- tor-project - lists.torproject.org

Tor Browser team meeting notes, 26 June 2018
by Georg Koppen 27 Jun '18

27 Jun '18

Hi! Even though the meeting yesterday was a bit bumpy due to OFTC issues here come the usual notes and link to the chat log. For the latter see: http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-06-26-17.59.log… The notes from the pad are: Tuesday, June 26, 2018 Discussion: -alpha release -next meetings (brade: July 2; discuss future meetings at that meeting or via email) (GeKo: I can't make it on Monday, sent a mail to tbb-dev for further planning (https://lists.torproject.org/pipermail/tbb-dev/2018-June/000867.html)) - sysrqb: do we have a process for including new bridges in TB? (GeKo: yes, https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Hacking#Adding…) - sysrqb: rustconf - 16-17 August, in Portland, OR, USA - should any of us go? (i'm thinking about going) (GeKo: sounds good to me!) pospeselr: Last Week: - finished #23247 (onion lock) - posted patch for #26039 (extension-overrides.js) - posted patches for #26355 (no install/update on Vista or lower) - discovered and investigated #26456 (HTTP onions tabs inherit certificate info from previous HTTPS pages) - #859782 (run without /proc) now fixed in FF62 - discovered an issue with pdfjs while working on #26039, disableRange option now seems to break pdfjs altogether, will file a bug in a hot sec This Week: - post fixups for #26039 - figure out and fix #26456 - file bug for pdfjs issue and investigate - backport patch #859782 to ESR60 TorBrowser sukhe: Last Week: - #9145 (enable hardware acceleration); under review - #26251 (build Snowflake for macOS); under review - #26319 (update mach build package); under review - #26186 (remove intl.locale.matchOS); merged This Week: - #26216 (MAR generation broken) - #12968 (Specify HEASLR in MinGW-w64) mcs and brade: Last week: - Continued with #22074 (Review Firefox Developer Docs and Undocumented bugs since FF52esr). GeKo: Did you already file bugs for the things you found in the Dev Docs? mcs: No, we will do that. - Worked on — but did not find the root cause of — #26381 (about:tor page does not load on first start in localized Windows bundle) (Arthur says: could you post your "headless" branch of tor-launcher? I'm curious if it fixes 26506 symptom) mcs: We will clean it up and post it. Arthur: thanks! :) - Helped with bug triage, code reviews, and testing of esr60 fixes and backports. This week: - Help with the Tor Browser 8.0a9 release, especially updater testing. - Continue on #26381 (about:tor page does not load on first start in localized Windows bundle) - Assist with #26506 (NoScript not working on TBB/ESR60 on Windows) - Look at #26477 (Meek is broken in ESR60-based Tor Browser) - Continue on #22074 (Review Firefox Developer Docs and Undocumented bugs since FF52esr). Note: We will have reduced hours next week due to the U.S. July 4th holiday. boklm: Last week: - helped build/publish the new releases - reviewed some patches: - #26362: Use old MAR format when generating the MAR files for the first esr60-based alpha - #23561: Fix NSIS builds for Windows 64 - #26424: Disable using UNC paths via preference - #26221: Backport patch for bug 1444532 to Tor Browser stable (7.5) - made some patches for: - #26428: temporary fix to avoid https-e submodule error - #26440: move vaulted vars to a separate directory - #26461: Generating incrementals fails if the release/signed or alpha/signed directory doesn't exist - #26450: disable dependency on firefox-langpacks in testbuild - #26489: dmg2mar script is broken due to added whitespace in "Tor Browser" - #26496: Set MAR_OLD_FORMAT=1 in dmg2mar - #26380: Remove tor browser sandbox from the download page - started working on a patch for #26323 (Build 32bit Linux bundles on 64bit systems) - booked flights for mexico meeting This week: - continue with 8.0a9 release - doing some reviews - fill upstream binutils ticket for #26148 - continue work on some ansible roles for testsuite VMs setup (#26149) PSA: I plan to be on vacation from 7/14-7/22 GeKo: Last Week -release preparations (including hotfixing a bunch of release blockers for the alpha over the weekend) -release signing -patches written for seatbelt profiles removes (#26438), unbreaking our Linux32 alpha builds (#26462) -reviews: #23247, #26428, #26440, #20628, #26451, #26039, #26461, #26186, #26430 This Week -help with the alpha release -bug triage after alpha release taking release fallout into account -more network code audit -work on tracking down the rust related reproducibility issue we found (#26475) -more reviews -getting up to speed again with the tor browser for android state and focusing on getting it moved forward towards the alpha release -prepare meeting with Cliqz folks PSA: I plan to be on vacation from 7/8-7/16 (inclusive) sysrqb: last week: - Rebased TBA patches onto 60.1.0, more testing (#26401) - Finished first-round proxy-safety audit (#21863) - Windows/OSX/Linux Sandbox investigation - Recovery from all-hands - Some thinking about Tor+IPv6 because mobile networks are adopting it faster than others - Created some more tickets from auditing #26401 This week - Setting up local proxy-bypass test environment for Android - Setting #26401 in needs-review, really this time - More sandboxing investigation, and hopefully writing an email - I'm making notes https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Sandbox igt0: Last week: - Investigated the Gecko Mozilla Update Service, the comment #9 describes my finds (#26242) - Commented out the ticket #26318 (Consider different installation methods) about a proposal how we can validate de app. - Started updating UpdateService to support F-Droid (I will open a ticket about it this week). This week: - Send patch to make UpdateService support F-Droid - Make UpdateService to use the app directory(sandboxed) instead of an external storage. arthuredelstein: Last week: - Investigated #26322 (Circuit display - UI bug - Long v3 name) - Wrote a patch for #26430 (New torbutton icons) - Patch for #26321 (Remove some menu items from torbutton and move to Fil/hamburger menu - Reviewed #26058 (Revert #18743 - "Sign in to Sync" icon not hidden) - Wrote patch for #20629 (More locales for Tor Browser) - Patch for 26451 (HTTPS-E update) - Opened and patched #26500 (Torbutton relay icon in the wrong place) - Opened and investigated #26506 (NoScript not working on TBB/ESR60 on Windows) - Investigated https://trac.torproject.org/projects/tor/ticket/26128#comment:13 (extension startup race affects noscript control) This week: - Keep looking at #26506, #26128 comment 13 issues - More UX issues in 8.0a we need to fix (some of which I will file today) - Optimistic SOCKS. HTTP/2 if there is time - Help verify build as needed tjr - mingw-clang (Jacek) goes swimmingly! We have a successful build in TaskCluster, and Jacek is cleaning up patches and getting them reviewed. - Unsure of how far along he is in his contract though - I have yet to dig into https://bugzilla.mozilla.org/show_bug.cgi?id=1470772 but plan to tomorrow - Are esr60-based builds going to have a Windows x86 release? Are esr60-clang-based builds? (GeKo: it sems 32bit Windows builds still seem useful, we keep them for now) - Answer: Yes. - I am working on fuzzyfox - I replied to tor-qa about alpha 9 on Windows. sisbell: Last week: -Got builds working in my environment: tor-browser desktop, rbm, Fennec This week: - Working on getting mobile tor browser build working Georg

1 0

Recent Tor bridge user counts are potentially misleading
by David Fifield 26 Jun '18

26 Jun '18

Thanks for your article, https://www.accessnow.org/venezuela-blocks-tor/. I'm writing in response to this statement: "traffic on the Tor network ... increased ... even more sharply this month via Tor bridges — likely in response to a new wave of online censorship from the Maduro government." I don't think the sharp increase in bridge users can be attributed to anything happening in Venezuela. A similar pattern is observed in many countries at the same time, not just in Venezuela. To choose a few examples: Chile https://metrics.torproject.org/userstats-bridge-country.html?start=2018-04-… Indonesia https://metrics.torproject.org/userstats-bridge-country.html?start=2018-04-… Morocco https://metrics.torproject.org/userstats-bridge-country.html?start=2018-04-… The same trend is visible in the aggregate of all countries: https://metrics.torproject.org/userstats-bridge-country.html?start=2018-04-… If you scroll down on the metrics page, you'll see that the phenomenon has been noted, but the cause is unknown: > 2018-04-15 to present Doubling of bridge users over about 45 days. Relay users unaffected. So while a decrease in Tor users in the past few days is likely attributable to censorship by the Venezuelan government, the increase in bridge users in the months preceding probably has some other, more global cause, not necessarily related to censorship.

1 0

services report - may 2018
by silvia [hiro] 26 Jun '18

26 Jun '18

Hi all, Here is the late report for the month of may about what has happened in services. Have been working on testing and tuning the support portal. It is now live at https://support.torproject.orga few things are under WIP at the moment but soon it will have some very nice features. Like allow for links to be translated, so that we will have better seo. Investigated and tested the support portal search application [1]. Started migrating newsletter to Lektor and styleguide. This is now ready to be launched. Created an elasticsearch testbed in docker-compose to analyse raw log data via kibana. This is supposed to be used as a prototype for more complex projects. Currently it is configured to download onionperf tpf files and import them so that they can be accessed as indexed data via kibana [3]. Lektor package has been submitted so it might be approved and available through the backports soon. Continued consolidating the test services infrastructure where things like onionperf and oniongit run. In the long term, the objective is to manage everything through saltstack [4], a configuration management software similar to ansible. This will be a long term effort. Updated oniongit dns. It should be much faster now! Sent a small merge request to ooni to parse fallback dirs list to csv [5] [1] https://search.onionlab.eu [2] https://trac.torproject.org/projects/tor/ticket/22026 [3] https://0xacab.org/spaghetti/metrics-search [4] https://saltstack.com/ [5] https://github.com/OpenObservatory/ooni-resources/pull/14

1 0

May 2018 report for the metrics team
by Karsten Loesing 25 Jun '18

25 Jun '18

Hello Tor, hello world! Below you'll find the highlights of Tor metrics team work done in May 2018. On behalf of the Tor metrics team, Karsten Completed the draft document with graph specifications to now include all graphs on Tor Metrics. Resolved a series of smaller inconsistencies in statistics on Tor Metrics, including: number of bytes spent on directory requests [1], bandwidth histories [2], and onion services [3]. [1] https://bugs.torproject.org/26002 [2] https://bugs.torproject.org/26015 [3] https://bugs.torproject.org/26022 Extended per-graph CSV files on Tor Metrics to support ad-hoc generation of CSV files without parameters to cover more data than what's displayed in a graph [4]. [4] https://bugs.torproject.org/25383 Improved explanations of metrics and flags on Relay Search [5, 6, 7] [5] https://bugs.torproject.org/25881 [6] https://bugs.torproject.org/25854 [7] https://bugs.torproject.org/26079 Put out new releases of CollecTor and metrics-lib [8] as well as Onionoo, ExoneraTor, and metrics-web [9] to switch from Gson to Jackson as JSON library. [8] https://lists.torproject.org/pipermail/tor-dev/2018-May/013191.html [9] https://lists.torproject.org/pipermail/tor-dev/2018-May/013204.html Extended CollecTor's index.json file to include contributed data in preparation of serving metrics-related research data from the wider Tor community on Tor Metrics.

2 1

[TSoP] stem.client - status report #3
by Dave Rolek 25 Jun '18

25 Jun '18

Hi everyone! This is my third status report for the stem.client TSoP project [1]. You may see my previous reports on the tor-project ml. [2][3] This report comes a bit late - sorry about that! # Updates Last week I was feeling ill, so I didn't tackle things quite as big (long periods of concentration were hard to achieve) nor get quite as much done. ## stem.client I pushed things forward a bit on code review [4][5][6], including branching some discussion/findings out into separate tickets [7][8][9]. Still waiting on some architecture discussion [10]. ## stem, general I did a few small fixes: * document the --quiet testing flag [11] * improve reliability of an integration test [12] * address some linter findings [13] I also spent some time working on the tox configuration, although that's not push-ready, so I don't have a reference for that. ## tor protocol, general Per previous suggestion from Roger, I've been glancing through the tor-design paper [14][15][16] and updates [17][18][19] while reading the specification, and that's been helping solidify my understanding. I neglected to mention in my last update that I brought up handling of padding bytes [20] at the network-team meeting that week. There's been a bit of discussion thereon with atagar in the context of stem.client. # What's next ## stem.client Per my previous plan, I'll be tackling some not-so-architecture-dependent changes. Hoping to get some feedback on the architecture soon, and start implementing some of those changes! ## stem, general I still have a few 'dev' tickets I'd like to work on. As mentioned above, I've done some work on improving the tox configuration, so I plan to wrap that up. ## tor-spec As aforementioned, I'll push forward on the padding bytes ticket [20] into a spec change. # Other Tor things On the side, I've spent time chatting with a lot of people about tor in the past few weeks, and it's really cool to see how many people are interested in it! This has spanned a wide range of professions from journalists, to artists, to musicians, to librarians, to software developers, to students, and more (I can't even remember all of it - lots of informal discussions). The Tor Browser manual's graphic showing a connection to a website [21] has been pretty helpful for ad-hoc descriptions. And when I haven't had paper to draw on, I've used various small objects to cover up parts of the graphic to contrast Tor with a VPN, and people have been able to make the mental leap! One person already came with some pre-existing knowledge of Tor, and so with him I asked him to explain what he thought Tor was / how it worked prior to any other input / visual aid (didactic strategy of having others teach you), and he did a pretty good job! I helped set a few things straight, but it was cool to know that he'll likely be able to explain Tor confidently now to anyone else. :) # Closing As with before, I've been active and reachable over IRC, where my nick is dmr. Please don't hesitate to reach out to me via IRC or email! Thanks, Dave [1] https://lists.torproject.org/pipermail/tor-dev/2018-April/013090.html [2] https://lists.torproject.org/pipermail/tor-project/2018-May/001811.html [3] https://lists.torproject.org/pipermail/tor-project/2018-June/001830.html [4] https://trac.torproject.org/projects/tor/ticket/26227#comment:7 [5] https://trac.torproject.org/projects/tor/ticket/26227#comment:9 [6] https://trac.torproject.org/projects/tor/ticket/26227#comment:13 [7] https://trac.torproject.org/projects/tor/ticket/26420 [8] https://trac.torproject.org/projects/tor/ticket/26431 [9] https://trac.torproject.org/projects/tor/ticket/26432 [10] https://trac.torproject.org/projects/tor/ticket/26226 [11] https://trac.torproject.org/projects/tor/ticket/26421 [12] https://trac.torproject.org/projects/tor/ticket/26225 [13] https://trac.torproject.org/projects/tor/ticket/26483 [14] https://www.torproject.org/docs/documentation.html.en#DesignDoc [15] https://svn.torproject.org/svn/projects/design-paper/tor-design.pdf [16] https://svn.torproject.org/svn/projects/design-paper/tor-design.html [17] https://blog.torproject.org/blog/top-changes-tor-2004-design-paper-part-1 [18] https://blog.torproject.org/blog/top-changes-tor-2004-design-paper-part-2 [19] https://blog.torproject.org/blog/top-changes-tor-2004-design-paper-part-3 [20] https://trac.torproject.org/projects/tor/ticket/26228 [21] https://tb-manual.torproject.org/en-US/media/how-tor-works.png

1 0

[TSoP 2018] Bandwidth scanner update - report #3
by juga 24 Jun '18

24 Jun '18

Hi, since report #2, these are the tasks i have worked on: Tor directory protocol: ------------------------ - started to work on specification for archiving bandwidth files [0] Bandwidth List format specification: -------------------------------------- - possible text to add regarding limiting measured bandwidth to MaxAdvertisedBandwidth [1] - fix Bandwidth file Timestamp is the latest scanner result, not the file creation time [2] little-t-tor -------------- - add test to check that descriptor is only updated on bandwidth changes when uptime is less than a day [3] - started to work on what makes some relays to advertise zero bandwidth-observed [4] Simple Bandwidth Scanner (sbws): --------------------------------- - keep previous bandwidth files and rename them to the date when they are generated [5] - run sbws with different python versions to find which ones fail with python lru_cache [6] - fix bandwidth file's earliest bandwidth [7] - fix node_id in bandwidth file to start with "$" [8] - find a bug when running sbws with python 3.4.2 [9] - find a bug when running sbws with python 3.4.5 [10] - fix a bug when there is not enough RAM [11] - suggest moving plotting scripts to other repo [12] - review limiting measured bandwidth to the advertised bandwidth [13] - review new Relay class [14] - discuss possible solutions when stem controller fails [15] - review integration test for RelayPrioritizer [16] [0] https://trac.torproject.org/projects/tor/ticket/21378 [1] https://trac.torproject.org/projects/tor/ticket/8494 [2] https://trac.torproject.org/projects/tor/ticket/26155 [3] https://trac.torproject.org/projects/tor/ticket/24104 [4] https://trac.torproject.org/projects/tor/ticket/24104 [5] https://github.com/pastly/simple-bw-scanner/issues/179 [6] https://github.com/pastly/simple-bw-scanner/issues/198, https://github.com/pastly/simple-bw-scanner/issues/193 [7] https://github.com/pastly/simple-bw-scanner/pull/187 [8] https://github.com/pastly/simple-bw-scanner/pull/188 [9] https://github.com/pastly/simple-bw-scanner/issues/194 [10] https://github.com/pastly/simple-bw-scanner/issues/203 [11] https://github.com/pastly/simple-bw-scanner/issues/195, https://github.com/pastly/simple-bw-scanner/pull/196 [12] https://github.com/pastly/simple-bw-scanner/issues/201 [13] https://github.com/pastly/simple-bw-scanner/pull/191 [14] https://github.com/pastly/simple-bw-scanner/issues/180 [15] https://github.com/pastly/simple-bw-scanner/issues/192 [16] https://github.com/pastly/simple-bw-scanner/pull/206

1 0

Tor blocked in Venezuela
by Maria Xynou 23 Jun '18

23 Jun '18

Hello, As of last night (or last morning, Venezuela-time), we've been receiving reports from locals in Venezuela that Tor is being blocked. State-owned CANTV is reportedly blocking access to Tor and obfs4. They've been running OONI Probe tests that seem to confirm this, though it remains unclear if other ISPs in Venezuela are blocking access to Tor (and Tor bridges) as well. This follows weeks of increased censorship, particularly targeting media websites (like lapatilla.com and elpitazo.com) What strategies would be relevant here? This may also be something worth thinking about for other countries where Tor is blocked as well (such as Egypt). Best, Maria. -- Maria Xynou Research and Partnerships Coordinator Open Observatory of Network Interference (OONI) https://ooni.torproject.org/ PGP Key Fingerprint: 2DC8 AFB6 CA11 B552 1081 FBDE 2131 B3BE 70CA 417E

9 11

[TSoP 2018] Ahmia status update ~ report #3
by Stelios Barberakis 23 Jun '18

23 Jun '18

Hello all, This is a status report for the development of ahmia.fi as part of tor summer of privacy. The things that have been *completed* the past two weeks are: * a migration script to automate copying Elasticsearch data from the old indices to the new ones according to the new scheme * a filter by time drop down menu, for the results page * set up the production environment on my workstation, the correct way... * some minor todos BR, Stelios -- PGP key: http://keyserver.ubuntu.com/pks/lookup?op=get&search=0xBF6EA91B7CBE3998

2 1

Notes from June 21 2018 Vegas team meeting
by Karsten Loesing 22 Jun '18

22 Jun '18

Notes for June 21 2018 meeting: Roger: 0) I'd like to call out Tom Ritter as being really super helpful last week at Mozilla All Hands, for organizing many many meetings for us and Mozilla folks, and making sure that our time there was really efficiently well spent. Thanks Tom! 1) Can we find a better duckduckgo contact for Isa? (better than what? What does Isa need the contact for? I have contacts at DDG.- Shari) 2) Shari, followup: status of funding-by-category-by-year spelunking? (maybe I'll be able to get back to that next week. that would be nice.) 3) Shari, followup: is sida money we-have-to-spend-it-to-keep-it? (no) 4) Mike: please confirm receipt of SponsorWTFPad annual report mail [Mike - I do not have a fastlane account. In the past, I sent you and Matt a bullet list of items to become the final report.. Am I supposed to write the whole thing this time?] 5) GeKo: Shari's funding pipeline report said there's $16k left in the OTF bug bounty funding, scheduled to end in August. We can get an NCE, so no huge deal, but I wonder if we should expand our publicity for the bug bounty program? "People aren't finding security bugs as quickly as we'd budgeted for" is something Steph can use too maybe. [GeKo: More publicity sounds good to me, and, yes, doing the NCE thing as well] 6) Arturo: did we ever hear from Roya about the Michigan NSF small? Else I'll mail her and ask. (No, last update was November 2017. Though maybe that is also news to you. It seemed like it was moving forward and they asked us to submit a budget about it. I guess it's still probably a good idea to checkin and see what the status of it is. - Art.) 7) Nickm: Internet Measurement Conference (IMC) is in Boston at the end of October: https://conferences.sigcomm.org/imc/2018/ The past few years the program has listed some awesome-looking talks. I can't go because of the OTF summit, but you could! 8) I mailed a bunch of people asking who else Isa and I should connect to for our Taipei trip. Let us know if you know somebody too. Shari: 1) going through resumes for new fundraising director 2) a few followup items from board meeting 3) finalizing contract for Mexico hotel and meeting space; other meeting details 4) need to work on budget reporting for Sida 5) finally feel like I've gotten rid of emergency stuff; trying to catch up on a bunch of other stuff next week Nick: 1) SVN has become more urgent. 2) We've begun moving things around the tor codebase a bit to try to get it in better shape for future modularity/refactoring/disentanglement work. If you are maintaining any patches on Tor, now is the time to get them upstreamed. :) Mike: 1) Getting back up to speed after vacation. 2) Need to decide between prioritizing more Sponsor2 work before the report vs packaging vanguards and doing final experiments. Arturo: 1) Attended CLSI (CitizenLab Summer Institute) in Toronto where we facilitated 2 sessions 2) Interviewed 5 community members for the "OONI Community Interviews" series 3) Published a research report on internet censorship in Nigeria: https://ooni.torproject.org/post/nigeria-internet-censorship/ 4) Creating materials for an OONI MOOC 5) Formed a new partnership with the Jordan Open Source Association 6) Made a lot of progress on implementing an OONI Psiphon test 7) Progress on OONI Explorer revamp work Karsten: 1) Performed an analysis of OnionPerf data, in particular circuit build times (#25774). Alison: 1) going to the American Library Association conference tomorrow, will be telling people about LFI and Tor 2) working on meeting planning 3) LFI is in week 3 4) Colin is finalizing the PETS relay ops meetup 5) Gus and I are working on the Kenya trip for sponsor9 6) we will soon start writing docs for Tor Browser 8.0 7) still have no details from HOPE about when our talk will be, hoping to get that soon so we can coordinate our booth times Georg: 1) release preparations for stable and alpha 2) Mike: Did we get some results out of the Tor-users-are-prevented-from-solving-CAPTCHAs measurements that were supposed to get done? [About two months ago they did a scan and it was fine. But I think it may have regressed, based on my personal experience]

1 0

Job Openings at Tor Project
by Erin Wyatt 20 Jun '18

20 Jun '18

Hey, everyone! Isa taking over as ED is a real thing (!!!) so we’re ready to recruit her replacement(s). We’ve posted two new PM job openings — please help us spread the word! :) * Project Manager for Network Projects: https://www.torproject.org/about/jobs-projectmanager-network.html.en <https://www.torproject.org/about/jobs-projectmanager-network.html.en> * Project Manager with Product Experience: https://www.torproject.org/about/jobs-projectmanager-product.html.en <https://www.torproject.org/about/jobs-projectmanager-product.html.en> We are also still looking for a Fundraising Director, which is a crucial position that can be tough to fill. Please continue to share the post: https://www.torproject.org/about/jobs-fundraising-director.html.en <https://www.torproject.org/about/jobs-fundraising-director.html.en> Thank you all! Cheers, Erin Wyatt HR Manager ewyatt(a)torproject.org GPG Fingerprint: 35E7 2A9F 6655 45F9 2CB6 6624 BA0C 9400 F80F 91CE

1 0