- tor-project - lists.torproject.org

Tor Browser team meeting notes, 3 April 2018
by Georg Koppen 04 Apr '18

04 Apr '18

Hello all! We had another team meeting yesterday. The chat log can be found on http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-04-03-18.59.log… and our pad items are: Tuesday, April 3, 2018 Discussion: -roadmap (https://docs.google.com/spreadsheets/d/1joFGDiHaqlorGeXhytKakiSnWY9TqTDv5Xq…) -Mozilla All Hands from the browser side - Wednesday's sync with UX team at 1900utc #tor-meeting - isa will send email to the list with agenda GeKo: Last Week: -https://bugzilla.mozilla.org/show_bug.cgi?id=1442406 (still not done, alas) -#25481 (made quite some progress) -update to the security control redesign proposal -continue triaging ages old bugs -during my Easter holidays came up with a fix for #21537 -prepared for IRC interviews This Week: -more IRC interviewing -more work on #25481 -monthly admin stuff -bug triage -getting back to #21777 mcs and brade: Last week: - Finished patches for #25405 (cannot use Moat if a meek bridge is configured). - Created an updated patch for #21850 (Update #16940 patch for e10s (about:tbupdate)). - Commented on #24309 (Activity 4.1: Improve how circuits are displayed to the user). - Spent a little time on #25663 (Downloaded files are corrupted). - Reviewed all of the updater bugs that have been fixed in Firefox since ESR52. [I am excited about the LZMA support that landed. I wonder about all the pieces we need to switch on our side for that, do we get that for free? GeKo] This week: - Review the team roadmap. - Help with code reviews including #25126 (about:tor should work on small screens). - Create tickets for some ESR60 updater-related tasks. - Start rebasing the Tor Browser updater patches for ESR 60. tjr: (may not make the meeting, feeling sick) - Got a MinGW x64 Build going in TaskCluster: https://bugzilla.mozilla.org/show_bug.cgi?id=1434316 - Don't have it running. Currently messing with --disable-install-strip to try and get usable symbols Might be a MinGW bug https://sourceforge.net/p/mingw-w64/mailman/mingw-w64-public/thread/CA%2BcU… - Have done some easy P2 Resist Fingerprinting Bugs: - Canvas Learn More Link in the Permission Prompt (Not uplifted to 60. Do you want it?) [Geko: that one looks like we would be interested] - WebGL Debug Info - uplifted to 60 - Spoof English Gets Reset https://bugzilla.mozilla.org/show_bug.cgi?id=1447592 Not uplifted yet. I have to figure out how to reproduce this, if anyone knows what they're talking about... [I think we don't need that one uplifted, GeKo] - Local IP Address Leak via WebRTC (being debated, not uplifting to 60 unless you want it) [I think this is nothing for ESR60 either for us, GeKo] igt0: Last week: - Took a look in the domain isolator to verify if it was possible to make it available for the alpha release. Final Status: The effort to make it work would be too hard since for the alpha release we will use the android vpn service. - Helped out sysrqb debugging the https-e race condition (it is still magical for us). - Investigated why cloudfare captcha doesn't render the image for Orfox users. This Week: - Keep investigating about cloudfare captcha and Firefox. Looks like if user is behind tor and the user agent is mobile, even the firefox desktop doesn't render the captcha image. [See my theory about "There is no ESR 52 for Android, therefore your browser is outdated and insecure and therefore we won't serve you content idea"? GeKo] [yep, i am using the latest fennec useragent and it didn't work (Mozilla/5.0 (Android; Mobile; rv:59.0) Gecko/59.0 Firefox/59.0) - igt0 Aha, so we need a different theory the, good. GeKo] boklm: Last week: - finished publishing of the new releases - started reviewing patch for #25483 (Windows reproducible build of snowflake) - worked on binutils reproducibility issue (#16472) This week: - continue work on toolchain updates - fix #25318 (Add Tor Browser nightly builds email notification) - work on getting the testsuite running sysrqb: Last week: Built Orfox (52.7.3) - still waiting for release https://people.torproject.org/~sysrqb/Orfox-tor-browser-52.7.3esr-7.5-1.apk Made progress on updating https-everywhere add-on (25603) - still debugging Started troubleshooting #25659 (race condition during add-on installation?) Documented some TBA roadmap items on the wiki https://trac.torproject.org/projects/tor/wiki/org/teams/ApplicationsTeam/To… Updated (a little) the Application team wiki page https://trac.torproject.org/projects/tor/wiki/org/teams/ApplicationsTeam This week: Merge Orfox https-everywhere update Start rebase onto mozilla-central sysrqb: gk, what should the review process look like? Will tor-browser.git have two new branches, one more for stable and another for alpha? [Okay, we'll wait on the rebase done by arthur; sysrqb and igt0 will help with the mobile parts. once done and reviewed we rebase the resulting patches onto mozilla-central used for tor browser alpha on mobile GeKo] pospeselr: Last week: Investigation on #20283 (Tor Browser should run without a /proc filesystem) Got a complete list of all open and openat sys calls requesting something in /proc in firefox and plugin_container process (for 64 bit linux) About 8 different scenarios found, majority of which currently handle failure gracefully 2 instances are dead code mozilla::ThreadStackHelper::GetThreadStackBase() is the remaining problem (pointed out by Yawning in the bug report) current stack address is used as a sort of heuristic in several places in the code seems to be ranges certain types of JS are allowed to recurse down to (system native, system js, user js) from what I've been able to glean, the only way to get this information on linux is via the /proc/self/maps file (this is file parsed by pthreads calls) stack size is queryable via getrlimit syscall best thing I've been able to come up with is bouncing up the rbp register until we get an address that's out of range in order to get a good estimate of where the stack memory map begins/ends seems unlikely this sort of hacky bs would get upstreamed breaks as soon as the compilation options are changed to omit frame pointer usage (-fno-omit-frame-pointer flag is required on amd64) I've started investigating what we would need to do to refactor FF to not need the stack memory layout, but this seems to be a security-ish feature? Have not investigated whether any fstat or other file related syscalls are called on things in /proc but easy enough to do once this GetThreadStackBase issue is sorted arthuredelstein: Last week: * Worked on rebasing patches to ESR60 * Worked on FPI of permissions patch https://bugzilla.mozilla.org/show_bug.cgi?id=1330467 * Revising circuit display patch: https://trac.torproject.org/projects/tor/ticket/24309 This week: * Try to finish rebasing desktop patches [mcs: where are you doing this work?] [arthur: it's on a local branch atm. Tends to get re-ordered a lot, but I could post a snapshot if needed.] [mcs: we don't need it yet but would be useful soon-ish; maybe let me know which patches brade and I should work on][arthur: will do, thanks] * Post revised circuit display patch * Try to finish permissions patch, continue Save As patch * AFK (vacation) on Thursday and Friday isabela: Final report for sponsor4 - vixe! Working on sponsor8 Q1 2018 report Reviewed all roadmap and created a tab for the things ux team is involved and i am organizing all that on ux (stakeholders) side question for arthur -> this item: "Click your flag" design - I will want it to be a test not really a feature we ship - if its related to the 'one click solve all censorship problem'. Something like this need to be tested well before we put it on alpha. Georg

2 1

Notes from March 29 2018 Vegas team meeting
by Karsten Loesing 30 Mar '18

30 Mar '18

Notes for March 29 2018 meeting: Arturo: 1) Have a working prototype of OONI Probe desktop on macOS shipping the ooni in go binary statically linked to measurement-kit 2) Progress on implementing the mockups for the revamped OONI Explorer 3) Completed a first pass at writing the copy for the revamped OONI Probe mobile app 4) Did a talk at the Tor Vergata university Linux Users Group 5) This morning, without any prior notification, I got removed admin rights from github.com/torproject (different from github.com/thetorproject, which is where OONI repos are at, but it took the sleepy me some time to realise that). Does somebody know who did this? I think we are going to soon migrate all OONI repositories away from github.com/thetorproject as a precaution. [This was my team, "moving fast and breaking things", since that repository only contains network team stuff atm. Sorry for false alarm; I'll pass on request for notification. - Nick] 6) Hosted the March OONI Community Gathering: http://meetbot.debian.net/ooni/2018/ooni.2018-03-27-14.00.log.html 7) Updated Sierra Leone test list: https://github.com/citizenlab/test-lists/pull/320 8) Supported various community members with OONI data requests Nick: 1) This is my 9th meeting this week. Joy! 2) Cleaning up github/thetorproject membership with Arturo. 3) New alpha coming out today. 4) We seem to be sticking to our "critical fixes only" thing in 0.3.3; wish us luck in the coming week as we triage 0.3.4 5) ED search moves forward Mike: 1) Lots of email, discussion, and research about potential future Tor network changes 2) Wrote a draft to send to a Google DoS engineer I know about recaptcha and privacy pass, ran it by gk. Will send today. 3) Tor code review for 0.3.3 Shari: 1) scheduling board meeting and preparing information re: ED search interviews for discussion 2) trying to finalize the 2016 audit; could it actually be done this week? 3) trying to finalize location of next Tor meeting 4) started pulling together figures for where our money has come from 5) I'll be in San Francisco the end of next week to visit lots of folks and speak at this https://www.eff.org/event/john-perry-barlow-symposium; I hope to see Mike when I'm there, and hopefully Sue Gardner 6) spoke with Erin about starting job search for development director; should have that description written by next week Karsten: 1) Set up CollecTor's webstats module to sanitize web server logs and modified metrics-web to process these logs instead of the ones available on webstats.tp.o. If everything continues to look good, we can shut down webstats.tp.o in a few weeks. 2) We'll have an in-person metrics team meeting on April 11 where we're updating our roadmap. isabela: 1) Network team had it first meeting on the new format and worked pretty well :) 2) Organizing weekly syncs for sponsor9 work 3) Organizing UX and services roadmap (while reviewing TB roadmap) - this is actually a big effort (takes time) since involves many tasks 4) FB research proposal: Names associated are Geko, Arturo and Roger (can people confirm this is ok ?) [GeKo: Fine with me. Arturo: ACK.] 5) Spoke with students at a high-school in Brooklyn about how it is to do what I do at Tor 6) Website work is moving on! Translation for support will start to be tested soon, we are picking our illustrator for the sites. Our next priority for development is 'torproject.org'. Georg: 1) We got another bunch of releases out. So far we keep up with Mozilla's weekly security bugfix release schedule :) 2) Worked on the team roadmap and waiting on ux team to incorporate the remaining feedback Roger: 1) snowflake front domain: ticket 23947 wants some attention from our service admin types. I'll plan to get that thread started after the meeting. 2) rightscon booth: should we have one? [answer: yes, steph will lead that] 3) two extra rightscon tickets [Arturo: it turns out I don't need the other OONI ticket, simone already got his via other means.]? three. three extra rightscon tickets. [answer: maybe we should offer them to the broader Tor community, for example in exchange for helping us to staff the booth.] 4) mozilla fellow, user advocate role, status? [answer: we're nearly ready to post it] 5) facebook proposal Steph: 1) Went to LibrePlanet with Alison, Isa, Nathan, Nick. Excited to get better at this, do more talks, and talk to people at our booths. We'll submit for RightsCon village 2) Upcoming blog posts: rehash of mozilla fellowship, privacy int post on onions, a few volunteer spotlights in the works, tor messenger update 3) Asking to set up a call with private internet access about exits 4) Newsletter about ready to go 5) DuckDuckGo Privacy Challenge on til April 10, new competitions to win more money this week Alison: 1) Libreplanet was awesome 2) Getting on track with Sponsor 9 planning tomorrow 3) Library Freedom Institute curriculum development is my biggest priority right now 4) Code of Conduct is out for a vote! 5) helping find a location for the next NYC Tor meetup 6) speaking at the Texas Library Association Conference next week 7) still waiting to hear about HOPE....

1 0

Addendum to Mozilla Manifesto
by Shari Steele 29 Mar '18

29 Mar '18

Hey all. Mitchell Baker at Mozilla asked me to share their new Addendum to the Mozilla Manifesto, which they released today: The Mozilla Blog post: https://blog.mozilla.org/blog/2018/03/29/mozilla-marks-20th-anniversary-com… <https://blog.mozilla.org/blog/2018/03/29/mozilla-marks-20th-anniversary-com…> The Addendum itself. At the bottom is a button where one can share one’s support. That button creates a tweet. https://www.mozilla.org/en-US/about/manifesto/ <https://www.mozilla.org/en-US/about/manifesto/> Mitchell's op-ed: https://www.cnn.com/2018/03/29/opinions/tech-backlash-facebook-google-opini… <https://www.cnn.com/2018/03/29/opinions/tech-backlash-facebook-google-opini…> Shari

1 0

Tor at RightsCon
by Sukhbir Singh 28 Mar '18

28 Mar '18

Hi, Is anyone from the community planning to attend RightsCon in Toronto May 16-18? I was wondering if it is possible to have some sort of an information booth there for Tor (the RightsCon website doesn't mention anything in the program), and if yes, then we should plan that together. Does anyone have more information about how this works? I will be there so I was thinking if I should attend in that capacity, or just attend the event as a volunteer. For the curious, the ticket prices if you attend as an individual (and don't volunteer) are quite steep, IMO. -- Sukhbir

6 6

Tor Browser team meeting notes, 26 March 2018
by Georg Koppen 26 Mar '18

26 Mar '18

Hi! Our Tor Browser meeting just finished. The chat log can be found on http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-03-26-18.00.log… and our pad items are: Monday, March 26, 2018 Discussion: -roadmap (https://docs.google.com/spreadsheets/d/1joFGDiHaqlorGeXhytKakiSnWY9TqTDv5Xq…) -thoughts from the Rome meeting? (GeKo: I prefer a pre-meeting day as other teams are doing instead of having multiple days for gathering the roadmapping stuff) -next tor browser team meeting (It will be on 4/3 1800 UTC on #tor-meeting) GeKo: Work done since Rome: -releases, releases, releases -prepared the roadmap trying to take results from our session, the mobile session etc. into account -shortened my review queue, sorry that it took so long (I am almost done but will finish the remaining things this week) -#21777 (little progress but not done) -https://bugzilla.mozilla.org/show_bug.cgi?id=1442406 -looked again at #10394 to disable automatic HTTPS-Everywhere updates (Arthur is curious about this one.) [GeKo explained the idea in the meeting, see IRC log] -started to integrate building rust and tor with it enabled into tor-browser-build (#25481) -backlog due to dev meeting This week: -#21777 -https://bugzilla.mozilla.org/show_bug.cgi?id=1442406 -#25481 -update to the security control redesign proposal -continue triaging ages old bugs mcs and brade: Since Rome: - Worked on patches for #25405 (cannot use Moat if a meek bridge is configured ). - Spent a little time on #20212 (Tor can be forced to open too many circuits by embedding .onion resources). - Backported patches for #23439 (Exempt .onion domains from mixed content warnings). This week: - Finish #25405 (cannot use Moat if a meek bridge is configured). - Start rebasing the Tor Browser updater patches for ESR 60. igt0: Since Rome: - Updated #25013 addressing arthur's comments; - Rebased and built Orfox(Orfox-1.5.1-RC-1) - Investigated if it is possible to drop items from external apps inside orfox/firefox(Android 7 feature) This Week: - Take a look into the domain-isolator component to verify if it is possible to use it in the alpha tbb for android build. isabela: This week: - finish reviewing TB(desktop+mobile) roadmaps and updating/organizing ux roadmap to make sure we are aligned - start preparing final reports for sponsor4 that ends on march 30th - following up on censorship team stuff and FB proposal stuff <- does tb team has any feedback on this? boklm: Since Rome: - helped with building/publishing new releases - bisected binutils issue for #16472 - worked on #25304 (Update gcc to 6.4.0 (Linux)) - fixed: - #25531 (Add locks in archive.tpo rsync scripts) - #25585 (Use https instead of http to fetch dependencies when possible) - #23640 (Send a patch to add rbm to the reproducible-builds.org documentation) This week: - finish publishing releases - try to fix binutils reproducibility issue (#16472) and -debug build (#25584) - finish #25304 (Update gcc to 6.4.0 (Linux)) - fix #25318 (Add Tor Browser nightly builds email notification) - make some progress on #18867 (Ship auto-updates for Tor Browser nightly channel) pospeselr: Last Week: - visited the Netherlands This week: - go through 1432966's dependent bugs and bring down any patches required to fully fix #25147 - investigating work to excise /proc dependency on Linux (#20283) sysrqb: Since Rome: - We have a roadmap for TBA! - Orfox patches merged into Alpha (#19675) - Updated Orfox build docs (#25562) - Chatted with Arthur about building TorLauncher (and TorButton) as system add-ons (#24856) This week: - Building/Releasing Orfox based on 52.7.3esr (with help from the Guardian Project) (today) - Update HTTPS-Everywhere add-on bundled with Orfox (#25603) - Open some more tickets for tracking roadmap milestones - Continue working on TBA tickets arthuredelstein: Since Rome: - Worked on a patch for https://trac.torproject.org/projects/tor/ticket/24309 (new tor circuit display) - Did some more rebasing to mozilla-60. This week: - Continue to rebase - Try to uplift permissions isolation patch, which is nearly ready - Review Tor SoP applications Following week: - afk for 3 days Georg

1 0

Network team meeting notes, 26 March 2018
by Nick Mathewson 26 Mar '18

26 Mar '18

Hi, all! Our weekly meeting logs are available from: http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-03-26-16.58.html Below is a record of the contents of our pad. ----------- = Network team meeting pad, 26 March 2018 = ROS: My name is Guildenstern, and this is Rosencrantz. (GUIL confers briefly with him.) (Without embarrassment.) I'm sorry - his name's Guildenstern, and I'm Rosencrantz. -- Tom Stoppard, _Rosencrantz And Guildenstern Are Dead_ Welcome to our meeting! Mondays at 1700 UTC on #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! Note the meeting location: #tor-meeting on OFTC! (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) == Stuff to do every week == * Let's check and update the roadmap. What's done, and what's coming up? * Check reviewer assignments at * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… == Announcements == * 0.3.3.x triage has happened. How was it? * Starting 0.3.4.x triage this week. I could use help.-N * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing 0.3.4.x work. * Important dates: * Apr 15, 2018 -- 0.3.3.x stable is supposed to be ready! * May 15, 2018 -- 0.3.4.x feature freeze! * Dgoulet now has commit permissions cool! :confetti_emoji: * dgoulet will be AFK on Friday/Monday, national holidays (Easter...). * ahf will be semi-AFK on Thursday/Friday/Monday (will be around for the meeting for sure) for easter. * isis will be semi-AFK on Friday/Monday * 0.3.3.x triage status: * 033-included-2018 are the ones that are still included after the first 2 rounds: https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… * There are also some new tickets still in the milestone that survived the first round of triage, but which we aren't currently planning to tackle in 0.3.3.x-final. They are tagged with 033-removed-2018 : https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… == Discussion topics == * Kat reminds us that we should nominate volunteers to receive Tor swag. - Let's maybe do this on another pad, so we aren't discussing volunteers in public :/ * We need to finish all the 033-must tickets. How are we going to do this? = Updates = == Nick == Last week: * Lots of post-rome tasks * Did 0.3.3.x triage * Worked on lots of little bugs * Helped interview 4/5 of ED candidates. Last 1st-round interview is Tuesday. * Went to Libreplanet on Saturday, gave a quick overview of network team stuff as part of State Of The Onion, talked to bunches of people. (Thanks to isabela and stephw and flexlibris and n8fr8!) * Cleared out my review queue * Quick refactoring branch to help people experiment with other relay crypto designs. This week: * PETS reviews, week 1. * Tons of meetings * Putting out 0.3.3.4-alpha. * 033-must tickets * Talking with dgoulet about CPU-usage-when-idle (done) * Talking with ahf about idle API * Talking with dgoulet, isis, catalyst about wide creates isabela Last week: * catch up on all the follow ups from Rome / sent summary to the ml This week: * prep for this meeting * follow up with FB proposal and censorship team dgoulet: Last week: * Post-Rome tasks: notes to the Wiki, emails. * Triage 0.3.3 tickets. * Addressed 033-must tickets. Some important ones: #25226 and #24767. * Reviewed and opened some tickets. See Timeline for this: https://trac.torproject.org/projects/tor/timeline?from=Mar+26%2C+2018&daysb… * Organized our roadmap modularization work with ahf: #25498. * Organized our roadmap Reduce CPU usage work with nickm: #25500 * Feedback on mike's tor-dev@ email thread: [tor-dev] Setting NumEntryGuards=2 * Helped breaking down Sponsor Bucket network team tasks with asn. This week: * Ticket work and review, most of it will be 033-must. * Modularization work with ahf. * Follow up on larger tickets from last week (#25226, #24767). * Organize the work for wide CREATE cells with isis/nickm/catalyst. Mike: Last week: * Mailinglist posts about two guards & QUIC * Meetings about other funding proposals, personel * (re)read a handful of research papers, filed tickets * Some ticket review This week: * Xfer two guards thread -> proposal. Does anyone have any other points/concerns/arguments? * TL;DR is that one guard is not any better than two, and arguably worse, because our path restrictions allow an adversary to force the use of a second guard at any time for specific activity. I am assuming we want to keep our path restrictions. Is this correct? * Relatedly, in order to prevent the adversary from being able to force the use of a *third* guard, we also need to ensure that the two guards we pick are not covered by the same path restrictions (ie must be chosen from different /16 and family). * Trim down prop247 to cover what we are doing with the vanguard script (which will also match our planned final implementation). * Review other tickets. (Are we deliberately assigning a new person to review a ticket each time it goes back to needs_revision? This seems expensive, but does mean more eyeballs) [dgoulet]: No, if it goes back in needs_revision, the original Reviewer stays as is and in charge of reviewing again when it goes back in needs_review. isis: last three weeks?: - finding bugs #25517 - refactoring protover and giving it a more memory efficient voting algorithm #24031 - reviewed linker/build modifications for testing rust code which calls C code #25386 - adding more tests for previously untested things #25605 #25425 - giant email to Ian about various handshake design considerations and (mis)usage(s) of hash functions - revising prop#269 based on said discussion/reading - documented our current policy for Rust dependencies and set up a script to help vendor them #25310 - reviewed a unittest that nick and juga wrote #25515 - ticket/hackerone triaging while people were in rome/afk - reviewed volunteer win32 patches from mailing list #25479 - reviewed/shepherded new rust module for calling tor's logger #23881 - fixed a flaky HSv3 unittest #25450 - reviewed other changes to Rust coding standards #25368 - wrapped our sha2 implementation so that we can call it from Rust #24659 - reviewed teor's crypto_rand_double_sign() in rust #25381 - reviewed/shepherded next stage of the crypto.h refactor #24658 - bought a mac and set up stuff like fish and rustup and git for testing thingsxk this week: - wrap our RNG? #24660 - finish the sha2 thing since it's also blocking the handshake work #24659 - more prop#269 thinking/writing ahf: Since Rome: Sponsor 8: - Discussed basic modularization with David (#25498): - Started looking into building a Tor with some of the dirauth code ripped out. Misc: - Reviewed: #25398, #25399, and #25512. - Post-Rome tasks: emails, backlog, look at tickets. - Wrote the onion_status.pl script for status reporting. - Got the subprocess API to work with the event loop on Unix. Now trying to get it work on Windows. - Participated in the weekly PT meeting. This week: Sponsor 8: - Continue with trying to build a Tor with some dirauth code left out. - Discuss Idle interface with Nick. Misc: - Need to review #25425 and #23846. - Bug triage rotation role. haxxpop Last week: Nothing Next week: I will start implementing the client authorization for v3 onion service (as I told dgoulet and asn in Rome) [dgoulet] Awesome! [asn]: epic juga Last week: * collecting questions for the virtual "bandwidth authority team" * bwscanner: * started merging PRs without review * solved some bugs and PRs * cleaned up not used code * status: still buggy and not getting nice numbers * sbws: still not sure whether to dedicate time on it or continue with bwscanner * got access to ln5 box for testing, though still not running bwscanner to do not generate traffic * funding: * received negative answer from previous funding attempt (aka F1) * submitted application for new funding attempt (aka F2) * writing application for new funding attempt (aka F3) Next week: * Look sbws more in detail, document? * bwscanner: * solve current blocking bugs: (https://github.com/TheTorProject/bwscanner) u#111, #94, others * document better what is doing * try run it with shadow? * funding: submit application for F3 (deadline sat) * time for working on #25515? * i would like to join this meetings to continue sharing updates and discuss bwscanner questions when i have them. - is this cool w/ the team?, and where/when/who i could send questions that would talk longer to discuss? pastly: sbws (simple bw scanner) is my attempt as a bw scanner been running some scans primarily for timing information got set up on ln5's donated box next steps: come up with and implement an intelligent scan order for relays sphynx documentation catalyst: last week (2018-W12): - day off to recover from travel - dealing with contractors at home - wrote up notes from Rome - sent near-term recommendations to team from CI session (thanks everyone who started signing up for and enabling their personal repos!) - reviewed tickets #24740, #24659 - installed Homebrew and Rust on my Mac to help review stuff that needs those - helped people with Travis and GitHub setup - CoC and SoV feedback this week (2018-W13): - talking to people about CC stuff - more ticket review - help with 033 and 034 tickets as needed - Coverity rotation duty asn: Last three weeks: - Attended Rome meeting! - Gave Tor talk in ENS Paris. Gave talk in Tor meetup hackfest in Athens. - Worked on network team roadmapping and worked on spreadsheets for roadmap and metadoc. - Worked on SponsorBucket roadmapping and briefed team about upcoming Snowflake position. Need help from Roger/Isa on figuring out next steps based on my last email to the thread. - Handed over the first round of weekly reviews with David. - Reviewed #17799, #24767, #24989, #6236. - Setup github account, github repo and travis and started transitioning there: https://github.com/asn-d6/tor - Discussed switching to 2 entry guards with Mike on [tor-dev]. I can be persuaded that it's a good idea but we need a proposal. - Worked on #14389 (UX of client auth for onions) with Arthur and David. Need more little-t-tor work and analysis. - Opened ticket about rev counter issue found by Roger and made an implementation plan: #25552 This week: - More reviews. - Start working on my vanguard simulation again. My goal is to have something initial on github by the end of the week, so that Mike can start using it in a week or two. - Need to do more work on #20212 and #25609 so that we can move forward there. Some mikeperry wisdom might be needed there.

1 0

Notes from March 22 2018 Vegas team meeting
by Karsten Loesing 23 Mar '18

23 Mar '18

Notes for March 22 2018 meeting: Shari: 1) Catching up on email. 2) Scheduled ED first round interviews. Now interviewing five strong candidates. 3) Reworking Sida budget (again). 4) Gathering statistics about where the Tor Project's money comes from to send to tor-meeting. 5) Planning a trip to San Francisco, either at the end of next week or April 6-8. Nick: 1) Also busy with ED screening interviews 2) Rome was great, wasn't it? 3) Ramping up with new network team plans and organizing methods, thanks to Isabela and the whole team: * Minimal roadmap * Regular roadmap checkins * only doing roadmapped stuff. * Preassigned ticket reviewers * preassigned rotations * Regular 1:1:1 meetings w me and isabela and each team member. * aggressive ticket triage * Serious CI * Every roadmap task has at least 2 people on it. 4) Doing libreplanet this weekend with Isa, Nathan, Alison and Steph. 5) Trying to fix all the bugs in 033 Georg: 1) Finalizing Tor Browser roadmap for the next few months, starting to install new procedures (e.g. rotating release duties) 2) Roger: There is still the Taler Mail from Shari from 02/20 asking you about your opinion. [Noted, will answer soon. -Roger] Alison: 1) Working on new community team roadmap 2) Doing LibrePlanet with a bunch of people this weekend! 3) Lots of LFI curriculum design 4) Kat is working on #24148 to get special treats to noteworthy volunteers 5) Colin is choosing our Outreachy intern(s) 6) Excited to have the Tor relay advocate position open! 7) Getting back on track for Sponsor 9 tasks after the meeting -- organizing content for community.torproject.org 8) Colin is also connecting with the group working on Localization Linguine 9) Trying to wrap up the remaining tasks for this Community Council. 10) Got lots of feedback from the CC session in Rome 11) Organizing the Tor Meeting committee. This is something we discussed in Rome and I think it'll make the meetings run even better. Steph: 1) DuckDuckGo Privacy Challenge is running. We had a bug with our campaign page, but it is fixed as of this morning https://www.crowdrise.com/duckduckgoprivacychallenge [should the rest of us make accounts for the challenge? i wasn't clear on what that gets us. -Roger] [if you want to personally fundraise for us, tell the story of why, then share your personal fundraising link. - Steph] 2) Preparing for LibrePlanet this weekend. Will be on a State of the Onion panel with nickm, n8fr8, isa. Had a retractable standing banner and flyers made for our table. Thanks to Alison for help putting this together 3) Mozilla Fellow application period opened yesterday, we’ll host a relay advocate https://blog.torproject.org/protect-open-web-ford-mozilla-fellow Mike: 1) Catching up and following up on Rome things. Wrote a tor-dev post about switching to two entry guards and (re)read a few related research papers. Plan to write a second post summarizing Rome QUIC meeting. 2) ReCaptcha is still banning all Tor users. Should we organize a publicity campaign about this? I find it deeply frustrating that they have set themselves up as the gatekeeper of "legitimate" traffic for the Internet and are now abdicating that responsibility in favor of just simply banning portions of the Internet instead. Do any other orgs care about this? [do we have any contact there? -steph][They actually don't ban all Tor users but some of the exit nodes are blocked, true. Georg] [I think it'd work best if we at least try to talk to someone there] Isabela: 1) a lot of follow up for different teams from discussion in Rome (did a summary for network team already, will work on reviewing+organizing roadmaps tbb,ux,services) 2) working on upcoming grants follow ups: FB research one (for 'one click solve all censorship problems') / OTF email bundle / Censorship Team 3) creating inventory of Tor swags in my house to build a control system to help with reports (yes I will take shirts and stickers to LibrePlanet) [Alison: yessss thank you] 4) prepared a short presentation on ux world at tor's land for LibrePlanet 5) Strong follow up with folks from countries we plan to visit on Q2 (this is priority after I catch up with Rome follow ups) 6) important - need help planning the FB research thing (head count for research and final deliverable) Roger: 1) continued progress towards a censorship team (session in Rome) 2) is there anything we should do to help with execdir search? [answer, no, the search committee is doing initial screening and that's a fine step for now] 3) can we draw more attention to the relay advocate position? like, a jobs page [answer: yes, we should make a page for it. Maybe Tommy will start on it.] 4) we've been helping damian go through another round of "is each member still active" 5) let's get to work on an invite list for santiago? 6) community council timing question: elect a new one next, or fix up the guidelines next? [Georg: I think we should fix up the guidelines first] [Alison: I think that's fine, and we can start the conversation after the CoC vote which is planned for next week] [answer: consensus is that we should have the next election on time ish, so we don't mess with our process too much, and we can fix up the guidelines after that.] Karsten: 1) Started providing metrics timeline events as Atom feed: https://metrics.torproject.org/news.atom 2) Explained why metrics are important and what we do to make sure they're safe: https://metrics.torproject.org/about.html 3) Released Onionoo protocol version 5.1 with smaller changes to handling nicknames and relay families. Arturo: 1) Established partnership with Karisma Foundation (Colombia): https://twitter.com/OpenObservatory/status/976059705037656064 2) Released press statement with CHRDI partner to encourage OONI Probe testing in Sierra Leone leading up to their next round of elections: https://snradio.net/ooni-probe-mobile-app-ooni-chrdi/ 3) Integrated a patch into measurement-kit for allowing us to integrate Tor into it: https://trac.torproject.org/projects/tor/ticket/23846#comment:8 4) A lot of progress on the OONI Probe golang implementation 5) Almost caught up with the huge backlog of email and things to tend to after a 3 week conference marathon

1 0

[Funding Opportunity] Mozilla Fellowships
by Tom Ritter 22 Mar '18

22 Mar '18

This is their copy/paste template: Mozilla just opened applications for the next cohort of the Mozilla Fellows program, a 10-month fellowship that is a transformative experience for emerging leaders concerned with making the internet a safer, more accessible resource for everyone. Fellows expand their network and sphere of influence; design impactful projects with the potential to reach millions; and learn from and collaborate with a global community of thousands of Mozillians. Mozilla Fellows are also awarded competitive funding and benefits. I’m writing you because I thought you might be interested in applying or know someone else who is. You can read more about the program and apply here, and see the recent announcement here. Applications are due April 20, 2018. https://foundation.mozilla.org/fellowships/apply/ https://blog.mozilla.org/blog/2018/03/21/seeking-fellows-better-internet-ap…

2 1

February Communications Report
by Stephanie A. Whited 21 Mar '18

21 Mar '18

Hello! Here's some of what the comms team got up to in February. Team written and/or edited blog posts  ================================== https://blog.torproject.org/weve-launched-search-our-next-executive-director https://blog.torproject.org/tor-outreachy-internships-underrepresented-peop… https://blog.torproject.org/volunteer-spotlight-meejah-helps-you-integrate-… https://blog.torproject.org/italian-anti-corruption-authority-anac-adopts-o… https://blog.torproject.org/new-guide-running-tor-relay    Social Media  ============  - Transitioned appearance to new covers featuring Antonela’s design   Twitter   ====== Posted at least 3 times each weekday.   Tweets: 75  New followers: 3,432  Top tweets: https://twitter.com/torproject/status/963444593860767744 https://twitter.com/torproject/status/968578305447391232 https://twitter.com/torproject/status/961400961485955074    Facebook  =========  Posted at least once every weekday.  New likes: 166 LinkedIn  ========= Posted at least once a week.   New followers: 44 Monthly Newsletter   =================  Sent 3/1:  https://newsletter.torproject.org/archive/2018-02-28-ed-search-relay-guide-…   Press Notables  ============= http://www.tomshardware.com/news/italian-anac-tor-whistleblower-platform,36… https://www.madamasr.com/en/2018/03/12/feature/politics/study-blocked-acces…  o/ -comms -- Stephanie A. Whited Communications Director The Tor Project IRC: stephw PGP Key ID: 39A876AD <https://pgp.mit.edu/pks/lookup?op=get&search=0x6D6B72C339A876AD>

1 0

OONI Monthly Report: February 2018
by Maria Xynou 19 Mar '18

19 Mar '18

Hello, The OONI team had an exciting month! We expanded our Latin American community by forming two new partnerships with Asociación por los Derechos Civiles (Argentina) and Fundación Karisma (Colombia). Our outreach efforts also focused on Africa, as we hosted OONI workshops in Uganda and South Africa. Following research, we updated the Egyptian and Mali test lists, and we published a follow-up study on the censorship events that occurred during Iran's anti-government protests. We also published a blog post that explains how to mine OONI data. We continued to make progress on the revamping of the OONI Probe mobile apps, we experimented with writing the OONI Probe CLI for the OONI Probe desktop apps, and we made a series of significant improvements to our data processing pipeline to better serve measurements on OONI Explorer. # Established new partnerships We are excited to have formally established two new partnerships! We now also have the opportunity to collaborate with: 1. Asociación por los Derechos Civiles (Argentina), Announcement: https://twitter.com/OpenObservatory/status/961617333113548800 2. Fundación Karisma (Colombia) As part of our new partnerships, we aim to collaborate on the study of internet censorship through the collection and analysis of OONI Probe network measurements. # Updated test lists We carried out research (https://ooni.torproject.org/get-involved/contribute-test-lists/#test-list-r…) <https://ooni.torproject.org/get-involved/contribute-test-lists/#test-list-r…> to identify more URLs to test for censorship in Egypt and Mali. Based on this research, we updated the following test lists: * Egypt: https://github.com/citizenlab/test-lists/pull/301 * Mali: https://github.com/citizenlab/test-lists/pull/304 We also updated the following test lists based on URLs provided by community members: * Zimbabwe: https://github.com/citizenlab/test-lists/pull/297 * Kenya: https://github.com/citizenlab/test-lists/pull/298 # Revamping of OONI Probe Mobile We made a significant amount of progress on revamping the OONI Probe mobile app. Based on mockups, we implemented a working proof of concept iOS mobile app to showcase the new UI. Based on this work we will be finalising the copy of the mobile app and begin a first round of user testing. # OONI Probe Desktop App This month we experimented with writing the OONI Probe CLI that is going to be driven by the desktop app in golang: https://github.com/openobservatory/gooni. The main things we were looking to compare and contract with the node.js app were: * How easy it is to link to the measurement-kit C++ library * How easy it is to cross-build and ship the CLI tool as a standalone binary * What tooling and libraries we would be needing to use to implement the full CLI tool * What the overall architecture of this software component should look like We are quite pleased with the results and believe this is probably the direction we are going to go for. Other factors that we took into account when thinking about using golang are: * How familiar developers in our team and community are with golang vs node.js * The security of the libraries and development process # OONI Pipeline & OONI Explorer We made a series of significant improvements and optimisation to our data processing pipeline to allow us to almost entirely move onto the new pipeline for serving measurements from OONI Explorer. In particular, we added better indexes to allow sorting by test_start_time (and therefore not break pagination in edge cases), as well as some fixes to prevent bad queries from making the database irresponsive. For more details, please refer to: * https://github.com/TheTorProject/ooni-explorer/pull/122 * https://github.com/TheTorProject/ooni-measurements/pull/50 * https://github.com/TheTorProject/ooni-measurements/pull/51 # Blog posts We published two blog posts in February: 1. I have hands, how can I mine OONI data? (https://ooni.torproject.org/post/mining-ooni-data/) <https://ooni.torproject.org/post/mining-ooni-data/%29> 2. Iran Protests: DPI blocking of Instagram (https://ooni.torproject.org/post/2018-iran-protests-pt2/) <https://ooni.torproject.org/post/2018-iran-protests-pt2/%29> The first post explains how to mine OONI data, while the second includes a follow-up study on the censorship events that occurred in Iran during anti-government protests. # Community activities Our outreach efforts focused on Africa during February. ## South Africa On 16th February 2018, we presented OONI (as part of a 1 hour talk) to the students and faculty members of the Computer Science department of the University of Cape Town. Further information about this seminar is available here: http://www.students.uct.ac.za/event/internet-censorship-measurements ## Uganda We participated in the "Internet Policy in Africa: Research Methods for Advocacy" workshop hosted in Kampala between 26th February 2018 to 3rd March 2018 (http://globalnetpolicy.org/event/research-methods-africa/) <http://globalnetpolicy.org/event/research-methods-africa/%29>. As part of this week-long event, we facilitated the following workshops: 1. "Network Measurement Research": A 1.5 hour workshop explaining OONI methodologies & presenting OONI censorship findings from various African countries. 2. "Deep Dive: Network measurement data analysis": A 2.5 hour workshop teaching OONI data analysis and interpretation. We also participated in a working group that designed a research project examining the relationship of internet censorship with conflict resolution in South Sudan. # Userbase In February 2018 OONI Probe was run 280k times from 4,924 different vantage points across 210 countries around the world. This information can also be found through our stats: https://api.ooni.io/stats ~ The OONI team. -- Maria Xynou Research and Partnerships Coordinator Open Observatory of Network Interference (OONI) https://ooni.torproject.org/ PGP Key Fingerprint: 2DC8 AFB6 CA11 B552 1081 FBDE 2131 B3BE 70CA 417E

1 0