Should we handle it the same way we did 0.3.3.x? Can we share/divide responsibility somehow? Tickets for 034 should be the ones (at least) that we organized at our roadmap to be on 034. And yes we should triage it like 033. * Let's discuss the 034-roadmap-proposed tickets? I think this is related to the other 2 questions above (033 and 034) and related to the roadmap check in. In short we need to review the amount of work we have planed to be done by May (which I think we are overcapacity but lets discuss that) * Should we change our regression rule? (Currently, we say that a regression is automatically 033-must or 034-must. But maybe this only makes sense for recent regressions? If something broke in 0.2.9 and nobody has noticed it since, maybe it isn't "must".) == Updates == Nick: Last week: * Start PETS reviews * Finished first round of ED screening * Review and merge a lot * Released 0.3.3.4-alpha * This week: * Finish PETS reviews * Review and merge a lot * Review all relevant SoP applications * Work on libevent mainloop-related refactoring for sponsor8 * Work on identifying triaged-in tickets for 0.3.4 * Maybe start on bucket-refill refactoring for sponsor8 teor: Last week: * Deployed research code (3.5 codebases, 3 machines, ~10 instances) * Worked with juga and pastly on bwauth scaling * Reviewed a Tor Summer of Privacy proposal * Collected streams-per-circuit for arma's DoS limits * Started a data collection for a paper This week: * Analyse streams-per-circuit and send an email * Post-travel admin * General employment admin / research admin * Maybe collect streams-per-circuit with less noise * Revise the PrivCount in Tor noise code after Isis' review isabela: Last week: * finished FB proposal * first meeting following new agenda format This week: * organizing pad for todays meeting * 1:1:1 with folks * prep work for sponsor8 Q1 2018 report (due end of april) Mike: last week: - Reviewed tickets #21394, #25505, #25355; commented on #25347, #24456 - Wrote two guards proposal - Started looking at #25545 - Emails about QUIC this week: - Discuss #25545 with asn - Sit in on relay crypto meeting - Work on vanguard roadmap tickets (#25546) pastly: Special thanks to juga for all the help so far, and hope you can continue helping make Simple Bandwidth Scanner (sbws) a reality :) last week: * Make sbws (torflow replacement) into even more of a proper package. Namely, give it a config file and it runs out of a data directory, not the current working directory * Write 95% of a specification for sbws * Close many usability tickets * Add version to client/server handshake and to result output * Begin running sbws in testnet with a variety of configurations * Choose a license, CC0 * SUBMIT PAPERWORK NECESSARY TO RELEASE SBWS AS AN OPEN SOURCE PROJECT * SUBMIT PAPERWORK NECESSARY TO RELEASE SBWS AS AN OPEN SOURCE PROJECT * SUBMIT PAPERWORK NECESSARY TO RELEASE SBWS AS AN OPEN SOURCE PROJECT this week: * Close some more UX tickets * Hopefully compare sbws to torflow in the testnet, with help from teor * Moar documentation!!! next month: * Get paper work back stating I can/cannot release sbws asn: [we should roadmap #25552 (rev counters hsv3) and #20212 (client-side guard dicsovery)] Last weeks: - Made patch for the 033 ticket I took over last week: #25347. After discussions with people, it seems like behind that ticket there are hidden complex security-related decisions and we should be really careful on how to resolve it. More discussion with at least Mike and Roger is required to make sure we come up with something decent here. - Worked on my vanguard simulator (#25545), polished the code, and pushed it on github: https://github.com/asn-d6/vanguard_simulator There is still work to be done here so that the results are useful for taking decisions, but publishing the code is an important first step. - Did roadmapping on the Penn censorship project. - Discussed switching to 2 entry guards with Mike (#25668). - Reviewed #24989, #25024, #25432, #24767. - Reviewed #25581 but it's still unclear what should happen here. I think Mike's input is required. - Finished community guide duty for this week - Acked exarkun's patch on #25627 - Got filipo's patch merged in #24342. - Discussed bw scanner work with juga. - Merge_readied #25432 by fristonio. - Helped researcher I met in RWC to use Chutney to test his patches. This week: - Bug triage duty. - More work on 033 ticket #25347. - More work with mike on 2-guard proposal and vanguard simulator. - Meeting with David/Arlo on Thursday about Snowflake and the penn censorship project. - Reviews as needed. ahf Last week: Sponsor 8: - Talked with Nick about Idle API. - Looked at DirAuth call graph for the directory server interface to figure out where DirAuth specific code is called from. Misc: - Submitted patch for #24782. - Fixed review comments for #25355. - Bug triage rotation role. - Worked together with Isis on review of #25425. - Reviewed #23846 and couldn't find anything problematic there, except for the Rust warning that Simone had seen himself. - Out Thursday/Friday and Monday for easter with friends and family. This week: Sponsor 8: - Talk with David (and maybe Nick?) about the DirAuth module project. - Begin splitting things up for DirAuth module project. - Discuss with the people from the guardian project some of the things we discussed last week for the Idle interface. Misc: - Work on more 033 tasks. dgoulet: - Last week: * Reviewed and worked on 033 tickets (most of them 033-must). See Trac Timeline for more details there. * Had a planning meeting with Nickm about roadmap item: Reduce client CPU usage. * Had a planning meeting with ahf about roadmap item modularization which is extracting dirauth into its own module. (#25610) * Investiguated #25616 which needs feedback about the possible solutions (staring at asn :). * Got #24767 merged so exciting. Thanks to the reviewers! * Discussed with arma the #25226 and I got a review from him so \o/ - This week: * Continue on 033-must tickets, I think I still have one to be merged. * Roadmap items, mostly modularization. From which, would be nice if people would read this small comment about the "plan" for dirauth code. If you think some of it is crazy or we could do better, good time to say so because after that we start in that direction. https://trac.torproject.org/projects/tor/ticket/25610#comment:3 haxxpop: - Last week * Start implementing hsv3 client authorization (progress https://github.com/torproject/tor/pull/36) * It includes loading HiddenServiceAuthorizeClient in torrc to the service * It also includes generating a new curve25519 key pair if we do not have that client's pubkey yet. Or just load the key if we already have that client's pubkey. - This week * Properly encrypt the descriptor if the client authorization is enabled catalyst: - Last week (2018-W13) * fixed two Coverity defects (#25629, #25675) (weekly rotation) * meeting on large create cells * fixed some torspec typos and got commit rights in that repo * did some follow up about the Rome cell crypto session -- meeting 1900 UTC today * looked at some build system patches (#23846 -- libtool, #25549 -- Appveyor) * looked into #25061 some more * worked with isis on some configuration of our github org * talked with people about the two github org issue * experimented with improving my work space ergonomics - This week (2018-W14) * cell crypto meeting today * community advocate rotation * write up my thoughts on #25061 and try something * code review * investigate the deleted github branches that keep reappearing * talk more with people about the two github org issue * more ergonomics juga: - Last week: * sbws: followed progress, talked with pastly and teor, add some docs * funding: wrote and submitted application for F3 * worked on #25515 - Next week: * sbws: solve some bugs, more docs * work on another test for #25515 - Maybe we could have a bwauth meeting once a month? (is difficult to find more than 1 or 2 persons to discuss in #tor-dev cause of timings) - Is it fine for all i switch (at least for now) to sbws instead of bwscanner?, - and that i integrate in it later some functionality that was in Torflow/bwscanner? - Does it makes sense i work on sbws?, or is it enough with 1 person? [pastly: thinks it makes sense to focus on sbws instead of bwscanner; also wonders what torflow/bwscanner does that sbws doesn't do and should do] [juga: ^^^ i'm not sure, we can discuss further...] [isis: where is the code for sbws? may i see it?] [pastly re isis: in a private GitHub repo, yes if you pinky promise to keep it private for now] isis: last week: - revised bridge.c tests #25425 - revised #24031 after two reviews - did the patches for #25517, now needs revision after teor's review - reviewed new appveyor configs #25549 - reported some potential windows bugs based on #25549 - reviewed build system patches for testing our C code from Rust #25386 - added more tests for C code that our Rust calls #25605 this week: - probably exposing our RNG to Rust #24660 - revising my branch for wide create cell creation #24986 - revising my function pointery handshake composition thingie #24987 - finish the sha2 thing since it's also blocking the handshake work #24659 - more prop#269 thinking/writing

1 0

Tor Browser team meeting notes, 3 April 2018
by Georg Koppen 04 Apr '18

04 Apr '18

Hello all! We had another team meeting yesterday. The chat log can be found on http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-04-03-18.59.log… and our pad items are: Tuesday, April 3, 2018 Discussion: -roadmap (https://docs.google.com/spreadsheets/d/1joFGDiHaqlorGeXhytKakiSnWY9TqTDv5Xq…) -Mozilla All Hands from the browser side - Wednesday's sync with UX team at 1900utc #tor-meeting - isa will send email to the list with agenda GeKo: Last Week: -https://bugzilla.mozilla.org/show_bug.cgi?id=1442406 (still not done, alas) -#25481 (made quite some progress) -update to the security control redesign proposal -continue triaging ages old bugs -during my Easter holidays came up with a fix for #21537 -prepared for IRC interviews This Week: -more IRC interviewing -more work on #25481 -monthly admin stuff -bug triage -getting back to #21777 mcs and brade: Last week: - Finished patches for #25405 (cannot use Moat if a meek bridge is configured). - Created an updated patch for #21850 (Update #16940 patch for e10s (about:tbupdate)). - Commented on #24309 (Activity 4.1: Improve how circuits are displayed to the user). - Spent a little time on #25663 (Downloaded files are corrupted). - Reviewed all of the updater bugs that have been fixed in Firefox since ESR52. [I am excited about the LZMA support that landed. I wonder about all the pieces we need to switch on our side for that, do we get that for free? GeKo] This week: - Review the team roadmap. - Help with code reviews including #25126 (about:tor should work on small screens). - Create tickets for some ESR60 updater-related tasks. - Start rebasing the Tor Browser updater patches for ESR 60. tjr: (may not make the meeting, feeling sick) - Got a MinGW x64 Build going in TaskCluster: https://bugzilla.mozilla.org/show_bug.cgi?id=1434316 - Don't have it running. Currently messing with --disable-install-strip to try and get usable symbols Might be a MinGW bug https://sourceforge.net/p/mingw-w64/mailman/mingw-w64-public/thread/CA%2BcU… - Have done some easy P2 Resist Fingerprinting Bugs: - Canvas Learn More Link in the Permission Prompt (Not uplifted to 60. Do you want it?) [Geko: that one looks like we would be interested] - WebGL Debug Info - uplifted to 60 - Spoof English Gets Reset https://bugzilla.mozilla.org/show_bug.cgi?id=1447592 Not uplifted yet. I have to figure out how to reproduce this, if anyone knows what they're talking about... [I think we don't need that one uplifted, GeKo] - Local IP Address Leak via WebRTC (being debated, not uplifting to 60 unless you want it) [I think this is nothing for ESR60 either for us, GeKo] igt0: Last week: - Took a look in the domain isolator to verify if it was possible to make it available for the alpha release. Final Status: The effort to make it work would be too hard since for the alpha release we will use the android vpn service. - Helped out sysrqb debugging the https-e race condition (it is still magical for us). - Investigated why cloudfare captcha doesn't render the image for Orfox users. This Week: - Keep investigating about cloudfare captcha and Firefox. Looks like if user is behind tor and the user agent is mobile, even the firefox desktop doesn't render the captcha image. [See my theory about "There is no ESR 52 for Android, therefore your browser is outdated and insecure and therefore we won't serve you content idea"? GeKo] [yep, i am using the latest fennec useragent and it didn't work (Mozilla/5.0 (Android; Mobile; rv:59.0) Gecko/59.0 Firefox/59.0) - igt0 Aha, so we need a different theory the, good. GeKo] boklm: Last week: - finished publishing of the new releases - started reviewing patch for #25483 (Windows reproducible build of snowflake) - worked on binutils reproducibility issue (#16472) This week: - continue work on toolchain updates - fix #25318 (Add Tor Browser nightly builds email notification) - work on getting the testsuite running sysrqb: Last week: Built Orfox (52.7.3) - still waiting for release https://people.torproject.org/~sysrqb/Orfox-tor-browser-52.7.3esr-7.5-1.apk Made progress on updating https-everywhere add-on (25603) - still debugging Started troubleshooting #25659 (race condition during add-on installation?) Documented some TBA roadmap items on the wiki https://trac.torproject.org/projects/tor/wiki/org/teams/ApplicationsTeam/To… Updated (a little) the Application team wiki page https://trac.torproject.org/projects/tor/wiki/org/teams/ApplicationsTeam This week: Merge Orfox https-everywhere update Start rebase onto mozilla-central sysrqb: gk, what should the review process look like? Will tor-browser.git have two new branches, one more for stable and another for alpha? [Okay, we'll wait on the rebase done by arthur; sysrqb and igt0 will help with the mobile parts. once done and reviewed we rebase the resulting patches onto mozilla-central used for tor browser alpha on mobile GeKo] pospeselr: Last week: Investigation on #20283 (Tor Browser should run without a /proc filesystem) Got a complete list of all open and openat sys calls requesting something in /proc in firefox and plugin_container process (for 64 bit linux) About 8 different scenarios found, majority of which currently handle failure gracefully 2 instances are dead code mozilla::ThreadStackHelper::GetThreadStackBase() is the remaining problem (pointed out by Yawning in the bug report) current stack address is used as a sort of heuristic in several places in the code seems to be ranges certain types of JS are allowed to recurse down to (system native, system js, user js) from what I've been able to glean, the only way to get this information on linux is via the /proc/self/maps file (this is file parsed by pthreads calls) stack size is queryable via getrlimit syscall best thing I've been able to come up with is bouncing up the rbp register until we get an address that's out of range in order to get a good estimate of where the stack memory map begins/ends seems unlikely this sort of hacky bs would get upstreamed breaks as soon as the compilation options are changed to omit frame pointer usage (-fno-omit-frame-pointer flag is required on amd64) I've started investigating what we would need to do to refactor FF to not need the stack memory layout, but this seems to be a security-ish feature? Have not investigated whether any fstat or other file related syscalls are called on things in /proc but easy enough to do once this GetThreadStackBase issue is sorted arthuredelstein: Last week: * Worked on rebasing patches to ESR60 * Worked on FPI of permissions patch https://bugzilla.mozilla.org/show_bug.cgi?id=1330467 * Revising circuit display patch: https://trac.torproject.org/projects/tor/ticket/24309 This week: * Try to finish rebasing desktop patches [mcs: where are you doing this work?] [arthur: it's on a local branch atm. Tends to get re-ordered a lot, but I could post a snapshot if needed.] [mcs: we don't need it yet but would be useful soon-ish; maybe let me know which patches brade and I should work on][arthur: will do, thanks] * Post revised circuit display patch * Try to finish permissions patch, continue Save As patch * AFK (vacation) on Thursday and Friday isabela: Final report for sponsor4 - vixe! Working on sponsor8 Q1 2018 report Reviewed all roadmap and created a tab for the things ux team is involved and i am organizing all that on ux (stakeholders) side question for arthur -> this item: "Click your flag" design - I will want it to be a test not really a feature we ship - if its related to the 'one click solve all censorship problem'. Something like this need to be tested well before we put it on alpha. Georg

2 1