- tor-project - lists.torproject.org

OONI Monthly Report: June 2018
by Maria Xynou 05 Jul '18

05 Jul '18

Hello Tor world, In June 2018, the OONI team established a new partnership with the Jordan Open Source Association and published two research reports. We also made progress on the new OONI Probe desktop and mobile apps, made improvements to the OONI API, and we came up with a new scheme for an OONI measurement ID. Further information is available below. # Established a new partnership We are excited to have established a new partnership with the Jordan Open Source Association! As part of our partnership, we aim to collaborate on the study of internet censorship in Jordan through the collection and analysis of OONI Probe network measurements. ## Recap of partnerships Overall, we have established new partnerships with the following 5 organizations over the last months: 1. Paradigm Initiative (Nigeria) 2. The Advocates for Human Rights and Democracy (South Sudan) 3. Karisma Foundation (Colombia) 4. Asociacion por los Derechos Civiles (Argentina) 5. Jordan Open Source Association (Jordan) # Report on internet censorship in Nigeria In collaboration with Paradigm Initiative, we published a research report examining internet censorship in Nigeria. The full report is available here: https://ooni.torproject.org/documents/nigeria-report.pdf The OONI network measurement findings are summarized here: https://ooni.torproject.org/post/nigeria-internet-censorship/ A summary of the report is also available: https://ooni.torproject.org/documents/nigeria-report-summary.pdf # Report on the unblocking of websites in Ethiopia In collaboration with Access Now, we published a research report examining whether and to what extent websites have been unblocked in Ethiopia, following the government's announcement on the unblocking of 264 websites. Our research report is available here: https://ooni.torproject.org/post/ethiopia-unblocking/ ## Recap of reports Over the last months, we have published reports covering censorship events in the following 5 countries: 1. Pakistan: https://ooni.torproject.org/post/how-pakistan-blocked-social-media/ 2. Iran: https://ooni.torproject.org/post/2018-iran-protests/ (Part 1) & https://ooni.torproject.org/post/2018-iran-protests-pt2/ (Part 2) 3. Sierra Leone: https://ooni.torproject.org/post/sierra-leone-network-disruptions-2018-elec… 4. Nigeria: https://ooni.torproject.org/post/nigeria-internet-censorship/ 5. Ethiopia: https://ooni.torproject.org/post/ethiopia-unblocking/ # OONI Probe Desktop We made a fair amount of progress on the OONI Probe desktop apps, mostly on the command line interface (CLI) front. See: https://github.com/ooni/probe-cli/pull/13 # OONI Measurement ID We came up with a strategy for adding a unique ID to past OONI Probe measurements and how to integrate this into our collector for future measurements. Up until now OONI measurements were identified by a report_id (which can be shared by a set of measurements in the same report file) and the input. With the newly proposed scheme, it will be possible to share a single identifier to identify a specific measurement. You can read more about this here: https://github.com/ooni/pipeline/blob/master/docs/ooni-uuid.md # OONI API We made some bug fixes to the OONI API and made a new release for it. See: https://github.com/ooni/api/pull/54 & https://github.com/ooni/api/blob/master/ChangeLog.md#ooni-measurements-104-… # Revamping the OONI Probe mobile apps We internally released the revamped OONI Probe Android app with the first three screens (Dashboard, Test Overview, Test running). See: https://github.com/lorenzoPrimi/ooniprobe-android/pull/2 https://github.com/lorenzoPrimi/ooniprobe-android/pull/1 https://github.com/lorenzoPrimi/ooniprobe-android/commits/release/2.0.0 # Community use of OONI data ## Blocking of political party site in Pakistan In the run up to Pakistan's elections, the site of the Awami Workers Party got blocked on 3rd June 2018. Through the use of OONI Probe and OONI data, Pakistan's Media Matters for Democracy reported on the blocking (and unblocking) of the site: http://digitalrightsmonitor.pk/generalelections2018-amidst-shrinking-online… ## Blocking of media websites in Venezuela Two media websites (lapatilla.com and el-nacional.com) were blocked in Venezuela this month. Our Venezuelan partner, IPYS Venezuela, reported on the blocking of these media sites based on OONI data: https://ipysvenezuela.org/alerta/nueva-forma-de-censura-en-internet-aparece… # Community activities ## ENOG 15 / RIPE NCC Regional Meeting OONI's Leonid attended the ENOG 15 / RIPE NCC Regional Meeting in Moscow, Russia, between 4th-5th June 2018 (https://www.enog.org/enog-15/) ## Citizen Lab Summer Institute (CLSI) 2018 We attended the Citizen Lab Summer Institute (CLSI) in Toronto, Canada, between 13th-15th June 2018 (https://citizenlab.ca/summerinstitute/2018.html) As part of our participation at the CLSI, we facilitated the following sessions: 1. Making OONI's censorship data more actionable (https://docs.google.com/document/d/e/2PACX-1vRhl3ErFOG5gRNdzVydrGIkpsIJ_C-p…) 2. Measurements from embedded devices (https://docs.google.com/document/d/e/2PACX-1vRhl3ErFOG5gRNdzVydrGIkpsIJ_C-p…) We also interviewed five community members and plan to publish their interviews within the next months (as part of the "OONI Community Interviews" series). ## Community meeting We held a community meeting on Slack (https://slack.openobservatory.org/) on Monday, 25th June 2018. As part of our June community meeting, we discussed the following: 1. Sub-categories and tags for test lists 2. OONI Probe Debian packaging 3. Challenges in sharing OONI Run links: Creating OONI-maintained URL shorteners? ## Updated test lists Based on URLs provided by community members, we updated the following test lists: 1. Cuba: https://github.com/citizenlab/test-lists/pull/357 2. Global: https://github.com/citizenlab/test-lists/pull/353 3. US: https://github.com/citizenlab/test-lists/pull/352 4. Egypt, Tunisia, Jordan, Saudi Arabia: https://github.com/citizenlab/test-lists/pull/358 5. Azerbaijan: https://github.com/citizenlab/test-lists/pull/361 # Userbase In June 2018, OONI Probe was run 240,541 times from 4,627 different vantage points in 214 countries around the world. This information can also be found through our stats: https://api.ooni.io/stats ~ The OONI team. -- Maria Xynou Research & Partnerships Director Open Observatory of Network Interference (OONI) https://ooni.torproject.org/ PGP Key Fingerprint: 2DC8 AFB6 CA11 B552 1081 FBDE 2131 B3BE 70CA 417E

1 0

Proposal for the people page: Pronouns
by Tom Ritter 04 Jul '18

04 Jul '18

There's a lot of us and many folks (or maybe just me) haven't met most people or are otherwise unsure about pronouns. Put them on the people page? Good idea? Bad idea? Too public? https://imgur.com/a/u6pIZnJ The crappy HTML I wrote to do this is to float left and float right the field. <td> <a id="tjr"></a> <div class="photo"><img src="../images/people/tjr.png" alt="tjr" width="128" height="150"></div> <div class="icon"><a href="https://twitter.com/tomrittervg"><img src="../images/twitter-small.png" alt="twitter" width="20" height="20"></a></div> <div class="icon"><a href="https://db.torproject.org/fetchkey.cgi?fingerprint=8ACD146EA94CEB12E4EA6915…"><img src="../images/pgp-key.png" alt="pgp key" width="20" height="20"></a></div> <div class="name"><a href="#tjr">Tom Ritter</a></div> <div class="field" style="float:left"><b>IRC:</b> tjr</div> <div class="field" style="float:right">he/him</div> <div class="description">Maintains <a href="https://consensus-health.torproject.org/">Consensus Health </a>, runs one of the bandwidth authorities, and contributes to Tor Browser.</div> </td> -tom

16 30

[Announcement] Antonela is our new UX team lead \o/
by isabela 04 Jul '18

04 Jul '18

Hello Tor! With me transitioning to ED some reorg will have to happen to accommodate tasks I was leading into other hands You might have already seen the 2 PMs job posts we have online: https://www.torproject.org/about/jobs.html.en Besides PMing things at Tor I was also leading the UX team. Back in May I asked Antonela if she would step up and take the leadership of the team. Antonela is amazing as you all know already she strongly shares the vision for the UX team that I have and has demonstrated amazing skills at actually executing it, not only on the design part of it (which she has being great at facilitating the collaboration of all stakeholders in the process) but at organizing projects related to the UX team vision, like leading the selection of illustrators and their projects or putting together user testing processes. I am very happy to say that Antonela said yes to my question and since then has already taken the leadership hat but we haven't yet announced it to the community so I am doing it now. If you wondering what are the other people in the UX team she will be leading, they are Helen (our User Research Coordinator), Emma (our Localization Project Coordinator), Alon (our illustrator) and will also help organize projects that Hiro (our Services Admin) is helping us with. I asked Antonela if she would share some words on her new role: --- start of Anto words --- I'm grateful for this opportunity. Finally, I found IT people who have the same concerns I have! We want informed and educated users. We want users who have the power to decide. We want to make technology that makes people free. The main UX team aim is to collect all those voices around the world, understand and empathize with them and make a technology that all can use. I hope we can continue working as a bridge, with all the teams around The Project, improving our technology for people without compromise their safety and privacy. --- end of Anto words --- So! Here is the official announcement \o/ join me on congratulating Antonela on this new role and supporting her too! #GoAnto! cheers, isabela

1 0

Network team meeting notes, 2 July 2018
by Nick Mathewson 03 Jul '18

03 Jul '18

Logs at http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-07-02-16.58.html Pad contents below: ==== = Network team meeting pad, 2 July 2018 = Welcome to our meeting! Mondays at 1700 UTC on #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! Note the meeting location: #tor-meeting on OFTC! (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) == Previous notes == 23 April: https://lists.torproject.org/pipermail/tor-project/2018-April/001747.html 30 April: https://lists.torproject.org/pipermail/tor-project/2018-April/001750.html 7 May: https://lists.torproject.org/pipermail/tor-project/2018-May/001760.html 14 May: https://lists.torproject.org/pipermail/tor-project/2018-May/001769.html 21 May: https://lists.torproject.org/pipermail/tor-project/2018-May/001806.html 11 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001828.html 18 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001835.html 25 June: https://lists.torproject.org/pipermail/tor-project/2018-July/001863.html == Stuff to do every week = * Let's check and update the roadmap. What's done, and what's coming up? url to roadmap: https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Check reviewer assignments at https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Also, let's check for things we need update on our spreadsheet! Are there important documents we should link to? Things we should archive? * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… * Community guides, it's time to hand off to the next guide! * Let's look at proposed tickets! == Announcements == * Tor 0.3.1 has reached end-of-life. * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next release! * The git master branch is now 0.3.5! == Discussion == Any volunteers for handling backports to stable? teor asks: what's the timeframe? Can people help out for particular releases? End of life for 0.3.2 is October, and 0.3.3 is February. (I don't know if that will work so well unless we coordinate. It would be messy if something were backported to e.g. 0.2.9 but not 0.3.2. -NM) Any volunteers for leading 0.3.5 triage process? teor asks: 0.3.5's feature freeze is September 15, so do we need triage done in July or August? (IMO now -NM. Working on with ahf.) Do we need a volunteer to focus on the remaining bugs in 0.3.4? (isis will make sure every must bug has a person who remembers they're working on it.) Where is the work-in-progress guide for big patches in Tor? Is this based on the Seattle notes or is there more info there? [komlo] [catalyst will send komlo a link. We're keeping this unpublished until we like it more, since it has potential to read as obnoxious if we get it wrong.] == Updates == Nick: * Last week: * Get 26479 and 26480 (appveyor failures) fixed so I can release 0.3.4.3-alpha. * Release 0.3.4.3-alpha. * Prepare for an 0.3.3.6 release * Continue refacatoring src/common * Make the dependencies in src/libs acyclic. * This week: * Plan an order of operations for splitting src/or. * Open tickets about remaining cases of #25386 (sanitizers, rustdoc). * Document src/lib. * Make requested post-merge cleanup changes in src/lib structure. * Release 0.3.3.8 * Finish PETS reviews teor (offline): last week: - Reviewed juga's patch to put bandwidth file headers in votes (#3723) - Other small bwauth suggestions and feedback - Helped answer some fallback questions - We have 30 new fallbacks, we need another 40 fallbacks for censored clients to bootstrap (Maybe it will take a few more weeks to get there.) https://trac.torproject.org/projects/tor/ticket/24805#comment:33 - Two successful experimental PrivCount data collections - And the research is done! this week: - Review PrivCount in Tor blinding and secret sharing branch - Implement PrivCount in Tor noise - Work on a per-relay / per-consensus / per-counter noise spec for PrivCount in Tor - Reduce my review and revision backlogs ahf Last week: Sponsor 8: - Better process handling for #25502 update: started to write the Windows related code, but ran into #26594 as a blocker. Spend some time trying to figure out what the issue was. Misc: - Reviewed #24104, #26594, first look at #24546. - Continued study of Chrome's Windows sandbox implementation. This week: Sponsor 8: - Finish Windows specific parts of #25502 (reading of output from subprocesses). - Memory profile work with Nick and David(?) Misc: - Look at the remaining Coverity issues from week 25 (bug #26521). - Rotation role: Bug triage. - Figure out Mexico logistics: We have no meetings before the team day? No meetings after the schedule on trac? (This is correct -NM.) - Hope to be able to lift Chrome's Windows sandbox out as a small C++ library to play around with. - I'm away most of Wednesday (US time). - Do phase 1 triage with Nick: https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TicketT… haxxpop: Last week: - Revise the PR according to dgoulet's comments This week: - Continue revising the PR komlo (offline): - Last week: - Prepare for some public talks (not much hands-on tor work) - This week: - Follow up and test out #24249 with https://github.com/eqrion/cbindgen. Overall, I think we definitely want to compile Rust->C types, as opposed to using bindgen as we would still need manual translation for libc types. More analysis on the ticket if anyone is interested. Mike: Last week: - Feeling a bit paralyzed by choosing which semi-urgent thing to prioritize (Sponsor2 work, Sponsor2 report, PETS Research Blog posts, vanguards experiments, vanguard packaging, vanguards blogposts, figuring out how the hell to pay PETS attendance, accumulated bureacracy since vacation). Treaded a bit of water trying to figure out which thing to do. This week: - Hopefully now have a plan: - Backburner Vanguard performance experiment and just choose consservative 2-3-8 params - Write a vanguards release blogpost draft, circulate to asn - Write PETS research blogpost draft, circulate to ??? - Ignore the bureacracy because fuck it. asn: Last week: - Finalized #25552. Been testing it for the past weeks and it's working great! Ensured that it addresses the issues onionshare has been seeing as well as #26549. - Reviewed #26479, #26480, #26425. - Discussed onion name systems with Mike and others. Now that v3s are getting more and more deployed, it's important to start fixing this big UX barrier. This week: - More reviews. - Catching up with leftover 035 deliverables. catalyst: last week (2018-W26): - CI rotation -- included some Jenkins issues like #26503 - reviewed some cross-compilation tickets (#25895, #25977) - made some progress on the big patches doc - helped with a few minor glitches from the refactoring commits (thanks for working on the refactor, Nick!) this week (2018-W27): - Coverity rotation - code review - more work on big patches doc - follow up on some Rust-related tickets as needed - dealing more with flaky internet access - July 4 off because holiday isis: last week: - took tuesday through thursday off to attend zcon0 - reviewed #25386 #24249 this week: - back to the create cell work - catching up on backlog - 1:1:1 meeting on tuesday at 10am PST - july 4 off

1 0

June 2018 report for the metrics team
by Karsten Loesing 02 Jul '18

02 Jul '18

Hello Tor, hello world! This month there's nothing substantial to report from the Tor metrics team. The reason is that iwakeh left the metrics team by the end of May and irl has just joined the team in July. It didn't make much sense for me to make changes in June without anybody reviewing them. Instead, I used the time for recovering from our end-of-May sprint, for cleaning up, and for having a vacation. I'm optimistic there will be more to report next month. On behalf of the Tor metrics team, Karsten

1 0

Notes from June 28 2018 Vegas team meeting
by Karsten Loesing 02 Jul '18

02 Jul '18

Notes for June 28 2018 meeting: Roger: 1) Should we collect and then maintain a list of who else in the world has Tor related funding? That way we can coordinate better at helping amplify their impact, and also remember to invite them to dev meetings, etc. [Answer: yes good idea in theory, but we'd need a responsible person to keep track of the list. We'll think on it.] Georg: 1) Our first Tor Browser alpha based on Firefox 60 ESR is out. The process was painful but the result seems to stick. \o/ 2) Got back to OTF regarding our bug bounty program Arturo: 1) Made some progress on coming up with a scheme for OONI measurement IDs. See: https://github.com/TheTorProject/ooni-pipeline/blob/master/docs/ooni-uuid.md 2) Investigating blocking of Tor in venezuela Shari: 1) We've been doing screenings for fundraising director candidates. 2) Lots of travel approvals for the Mexico City meeting. We need to come up with a more efficient way to do this! Contracts with the hotel have (finally!) been signed. 3) Worked on, and working on, more job descriptions and reading resumes. 4) Lots of little stuff in preparation for transitioning Isa; also getting caught up on a bunch of stuff. 5) FYI, I'll be doing this: https://shuttleworthfoundation.org/thinking/2018/06/26/thinking-Steward-Sha…; it wraps up in July Steph: 1) newsletter sending today or tomorrow (thanks, hiro!) 2) spoke on a panel with Trevor Timm (FPF) and David Greene (EFF) last week in Pittsburgh, people were very engaged 3) helped with 8.0a9 post and sharing 4) getting help from Tom and Arthur and others on a !(Tor + $Browser) post 5) connected with a comms person at mozilla who will check in with me about collaboration opportunities this fall 6) meeting today with gman999 and folks at NYU tandon about doing a talk 7) connected with access now and have been trying to get info about bridges out to folks in venezuela. thanks to antonela for helping with translations! 8) responded to inquiry about tor tab in brave Mike: 1) Nothing for the group, though curious how the patch count trend is going with Tor Browser, and other aspects of the Mozilla relationship. [GeKo: I could look the patch trend up. I think I posted metrics on a trac ticket for previous years, let me find it] Alison 1) still playing catch up after lots of travel 2) LFI is in week 4 and things are humming along. 3) HOPE talk organizing (we just got our timeslot confirmed this week) 4) finished community team roadmap 5) reading through support.torproject.org for soft launch 6) went to the ALA annual conference earlier in the week 7) Tor meetup in India was a success, trying to coordinate with those folks for what they need going forward 8) beginning planning for Kenya trip 9) Gus finished the week in Colombia (six trainings!) 10) Colin worked on the fallback directory mirror list 11) Tommy/Jaruga/Colin worked on user manual updates 12) Make sure to look at Cy's user issues report from May and let us know what you find useful: https://ethercalc.org/may_2018 Nick: 1) Busy with coding 2) All seems well. isabela: 1) back from Colombia where we (me, gus and antonela) did 6 trainings in 3 cities with over a dozen organizations (human rights defenders, social movements, women's groups, students etc). 2) working on sponsor9 phase 2 plan 3) dealing with many small things such as: expenses reports; catching up with emails; organizing sponsors reports and other stuff

1 0

Network team meeting notes, 25 June 2018
by Nick Mathewson 01 Jul '18

01 Jul '18

Whoops! Sorry for the delay. Our chat logs are at : http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-06-25-17.00.html And our pad contents are below: = Network team meeting pad, 25 Jun 2018 = Welcome to our meeting! Mondays at 1700 UTC on #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! Note the meeting location: #tor-meeting on OFTC! (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) == Previous notes == 23 April: https://lists.torproject.org/pipermail/tor-project/2018-April/001747.html 30 April: https://lists.torproject.org/pipermail/tor-project/2018-April/001750.html 7 May: https://lists.torproject.org/pipermail/tor-project/2018-May/001760.html 14 May: https://lists.torproject.org/pipermail/tor-project/2018-May/001769.html 21 May: https://lists.torproject.org/pipermail/tor-project/2018-May/001806.html 11 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001828.html 18 June: https://lists.torproject.org/pipermail/tor-project/2018-June/001835.html == Stuff to do every week = * Let's check and update the roadmap. What's done, and what's coming up? url to roadmap: https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Check reviewer assignments at https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Also, let's check for things we need update on our spreadsheet! Are there important documents we should link to? Things we should archive? * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… * Community guides, it's time to hand off to the next guide! * Let's look at proposed tickets! == Announcements == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next release! * The git master branch is now 0.3.5! == Discussion == Any volunteers for handling backports to stable? Any volunteers for leading 0.3.5 triage process? (Labeling tickts, asking people to label tickets, etc)? How can we help Ooni integrate and test Tor? https://github.com/measurement-kit/measurement-kit/issues/86 (teor added a comment about tor_api.h) [I think that ticket may be stale: simone knows about tor_api.h and has been working with it, IIUC. -nm] How can we help Ooni integrate and test pluggable transports? https://github.com/measurement-kit/measurement-kit/issues/1426 Ooni tests reachability to the default Tor Browser bridge IPs and ports, but how can they embed the protocols? [This is trickier. At least four ISPs in two countries have blocked most of the January 2018 list of fallbacks. Do we want to do a fallback rebuild in the next few weeks? When is our next stable Tor release? Update Steps: https://trac.torproject.org/projects/tor/wiki/doc/UpdatingFallbackDirectory… Master ticket: https://trac.torproject.org/projects/tor/ticket/24786 Step 1: Ask Relay Operators to Opt-In: https://trac.torproject.org/projects/tor/ticket/24804 [I am fine with doing this on whatever schedule you like. -nm] [I have talked with teor, and will handle the rebuild if/when desired. -phoul] Roger's thoughts: "if it's easy to make a new list, let's try it" "if they block the new list, we've learned something" "oh i wonder how tor behaves when half its fallbackdir list is blocked. like, do we have to throw out the existing ones, in order to give people a list that isn't half blocked in india andvenezuela? that would be sad" [Clients need >30% of the list to be unblocked to bootstrap reliably. Currently 97% of the list is blocked at one of the ISPs. So if we can get 50 new or rotated fallbacks, let's update the list. We have 13 new or changed fallbacks on #24805. We could get up to 35 rotated fallbacks from large operators in the existing whitelist. (If we aim for 200 fallbacks rather than 150, we can bump to 200 * 5% = 10 per operator and get 15 extra fallbacks from large operators.) Let's see if we can get ~40 more relays opted-in by emailing tor-relays and large operators? -teor] Or should we write blog posts / tweets / etc. about bridges? (Or both?) [Both seems good. -nm] What are next steps on SimonHF's "trace" proposal? https://lists.torproject.org/pipermail/tor-dev/2018-June/013205.html == Updates == Nick: * Last week: * Split roughly half of src/common into src/libs (#26481) per refactoring plan (https://pad.riseup.net/p/cJUbdx0c7IzM-keep) My goal is to have src/common completely gone in 0.3.5, replaced by a set of libraries. * Review and merge various stuff * Solved #25386 (rust linking), except not really. :/ * Worked on open appveyor issues * Wrote a utility to handle changing moving include files and automatically fixing up whatever uses them. * Made "src" the top of our include path. Now one includes "or/or.h" rather than or.h. * Wrote a utility to make sure that modules aren't including other modules when they shouldn't. * This week: * Get 26479 and 26480 (appveyor failures) fixed so I can release 0.3.4.3-alpha. * Release 0.3.4.3-alpha. * Prepare for an 0.3.3.6 release * Continue refacatoring src/common * Make the dependencies in src/libs acyclic. * Plan an order of operations for splitting src/or. * Open tickets about remaining cases of #25386 (sanitizers, rustdoc). * Document src/lib. * Make requested post-merge cleanup changes in src/lib structure. Dgoulet: * Offline this Monday for a holiday! isis (offline): last week: - still very sick - travelled to england for a wedding and was even more sick there, took wednesday through friday off mostly - worked on the PQ KEX spec and worked out lowering the number of error correcting codes #24990 - reviewed #25386 #24249 #26196 - some maintenance on the bridge authority, started looking into getting a new server racked this week: - offline monday to travel back from europe - taking tuesday through thursday off to attend the zcash meetings and conference in montréal - probably 50% around tuesday through friday to do work and be online - maybe taking friday off because i'm not sure how useful i can be after that much travel and i'm also still sick komlo (offline): last week: - Sumitted some ideas for #24249 (Create automated mechanism for C/Rust types to stay in sync); would appreciate others thoughts here this week: - I have a few public talks coming up so will focus on getting those done and then will be back to more tor things. haxxpop (offline): last week: - nothing this week: - Read dgoulet's review on client auth and revise the PR according to the comments teor (offline): last week: - tried to work out why 0.3.3 breaks on cygwin (#26460) and SunOS (#26469) - read (some of) The Unicode Standard, and made the UTF-8 spec in prop#285 more precise (#26457) - Worked with juga to spec MaxAdvertisedBandwidth (#8494) - Other small bwauth suggestions and feedback - General ticket herding - Started a final experimental PrivCount data collection - Final report, contract admin, transition planning, etc. this week: - Move an experimental PrivCount node - Finish and analyse the final experimental PrivCount data collection - Final report, contract admin, transition planning, etc. - Do some more work on PrivCount in Tor, if I get time asn: Last weeks: - Went travelling. Was fun. - Revised #25552. - Pushed torspec branch to #26379. - Pinged my contact about DV certs for onions. This week: - Catch up with backlog - Do reviews. - Finalize #25552. - Start planning for 035 work and deliverables. ahf Last week: Sponsor 8: - Worked on better process handling for #25502 - looked into what is needed to do what I think is needed on all our platforms including Windows. - Looked at mio/miow from the Rust people. - Tried to write a small IOCP backend for libevent that fakes "readiness" in the same way that Mio does it. Misc: - Coverity duty: Lots of issues found. A lot of them are fixed in #26467, but two "classes" of bugs remain unfixed. Would like some help to figure out what the issue is there. - CI duty: Thanks to Nick and Taylor for diving into the Rust issue! - Wrote a very minimal Sandbox for MacOS (#26374) in https://github.com/ahf/tor/tree/wip-macos-sandbox. - Got introduced to the build process of Tor Browser. - Investigated Sandbox options for Windows. This week: Sponsor 8: - Continue with development of process handling code for #25502 Misc: - Finish off two remaining classes of Coverity issues for #26467. - Review: #17873, #24104, #24546. - Rotation roles: Community Hero. catalyst: last week (2018-W25): - fought with flaky internet connection - with Nick, tried to fix a lot of issues related to tests in the crypto crate that were causing CI to fail - made some progress on the big patches doc, with Nick this week (2018-W26): - CI rotation - more work on big patches doc - more Rust build fixes - code reviews - does someone more familiar with trunnel want to swap reviews on #3569 (refactor SOCKS parsing)? [Nick will] Mike: last week: - Updated and rebased #26214 - Tried to sign up for PETS, failed (banned by paypal, even over nontor) - Signed up for account for sending sponsor2 report - Began enumerating work items for said report - Still clearing the decks from vacation, etc (travel went longer than expected) this week: - Figure out sponsor2 report; decide how much more to try to get done before submitting it - Figure out PETS booking + research blog post topics - For real set up vanguard perf experiments dmr this week: - atagar and I would like to move #26197 forward (automatic mirroring to3 stem repo on github)

1 0

Tor Browser team meeting notes, 26 June 2018
by Georg Koppen 27 Jun '18

27 Jun '18

Hi! Even though the meeting yesterday was a bit bumpy due to OFTC issues here come the usual notes and link to the chat log. For the latter see: http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-06-26-17.59.log… The notes from the pad are: Tuesday, June 26, 2018 Discussion: -alpha release -next meetings (brade: July 2; discuss future meetings at that meeting or via email) (GeKo: I can't make it on Monday, sent a mail to tbb-dev for further planning (https://lists.torproject.org/pipermail/tbb-dev/2018-June/000867.html)) - sysrqb: do we have a process for including new bridges in TB? (GeKo: yes, https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Hacking#Adding…) - sysrqb: rustconf - 16-17 August, in Portland, OR, USA - should any of us go? (i'm thinking about going) (GeKo: sounds good to me!) pospeselr: Last Week: - finished #23247 (onion lock) - posted patch for #26039 (extension-overrides.js) - posted patches for #26355 (no install/update on Vista or lower) - discovered and investigated #26456 (HTTP onions tabs inherit certificate info from previous HTTPS pages) - #859782 (run without /proc) now fixed in FF62 - discovered an issue with pdfjs while working on #26039, disableRange option now seems to break pdfjs altogether, will file a bug in a hot sec This Week: - post fixups for #26039 - figure out and fix #26456 - file bug for pdfjs issue and investigate - backport patch #859782 to ESR60 TorBrowser sukhe: Last Week: - #9145 (enable hardware acceleration); under review - #26251 (build Snowflake for macOS); under review - #26319 (update mach build package); under review - #26186 (remove intl.locale.matchOS); merged This Week: - #26216 (MAR generation broken) - #12968 (Specify HEASLR in MinGW-w64) mcs and brade: Last week: - Continued with #22074 (Review Firefox Developer Docs and Undocumented bugs since FF52esr). GeKo: Did you already file bugs for the things you found in the Dev Docs? mcs: No, we will do that. - Worked on — but did not find the root cause of — #26381 (about:tor page does not load on first start in localized Windows bundle) (Arthur says: could you post your "headless" branch of tor-launcher? I'm curious if it fixes 26506 symptom) mcs: We will clean it up and post it. Arthur: thanks! :) - Helped with bug triage, code reviews, and testing of esr60 fixes and backports. This week: - Help with the Tor Browser 8.0a9 release, especially updater testing. - Continue on #26381 (about:tor page does not load on first start in localized Windows bundle) - Assist with #26506 (NoScript not working on TBB/ESR60 on Windows) - Look at #26477 (Meek is broken in ESR60-based Tor Browser) - Continue on #22074 (Review Firefox Developer Docs and Undocumented bugs since FF52esr). Note: We will have reduced hours next week due to the U.S. July 4th holiday. boklm: Last week: - helped build/publish the new releases - reviewed some patches: - #26362: Use old MAR format when generating the MAR files for the first esr60-based alpha - #23561: Fix NSIS builds for Windows 64 - #26424: Disable using UNC paths via preference - #26221: Backport patch for bug 1444532 to Tor Browser stable (7.5) - made some patches for: - #26428: temporary fix to avoid https-e submodule error - #26440: move vaulted vars to a separate directory - #26461: Generating incrementals fails if the release/signed or alpha/signed directory doesn't exist - #26450: disable dependency on firefox-langpacks in testbuild - #26489: dmg2mar script is broken due to added whitespace in "Tor Browser" - #26496: Set MAR_OLD_FORMAT=1 in dmg2mar - #26380: Remove tor browser sandbox from the download page - started working on a patch for #26323 (Build 32bit Linux bundles on 64bit systems) - booked flights for mexico meeting This week: - continue with 8.0a9 release - doing some reviews - fill upstream binutils ticket for #26148 - continue work on some ansible roles for testsuite VMs setup (#26149) PSA: I plan to be on vacation from 7/14-7/22 GeKo: Last Week -release preparations (including hotfixing a bunch of release blockers for the alpha over the weekend) -release signing -patches written for seatbelt profiles removes (#26438), unbreaking our Linux32 alpha builds (#26462) -reviews: #23247, #26428, #26440, #20628, #26451, #26039, #26461, #26186, #26430 This Week -help with the alpha release -bug triage after alpha release taking release fallout into account -more network code audit -work on tracking down the rust related reproducibility issue we found (#26475) -more reviews -getting up to speed again with the tor browser for android state and focusing on getting it moved forward towards the alpha release -prepare meeting with Cliqz folks PSA: I plan to be on vacation from 7/8-7/16 (inclusive) sysrqb: last week: - Rebased TBA patches onto 60.1.0, more testing (#26401) - Finished first-round proxy-safety audit (#21863) - Windows/OSX/Linux Sandbox investigation - Recovery from all-hands - Some thinking about Tor+IPv6 because mobile networks are adopting it faster than others - Created some more tickets from auditing #26401 This week - Setting up local proxy-bypass test environment for Android - Setting #26401 in needs-review, really this time - More sandboxing investigation, and hopefully writing an email - I'm making notes https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Sandbox igt0: Last week: - Investigated the Gecko Mozilla Update Service, the comment #9 describes my finds (#26242) - Commented out the ticket #26318 (Consider different installation methods) about a proposal how we can validate de app. - Started updating UpdateService to support F-Droid (I will open a ticket about it this week). This week: - Send patch to make UpdateService support F-Droid - Make UpdateService to use the app directory(sandboxed) instead of an external storage. arthuredelstein: Last week: - Investigated #26322 (Circuit display - UI bug - Long v3 name) - Wrote a patch for #26430 (New torbutton icons) - Patch for #26321 (Remove some menu items from torbutton and move to Fil/hamburger menu - Reviewed #26058 (Revert #18743 - "Sign in to Sync" icon not hidden) - Wrote patch for #20629 (More locales for Tor Browser) - Patch for 26451 (HTTPS-E update) - Opened and patched #26500 (Torbutton relay icon in the wrong place) - Opened and investigated #26506 (NoScript not working on TBB/ESR60 on Windows) - Investigated https://trac.torproject.org/projects/tor/ticket/26128#comment:13 (extension startup race affects noscript control) This week: - Keep looking at #26506, #26128 comment 13 issues - More UX issues in 8.0a we need to fix (some of which I will file today) - Optimistic SOCKS. HTTP/2 if there is time - Help verify build as needed tjr - mingw-clang (Jacek) goes swimmingly! We have a successful build in TaskCluster, and Jacek is cleaning up patches and getting them reviewed. - Unsure of how far along he is in his contract though - I have yet to dig into https://bugzilla.mozilla.org/show_bug.cgi?id=1470772 but plan to tomorrow - Are esr60-based builds going to have a Windows x86 release? Are esr60-clang-based builds? (GeKo: it sems 32bit Windows builds still seem useful, we keep them for now) - Answer: Yes. - I am working on fuzzyfox - I replied to tor-qa about alpha 9 on Windows. sisbell: Last week: -Got builds working in my environment: tor-browser desktop, rbm, Fennec This week: - Working on getting mobile tor browser build working Georg

1 0

Recent Tor bridge user counts are potentially misleading
by David Fifield 26 Jun '18

26 Jun '18

Thanks for your article, https://www.accessnow.org/venezuela-blocks-tor/. I'm writing in response to this statement: "traffic on the Tor network ... increased ... even more sharply this month via Tor bridges — likely in response to a new wave of online censorship from the Maduro government." I don't think the sharp increase in bridge users can be attributed to anything happening in Venezuela. A similar pattern is observed in many countries at the same time, not just in Venezuela. To choose a few examples: Chile https://metrics.torproject.org/userstats-bridge-country.html?start=2018-04-… Indonesia https://metrics.torproject.org/userstats-bridge-country.html?start=2018-04-… Morocco https://metrics.torproject.org/userstats-bridge-country.html?start=2018-04-… The same trend is visible in the aggregate of all countries: https://metrics.torproject.org/userstats-bridge-country.html?start=2018-04-… If you scroll down on the metrics page, you'll see that the phenomenon has been noted, but the cause is unknown: > 2018-04-15 to present Doubling of bridge users over about 45 days. Relay users unaffected. So while a decrease in Tor users in the past few days is likely attributable to censorship by the Venezuelan government, the increase in bridge users in the months preceding probably has some other, more global cause, not necessarily related to censorship.

1 0

services report - may 2018
by silvia [hiro] 26 Jun '18

26 Jun '18

Hi all, Here is the late report for the month of may about what has happened in services. Have been working on testing and tuning the support portal. It is now live at https://support.torproject.orga few things are under WIP at the moment but soon it will have some very nice features. Like allow for links to be translated, so that we will have better seo. Investigated and tested the support portal search application [1]. Started migrating newsletter to Lektor and styleguide. This is now ready to be launched. Created an elasticsearch testbed in docker-compose to analyse raw log data via kibana. This is supposed to be used as a prototype for more complex projects. Currently it is configured to download onionperf tpf files and import them so that they can be accessed as indexed data via kibana [3]. Lektor package has been submitted so it might be approved and available through the backports soon. Continued consolidating the test services infrastructure where things like onionperf and oniongit run. In the long term, the objective is to manage everything through saltstack [4], a configuration management software similar to ansible. This will be a long term effort. Updated oniongit dns. It should be much faster now! Sent a small merge request to ooni to parse fallback dirs list to csv [5] [1] https://search.onionlab.eu [2] https://trac.torproject.org/projects/tor/ticket/22026 [3] https://0xacab.org/spaghetti/metrics-search [4] https://saltstack.com/ [5] https://github.com/OpenObservatory/ooni-resources/pull/14

1 0