- tor-project - lists.torproject.org

Fwd: Call for ideas: What should be in the Internet Health Report?
by Matthew Finkel 21 Aug '18

21 Aug '18

FYI. (I also replaced the clicktrackers in the below email) ---------- Forwarded message ---------- From: Mozilla <Mozilla(a)e.mozilla.org> Date: Tue, Aug 21, 2018 at 2:27 PM Subject: Call for ideas: What should be in the Internet Health Report? To: matthew.finkel(a)gmail.com Dear Mozillians, Today the Internet Health Report team is launching a Call for Ideas <https://internethealthreport.org/yourideas/>-- an opportunity for friends, allies, and readers to suggest the topics that deserve coverage in the next Report. The Internet Health Report <https://internethealthreport.org/2018/> is a check up on the internet. It includes research and stories from people all over the world on how the internet is working for good--or bad--in their lives. * We invite everyone to submit ideas <https://docs.google.com/forms/d/e/1FAIpQLScjVdkx69izq7NbaiHfrh_GiDtYVqaYYnq…> before September 14. * We’re mainly looking for research, articles, and inspiring initiatives to make the internet healthier, but also suggestions about issues people don't hear enough about. We accept ideas on our website <https://internethealthreport.org/yourideas/> (anonymous or public) or by Twitter message (use the hashtag #internethealth). To kick- off the campaign we will host a Twitter chat today (August 21)* 1pm - 2:30pm ET (7 - 8:30PM CEST)*. We hope you will join! Just follow the conversation led by @mozilla. *Please help us spread the word in your communities and among friends who care about the health of the internet.* Here is an example tweet you can use: 🚨 Mozilla is hosting an #internethealth Report Call for Ideas 🚨 You can recommend what topics — from facial recognition to cyberwarfare — should be investigated in 2019 Report. Reply with ideas + links to studies or projects we should examine or visit https://mzl.la/ideas The Call for Ideas is available in 4 languages (English: https://mzl.la/ideas // French: https://mzl.la/idees // Spanish: https://mzl.la/tusideas // German: https://mzl.la/ideen) but submissions can be from anywhere in the world and in any language. We hope you'll join us on Twitter or get your ideas over to us before September 14th. Working for a healthier internet is a team effort. A big thank you for being part of the team. The IHR team (Solana, Kasia, Jairus) ------------------------------ * You're receiving this email because you're a registered Mozillian. We'll send you timely and occasional organizational news and updates - meant just for Mozillians. If you do not wish to receive these updates, please unsubscribe here <https://click.e.mozilla.org/?qs=434b787285796223cb44611de89db42b894961b4abb…>. We do some aggregate tracking <https://click.e.mozilla.org/?qs=434b7872857962231855305363464b18ffc116e671e…> on these emails to improve the experience. If you would like to opt out of tracking please update your email preferences <https://click.e.mozilla.org/?qs=434b787285796223cb44611de89db42b894961b4abb…> to text only. Read the Mozilla Privacy Policy <https://click.e.mozilla.org/?qs=434b787285796223eaa5632e7b5773baea58179e303…> here.* Mozilla 331 E. Evelyn Avenue <https://maps.google.com/?q=331+E.+Evelyn+Avenue+%0D%0AMountain+View,+CA+940…> Mountain View, CA 94041 USA -- Matthew Finkel

1 0

Tor Browser team meeting notes, 20 Aug 2018
by Georg Koppen 21 Aug '18

21 Aug '18

Hi! We had another Tor Browser meeting yesterday. The IRC log can be found at: http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-08-20-17.59.log… And here are the notes from our pad: Tor Browser Meeting Notes Monday August 20, 2018 Discussion: -tommy: Tor Browser for small businesses -reminder: sessions for Mexico - Mozilla viewport size quantization: https://bugzil.la/1407366 - viewport fingerprinting for mobile (igt0: I know sysrqb opened a bug, I wonder if we fix it for mobile, it will make the sites terrible) (GeKo: That's #27083. Let's discuss the drawbacks/improvements compared to our current solution there, in general I think mobile is no showstopper here) mcs and brade: Last week: - Finished #26514 (intermittent updater failures on Win64). - Worked on desktop onboarding: - Updated our patches for #26961 (new user onboarding). - Updated out patches for #27082 (enable a limited UITour). - Worked on #26962 (new feature onboarding). - Answered updater questions for #25485 (libstdc++.so.6: version `CXXABI_1.3.11' not found). - Sent Alison some ideas for the Mexico City meeting agenda. - Helped with triage of incoming bugs. This week: - Continue working on #26962 (new feature onboarding). - Scope the work and determine what we have time to implement for #25694 (Improve the user experience of updating Tor Browser). - Review our notes from #22074 (undocumented bugs since FF52esr) and file additional tickets if necessary. - After the Tor Browser nightly builds include the network team's fix for #26876, do some testing for #26251 (Adapt macOS snowflake compilation to new toolchain). GeKo: Last week: -release preparations and release help -helped with mobile reviews and testing (we are close!!) This week: -help with the mobile release where needed -monitoring our blog etc. for 8.0a10 fallout -trying to finish network code review -starting to the Tails summit on Saturday -planning the work for remaining two weeks before 8.0 hits the ground -igt0, sysrqb, sisbell: should we get together to plan the post-first-tba work? (GeKo: the decision was, yes, maybe later this week after the alpha is out) -reminder: please do your daily status updates on #tor-dev (/me status: fixing everything) -pospeselr: it seems #26450 fell through the cracks? Was that ready for review again after my initial pass? (GeKo: no, all is good) sysrqb: Last week: - Release preparations for first alpha version of TBA - Reviewed #25696 - Android onboarding - Reviewed #26884 - torbutton on android - Clarified #26314 - Mobile TB landing page - Attended RustConf - Started creating Android signing key for Alpha release(s) - #26536 - Revised Android permissions - #24796 - Worked more on Investigating Account Manager patch - #26858 This week: - First TBA Alpha release - Finish #26858 - Bug fixing... arthuredelstein: Last week: - Finished audit of HTTP2/AltSvc (#14952) - Finished audit of User Timing API (#26598) - Patches for "Add ca, ga, id, is, nb locales for Tor Browser" (#27129) - Patched "UI locale is detectable by button width" (#24056) - Patch for "Add new Tor Browser locales to our website" (#27151) - Reviewed #26456, #26833, #26628, #26655 - Met with the Tor Uplift team - Updated https://torpat.ch/locales and https://torpat.ch/support-locales This week: - More fingerprinting protections for ff60-esr - Review https://bugzilla.mozilla.org/show_bug.cgi?id=1333933 for unpatched items - Any patch reviews needed - Optimistic SOCKS? (GeKo: that won't be in 8.0 as we need more testing than our schedule provides. It's therefore not high prio but we should work on it during our 8.5 dev time) boklm: Last week: - fixed some testsuite tickets: - #27133: update useragent string in fp_navigator, useragent and settings tests - #27122: fix slider_settings tests - made patch for #25485 (replace firefox by a wrapper script) and tested it - made patch for #27178 (add support for xz compression in mar files) - helped build and publish 8.0a10 release This week: - continue working on #27105 (Fix Tor Browser testsuite for esr60) and subtickets - look at #12968 (HEASLR) PSA: I'm planning to be afk from 2018-09-06 to 2018-09-10, just after 8.0 release igt0: Last week: - Did several UX iterations on #25696 (On boarding) - Fixed issues in the #26884 (sec settings) - Iterated again in the about:tor for mobile(I am trying to avoid to change lot of gecko code) - Reviewed some code This week: - Finish about:tor (#27111) (I am testing in on tablets) - Update XPInstall to bypass the addons signature checks pospeselr: Last week: - #26874 (smb leak) uplift (was actually a bug introduced by another Mozilla patch, so they're handling it) - reviewed boklm's #27045 [boklm: can you post the logs from the error you get? pospeselr: done!] - rustconf on the 16th and 17th, successfully indoctrinated into the cult of rust - a bit of investigation into #26381 (about:tor page not loading properly in localized windows bundle) This week: - continue #26381 investigation sisbell: Last Week: Attended RustConf on 16-17 Created program to parse android dev file. Found indexes on class annotations differ between builds. This week: Parse data sections of dex file to get more info on deltas between builds. sukhe: Last Weeks: - #26476 (Windows crash): still investigating, doing log comparison now between TC and tor-browser builds - Looking at #24465 (Snowflake bundle libatomic; revision) and #27061 (langpack) - Merged #27152 (fxc2 update; small change) This Week: - Continue the above tasks Georg

1 0

Network team meeting notes, 20 Aug 2018
by Nick Mathewson 21 Aug '18

21 Aug '18

Hi! You can find our logs at http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-08-20-17.00.html Below are the notes from our meeting today: = Network team meeting pad! = Welcome to our meeting! Mondays at 1700 UTC on #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! Note the meeting location: #tor-meeting on OFTC! (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) After each week's meetings, the contents of this pad will be sent to tor-project @ lists.torproject.org. After that is done, the pad can be used for the next week. == Previous notes == 11 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001828.html 18 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001835.html 25 June: https://lists.torproject.org/pipermail/tor-project/2018-July/001863.html 2 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001866.html 9 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001884.html 16 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001888.html 23 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001926.html 30 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001928.html 6 Aug: https://lists.torproject.org/pipermail/tor-project/2018-August/001936.html 13 Aug: https://lists.torproject.org/pipermail/tor-project/2018-August/001947.html == Stuff to do every week = * Let's check and update the roadmap. What's done, and what's coming up? url to roadmap: https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Check reviewer assignments at https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Also, let's check for things we need update on our spreadsheet! Are there important documents we should link to? Things we should archive? * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… * Community guides, it's time to hand off to the next guide! * Let's look at proposed tickets! [but see discussion] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… == Reminders == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next releases ------------------------------- ---- 20 August 2018 ------------------------------- == Announcements == """ Sponsor8 ends on Dec 31, and we have some deliverables that needs to make 035. The 035 merge window closes on Sept 15. With that in mind, we need to prioritize these deliverables, and ask some folks to step out from rotations and most code reviews for the next month or so, so we can get it all done. Code reviews will also prioritize sponsor8 work, so, some reviews might be delayed and not added to the weekly review spreadsheet. For the rest of us, we don't intend that reviews and rotations should take up your whole life. If you're spending more than 20% or so of your week on reviews and rotations, then we might need to recalibrate. Talk to Nick and Isa if that sounds like the situation you're in. We will resume normal team operations once we get the sponsor8 deliverables done :) thank you for the understanding. """ If anyone has an opinion on bwauth scaling and how sbws needs to match torflow, please contribute to: * https://github.com/pastly/simple-bw-scanner/issues/182 * Trac #27135 We don't want to be making last-minute changes to the design. == Discussion == Do these tickets block 0.3.4: - our macOS time API seems to return weird results (#26987, #27139) - did we break the consensus between 0.3.3.9 and master? (#27146) [I've tried to opine on these tickets. -nm] == Updates == Nick: Last week: - NSS TLS stuff. Got X509 working (?). Worked on TLS initialization. - Worked on roadmap revision - Met about congestion control alternatives - Review & merge a bunch of patches - Initial (messed up) bisecting on #27080 This week: - Draft a whitepaper about datagram-related attacks - NSS TLS: maybe finish the implementation? - Help work on 034 blocker tickets. teor (offline): last week: - PrivCount in Tor: blinding and encryption (#24629, #26972) - bwauth mentoring (mainly https://github.com/pastly/simple-bw-scanner/issues/182 and #27135) - Reviewed the large vanguards patch (#25573), and other code reviews (#23588, #15188, #22747, #27190 #27191) - Worked on bridges are broken in 0.3.4 and master (#27080) - our macOS time API seems to return weird results (#26987, #27139) - did we break the consensus between 0.3.3.9 and master? (#27146) - I was on leave for a local holiday on Wednesday this week: - Keep on trying to fix bridges are broken in 0.3.4 and master (#27080) - PrivCount in Tor: blinding and encryption - reviews, fixes, design meeting - other reviews and revisions rest of 0.3.5: - work out the earliest rust version tor supports, and add CI for it - Implement PrivCount in Tor noise generation (#26637, maybe #26398) - Merge PrivCount in Tor komlo (offline): - Last week: - Gave a talk about Rust, had a lot of conversations about how to move forward with some existing Rust issues. Will be sending updates/syncs this week - This week: - Finish writing a draft for a peer review checklist, will work with Mike on adding his input/finalizing this - Look over recently-opened Rust tickets (thank you to the people opening these and adding improvements!) haxxpop: - Last week: - The client auth code is ready for review and test. Even thought the test still fails on Windows but I think we can review and test the code while I fix this issue. The code is in https://github.com/torproject/tor/pull/36 - This week: - One thing that we haven't discussed about yet is how clients generate their keypairs (how the command will look like). After discussing about this, I think I will implement it. catalyst: - last week (2018-W33): - CI/Coverity rotation - reviewed some more of teor's CI changes - PM candidate interviews - more digging in bootstrap related code for #25502, #22266 - this week (2018-W34): - design meeting organizer rotation - #25502, #22266 (bootstrap progress reporting improvements) Mike: Last week: - Continue discussions about congestion control - Make sure Sponsor2 report is good for submission - Chat with Tobias Pulls about adaptive padding implementation variants - Code reviews This week: - Help with anti-censorship hiring process - Update #25573 - Keep digging into #27066 - WTF-PAD proposal update - Research website update - Vanguards/onion service security blog post with asn?

1 0

Board Minutes from July 14, 2016, to April 16, 2018
by biella 18 Aug '18

18 Aug '18

Hello, The board is releasing our first batch of Tor Project meeting minutes from July 14, 2016, to April 16, 2018 [1]. After our next reunion, to be held on August 20, 2018, we will release minutes as a single item shortly after we meet. Before the board made the decision to publish them, I had volunteered to write a report about board work and accomplishments. Now that we are releasing our minutes, there is less of a need to write a detailed report, but I’ve decided to highlight some of things we’ve done and what we are up to in the next few months. As is probably obvious, board minutes are a fairly conventional genre of documentation for providing an official record of decisions taken by the board. They reference our collective discussions and include other standard information such as the start time of meeting, place or method of connecting, and a list of present and absent members. They tend to contain regular items of business, such as a discussion of pending and current grants and the finance reports, both of which relate to one of the core of duties of a board: fiduciary oversight of the organization. But these notes also provide a limited window into other aspects of the organization, as well as its shifting concerns and priorities depending on unforeseen factors and events. Early in this board’s tenure, we, along with TPI (The Tor Project, INC.) officers (Shari, Roger and Nick) dealt with matters of organizational housekeeping: filling board positions, establishing email voting protocols, clarifying and defining roles around the officers, and approving new policy documents or changes in existing policy documents. (These documents are included with the minutes.) With that in place, we moved on to other tasks that are also typical of boards, such as the ED review, which was carried out in the winter of 2017. As the organization stabilized, we were free to take on more time consuming projects, such as board expansion and diversification, which involved a number of meetings outside of the regular board reunions as we vetted and interviewed potential new members. Another fairly large undertaking for the current board was finding a replacement for Shari after she notified us of her plans to retire. While a search committee was constituted and tasked with the bulk of the initial work—compiling names, reaching out to candidates, scheduling meetings, and holding initial interviews—the entire board and TPI officers were also pulled in at various points to rate the long list of applications, hammer out procedures and timing, and interview and discuss the final few candidates. While the minutes provide a fairly accurate record of board duties, roles, and accomplishments, board members contribute in ways that are not registered or reflected in our minutes. Shari has reached out to individual board members to help build strategic partnerships, as she did with Mozilla, for instance. Other board members have many informal discussions with members of the Tor community that directly loop back into board discussions, while organization officers like Roger reach out to board members to discuss particular grants. We’d also like to remind everyone that they should feel free to contact us at any time on any matter related to the Tor Project (I've included our contact information below). Now that we’ve wrapped up the ED search, we’ve returned again to expanding the board, and a few of us are in the process of reaching out to a couple of other candidates, one of whom was recommended by a Tor community member (and we happily continue to welcome recommendations like these). Like everyone else, we are also thrilled to work with the incoming ED, Isabela, who will be joining us for our August board meeting. While there will be period of transition as we work with a new ED, we feel the organization has matured and stabilized under Shari’s careful and skilled guiding hand to the point where we can help Isabela fulfill her strategic vision. We were exceedingly impressed by her plan to make Tor more usable and more technically robust and we felt her wide-ranging experience running projects and teams, her intense familiarity with Tor, and her dedication to the fight for privacy and the people of Tor, made her the ideal candidate to shepherd this organization forward into the future. Don’t hesitate to contact any of us if you have any questions, queries, suggestions, and/or comments. Gabriella Coleman, on behalf of the entire board. ps-- I'd like to thank Linus for formatting all the minutes and putting them online. [1] https://gitweb.torproject.org/company/policies.git/tree Gabriella Coleman, biella(a)riseup.net <mailto:biella@riseup.net> Megan Price, meganp(a)hrdag.org <mailto:meganp@hrdag.org> Cindy Cohn, cindy(a)eff.org <mailto:cindy@eff.org> Linus Nordberg linus(a)torproject.org <mailto:linus@torproject.org> rsa4096/8C4CD511095E982EB0EFBFA21E8BF34923291265 Ramy Raoof, ramyraoof(a)riseup.net <mailto:ramyraoof@riseup.net> Bruce Schneier, schneier(a)schneier.com <mailto:schneier@schneier.com> Matt Blaze, blaze(a)cis.upenn.edu <mailto:blaze@cis.upenn.edu> Julius Mittenzwei, julius(a)mittenzwei.com <mailto:julius@mittenzwei.com>

3 2

July spreadsheet: users queries, demands, and issues
by cy63113 17 Aug '18

17 Aug '18

Hi everybody, As many of you know, I've been gathering, for the last for 3 months, issues, comments, demands, and suggestions from different sources like IRC channels, blog comments, Stack Exchange, Tor and Tails Reddit, RT, Facebook, and Twitter. During these months, I noticed that there are multiple users reporting of the same issues, the number #1 are connection problems in TBB alpha and unstable version (7.5.6 & 8.09): "TOR unexpectedly exited" "It is not working" "Fail to connect" and so on, mostly in Windows 10. Also, there are lots of users concern is if is safe to use Tor in Windows. You can check the July spreadsheet here: https://ethercalc.org/fk4bgj7ntrbj A curious fact, seems (there's no way to know for sure) that many more men than women make questions, looking for answers, ask for help... in the monitored channels. Please feel free to reach me out if you have feedback, comments or something else. Cheers, Cybelle

2 1

Notes from August 16 2018 Vegas team meeting
by Karsten Loesing 17 Aug '18

17 Aug '18

Notes for August 16 2018 meeting: Georg: 1) got back from vacation and dealt with my backlog 2) We prepared Tor Browser 8.0a10 and are currently building it. Planned release is 8/20. 3) We are close to get our first alpha for Tor Browser on Android out. Planned build date is tomorrow, 8/17, and it will go out next week. isabela: 1) Working on sponsors reports (I need to get this done asap) 2) Attended FOCI, met a lot of people. Had meetings w/ Sarah, Arturo and Roger as well. Time well spent :) 3) Organizing 2 things related to our Brand: 1. Mozilla want to do a research on Tor brand perception, we will meet w/ them next week and 2. Berkeley University has a student program called the Berkeley Group that helps non-profits with different things, we are in touch with them to help us build a strategy to help improve our brand perception. 4) Working on hiring, interviewing candidates, job posts. Also building onboarding for PMs and general onboarding. 5) Trying to catch up with emails and with sending Alison the sessions suggestions I have. steph: 1) DEF CON last weekend: ama went well! very friendly tone, in depth questions / answers. demand for us to have a booth next year! who’s in? will keep an eye on submission dates. 2) presented at 2nd cybersecurity program for HS girls. thanks to gman999 for the help. talking with Yin about possible future events and media collabs. {It took me a few seconds to figure out that HS=High School, not Hidden Service --Nickm} [haha :D] 3) edited a nice post tommy wrote about sina for the blog 4) working on website copy 5) talking with sarah about possible newsletter changes 6) trying to get a mozilla blog post mentioning Tor updated 7) talking with Gunnar about media outreach for mexico Alison: 1) Back from vacation and catching up 2) Held LFI weekend on the first weekend of August, and it was awesome! 3) Continuing with meeting planning for Mexico. Please encourage your teams to submit their agenda ideas emails to me. 4) Gus is working on further developing the open days. Ideally we'll have a blog post out soon, just waiting on the location details of the feminist meetup after the meeting. 5) Colin is working on a relay operators meetup for the open days 6) We started organizing our team plans for developing community.tpo 7) The Outreachy term is ending, and we're encouraging Cy and Jaruga to stick around Tor :) 8) Gus is getting ready to go to Kenya 9) Once we catch up with this week, we'll get back to the TB 8.0 docs for Android Sarah: 1) Met with isabela and Roger at FOCI. 2) Working to optimize the email list and make the subscribe/unsubscribe process better for the user and have clear data collection in Civi. 3) Finalizing Donate page changes with Giant Rabbit. 4) YE campaign planning. 5) Networking to find a great grant writer. Nick: 1) Getting somewhat bogged down with team deliverables; must remind various folks. 2) Worked with mike et al to try to find some direction on congestion control/datagram issues. 3) Privcount marches on 4) NSS+TLS is still eating my brain as a programmer. Shari: 1) preparing for board meeting next week 2) continuing to interview people for various jobs 3) met with auditors last week; preparing for 2017 audit 4) talking with UC Berkeley group about branding 5) need to make small budget revisions for Sida Karsten: 1) Moved ExoneraTor to its own webpage on Tor Metrics in an attempt to bundle all user-facing metrics-related content and services on the Tor Metrics website. 2) Modified per-graph CSV files available on Tor Metrics in preparation of deprecating and removing the pre-aggregated CSV files one month later. 3) Removed the "Fraction of relays reporting onion-service statistics" graph after including its data in existing per-graph CSV files. 4) Put out several Onionoo releases and patch releases to fix regressions introduced in protocol version 6.2. Mike: 1) Coordinating research on congestion control/Tor performance topics 2) Finishing up Sponsor2 report 3) I think that Tor could benefit from (at least one?) more research/transition to practice developer(s). I can't do all the coordination and all the development, and fill in missing research/experimentation pieces too. I am still thinking about what this looks like, but in particular there are often experiments that are left out of published papers, and aren't quite enough for papers on their own. This means the academic community won't do them. There's also a lot of work to do things like eg transition the various subcomponents from vanguards into core-tor.

1 0

Tor Browser team meeting notes, 13 Aug 2018
by Georg Koppen 14 Aug '18

14 Aug '18

Hi all! We had another Tor Browser team meeting yesterday 1800 UTC in #tor-meeting at irc.oftc.net. The meeting log can be found at: http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-08-13-17.59.log… The entries from our meeting pad are below: Discussion: - The TBA strings file seem to contain Fennec strings. Compare: https://gitweb.torproject.org/translation.git/tree/en/android_strings.dtd?h… https://hg.mozilla.org/mozilla-central/file/812e732d0928/mobile/android/bas… mcs and brade: Past two weeks: - Tried a few more things for #26514 (intermittent updater failures on Win64). - Fixed #26985 (Tor Launcher help button icons missing). - Fixed #25509 (Tor Launcher misleading proxy prompt). - Created an updated patch for #26960 (implement new about:tor). - Worked on desktop onboarding: - Created a patch for #26961 (new user onboarding). - Created a patch for #27082 (enable a limited UITour). - Researched #26962 (new feature onboarding). This week: - We will be unavailable on Thursday and Friday of this week due to family commitments. - Try jacek's suggestion for #26514 (intermittent updater failures on Win64). - Incorporate final artwork for #26961 (new user onboarding). - Work on #26962 (new feature onboarding). - Review our notes from #22074 (undocumented bugs since FF52esr) and file additional tickets if necessary. - Revisit #26381 (about:tor page does not load on first start in localized Windows bundle). Does anyone else have time to work on this ticket? -pospeselr: I can take a look! - After the Tor Browser nightly builds include the network team's fix for #26876, do some testing for #26251 (Adapt macOS snowflake compilation to new toolchain). boklm: Past two weeks: - made a patch adding an option for incremental firefox builds (#27045) - found some way to make a program requiring GLIBCXX_3.4.22 for #25485 (Fix libstdc++.so.6 compatibility for Tor Browser) and reviewed patch from sukhe - reviewed #27020 (RBM build fails with runc version 1.01) - made patch for #27101 (Error building tor in tor browser nightly builds) - the machine doing nightly builds has some network issue, but I won't be able to fix it until next week, so I set up a new replacement VM - fixed some testsuite issues: #26981, #27106 This week: - continue working on #27105 (fixing testsuite for esr60) and subtickets - look at #12968 (HEASLR) - help with #25485 if needed (libstdc++ issue with updater) - help with building new release pospeselr: Last weeks: - got cross-compiled incremental mingw windows builds working, initial setup and build still takes awhile (but less than a full rbm build), but subsequent builds after changes around ~2 minutes, mostly linking (in a VM) - workflow for printf debugging windows tor-browser is now way less painful - winsetup and winbuild scripts available in a branch here: https://gitweb.torproject.org/user/richard/tor-browser.git/commit/?h=winbui… - shouldn't we apply ifdef'd versions of the build-time windows specific patches ( 1464084.patch, 1467041.patch and strcmpi -> stricmp) to the firefox source directly rather than applying them in rbm? [GeKo: it's meant to indicate their temporal status essentially being patches not meant to be carried around in tor-browser, although this could possibly be debated in the strcmpi->stricmp case] - fix for #26874 ( Investigate UNC path restrictions failure in Tor Browser 8.0a9 ) - turns out this is actually broken in ESR60 when FF is *not* installed to an SMB share This week: - uplift fix for #26874 - update wiki with cross-compile mingw build instructions - review #27045 ( Add option for firefox incremental builds ) - review gk's patches - #26381 (about:tor page does not load on first start in localized Windows bundle) - #21785 (Keep an eye on the Storage API ) - Portland for Rustconf Thursday-Friday - my initial reason for going to this was to get some hands on experience with rust, but do we as a team have any goals we wish to accomplish with a presence here? - considerations for rust for tbb standalone launcher, rust-qt bindings? igt0: Last Weeks: - Make sure the #26884 works with noscript webextension (it does!) - Worked on TBA onboarding #25696 - The final assets are missing, I am working together with Antonela on it. - The design is slightly different than the one in the bug. In landscape mode the UI doesn't have enough space, so the whole view scrolls. - Started #27111 (about:tor for mobile) This Week: - Finish #27111 - Update #26574 addressing Geko's comments - Review mobile related patches sysrqb: Last weeks: Audited third party libraries in Fennec (#26982, #25851 (plus child tickets)) Reviewed permissions requested by Fennec and created patches (#24796, #26825, #26826) Investigated Fennec's Firefox Account code and nearly finished a patch for it (#26858) Researched how Mozilla localize Fennec and build localized releases (#26843) This week: Finish Firefox Account Manager patch (#26858) TBA onboarding ticket Make sure we're ready for releasing the first alpha version of TBA RustConf on Friday tjr mingw - Have a build in -central that builds.... just doesn't run =( pospeselr: you using msvcr whatever spec file? nevermind! tjr: this is using mingw-clang w/ ucrt so we shouldn't need it fuzzyfox needs some feedback from david; but it probably getting closer arthuredelstein: Last two weeks: * Was afk for a few days * Audited HTTP2 implementation and patch for #14952 * Wrote patch for #24056 (UI locale is detectable by button width) * Wrote patch for #17252 (Confirm TLS session resumption/ID respect FPI) * Confirmed #21787 (Make sure exposing calendar info does not leak the locale) * Reviewed #26655 (onion button wrong size and color) * Re-verified #17512 (Tor Browser installer isn't properly localized) * Opened #27123 (ping/settings timing side-channels, #27098 (monthly giving banner), #23925 (2018 donation banner) #27097 (Join email list) * Updated Tor Browser locale monitoring: torpat.ch/locales * Wrote patch for #26609 (investigate whether the -moz-windows-accent-color-in-titlebar media query adds a fingerprinting vector) -- patch soon Coming week: * Revise #14952 as needed * More tbb-fingerprinting patches * torbutton banner GeKo: Last Week: -being on vacation (the week before mainly reviewing patches, working on #26475 and a bit on the network code review) This Week: -trying to get releases out -I need help with reviews, in particular a second review for #26456, #24056 and tickets I provided patches for (#26628, #26833, #26655) -work on my backlog -work on #26475 -work on network code review sukhe: Last Weeks: - #25485 (libstdc++): merged but will need revision - #26476 (Windows crash): still investigating, doing log comparison now - no longer blocks on tjr - #12968 (HEASLR): no progress so now asked boklm to look into it - (offline two days last week) This Week: - #26476 (Windows crash) - Revise #25485? - Hooman and I are going to resume #25483 (Windows reproducible build of snowflake) - anything else I can pick since the above two involve building and won't take up all my time? [GeKo: I'll look at some tickets after the meeting, e.g.:#27061 and #24465] sisbell: Last Week: Confirmed that generated Android APKs have different checksums after 2 builds (classes.dex different) Investigating diffs and android grade builds This Week: Continue investigating why classes.dex isn’t reproducible Setup Mac environment for builds Attending RustConf Thurs/Fri Georg

1 0

Network team meeting notes, 13 Aug 2018
by Nick Mathewson 14 Aug '18

14 Aug '18

Good hello! Logs at: http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-08-13-17.06.html Meeting notes below-- = Network team meeting pad! = Welcome to our meeting! Mondays at 1700 UTC on #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! Note the meeting location: #tor-meeting on OFTC! (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) After each week's meetings, the contents of this pad will be sent to tor-project @ lists.torproject.org. After that is done, the pad can be used for the next week. == Previous notes == 11 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001828.html 18 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001835.html 25 June: https://lists.torproject.org/pipermail/tor-project/2018-July/001863.html 2 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001866.html 9 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001884.html 16 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001888.html 23 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001926.html 30 July: https://lists.torproject.org/pipermail/tor-project/2018-July/001928.html 6 Aug: https://lists.torproject.org/pipermail/tor-project/2018-August/001936.html == Stuff to do every week = * Let's check and update the roadmap. What's done, and what's coming up? url to roadmap: https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Check reviewer assignments at https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Also, let's check for things we need update on our spreadsheet! Are there important documents we should link to? Things we should archive? * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… * Community guides, it's time to hand off to the next guide! * Let's look at proposed tickets! [but see discussion] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… == Reminders == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next releases ------------------------------- ---- 13 August 2018 ------------------------------- == Announcements == - Nick is on a plane flight, scheduled to land 30 minutes before this meeting. He might miss this one. :( == Discussion == - Did everybody answer on the pad about roadmap status at https://pad.riseup.net/p/huDStrBDgqi5 ? - How are reviews coming? == Updates == Nick: * Last week: - Put out a release candidate - Privcount revisions - NSS TLS prep-work, and started hacking on it - Various NSS bugfixes - Roadmap revisions. - Visiting inlaws - Misc review * This week: - Further privcount revisions TBD - NSS TLS implementation ? - Finalize roadmap revisions. - Welcome dgoulet back (on/after the 16th), ask about memory profiles - In theory 0.3.4 becomes stable on August 15. Delay it? (Decided: yes, esp wrt 27080) teor (offline): last week: - I was on the community hero rotation. It was a quiet week. We have a great community! - revised macOS CI for Core Tor (#24629) - chutney 0.3.5 refactor fix (#26067, #26068) - PrivCount in Tor: blinding and encryption (#24629, #26970, #26972, #26973) - bwauth mentoring (mainly https://github.com/pastly/simple-bw-scanner/issues/182 ) - code reviews (#26972, #23588, #27089) - Discovered that bridges are broken in 0.3.4 and master (#27080) - meeting planning this week: - I'm on leave for the local holiday on Wednesday - Try to fix bridges are broken in 0.3.4 and master (#27080) - PrivCount in Tor: blinding and encryption - reviews, fixes, design meeting - work out the earliest rust version tor supports, and add CI for it rest of 0.3.5: - Implement PrivCount in Tor noise generation (#26637, maybe #26398) - Merge PrivCount in Tor - Reduce my revision backlog asn: [Will be commuting during meeting time. Will attend based on net connectivity.] Last week: - Reviewed #26885, #27003, #23576. - Did some more vanguard testing and submitted edits to mike's vanguard docs. - Revised and posted latest iteration of v3 client auth spec to [tor-dev]: https://lists.torproject.org/pipermail/tor-dev/2018-August/013386.html Will wait a few days before merging it upstream. - Read teor's et al. (unpublished) paper on Tor statistics. There are a few oddities highlighted in that paper that we might want to look at. - Got travel arranged for Mexico! - Did review assignments. We have two people in vacations this week (ahf, and dgoulet until thursday), so load was spread less thinly. If you are too overwhelmed with reviews, please let us know and we will try to load balance better. This week: - Debug v3 issues. - Look at some vanguard stuff and maybe think about turning the README to a blog post. - Do reviews catalyst: last week (2018-W32): - reviewed #24629 (macos Travis support) and related tickets - more NSS patch review (problems with test-network) - gave feedback on Rust stuff to prep for Rustconf - made some subtickets for #25502 (intermediate PT bootstrap status) and #22266 (jump-to-80% bootstrap problem) - talked with ahf briefly about #25502 this week (2018-W33): - CI/Coverity roation - ticket review - more work on #25502 and #22266 - home maintenance backlog haxxpop: last week: - discussed with asn and we concluded that we should merge the torspec branch first to make it final before I start revising my client auth branch [asn: how long do you think i should wait before merging? i could do it tomorrow even. wondering because the branch is lined up for 035, so torspec merge influences final merge date][haxpop: I think 3 days is enough because we already had a long discussion about it] this week: - I will try to rebase my branch with master first and see if there is anything broken - Revise my branch after the torspec is merged Mike: Last week: - Wrote Sponsor2 report, sent it to our grants list, did not submit yet. - Did most of my code reviews; will need a second review with #25152 [Nickm volunteers -nm] - Worked with packagers/prepped for next vanguard release - Dug into #27066. Still digging.. - Updated branch for #25573 - In dicussions with various people about congestion control research. Please see my network-team mail. Do we have any preferences for direction and collaboration wrt that mail? This week: - Make sure Sponsor2 report is good for submission - Keep digging into #27066 - Put out vanguard release - Continue discussions about congestion control - Chat with Tobias Pulls about adaptive padding implementation variants - Vanguards/onion service security blog post with asn? - Work with Chelsea+others on a peer review checklist for research?

1 0

July Communications Report
by Stephanie A. Whited 13 Aug '18

13 Aug '18

Hello Tor! Last month, we were out and about + working on copy for upcoming releases and our new site. I joined Alison, David, George, and Matt at HOPE for the Onion Report: https://livestream.com/internetsociety/hope/videos/178158095 We had a booth the whole weekend and were cleaned out of shirts for donations in a few hours. Matt and I (with help from gman and Yin) led a Tor session as part of the Computer Science for Cyber Security (CS4CS) Summer Program for High School Women. Another session with a new group is happening next week. July in links and stats: Blog posts https://blog.torproject.org/help-us-translate-our-new-support-portal https://blog.torproject.org/explore-tor-nyc-qa-isabela-bagueros https://blog.torproject.org/how-do-effective-and-impactful-tor-research https://blog.torproject.org/tors-open-research-topics-2018-edition https://blog.torproject.org/announcing-vanguards-add-onion-services https://blog.torproject.org/support-torservers https://blog.torproject.org/egypt-internet-censorship Twitter https://twitter.com/torproject avg at least 3 tweets/weekday New followers: 994* *We lost between 2,000-3,000 followers in the Twitter purge[1]. We gained 944 more back this month than however many we lost (exact number unknown). Top tweets https://twitter.com/torproject/status/1013859982876561408 https://twitter.com/torproject/status/1015311953596764160 https://twitter.com/torproject/status/1016712421044604929 https://twitter.com/torproject/status/1016307257771003904 https://twitter.com/torproject/status/1016712421044604929 https//twitter.com/torproject/status/1015311953596764160Mastodon https://mastodon.social/@torproject at least 1 post/week New followers: 221 Instagram https://www.instagram.com/torproject/ at least 1 post/month New followers: 57 LinkedIn https://www.linkedin.com/company/tor-project/ at least 1 post/week New followers: 59 Facebook https://www.facebookcorewwwi.onion/TorProject/ at least 1 post/weekday New followers: 178 Newsletter 1/month https://newsletter.torproject.org/archive/2018-07-31-research-tips-topics-e… Notable press https://www.techrepublic.com/article/5-ways-to-protect-your-privacy/ https://www.cyberscoop.com/domain-fronting-ban-letter-ron-wyden-marco-rubio… https://motherboard.vice.com/en_us/article/wjkjzm/what-went-wrong-at-the-ho… [1] https://www.nytimes3xbfgragh.onion/2018/07/12/technology/twitter-followers-… o/ -steph -- Stephanie A. Whited Communications Director The Tor Project IRC: stephw PGP Key ID: 39A876AD <https://pgp.mit.edu/pks/lookup?op=get&search=0x6D6B72C339A876AD>

3 3

[TSoP] stem.client - status report #6
by Dave Rolek 13 Aug '18

13 Aug '18

Hi everyone! This is my sixth status report for the stem.client TSoP project [1]. You may see my previous reports on the tor-project ml. [2][3][4][5][6] This report is about a week late. # Updates It's been roughly 2.5 weeks since my last update. I've still suffered from illness during this time - I'd say it knocked out most of a week :( - but I think I've made some decent progress in stem.client. I'm working through it, somewhat successfully. ## stem.client I'm working through my plans for the stem.client roadmap. You may recall from a previous status report [5] these early items on the roadmap: 1. refactor: Relay cell encryption/decryption/processing 2. centralize ORPort reads/sends (demux/mux) at connection level 3. implement required RelayCell subclasses (e.g. parsing of decrypted body) (1) is mostly done in #27112 [7], with just a few more changes I wish to make [8]. Both (2) and (3) have had some groundwork laid with #27112, as well. Notably I've created an intermediate RawRelayCell class that can handle arbitrary payloads (mostly to be used for encrypted payloads), and started to move the finer details of encryption/decryption/processing into the Cell abstraction. ## stem, general Discovering a py3 bug in #26432 [9], I filed #27030 [10]. I concurrently ran into some of the problems Damian did, and took notes about / fixed them concurrently: * hashing super() causing an infinite loop, a la b48ce682ef1a5fc1d4237d106700ec929f49246b (but not exactly this) [11] * a bit of cleanup from #26420 [12] I ran into a lot of trouble with the tests in #27053 [13], and provided a few rounds of input that has helped move that ticket forward. ## other project-related I convened with plcp a bit over IRC in discussing stem.client code and functionality of the tor-spec, reviewing some of their code [14]. And I did some stem ticket bookkeeping / responses. ## tor, general I've continued to do some bookkeeping / ticket triage as I run across things: * #25573, #25574 "DropMark" * #26228, respond on PR and close out PR * probably more at such lower notability that I didn't take a note about it ## misc I've improved my IRC client config for rejoining the registered IRC channels on reconnect - I should be easier to reach now, even when I'm not personally paying attention to the IRC client. # What's next There's only a bit over a week left in the project. I plan to focus as much as possible on stem.client! ## stem.client Please refer above to the roadmap bullets. I've highlighted a few more changes I wish to make for (1) in the ticket [8]. Between (2) and (3), I'm not sure what's best to tackle next. For (2), the work primarily involves rearchitecting the recv/send into its own thread(s) and centralizing the handling. I've done that sort of work before, so I think I could design and implement that well. For (3), the work is a bit more mundane, but it *does* provide the building blocks to do higher-level management of circuits, like extending a circuit (building blocks, naturally: EXTEND[ED][2] cells). I'm thus leaning to tackle (3) first. These are both important, but I think (3) enables other work to be done, whereas (2) is an architectural improvement that improves stability and usage, but doesn't open way for much functionality. ## tor-spec File tickets to track spec improvements resulting from TSoP experience. (These are bookkeeping / awareness tickets for my WIP changes.) I still haven't filed these, and the spec has changed a bit, so I'm deprioritizing this further until after stem.client coding. ## misc I've generated a backlog of tasks that I haven't gotten to, including ones I've mentioned in previous status reports. I'm deprioritizing these for now, but I really do hope to get to them. I'm not going to repeat / enumerate them here, for sanity's sake :) # Other Tor things Multiple in-person chats, yet again. While a sample size of 1 (i.e. me) is by no means scientific, I'd say there's a definite, growing interest in Tor and digital privacy overall. # Closing With illness persisting, I had another period where I stopped reading IRC scrollback proactively, but I think I might be back on track again. Nonetheless, please still mention my nick (dmr) if you want to get my attention! As with before, please don't hesitate to reach out to me via IRC or email! Thanks, Dave [1] https://lists.torproject.org/pipermail/tor-dev/2018-April/013090.html [2] https://lists.torproject.org/pipermail/tor-project/2018-May/001811.html [3] https://lists.torproject.org/pipermail/tor-project/2018-June/001830.html [4] https://lists.torproject.org/pipermail/tor-project/2018-June/001858.html [5] https://lists.torproject.org/pipermail/tor-project/2018-July/001886.html [6] https://lists.torproject.org/pipermail/tor-project/2018-July/001917.html [7] https://trac.torproject.org/projects/tor/ticket/27112 [8] https://trac.torproject.org/projects/tor/ticket/27112#comment:2 [9] https://trac.torproject.org/projects/tor/ticket/26432 [10] https://trac.torproject.org/projects/tor/ticket/27030 [11] https://gitweb.torproject.org/stem.git/commit/?id=b48ce682ef1a5fc1d4237d106… [12] https://gitweb.torproject.org/stem.git/commit/?id=d1284e6d0301de59ddf286b5e… [13] https://trac.torproject.org/projects/tor/ticket/27053 [14] https://github.com/plcp/stem-client/tree/6593f56f6dfdfc54102091b537b63f8dd1…

1 0