tor-project

tor-project@lists.torproject.org

17 participants
2328 discussions

Network team meeting notes, 17 July 2017
by George Kadianakis 19 Jul '17

19 Jul '17

Hi; we had our regular meeting. Logs here: http://meetbot.debian.net/tor-dev/2017/tor-dev.2017-07-17-17.00.html And updates below: ================== teor (not online): Last week: * Took a few days leave, because winter [wow winter!!!] * Fixed some bugs in PrivCount's circuit and cell counting * Got a PrivCount code review from Nick (thanks!) and made tickets for it * Wrote some tor cell packing & unpacking code, so stem can learn to talk ORPort #18856 https://github.com/teor2345/endosome * Found some tor bugs that might affect link padding (#22934, #22948) This week: * Implement some more PrivCount features * Deploy and Run PrivCount Single Onion Service counts * Plan and book Montreal travel * Maybe do cell crypto in endosome komlo (most likely won't be able to make today's meeting) Last week: - Submitted patches for #22905 and #22830 (thanks Isis for splitting!) - Booked Montreal trip This week: - I am going to follow nickm's fuzzing guide to fuzz rust protover, as the last step before submitting this for review. dgoulet Last Week: * The load and configure v3 service patch was merged!!! (#21979) * Addressed multiple things found in #20657 by asn * Continue the prop224 client implementation (#17242) * Important issue found for prop224 service, asn's opened the ticket in #22940. This week: * Address asn's review on #20657 so we can put it back in needs review for nickm and thus upstream merge. * Continue client implementation #17242. * Roger's Defcon talk on July 28th is my hard deadline to have a working alpha product of prop224 so we can give the world a branch to play with. isabela: Last Week: - got the sponsor4 june report out - start working with brad on info for nsf reports (because storm was down the progress report part got delayed) This week: - will catch up on PT discussion - will work on tor launcher automation update (if possible) - will be at PETS catalyst: Last week (2017-W28): - helped Roger with sponsor3 reporting - started more aggressively tagging stuff with sponsors - laptop and phone brain transplants (Apple, Y U make iCloud Keychain "Local Items" unusable after migration?) - helped atagar with some stem bugs #22894 #22902 - helped isis with some Travis CI stuff #22636 - .onion UX stuff - Trac meeting - made some progress on learning enough about chutney to make a #20532 test case This week (2017-W29): - packing and moving! (see earlier email message for details) - more review of #22636 - more #20532 pastly: - KIST code still available on gitweb. Need to talk to dgoulet sometime about reviewing - KIST still running on my relay and dgouelet's IIRC - Want to update tickets, but want to put in as little work as possible. Ideally would just attach paper or something, but it wasn't accepted and don't want its first publication to be an attachment on some ticket. Talking to co-author. - Attempts at measuring network latency. Last week: home-grown with RIPE Atlas. Meh. This week: Ting. nickm: Last week: - Review and merge on lots and lots of things, incl HS work - Chase down misc bugs on odd platforms, fix them. (including zstd 1.3.0) - Initial review and comment on the preliminary tor privcount patch series - Finish triage on tor-unspecified, start marking some sponsors' tickets in 0.3.2-alpha milestone This week: - PETS - Livetweet PETS? - Talk with collaborators about sponsor2/anti-fingerprinting stuff - Hack, time permitting [WARNING: SSH HATES ME RIGHT NOW; THIS INTERNET CONNECTION IS TERRIBLE] asn Last week: - Mad review of #20657. Got familiar with the code and now I'm getting deeper with testing. - Reviewed #22803. - Started coding #22735. Not an easy task but very important for prop224. - Started maintaining a pad with open prop224 tickets, so that we can organize development/merging better as time gets closer: https://pad.riseup.net/p/LPVY6AL_prop224_upstreaming - (Had no real time for prop247 simulation stuff...) This week: - Write patches for two major open service-side issues: #22735 and #22940 - Continue review of #20657. - More prop224 frenzy. ahf: (traveling - will miss the meeting). Sponsor 4: - Extended our analyzer to include all Tor traffic such that we can see which percentage the directory traffic amounts to. - Started writing the outline of a blog post for blog.tpo about the Sponsor 4 work. Sponsor 8: - Read up on what the proposal includes for the network team. - Kick off meeting with Nick on Sponsor 8. - Looked into how to do battery measurements on the Android platform and trying to figure out how I can make it as reproducible as possible when on a physical device and if it is possible to track in an emulator (the wakeups only). - Read up on using Guardian Projects orbot to get Tor onto a device on Android as an apk. This week: Sponsor 4: - Discuss results with Nick for the dir / total traffic part. - Finish blog post about Sponsor 4 work. Sponsor 8: - Follow up on tasks from the Tuesday kick-off meeting: look at Nick's results with which functions that are running in a timer and do network $stuff. - Get more knowledge of the Android platform work. isis: last week: - made a server for BridgeDB's CAPTCHAs so that we can serve them to moat too #15976 - made a cmdline option to see the expiration date for a tor signing cert #17639 - polished up and fixed a Travis config for tor #22636 - investigated and fixed some problems with rust builds #22830 #22905 - opened some other rust build system integration tickets #22906 #22907 #22909 - reviewed #22349 (on gitlab!) and #22916 - reviewed and cleaned up #19476 - removed some dead/obsolete code in rephist.c #19871 - started moving the internship forward this week: - more work on getting the intern started and set up - get review/feedback for moat CAPTCHA api #15976 - start writing moat backend server #22871 - revising farfetchd #15876 - maybe getting a service set up for farfetchd?

1 0

Expanding our people page
by Damian Johnson 18 Jul '17

18 Jul '17

Freedom! Sweet GSoC-less freedom! Ok, lets ruin it. Between newhires and new volunteers Tor is growing quite a bit right now and a common complaint I've heard for years is that our community makes it maddeningly hard to figure out who's who. Yes, for many of us this is intentional but for others it's not... "Who's that arma guy I was talking with on irc? He seemed nice. Ok, thanks. Now which of these people is Roger? Great. And, what does he do?". Multiply that by ninety dev meeting attendees and it's no wonder we drive our lovely hair-pulling newcomers to early baldness. For much of our community this anonymity is intentional and we definitely don't want to muck with that, but I suspect some opt-in information from those of us ok with it could make our community a lot easier to join. As such I'd like to run the following questionnaire among our tor-internal@ membership... * Would you like to be listed on the 'core people' webpage [1]? If so... * What name or alias would you like to be called? * Provide a description for the page of what you do. * Would it be ok to list your IRC nick? If so, what is it? * Would it be ok to list your OpenPGP key? If so what is your public key? * Is there a photo or image you'd like to have displayed? Many folks will say 'heck no' to much of this and that's perfectly fine. The last question is a bit of an experiment where I'm curious if we can pattern ourselves after the EFF's page [2]. Maybe this won't pan out but here's my thoughts... * Newcomers first come to know us by cryptic irc nicks that look akin to truncated sha256 digests. Pictures may make our community feel friendlier and more approachable. Note this *doesn't* need to see a photo. For example see Mark Burdett and Ben Burke on the EFF page. * Maybe a page of smiling faces and cartoon turtles will be helpful to Shari for her upcoming fund raiser? Maybe this'll work, maybe it won't. My hope is that folks will have fun coming up with a picture to represent them, but maybe too few people will to make it work. Who knows - worth asking. ;) Thoughts? This dovetails nicely with my role maintaining tor-internal@ so I'd be happy to keep it up to date as we continue to grow our community. Cheers! -Damian [1] https://www.torproject.org/about/corepeople.html.en [2] https://www.eff.org/about/staff

14 31

Fwd: Cybersecurity and cryptography ebooks in our new bundle!
by Shari Steele 17 Jul '17

17 Jul '17

Hey all. Name your own price for cybersecurity and cryptography ebooks! And while I love EFF (one of their chosen charities), I encourage you to choose "select a new one" and then do a search for Tor Project. You can always select us in this way for any Humble Bundles you purchase. Shari > Begin forwarded message: > > From: "Humble Bundle" <contact(a)mailer.humblebundle.com> > Subject: Cybersecurity and cryptography ebooks in our new bundle! > Date: July 17, 2017 at 11:22:36 AM PDT > To: ssteele(a)eff.org > Reply-To: contact(a)humblebundle.com > > <http://track.cordial.io/c/102:5969310af4ab4ee605cf8d98:ot:56c3e4e8733462ca8…> > <http://track.cordial.io/c/102:5969310af4ab4ee605cf8d98:ot:56c3e4e8733462ca8…> > Pay what you want for a bundle of ebooks on > cybersecurity, hacking, cryptography & more! > <http://track.cordial.io/c/102:5969310af4ab4ee605cf8d98:ot:56c3e4e8733462ca8…> > Secrets and Lies: Digital Security in a Networked World, Applied Cryptography, The Art of Deception, Social Engineering, and other great titles from Wiley > Get it now! <http://track.cordial.io/c/102:5969310af4ab4ee605cf8d98:ot:56c3e4e8733462ca8…> > Supporting: > <http://track.cordial.io/c/102:5969310af4ab4ee605cf8d98:ot:56c3e4e8733462ca8…> > Pay what you want for a bundle celebrating comics greats Kirby & Eisner! > <http://track.cordial.io/c/102:5969310af4ab4ee605cf8d98:ot:56c3e4e8733462ca8…> > Check it out! <http://track.cordial.io/c/102:5969310af4ab4ee605cf8d98:ot:56c3e4e8733462ca8…> > <http://track.cordial.io/c/102:5969310af4ab4ee605cf8d98:ot:56c3e4e8733462ca8…> <http://track.cordial.io/c/102:5969310af4ab4ee605cf8d98:ot:56c3e4e8733462ca8…> <https://track.cordial.io/c/102:5969310af4ab4ee605cf8d98:ot:56c3e4e8733462ca…> <http://track.cordial.io/c/102:5969310af4ab4ee605cf8d98:ot:56c3e4e8733462ca8…> > > This email was sent to ssteele(a)eff.org <mailto:ssteele@eff.org> > unsubscribe from this list <https://track.cordial.io/optout/index.php?mcID=102:5969310af4ab4ee605cf8d98…> | update your preferences <https://www.humblebundle.com/newsletter-update?id=56c3e4e8733462ca89422378> > © 2017 Humble Bundle Inc. | 201 Post Street 11th Floor | San Francisco, CA | 94108 > >

1 0

Notes from July 13 2017 Vegas team meeting
by Karsten Loesing 14 Jul '17

14 Jul '17

Notes for July 13 2017 meeting: Arturo: 1) We ran the OONI Partner gathering in Toronto and it went well. 2) Now attending CLSI where we have many OONI Sessions Alison: 1) About to submit the Sappi graphic design grant for making LFP posters 2) Need to start creating the schedule for the Tor Meeting 3) Working on code of conduct draft with Catalyst 4) Putting finishing touches on support wiki, writing blog post for it 5) Organized meeting for support team 6) A few members of the community team lost a bunch of data stored on Sandstorm, appears to be unrecoverable :( 7) Phoul continues to work with Trusteer to solve issues with blocking Tor Browser/Firefox ESR 8) I'd like to start organizing the Tor meeting schedule next week sometime. Karsten: 1) Put out CollecTor 1.2.0 release, started working on 1.3.0, to be released by end of the month. 2) Worked on a specification of sanitized bridge descriptors. 3) Will be working on MOSS final report and blog post over the next very few weeks. Isabela: 1) Reports and invoices: finished june report for sponsor4 - sent out last invoice for MOSS, got back from them a request for final report and blog post Brad: Is Sponsor 4 ready to invoice now? 2) Working on NSF reports - met with Brad yesterday - got a little blocked because of storm issue but started working on pads for each NSF grant to collect report information. 3) working with Linda on website redesign - preparing the tpo information architecture doc so we don't loose track when building wireframs. We got comms team looped in in the project now. For July Linda will continue to work on the website wireframes+organzing content/functions; update tor launcher wireframes and organize user testing for onion browser onboarding project 4) working with hiro on issue tracker 'benchmarking' table (requirements from survey, vs gitlab and trac has to offer). Hiro is also working on the grant pipeline form and on remaining tor blog tasks. 5) long pending stuff that i never get to finish - tor launcher feature brief update, growth strategy update - hope to get to those :( [Sandboxing planning, Tor Messenger strategy; just two things that might be missing on your list :) GeKo] ! true and PT POC 6) will be at PETS next week o/ Steph: 1) Preparing for bug bounty launch: Tor blog post, H1 q&a blog post, coordination with H1 on press outreach, OTF will support on social media. Projected launch date: next Thurs 2) Finalizing newsletter, will likely send by Tues. Running a lot of tests with Civi 3) Upcoming content: bug bounty, safety hierarchy of diff ways to access Tor, Tor 6 mos metrics, sha2017 4) Tommy and I have joined website redesign convo, adding commments. Copy to come later 5) Maintaing consistent posts on FB (at least 1/day), twitter (3-6/day), linkedin (1/week). Analytics up over the past month. Nick: 1) All's well with the network team afaict. 2) Trying to get everything straightened out with timesheets, expenses, etc. Thanks to Brad and Sue for all their help! (Am I supposed to confirm that expenses/travel were preapproved?) Brad: I verify proper approval before we issue expense reimbursement. No need to confirm on your end, but please note any concerns you have re: lack of proper approval and/or potentially unallowable charges during your review (Nick: Thanks, Brad!) 3) Roger -- please look at Taylor's notes wrt sponsor3 and let us know if we're on the wrong track? 4) Done with massive ticket triage and labeling on tor: unspecified. Started to sponsor-label some of our tickets 5) At PETS next week. Georg: 1) I Helped with the bug bounty launch planning 2) I worked on moving the browser dev hiring forward (we are almost ready to start with the coding tasks) 3) Isa -- Where are we with the job postings for the mobile work? [Question: would the description of the current browser dev be the same for the mobile work?] [not exactly. we could certainly reuse parts but we need to add mobile specific things (knowledge of Java might certainly be a good thing; experience with mobile development as well etc.)] 4) Did we figure out the timesheet management questions? <- we are still working on it Brad: 1) Closing the books and performing final review for fiscal year-end 2) Completed final steps of conversion to ADP for US-based payroll processing (first paycheck is July 14) 3) Updating grant/contract sub-ledgers to reflect budget-to-actuals through June 30 4) Gathering info to assist arma with annual reports due for Sponsors M, V, 2 & 3 6) Creating detailed travel budget for Montreal meeting based on invite lists 7) Working with Jon to overhaul spreadsheet he uses to track attendees for Montreal meeting 8) PETS meeting next week: should we expect to receive any large invoices that are to be paid out of TPI's PETS fund? Mike: 1) Helping with the Tor Browser hiring 2) Emailing researchers about changes to padding code and fixing bugs 3) Meeting with folks at PETS next week Shari: 1) Lots of loose ends requiring bits of my attention. 2) Working on final report for donation database. 3) Worked with Jon to get invitations out; can we send the last ones? 4) Answering lots of questions for MDF general operating grant. 5) I have to answer DRL questions. 6) mikeperry, did you see my email about Mozilla/Amazon? Please respond to it about whether you'll be around to help!

1 0

Are there countries where using Tor is illegal?
by Cristian Consonni 13 Jul '17

13 Jul '17

Hi, (Sorry if this question has already been asked in the past, feel free to point me to the relevant resources.) I know that the legal FAQs by the EFF state that: «we believe that running a Tor relay — including an exit relay that allows people to anonymously send and receive traffic — is legal under U.S. law.»[1] I also know there is a list of countries for which there is legislation that exclude communication service providers from liability. They are indicated in the Legal of the Tor Exit Guidelines page[2], they are USA, Germany, Netherlands, Austria, France, and Sweden. >From some articles in the press[3a][3b] it may be illegal - depending on how you interpret the wording[*] - to use Tor (and other technologies such as VPNs or proxies) in the UAE, with fines ranging in the millions of dirhams (hundreds of thousand of dollars). A couple of weeks ago it was discussed - on this list as well - that a law was introduced to the state parliament to ban Tor[4a][4b]. This follows a case of some months ago of a Russian Tor exit node operator being arrested for inciting mass riots and terrorism[4c][4d]. The idea of blocking VPNs or Tor seems to have already been considered in the past[4e]. This infographic about pluggable transports[5] suggests access to the Tor network is censored or limited in China, Uzbekistan, Iran, and Kazakhstan. Tor being censored orblocked may be different from it being illegal. What about other countries? Is there a place where I can find more about this topic? Cristian [1]: https://www.torproject.org/eff/tor-legal-faq.html.en [2]: https://trac.torproject.org/projects/tor/wiki/doc/TorExitGuidelines [3a]: http://www.emirates247.com/news/emirates/dh500-000-fine-if-you-use-fraud-ip… [3b]: http://news.softpedia.com/news/people-caught-using-vpns-tor-or-proxies-in-t… [*]: «Whoever uses a fraudulent computer network protocol address (IP address) by using a false address or a third-party address by any other means for the purpose of committing a crime or preventing its discovery» [4a]: https://lists.torproject.org/pipermail/tor-talk/2017-June/043293.html [4b]: https://trac.torproject.org/projects/tor/ticket/22055 [4c]: https://lists.torproject.org/pipermail/tor-talk/2017-April/043109.html [4d]: https://techcrunch.com/2017/04/24/dmitry-bogatov-tor-russia/ [4e]; https://torrentfreak.com/vpn-and-tor-ban-looming-on-the-horizon-for-russia-… [5]: https://www.torproject.org/images/PT/2016-07-how-to-use-PT.png

3 2

Update from Tor's Community Council
by Jens Kubieziel 13 Jul '17

13 Jul '17

Hi friends, I am writing on behalf of the Community Council with some updates. We wanted to be in touch and let folks know what we have been up to since the recent election. We have had several meetings with the new Council (Alison, qbi, Linda, Hiro, Gunner). We are enjoying working together. In the near term, we are prioritizing the drafting of policies and procedures for the Council. Our plan is to draft these sequentially and then ask for community input once we think specific policies and procedures are ready for feedback. Procedures we are drafting include case handling, Council operations (e.g. when and how we meet), and Council elections. Policies we are drafting include conflict of interest, operational security (in particular what we store and where), and confidentiality (what is and is not confidential). We welcome anyone interested to reach out to any or all Council members if you have input, questions or concerns you would like to share We'll continue to update the community at least once a month. thanks, -- Jens Kubieziel http://www.kubieziel.de Weisheit ist mehr als Wissen: Es kommt darauf an, was zu tun ist, und nicht, was zunächst getan werden soll. Herbert Clarke Hoover

4 4

Core Tor sponsor 4 June report
by isabela 12 Jul '17

12 Jul '17

In June we finished the task [1] to update dir-spec.txt to reflect prop278. We continue to run tests, compare measurements and fixed bugs, some were found at our test network, and an important one (more bellow) affecting other tor relays. Some of the bugs we diagnosed and fixed: #22460 Link handshake trouble: certificates and keys can get out of sync [2] #22466 "Crosscert is expired" warnings: RSA->Ed25519 identity crosscertifice apparently made in 1970? [3] #22751 LZMA coder causes crash when the sandbox is enabled [4] #22752 Assertion failure in consensus_cache_entry_handle_get on Windows [5] As mentioned, we found an important bug that cost us some time to figure out. This was related to the implementation of both proposals, 140 and 278. Where we didn't send the "not modified" header so relays would keep asking for data they already had and receive the document. This was leading to more bandwidth usage which is completely the contrary of our goal with this project. The bug was tracked under this ticket: #22702 Never send a consensus which the downloader already has [6] We collected measurements before and after fixing the bug [7]. If you look at our spreadsheets, in the "regression found" subsheet you will see that middle nodes (XXXm under ID) and relays (XXXr under ID) are above 100% in the delta, which is a regression (using more bandwidth). In the "regression fixed" subsheet, you can see that for XXXm and XXXr nodes this is fixed. They are around 55% which give us a bandwidth improvement of 45% for relays. For clients we ave reduced the bandwidth consumption to the point where we are now only using 41% of the bandwidth we used before version 0.3.1 of core tor. We are very happy with these results. For next month we will evaluate one more compression algorithm to see if we can improve these gains even more[8]. And we also received a ticket[9] from an user (relay operator) with a low-powered machine complaining about a side effect our solution have created. Where a relay now generates a bunch of diffs every time it gets a new consensus, and then it compresses them all in several ways, this happens in the background, but for low-powered machines is noticeable as it's taking a lot of resources. We have a couple of design changes to solve this in mind and will be working on it in July as well. [1] https://trac.torproject.org/projects/tor/ticket/22275 [2] https://trac.torproject.org/projects/tor/ticket/22460 [3] https://trac.torproject.org/projects/tor/ticket/22466 [4] https://trac.torproject.org/projects/tor/ticket/22751 [5] https://trac.torproject.org/projects/tor/ticket/22752 [6] https://trac.torproject.org/projects/tor/ticket/22702 [7] https://docs.google.com/spreadsheets/d/1l_m-kHkOrq4UGmTUtpuffbUY85fvcDQJaoF… [8] https://trac.torproject.org/projects/tor/ticket/22819 [9] https://trac.torproject.org/projects/tor/ticket/22883

1 0

Damian's Status Report - June 2017
by Damian Johnson 12 Jul '17

12 Jul '17

Short one this month but here ya go! http://blog.atagar.com/june2017/

1 0

Default obfs4 bridges frosty and dragon reporting 0 bandwidth since ~June 18
by David Fifield 10 Jul '17

10 Jul '17

These bridges, added to Tor Browser in ticket #22468, are reporting 0 bandwidth since a few days ago. Is there something wrong with them? https://atlas.torproject.org/#details/854173307E33686BBBAC36A3A093BEF320B71… https://atlas.torproject.org/#details/D9E712E593400635462172121B7DB90B07669…

1 1

Community Team report June 2017
by Alison 10 Jul '17

10 Jul '17

ello all, Here are the highlights of the Community Team's work in June 2017: June 2017 Community Team report Meeting notes June 2017 ================================================================== https://trac.torproject.org/projects/tor/wiki/org/teams/CommunityTeam#Curre… Tor Meeting planning ================================================================== Alison began planning for the October Tor Meeting in Montreal. Invites will go out very soon! Windows 10 user issue ================================================================== Alison and Phoul identified an issue that was preventing Windows 10 users from opening Tor Browser when they were also using a popular piece of banking software. Phoul was able to get the issue resolved, but this problem has occurred with past versions of both pieces of software, so we are working with the makers of the banking software to prevent this problem in the future. Community Team roadmap ================================================================== We're roadmapping our plans for the rest of 2017 and trying to coordinate our dependencies with other teams, particularly dependencies related to user support. Support portal/support wiki ================================================================== The full support portal has to be put on hold while we wait for an update on that funding, so we've opted to put the questions and answers onto a read-only wiki so that users have something to help them in the meantime. We'll publish the wiki in July with a blog post announcing it. Contributor guidelines ================================================================== Alison, atagar, and arma put the finishing touches on our core contributor (membership) guidelines draft, and arma initiated the proposal discussion on tor-internal at the end of June. Library Freedom Project ================================================================== We completed and submitted the IMLS grant at the beginning of June. We then began working with a graphic design firm on another grant to make infographic posters explaining basic privacy concepts, like encrypted messaging and strong passwords. If we get this grant, we'd print the posters in at least three languages (English, Spanish, and Arabic) and distribute them for free to any interested libraries. Outreach ================================================================== sukhe made plans to give two Tor talks in Toronto in August: https://lists.torproject.org/pipermail/tor-community-team/2017-June/000048.…. He also connected with folks at SFLC India and is working on some talks with them in September. Phoul, Alison, arma and others participated in the Localization Lab AMA. ================================================================== Next up: completing the community team roadmap, more meeting planning including the Montreal meeting and future Global South meeting(s), publishing the support wiki, drafting the code of conduct, writing documentation for FOSS/Tor cultural norms for onboarding new employees, organizing support team feedback to applications team. ================================================================== Thanks for reading! -- Alison Macrina Community Team Lead The Tor Project

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

tor-project