- tor-project - lists.torproject.org

March 2018 report for the Tor Browser team
by Georg Koppen 09 Apr '18

09 Apr '18

Hi! In March we were quite busy keeping up with Mozilla's almost weekly security updates. Two releases, Tor Browser 7.5.1[1] and 8.0a3[2], got out during the Tor dev meeting (which was a new experience) and contained an update to Firefox 52.7.0esr + newer Tor versions (0.3.2.10 and 0.3.3.3-alpha, respectively). Additionally, they mostly shipped bug fixes (e.g. a fix for broken Windows Vista 64bit builds) with one notable exception: Moat, our new feature to request bridges via meek from BridgeDB, made it into 8.0a3 for wider testing. Tor Browser 7.5.2[3] and 8.0a4[4] shipped Firefox 52.7.2esr including the fixes for the bugs found during Pwn2Own. Tor Browser 7.5.3[5] and 8.0a5[6] in turn picked up Firefox 52.7.3esr. Apart from releases we made progress in our preparations to switch to Firefox ESR 60: we worked on rebasing our patches, integrating rust into our build setup, and updating our toolchains, to name just a few areas. On the mobile side we finally merged the Orfox patches into our tor-browser repo[7] and started to help with getting updated Orfox versions faster out to our users. The latter resulted in new Orfox versions based on Firefox 52.7.2esr and Firefox 52.7.3esr following the above mentioned Tor Browser releases. The full list of tickets closed by the Tor Browser team in March is accessible using the `TorBrowserTeam201803` keyword in our bug tracker.[8] For April we are excited to see a lot of progress in our work with the UX team: we are close to have an updated circuit display ready[9] and plan to make improvements to our security controls[10] and our about:tor start page[11]. Two additional major areas of work for April will be Tor Browser for Android and preparations for Firefox 60. For the former, we outlined a mini-roadmap containing all the items we need to have solved before we want to ship a first alpha (which is planned for July)[12] and are now following up on those tasks. The latter is more of patch rebasing and toolchain updates already seen in March. We hope to start early this time with reviewing the new features that landed between Firefox 52 and 60 to have more time for writing patches. But we'll see. All tickets on our radar for this month can be seen with the `TorBrowserTeam201804` keyword in our bug tracker.[13] Georg [1] https://blog.torproject.org/tor-browser-751-released [2] https://blog.torproject.org/tor-browser-80a3-released [3] https://blog.torproject.org/tor-browser-752-released [4] https://blog.torproject.org/tor-browser-80a4-released [5] https://blog.torproject.org/tor-browser-753-released [6] https://blog.torproject.org/tor-browser-80a5-released [7] https://bugs.torproject.org/19675 [8] https://trac.torproject.org/projects/tor/query?status=closed&keywords=~TorB… [9] https://bugs.torproject.org/24309 [10] https://bugs.torproject.org/25658 [11] https://bugs.torproject.org/25695 [12] https://lists.torproject.org/pipermail/tbb-dev/2018-March/000814.html ff. [13] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig…

1 0

March 2018 Transifex report
by Colin Childs 06 Apr '18

06 Apr '18

Hi everyone, Below is the monthly Transifex report for March, 2018: ### Report Attached are daily, weekly and monthly translation graphs. The Y axis is "source words”. 20.28k source words 1.83k source strings 3,495 collaborators 154 languages 53 Project resources 2 languages at 100% completion (across all 53 project resources): French (fr) Spanish (es)

1 0

Notes from April 5 2018 Vegas team meeting
by Karsten Loesing 06 Apr '18

06 Apr '18

Notes for April 5 2018 meeting: Roger: 1) Brave is integrating Tor into their browser and this means we're going to have some trademark questions to answer soon ("no, those are Tor Private Tabs. Of course they're less safe than Tor Browser. Why are you so confused?"). Also, they could be convinced to run relays and/or donate for running relays. We should hook up Steph and Shari with their press people. And we need somebody to take point on this relationship. [Conclusion: this isn't just Brave, it's Cliqz, Mozilla, Facebook, etc who are working to integrate Tor into their things. We're going to get together a team of people -- dev, press, relay capacity, etc to try to handle the question more generally.] 2) Steph: Status on Rightscon booth plan? Plans for three bonus Rightscon tickets? [steph: we're on track for a free, half day booth. waiting to hear about time slot.] 3) Mike: you sent the google recaptcha mail right? [GeKo: I got copied, so it seems "yes"] Mike: 1) Sent mail to a DoS engineer I know at Google. No reply. 2) tor-dev things Georg: 1) We are almost done with putting our final roadmap in place and started to work according to it 2) We worked with the UX team on the improved circuit display and security controls, exciting! 3) We did the first two interviews for the Android related position Nick: 1) Nothing much happening. Isabela and I are doing more regular meetings with team members who wanted them. 2) Will 0.3.3-stable come out on 15 April? Probably not, but 0.3.3-rc is possible. 3) Trying to read all Summer of Privacy applications later today; I'm behind there, and need to catch up. 4) Trying to triage all the 034 tickets with my team. Steph: 1) The DDG Privacy Challenge ends April 10. If we raise $500 this week (tues-tues), we get $2,000. $153 left to go as of April 5 14:00 UTC 2) Submitted for a half day booth at RightsCon, waiting to hear about time slot. 3) Helping with the next nyc meetup 4) Edited multiple blog posts 5) Finalizing donor material on onion services 6) Talking through going to Def Con so I can get a better feel for it to make future proposals. Alison: 1) did a workshop at the Texas Library Association conference in Dallas yesterday; it was good! 2) big priority today is getting a bunch of sponsor9 tasks done (organizing with our contacts, getting our materials together, etc). 3) code of conduct vote is still happening. please vote! 4) working on a new meeting time for the community team 5) waiting on sysadmins to create a new mailing list for meeting planning; once that's done I'll coordinate with the meeting planning group that formed in Rome 6) in the meantime I'm helping Jon some with Mexico City related tasks 7) preparing for a talk in June at the French librarian's congress in La Rochelle 8) more LFI prep, lots of curriculum development 9) reviewing community liaison applicants!!!! 10) helping some with next NYC Tor meetup 11) way behind on writing community team roadmap but it's on my list! 12) Tommy is actively seeking funding for global south meeting/meetup related stuff 13) privacy meetups in Pune, India (run by kushal) seem to be going well and are happening regularly 14) are people nominating volunteers for special swag and glory? make sure your team is doing this and telling kat5! [ux team is so little i am checking tho:isabela] 15) sukhe has been working with the Toronto Public Library to help further their Tor Browser program (they're doing a pilot in one library and then eventually want to be TB on all public computers, then run an exit!!!!!!!) 16) Phoul is working on a new proposal to deal with the endless frontdesk@ queue 17) Phoul is also making progress on all the Outreachy and Summer of Privacy tasks 18) I sent you all an email with the list of invitees from Rome. let's start preliminary planning who we want to invite to Mexico City. Arturo: 1) Published our research on how we are going to approach developing a methodology for investigating internet blackouts: https://ooni.torproject.org/post/investigating-internet-blackouts/Investiga… (announcement blog post: https://ooni.torproject.org/post/investigating-internet-blackouts/) 2) Published a blog post on the internet blackout in Sierra Leone following the elections: https://ooni.torproject.org/post/sierra-leone-network-disruptions-2018-elec… in collaboration with Campaign for Human Rights and Development International 3) Will soon publish March report 4) Did some research and wrote a statement for the Internet Sans Frontier press release on the shutdown of social media in Chad: https://internetwithoutborders.org/chad-is-blocking-social-media-and-messag… 5) Reached prototype quality version of OONI Probe desktop for macOS: https://github.com/openobservatory/ooniprobe-desktop. Golang is the winner of the language war for writing the CLI interface. 6) Some progress on the Tor-in-MeasurementKit integration: https://trac.torproject.org/projects/tor/ticket/23846 Karsten: 1) Wrote a first draft document containing approximately 2500 words with a graph specification of the relay users graph and sent it Tor folks outside of the metrics team for an initial review. 2) Discussed which Java frameworks to include in the white paper about CollecTor's data processing. Isabela: 1) Decided to 'wave my tail' to all sponsors - pinging people on different things such as status of proposals that are under review, or status of proposals we are executing or proposals we just finished. 2) Besides these personal emails I am also writing reports (big reports month this month) 3) catching up on tasks w/ ux team and services/infra - finishing organizing roadmaps on gitlab kanban (yeah we are doing that) and finishing old open tasks from ux work that are on my plate 4) many meetings, new ones are: 1:1:1 with nick and folks from network team who requested those; wednesdays ux team meetings in April will be focus on Tor Browser work; fridays on sponsor9 (aka website stuff) work; sync with tommy on fridays too to follow up on censorship team work and grant proposals. Shari: 1) on my way to San Francisco for a bunch of meetings through the weekend 2) getting Heather (new CFGO) acclimated 3) moving to next round on ED search 4) writing job description for development (fundraising) director 5) choosing new auditor and finishing 990 for 2016 (hopefully this week)

1 0

March 2018 report for the metrics team
by Karsten Loesing 05 Apr '18

05 Apr '18

Hello Tor, hello world! Below you'll find the highlights of Tor metrics team work done in March 2018. On behalf of the Tor metrics team, Karsten Wrote a first draft document containing approximately 2500 words with a graph specification of the relay users graph [1] and sent it Tor folks outside of the metrics team for an initial review. The relay users graph is our most popular graph and also one of the most complex ones. We'll be able to re-use parts of this specification, or link to it, from other graph specifications. All in all, we'll produce approximately 10 times as much text for all graphs and tables. [1] https://metrics.torproject.org/userstats-relay-country.html Discussed [2] which Java frameworks to include in the white paper about CollecTor's data processing. [2] https://bugs.torproject.org/25644 Started providing metrics timeline events as Atom feed [3, 4]. [3] https://metrics.torproject.org/news.atom [4] https://bugs.torproject.org/23854 Added more explanations to the website why metrics are important and what we do to make sure they're safe [5]. [5] https://metrics.torproject.org/about.html Released Onionoo protocol version 5.1 [6] which always adds a relay's own fingerprint to its "effective_family" and makes nickname fields "n" in summary documents and "nickname" in details documents required fields. [6] https://lists.torproject.org/pipermail/tor-dev/2018-March/013012.html Set up CollecTor's webstats module to sanitize web server logs [7] and modified metrics-web to process these logs [8] instead of the ones available on webstats.tp.o [9]. [7] https://metrics.torproject.org/collector.html#webstats [8] https://metrics.torproject.org/webstats-tb.html [9] https://webstats.torproject.org/

1 0

OONI Monthly Report: March 2018
by Maria Xynou 05 Apr '18

05 Apr '18

Hello,* * The OONI team made steady progress in March. We published a technical report explaining our new methodology for investigating internet blackouts, and we created a working prototype of the OONI Probe desktop app for macOS. We also released the first iOS testflight and continued to make progress in revamping our mobile apps. # Internet blackouts methodology ================================== We are experimenting with the creation of a new methodology that will be included in future OONI Probe mobile app releases, enabling community members to participate in internet blackout investigations. We published a technical report explaining how we are going to approach developing a methodology for investigating internet blackouts. This report is availablehere: https://ooni.torproject.org/post/investigating-internet-blackouts/Investiga… We also published a blog announcing the report and explaining why we're interested in developing this methodology: https://ooni.torproject.org/post/investigating-internet-blackouts/ Our strategy is going to involve using OONI Probe mobile deployments to gather rich network telemetry documenting when, where and how an internet blackout is happening by running network measurements from the edge of the network. # OONI Probe Desktop apps ============================== We made a lot of progress on the OONI Probe desktop apps. We now have a working prototype of OONI Probe Desktop on macOS. This uses the following software components that we developed: * Measurement Kit Golang bindings: https://github.com/measurement-kit/go-measurement-kit * OONI Probe golang CLI: https://github.com/openobservatory/gooni * OONI Probe Desktop electron app: https://github.com/openobservatory/ooniprobe-desktop Since this is just a prototype, we will not be publishing a .app (or .dmg) at this stage. If you are interested in hacking on it, you can follow the instructions inside of the ooniprobe-desktop Readme. Please be aware of the fact that it's still in its early stages of development. When the app will be out, you will likely have to do some cleanup (i.e. deleting the ~/.ooni directory). # Progress on revamping the OONI Probe mobile apps ======================================================= As part of our work on revamping the OONI Probe mobile apps, we re-wrote all of the copy and continued to make improvements to the design and UI. We also released the first iOS testflight including the following features: * Ability to run tests * Ability to re-run failed tests * Ability to filter test results * Basic test result screen # Updated test lists ======================== We carried out research (https://ooni.torproject.org/get-involved/contribute-test-lists/#test-list-r…) <https://ooni.torproject.org/get-involved/contribute-test-lists/#test-list-r…> to identify more URLs to test for censorship in Sierra Leone. Based on this research, we updated the Sierra Leone test list: https://github.com/citizenlab/test-lists/pull/320 We also updated the following test lists based on URLs provided by community members: * Azerbaijan: https://github.com/citizenlab/test-lists/pull/316 & https://github.com/citizenlab/test-lists/pull/311 * Russia & Ukraine: https://github.com/citizenlab/test-lists/pull/310 # Community use of OONI data ================================ ## OONI data cited in research reports ========================================= * Article19 report ("Iran: Government throttling of Telegram after lifting block"): https://www.article19.org/resources/iran-government-throttling-telegram-wen… * Citizen Lab report ("Bad Traffic: Sandvine's PacketLogic Devices Used to Deploy Government Spyware in Turkey and Redirect Egyptian Users to Affiliate Ads?"): https://citizenlab.ca/2018/03/bad-traffic-sandvines-packetlogic-devices-dep… ## OONI data used as part of Pakistan court case =================================================== For the first time (to our knowledge), OONI data was used as evidence of internet censorship in a court case. Last November, we reported on the blocking of news outlets, social media sites and IM apps amidst protests in Pakistan (https://ooni.torproject.org/post/how-pakistan-blocked-social-media/) <https://ooni.torproject.org/post/how-pakistan-blocked-social-media/%29>. Our report (and the OONI data it shares) was referenced in a recent court case in Pakistan that challenges the legality of the social media censorship events from last November. As an outcome, the Islamabad High Court has directed the government to provide a legal justification for the censorship events, and to submit written replies in response to the petition of local human rights advocates. More information about this case is available here: http://digitalrightsmonitor.pk/islamabad-high-court-takes-up-petition-filed… # Community activities ======================== ## NullCon ============ We traveled to India to present OONI at NullCon on 2nd March 2018. Information about our talk is available here: https://nullcon.net/website/goa-2018/speakers/leonid-evdokimov.php ## Internet Freedom Festival (IFF) ======================================== This year OONI was an IFF partner. As part of our participation at the event, we helped organize the social evening on 7th March 2018 (https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…) <https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…> and we hosted an OONI Partners Meetup (on 6th March 2018). During the OONI Partners Meetup, we facilitated a session explaining how to use OONI Explorer and interpret its data. We also (co-)facilitated and participated in the following: * Which questions would you like internet censorship data to answer? (https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…) <https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…> * Internet-based information controls and elections (https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…) <https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…> * Tool Showcase: OONI presentation (https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…) <https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…> * Localization Sprint: Engaging the translator community with OONI Probe (https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…) <https://platform.internetfreedomfestival.org/en/IFF2018/public/schedule/cus…> ## Tor Meeting ================== We attended the Tor meeting which was held in Rome between 11th - 15th March 2018. As part of the meeting, we held an internal team meeting where we worked on our roadmap for the next 6 months. We also facilitated the following sessions: * Building communities to measure & respond to global censorship events (discussion of challenges & brainstorming on strategies) * OONI Tor vanilla + Tor launcher one click solve all censorship problems!! * OONI Internet blackout methodology * OONI Censorship Alert System * OONI data analysis More information about the latest Tor meeting and its sessions is available here: https://trac.torproject.org/projects/tor/wiki/org/meetings/2018Rome/Working… ## Community meeting ======================== We hosted the OONI community meeting on 27th March 2018. As part of the meeting, we discussed the following: 1. Standard form to add URLs for testing 2. Which features would you like to see in the OONI Probe mobile apps? 3. Using OONI Run 4. Using Discourse as a long-term replacement for mailing lists? Would it serve community neeeds better? # Userbase ============ In March 2018 OONI Probe was run 304k times from 5,091 different vantage points across 211 countries around the world. This information can also be found through our stats here: https://api.ooni.io/stats ~ The OONI team. -- Maria Xynou Research and Partnerships Coordinator Open Observatory of Network Interference (OONI) https://ooni.torproject.org/ PGP Key Fingerprint: 2DC8 AFB6 CA11 B552 1081 FBDE 2131 B3BE 70CA 417E

1 0

(FWD) [tor-relays] Ubuntu LTS about to ship with a soon-to-expire Tor version?
by Roger Dingledine 04 Apr '18

04 Apr '18

FYI, if you know any good Ubuntu contacts, or you are one: Ubuntu is about to release a long-term-stable with a version of Tor that will soon become obsolete. If you have any useful progress to make here, please make it on the ticket: https://trac.torproject.org/25715 Thanks! --Roger ----- Forwarded message from Roger Dingledine <arma(a)mit.edu> ----- Date: Wed, 4 Apr 2018 22:07:36 -0400 From: Roger Dingledine <arma(a)mit.edu> To: tor-relays(a)lists.torproject.org Subject: [tor-relays] Ubuntu LTS about to ship with a soon-to-expire Tor version? Do we have any good Ubuntu contacts here? I noticed today that Ubuntu Bionic LTS will come out this month: https://wiki.ubuntu.com/Releases and they are currently on track to include Tor 0.3.2.10: https://launchpad.net/ubuntu/bionic/+source/tor which is scheduled to go end-of-life before the end of 2018: https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… So we are on track for 4.5 years of sadness for Ubuntu users -- and since some of the most critical users of the Tor deb on Ubuntu are relay operators, this seems like a good time to try to rescue things. The best fixes I've thought of are to either: (A) Convince them to downgrade to Tor 0.2.9, which we will maintain for another few years. (B) Make a deal with them where they know that 0.3.2 will be abandoned soon, and that they'll move to our next LTS once it comes out. In the past we tried something like 'B' and it did not go smoothly. So I'm inclined to think 'A' is the better plan. See also this trac ticket where I'll aim to keep track of our progress: https://trac.torproject.org/25715 I'm also going to forward this note to tor-project@ in case there are better Ubuntu contacts there. Never a dull moment, --Roger _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays ----- End forwarded message -----

1 0

Notes from network team meeting, 3 April 2018
by Nick Mathewson 04 Apr '18

04 Apr '18

Hi! You can find our chat logs from http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-04-03-16.59.html Our pad notes follow below: = Network team meeting pad, 3 April 2018 = But above and beyond there's still one name left over, And that is the name that you never will guess; The name that no human research can discover-- But THE CAT HIMSELF KNOWS, and will never confess. -- T. S. Eliot, "The Naming of Cats" Welcome to our meeting! Mondays at 1700 UTC on #tor-meeting on OFTC. [**April 2's meeting is one day late, for holiday reasons**] (This channel is logged while meetings are in progress.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! Note the meeting location: #tor-meeting on OFTC! (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) == Previous notes == 5 March: https://lists.torproject.org/pipermail/tor-project/2018-March/001685.html 26 March: https://lists.torproject.org/pipermail/tor-project/2018-March/001695.html == Stuff to do every week == * Let's check and update the roadmap. What's done, and what's coming up? isabela will give a bit of orientation on irc url to roadmap: https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… 0.3.3 must fix bugs status: https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… Needs information - no owner #21394 - mike is reviewer and needs info #3940 - isis is reviewer and needs info #25316 Needs review and has no reviewer #24454 Needs review, has reviewer and no owner #24456 Also, have a look at the other tickets in the 0.3.3 milestone that are NOT currently labelled 033-must. Should any of them get that label? * Check reviewer assignments at https://docs.google.com/spreadsheets/d/1Ufrun1khEo5Cwd6OwngERn829wU3W3eskdr… * Check rotations at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… == Announcements == * Beginning general 0.3.4.x triage this week. * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing 0.3.4.x work. * Important dates: * Apr 15, 2018 -- 0.3.3.x stable is supposed to be ready! * May 15, 2018 -- 0.3.4.x feature freeze! * Cell crypto meeting in #tor-meeting2 at 1900 UTC on Tuesday. * 0.3.4.x triage has begin! == Discussion topics == * How did all the rotations go last week? * We need to finish all the 033 tickets. How are we going to do this? * We need to triage all the tickets in 034. Should we handle it the same way we did 0.3.3.x? Can we share/divide responsibility somehow? Tickets for 034 should be the ones (at least) that we organized at our roadmap to be on 034. And yes we should triage it like 033. * Let's discuss the 034-roadmap-proposed tickets? I think this is related to the other 2 questions above (033 and 034) and related to the roadmap check in. In short we need to review the amount of work we have planed to be done by May (which I think we are overcapacity but lets discuss that) * Should we change our regression rule? (Currently, we say that a regression is automatically 033-must or 034-must. But maybe this only makes sense for recent regressions? If something broke in 0.2.9 and nobody has noticed it since, maybe it isn't "must".) == Updates == Nick: Last week: * Start PETS reviews * Finished first round of ED screening * Review and merge a lot * Released 0.3.3.4-alpha * This week: * Finish PETS reviews * Review and merge a lot * Review all relevant SoP applications * Work on libevent mainloop-related refactoring for sponsor8 * Work on identifying triaged-in tickets for 0.3.4 * Maybe start on bucket-refill refactoring for sponsor8 teor: Last week: * Deployed research code (3.5 codebases, 3 machines, ~10 instances) * Worked with juga and pastly on bwauth scaling * Reviewed a Tor Summer of Privacy proposal * Collected streams-per-circuit for arma's DoS limits * Started a data collection for a paper This week: * Analyse streams-per-circuit and send an email * Post-travel admin * General employment admin / research admin * Maybe collect streams-per-circuit with less noise * Revise the PrivCount in Tor noise code after Isis' review isabela: Last week: * finished FB proposal * first meeting following new agenda format This week: * organizing pad for todays meeting * 1:1:1 with folks * prep work for sponsor8 Q1 2018 report (due end of april) Mike: last week: - Reviewed tickets #21394, #25505, #25355; commented on #25347, #24456 - Wrote two guards proposal - Started looking at #25545 - Emails about QUIC this week: - Discuss #25545 with asn - Sit in on relay crypto meeting - Work on vanguard roadmap tickets (#25546) pastly: Special thanks to juga for all the help so far, and hope you can continue helping make Simple Bandwidth Scanner (sbws) a reality :) last week: * Make sbws (torflow replacement) into even more of a proper package. Namely, give it a config file and it runs out of a data directory, not the current working directory * Write 95% of a specification for sbws * Close many usability tickets * Add version to client/server handshake and to result output * Begin running sbws in testnet with a variety of configurations * Choose a license, CC0 * SUBMIT PAPERWORK NECESSARY TO RELEASE SBWS AS AN OPEN SOURCE PROJECT * SUBMIT PAPERWORK NECESSARY TO RELEASE SBWS AS AN OPEN SOURCE PROJECT * SUBMIT PAPERWORK NECESSARY TO RELEASE SBWS AS AN OPEN SOURCE PROJECT this week: * Close some more UX tickets * Hopefully compare sbws to torflow in the testnet, with help from teor * Moar documentation!!! next month: * Get paper work back stating I can/cannot release sbws asn: [we should roadmap #25552 (rev counters hsv3) and #20212 (client-side guard dicsovery)] Last weeks: - Made patch for the 033 ticket I took over last week: #25347. After discussions with people, it seems like behind that ticket there are hidden complex security-related decisions and we should be really careful on how to resolve it. More discussion with at least Mike and Roger is required to make sure we come up with something decent here. - Worked on my vanguard simulator (#25545), polished the code, and pushed it on github: https://github.com/asn-d6/vanguard_simulator There is still work to be done here so that the results are useful for taking decisions, but publishing the code is an important first step. - Did roadmapping on the Penn censorship project. - Discussed switching to 2 entry guards with Mike (#25668). - Reviewed #24989, #25024, #25432, #24767. - Reviewed #25581 but it's still unclear what should happen here. I think Mike's input is required. - Finished community guide duty for this week - Acked exarkun's patch on #25627 - Got filipo's patch merged in #24342. - Discussed bw scanner work with juga. - Merge_readied #25432 by fristonio. - Helped researcher I met in RWC to use Chutney to test his patches. This week: - Bug triage duty. - More work on 033 ticket #25347. - More work with mike on 2-guard proposal and vanguard simulator. - Meeting with David/Arlo on Thursday about Snowflake and the penn censorship project. - Reviews as needed. ahf Last week: Sponsor 8: - Talked with Nick about Idle API. - Looked at DirAuth call graph for the directory server interface to figure out where DirAuth specific code is called from. Misc: - Submitted patch for #24782. - Fixed review comments for #25355. - Bug triage rotation role. - Worked together with Isis on review of #25425. - Reviewed #23846 and couldn't find anything problematic there, except for the Rust warning that Simone had seen himself. - Out Thursday/Friday and Monday for easter with friends and family. This week: Sponsor 8: - Talk with David (and maybe Nick?) about the DirAuth module project. - Begin splitting things up for DirAuth module project. - Discuss with the people from the guardian project some of the things we discussed last week for the Idle interface. Misc: - Work on more 033 tasks. dgoulet: - Last week: * Reviewed and worked on 033 tickets (most of them 033-must). See Trac Timeline for more details there. * Had a planning meeting with Nickm about roadmap item: Reduce client CPU usage. * Had a planning meeting with ahf about roadmap item modularization which is extracting dirauth into its own module. (#25610) * Investiguated #25616 which needs feedback about the possible solutions (staring at asn :). * Got #24767 merged so exciting. Thanks to the reviewers! * Discussed with arma the #25226 and I got a review from him so \o/ - This week: * Continue on 033-must tickets, I think I still have one to be merged. * Roadmap items, mostly modularization. From which, would be nice if people would read this small comment about the "plan" for dirauth code. If you think some of it is crazy or we could do better, good time to say so because after that we start in that direction. https://trac.torproject.org/projects/tor/ticket/25610#comment:3 haxxpop: - Last week * Start implementing hsv3 client authorization (progress https://github.com/torproject/tor/pull/36) * It includes loading HiddenServiceAuthorizeClient in torrc to the service * It also includes generating a new curve25519 key pair if we do not have that client's pubkey yet. Or just load the key if we already have that client's pubkey. - This week * Properly encrypt the descriptor if the client authorization is enabled catalyst: - Last week (2018-W13) * fixed two Coverity defects (#25629, #25675) (weekly rotation) * meeting on large create cells * fixed some torspec typos and got commit rights in that repo * did some follow up about the Rome cell crypto session -- meeting 1900 UTC today * looked at some build system patches (#23846 -- libtool, #25549 -- Appveyor) * looked into #25061 some more * worked with isis on some configuration of our github org * talked with people about the two github org issue * experimented with improving my work space ergonomics - This week (2018-W14) * cell crypto meeting today * community advocate rotation * write up my thoughts on #25061 and try something * code review * investigate the deleted github branches that keep reappearing * talk more with people about the two github org issue * more ergonomics juga: - Last week: * sbws: followed progress, talked with pastly and teor, add some docs * funding: wrote and submitted application for F3 * worked on #25515 - Next week: * sbws: solve some bugs, more docs * work on another test for #25515 - Maybe we could have a bwauth meeting once a month? (is difficult to find more than 1 or 2 persons to discuss in #tor-dev cause of timings) - Is it fine for all i switch (at least for now) to sbws instead of bwscanner?, - and that i integrate in it later some functionality that was in Torflow/bwscanner? - Does it makes sense i work on sbws?, or is it enough with 1 person? [pastly: thinks it makes sense to focus on sbws instead of bwscanner; also wonders what torflow/bwscanner does that sbws doesn't do and should do] [juga: ^^^ i'm not sure, we can discuss further...] [isis: where is the code for sbws? may i see it?] [pastly re isis: in a private GitHub repo, yes if you pinky promise to keep it private for now] isis: last week: - revised bridge.c tests #25425 - revised #24031 after two reviews - did the patches for #25517, now needs revision after teor's review - reviewed new appveyor configs #25549 - reported some potential windows bugs based on #25549 - reviewed build system patches for testing our C code from Rust #25386 - added more tests for C code that our Rust calls #25605 this week: - probably exposing our RNG to Rust #24660 - revising my branch for wide create cell creation #24986 - revising my function pointery handshake composition thingie #24987 - finish the sha2 thing since it's also blocking the handshake work #24659 - more prop#269 thinking/writing

1 0

Tor Browser team meeting notes, 3 April 2018
by Georg Koppen 04 Apr '18

04 Apr '18

Hello all! We had another team meeting yesterday. The chat log can be found on http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-04-03-18.59.log… and our pad items are: Tuesday, April 3, 2018 Discussion: -roadmap (https://docs.google.com/spreadsheets/d/1joFGDiHaqlorGeXhytKakiSnWY9TqTDv5Xq…) -Mozilla All Hands from the browser side - Wednesday's sync with UX team at 1900utc #tor-meeting - isa will send email to the list with agenda GeKo: Last Week: -https://bugzilla.mozilla.org/show_bug.cgi?id=1442406 (still not done, alas) -#25481 (made quite some progress) -update to the security control redesign proposal -continue triaging ages old bugs -during my Easter holidays came up with a fix for #21537 -prepared for IRC interviews This Week: -more IRC interviewing -more work on #25481 -monthly admin stuff -bug triage -getting back to #21777 mcs and brade: Last week: - Finished patches for #25405 (cannot use Moat if a meek bridge is configured). - Created an updated patch for #21850 (Update #16940 patch for e10s (about:tbupdate)). - Commented on #24309 (Activity 4.1: Improve how circuits are displayed to the user). - Spent a little time on #25663 (Downloaded files are corrupted). - Reviewed all of the updater bugs that have been fixed in Firefox since ESR52. [I am excited about the LZMA support that landed. I wonder about all the pieces we need to switch on our side for that, do we get that for free? GeKo] This week: - Review the team roadmap. - Help with code reviews including #25126 (about:tor should work on small screens). - Create tickets for some ESR60 updater-related tasks. - Start rebasing the Tor Browser updater patches for ESR 60. tjr: (may not make the meeting, feeling sick) - Got a MinGW x64 Build going in TaskCluster: https://bugzilla.mozilla.org/show_bug.cgi?id=1434316 - Don't have it running. Currently messing with --disable-install-strip to try and get usable symbols Might be a MinGW bug https://sourceforge.net/p/mingw-w64/mailman/mingw-w64-public/thread/CA%2BcU… - Have done some easy P2 Resist Fingerprinting Bugs: - Canvas Learn More Link in the Permission Prompt (Not uplifted to 60. Do you want it?) [Geko: that one looks like we would be interested] - WebGL Debug Info - uplifted to 60 - Spoof English Gets Reset https://bugzilla.mozilla.org/show_bug.cgi?id=1447592 Not uplifted yet. I have to figure out how to reproduce this, if anyone knows what they're talking about... [I think we don't need that one uplifted, GeKo] - Local IP Address Leak via WebRTC (being debated, not uplifting to 60 unless you want it) [I think this is nothing for ESR60 either for us, GeKo] igt0: Last week: - Took a look in the domain isolator to verify if it was possible to make it available for the alpha release. Final Status: The effort to make it work would be too hard since for the alpha release we will use the android vpn service. - Helped out sysrqb debugging the https-e race condition (it is still magical for us). - Investigated why cloudfare captcha doesn't render the image for Orfox users. This Week: - Keep investigating about cloudfare captcha and Firefox. Looks like if user is behind tor and the user agent is mobile, even the firefox desktop doesn't render the captcha image. [See my theory about "There is no ESR 52 for Android, therefore your browser is outdated and insecure and therefore we won't serve you content idea"? GeKo] [yep, i am using the latest fennec useragent and it didn't work (Mozilla/5.0 (Android; Mobile; rv:59.0) Gecko/59.0 Firefox/59.0) - igt0 Aha, so we need a different theory the, good. GeKo] boklm: Last week: - finished publishing of the new releases - started reviewing patch for #25483 (Windows reproducible build of snowflake) - worked on binutils reproducibility issue (#16472) This week: - continue work on toolchain updates - fix #25318 (Add Tor Browser nightly builds email notification) - work on getting the testsuite running sysrqb: Last week: Built Orfox (52.7.3) - still waiting for release https://people.torproject.org/~sysrqb/Orfox-tor-browser-52.7.3esr-7.5-1.apk Made progress on updating https-everywhere add-on (25603) - still debugging Started troubleshooting #25659 (race condition during add-on installation?) Documented some TBA roadmap items on the wiki https://trac.torproject.org/projects/tor/wiki/org/teams/ApplicationsTeam/To… Updated (a little) the Application team wiki page https://trac.torproject.org/projects/tor/wiki/org/teams/ApplicationsTeam This week: Merge Orfox https-everywhere update Start rebase onto mozilla-central sysrqb: gk, what should the review process look like? Will tor-browser.git have two new branches, one more for stable and another for alpha? [Okay, we'll wait on the rebase done by arthur; sysrqb and igt0 will help with the mobile parts. once done and reviewed we rebase the resulting patches onto mozilla-central used for tor browser alpha on mobile GeKo] pospeselr: Last week: Investigation on #20283 (Tor Browser should run without a /proc filesystem) Got a complete list of all open and openat sys calls requesting something in /proc in firefox and plugin_container process (for 64 bit linux) About 8 different scenarios found, majority of which currently handle failure gracefully 2 instances are dead code mozilla::ThreadStackHelper::GetThreadStackBase() is the remaining problem (pointed out by Yawning in the bug report) current stack address is used as a sort of heuristic in several places in the code seems to be ranges certain types of JS are allowed to recurse down to (system native, system js, user js) from what I've been able to glean, the only way to get this information on linux is via the /proc/self/maps file (this is file parsed by pthreads calls) stack size is queryable via getrlimit syscall best thing I've been able to come up with is bouncing up the rbp register until we get an address that's out of range in order to get a good estimate of where the stack memory map begins/ends seems unlikely this sort of hacky bs would get upstreamed breaks as soon as the compilation options are changed to omit frame pointer usage (-fno-omit-frame-pointer flag is required on amd64) I've started investigating what we would need to do to refactor FF to not need the stack memory layout, but this seems to be a security-ish feature? Have not investigated whether any fstat or other file related syscalls are called on things in /proc but easy enough to do once this GetThreadStackBase issue is sorted arthuredelstein: Last week: * Worked on rebasing patches to ESR60 * Worked on FPI of permissions patch https://bugzilla.mozilla.org/show_bug.cgi?id=1330467 * Revising circuit display patch: https://trac.torproject.org/projects/tor/ticket/24309 This week: * Try to finish rebasing desktop patches [mcs: where are you doing this work?] [arthur: it's on a local branch atm. Tends to get re-ordered a lot, but I could post a snapshot if needed.] [mcs: we don't need it yet but would be useful soon-ish; maybe let me know which patches brade and I should work on][arthur: will do, thanks] * Post revised circuit display patch * Try to finish permissions patch, continue Save As patch * AFK (vacation) on Thursday and Friday isabela: Final report for sponsor4 - vixe! Working on sponsor8 Q1 2018 report Reviewed all roadmap and created a tab for the things ux team is involved and i am organizing all that on ux (stakeholders) side question for arthur -> this item: "Click your flag" design - I will want it to be a test not really a feature we ship - if its related to the 'one click solve all censorship problem'. Something like this need to be tested well before we put it on alpha. Georg

2 1

Notes from March 29 2018 Vegas team meeting
by Karsten Loesing 30 Mar '18

30 Mar '18

Notes for March 29 2018 meeting: Arturo: 1) Have a working prototype of OONI Probe desktop on macOS shipping the ooni in go binary statically linked to measurement-kit 2) Progress on implementing the mockups for the revamped OONI Explorer 3) Completed a first pass at writing the copy for the revamped OONI Probe mobile app 4) Did a talk at the Tor Vergata university Linux Users Group 5) This morning, without any prior notification, I got removed admin rights from github.com/torproject (different from github.com/thetorproject, which is where OONI repos are at, but it took the sleepy me some time to realise that). Does somebody know who did this? I think we are going to soon migrate all OONI repositories away from github.com/thetorproject as a precaution. [This was my team, "moving fast and breaking things", since that repository only contains network team stuff atm. Sorry for false alarm; I'll pass on request for notification. - Nick] 6) Hosted the March OONI Community Gathering: http://meetbot.debian.net/ooni/2018/ooni.2018-03-27-14.00.log.html 7) Updated Sierra Leone test list: https://github.com/citizenlab/test-lists/pull/320 8) Supported various community members with OONI data requests Nick: 1) This is my 9th meeting this week. Joy! 2) Cleaning up github/thetorproject membership with Arturo. 3) New alpha coming out today. 4) We seem to be sticking to our "critical fixes only" thing in 0.3.3; wish us luck in the coming week as we triage 0.3.4 5) ED search moves forward Mike: 1) Lots of email, discussion, and research about potential future Tor network changes 2) Wrote a draft to send to a Google DoS engineer I know about recaptcha and privacy pass, ran it by gk. Will send today. 3) Tor code review for 0.3.3 Shari: 1) scheduling board meeting and preparing information re: ED search interviews for discussion 2) trying to finalize the 2016 audit; could it actually be done this week? 3) trying to finalize location of next Tor meeting 4) started pulling together figures for where our money has come from 5) I'll be in San Francisco the end of next week to visit lots of folks and speak at this https://www.eff.org/event/john-perry-barlow-symposium; I hope to see Mike when I'm there, and hopefully Sue Gardner 6) spoke with Erin about starting job search for development director; should have that description written by next week Karsten: 1) Set up CollecTor's webstats module to sanitize web server logs and modified metrics-web to process these logs instead of the ones available on webstats.tp.o. If everything continues to look good, we can shut down webstats.tp.o in a few weeks. 2) We'll have an in-person metrics team meeting on April 11 where we're updating our roadmap. isabela: 1) Network team had it first meeting on the new format and worked pretty well :) 2) Organizing weekly syncs for sponsor9 work 3) Organizing UX and services roadmap (while reviewing TB roadmap) - this is actually a big effort (takes time) since involves many tasks 4) FB research proposal: Names associated are Geko, Arturo and Roger (can people confirm this is ok ?) [GeKo: Fine with me. Arturo: ACK.] 5) Spoke with students at a high-school in Brooklyn about how it is to do what I do at Tor 6) Website work is moving on! Translation for support will start to be tested soon, we are picking our illustrator for the sites. Our next priority for development is 'torproject.org'. Georg: 1) We got another bunch of releases out. So far we keep up with Mozilla's weekly security bugfix release schedule :) 2) Worked on the team roadmap and waiting on ux team to incorporate the remaining feedback Roger: 1) snowflake front domain: ticket 23947 wants some attention from our service admin types. I'll plan to get that thread started after the meeting. 2) rightscon booth: should we have one? [answer: yes, steph will lead that] 3) two extra rightscon tickets [Arturo: it turns out I don't need the other OONI ticket, simone already got his via other means.]? three. three extra rightscon tickets. [answer: maybe we should offer them to the broader Tor community, for example in exchange for helping us to staff the booth.] 4) mozilla fellow, user advocate role, status? [answer: we're nearly ready to post it] 5) facebook proposal Steph: 1) Went to LibrePlanet with Alison, Isa, Nathan, Nick. Excited to get better at this, do more talks, and talk to people at our booths. We'll submit for RightsCon village 2) Upcoming blog posts: rehash of mozilla fellowship, privacy int post on onions, a few volunteer spotlights in the works, tor messenger update 3) Asking to set up a call with private internet access about exits 4) Newsletter about ready to go 5) DuckDuckGo Privacy Challenge on til April 10, new competitions to win more money this week Alison: 1) Libreplanet was awesome 2) Getting on track with Sponsor 9 planning tomorrow 3) Library Freedom Institute curriculum development is my biggest priority right now 4) Code of Conduct is out for a vote! 5) helping find a location for the next NYC Tor meetup 6) speaking at the Texas Library Association Conference next week 7) still waiting to hear about HOPE....

1 0

Addendum to Mozilla Manifesto
by Shari Steele 29 Mar '18

29 Mar '18

Hey all. Mitchell Baker at Mozilla asked me to share their new Addendum to the Mozilla Manifesto, which they released today: The Mozilla Blog post: https://blog.mozilla.org/blog/2018/03/29/mozilla-marks-20th-anniversary-com… <https://blog.mozilla.org/blog/2018/03/29/mozilla-marks-20th-anniversary-com…> The Addendum itself. At the bottom is a button where one can share one’s support. That button creates a tweet. https://www.mozilla.org/en-US/about/manifesto/ <https://www.mozilla.org/en-US/about/manifesto/> Mitchell's op-ed: https://www.cnn.com/2018/03/29/opinions/tech-backlash-facebook-google-opini… <https://www.cnn.com/2018/03/29/opinions/tech-backlash-facebook-google-opini…> Shari

1 0