- tor-project - lists.torproject.org

August 2017 Report for the Tor Browser Team
by Georg Koppen 05 Sep '17

05 Sep '17

Hi all! In August the Tor Browser team made two releases, Tor Browser 7.0.4[1] and Tor Browser 7.5a4[2]. Both releases updated Firefox to 52.3.0esr and bumped the respective Tor versions included. Moreover, we added a fix to avoid scary warnings when dealing with .onion services that don't have a TLS certificate[3]. In addition to that, the alpha release provided a number of improvements and bug fixes that needed more testing: selfrando enabled Tor Browser bundles for 32-bit Linux users[4], regression fixes around our external helper app dialog[5], and better W^X enforcement for Tor Browser on Windows[6] to mention just the highlights. Non-release work focused on remaining Sponsor4 items: we tested the Gitian replacement we have been working on for the past months and are switching over to it while I am writing this status report. The next alpha release is supposed to get built with rbm/tor-browser-build to give it a wider testing and iron out remaining issues. We documented and fixed the first issues when building Tor Browser for 64-bit Windows.[8] And, finally, our UX redesign of Tor Launcher got a first prototype we can experiment with and improve upon.[9] The full list of tickets closed by the Tor Browser team in August is accessible using the `TorBrowserTeam201708` keyword in our bug tracker.[10] In September we plan to get our first alpha builds out which are based on rbm/tor-browser-build. Moreover, we finally plan to integrate FPCentral as our Panopticlick instance into our QA system.[11] Additional items on our ToDo list are: enabling sandboxing in Linux bundles in the next alpha release[12], making progress with our Tor Browser for 64-bit Windows project, getting the proposed Tor Launcher improvements better tested and finetuned, and starting to update the security slider by taking past year's Firefox vulnerabilities into account[13]. All tickets on our radar for this month can be seen with the `TorBrowserTeam201709` keyword in our bug tracker.[14] Georg [1] https://blog.torproject.org/blog/tor-browser-704-released [2] https://blog.torproject.org/blog/tor-browser-75a4-released [3] https://bugs.torproject.org/21321 [4] https://bugs.torproject.org/20848 [5] https://bugs.torproject.org/22618 [6] https://bugs.torproject.org/22563 [7] https://bugs.torproject.org/23213 [8] https://bugs.torproject.org/23229 [9] https://bugs.torproject.org/23261 [10] https://trac.torproject.org/projects/tor/query?status=closed&keywords=~TorB… [11] https://bugs.torproject.org/6119 [12] https://bugs.torproject.org/22692 [13] https://bugs.torproject.org/23409 [14] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig…

1 0

Damian's Status Report - August 2017
by Damian Johnson 03 Sep '17

03 Sep '17

Hi all, no pretty pictures this time but here's what I've been up to this last month... http://blog.atagar.com/august2017/ Cheers! -Damian

1 0

Ricochet is in the wrong language
by Andri Effendi 03 Sep '17

03 Sep '17

Hi All, I am trying to run ricochet on MacOS. I recently had to do a clean install of my OS so I am in the process of reinstalling all the software. Why is Ricochet now in spanish when I open it? I have downloaded it from https://ricochet.im/releases/1.1.4/ricochet-1.1.4.1-macos.dmg Not sure what to do to get it in English again. Kind Regards, -- Andri Effendi <fusionman133(a)gmx.de> Organiser of The Free Software Movement in Sydney www.freesoftware.org.au/sydney/ GPG fingerprint: 8438 138D ECDA 05E0 591F F2B4 4721 0F03 AC24 DF73 Confidentiality cannot be guaranteed on emails sent or received unencrypted. Sent with GMX - Email Made in Germany

2 1

SponsorR Status Report August 2017
by George Kadianakis 03 Sep '17

03 Sep '17

Hello, here is the August 2017 report for SponsorR: - We are near the end of our work here! We've successfuly merged upstream both the service-side and the client-side of prop224 (#20657 & #17242)! Running an HS v3 hidden service should work fine from latest master. That's basically the minimum viable product for next generation hidden services. Now we start a period of testing, bugfixing and maintainance until the stable 0.3.2 release. Expect a blog post about our work when we have killed most serious bugs. - We fixed various high severity bugs that could influence reachability and correctness of prop224: #23110, #23157, #23311, #23335, #23343. - We have also prepared fixes for various blocker prop224 bugs that we will get fixed real soon now: #23360, #23327, #23056, #23346, #23331, #23355, #23361, #23123

1 0

August 2017 report for the metrics team
by Karsten Loesing 01 Sep '17

01 Sep '17

Hello Tor, hello world! Below you'll find the highlights of Tor metrics team work done in August 2017. On behalf of the Tor metrics team, Karsten Published a blog post [1] summarizing achievements made in the past 12 months with support of Mozilla's Open Source Support (MOSS) program. [1] https://blog.torproject.org/blog/we-enhanced-security-and-integrity-tor-met… Formalized the steps for sanitizing bridge descriptors [2] that are collected and published by CollecTor. [2] https://metrics.torproject.org/bridge-descriptors.html Released Onionoo releases 4.0-1.3.0 [3], 4.1-1.4.0, and 4.1-1.4.1 [4] which add a new "version" parameter, remove bridge clients objects' beta fields "countries", "transports", and "versions", contain configuration improvements, and update dependencies. [3] https://lists.torproject.org/pipermail/tor-dev/2017-August/012387.html [4] https://lists.torproject.org/pipermail/tor-dev/2017-August/012433.html Released CollecTor 1.2.1 [5] with a fix for handling bridge network statuses containing zero entries. [5] https://lists.torproject.org/pipermail/tor-dev/2017-August/012402.html

2 2

August 2017 TC Report
by Tommy Collison 01 Sep '17

01 Sep '17

Quick report on what I got up to in August. Renaming this from "Grants Report" to "TC Report" because sometimes I do things that aren't grants. Grants: - Got awarded a grant from OTF. - Got awarded a grant from MDF. - Submitted a (different) grant to OTF. - Submitted a grant to Knight Foundation. - Drafted a letter of inquiry for Tor outreach funding but haven't sent anywhere yet. - Researched other funding sources. Comms: - Published a blog post about Tor Browser downloads. [1] - Edited a blog post about our MOSS final report. [2] - Edited an upcoming blog post about Orfox updates for Isa. - Added some copy to our statement on racists being bad [3] and dealt with the fall-out on the twitterz. - Worked with Steph on a blog calendar so that we post something at least once a week. Misc: - Voted on our membership guidelines -- you should too! - Put all of my New York apartment things in a box and then, a week and 2,865 miles later, unpacked them all in a different apartment in Seattle. All of the movers asked "Microsoft or Boeing?" and so I got to tell them about Tor. Anything that should be on my radar? TC [1] https://blog.torproject.org/blog/tor-downloads-2017 [2] https://blog.torproject.org/blog/we-enhanced-security-and-integrity-tor-met… [3] https://blog.torproject.org/blog/tor-project-defends-human-rights-racists-o…

1 0

UX team August summary
by Linda Naeun Lee 01 Sep '17

01 Sep '17

Hi all, Qe finalized the design and copy of Tor launcher (#23261 <https://trac.torproject.org/projects/tor/ticket/23261>). You can see the final version, version 8, mocked up here <https://marvelapp.com/3f6102d>. Mark built a working prototype of this new design, and we're getting ready to push changes. I'm personally very excited for this new version of Tor launcher. It's more clear on what options to choose, shows all the network settings on one screen, and communicates more succinctly. We finished three iterations of the Onion Browser branding survey, which aims to quantify how likely they will pick Onion Browser from an app store of browsers that claim to be affiliated with Tor, and what they would find more helpful in signaling the recommendation for Onion Browser and Tor. The next steps are to host the survey ourselves (so we don't rely on a third party collecting user information), and run the survey! We hypothesize that the takeaway will be "okay, no one knows Onion Browser was the recommended one," but are interested in verification, quantification, and use thought processes. We've settled into a rhythm of triaging tickets and getting new tasks to do each week, and using our weekly team meeting to talk about one of our big projects with other teams' members. Now that we're doing this, we feel like we can better be that internal service to other teams at Tor. Not to mention that it feels more productive. Cheers, Linda N. Lee Current Key: https://pgp.mit.edu/pks/lookup?search=lindanaeunlee GPG Fingerprint: FA0A C9BE 2881 B347 9F4F C0D7 BE70 F826 5ED2 8FA2

1 0

Notes from August 31 2017 Vegas team meeting
by Karsten Loesing 01 Sep '17

01 Sep '17

Notes for August 31 2017 meeting: Roger: 0) I'm back from the crazy travel. For a bit. Do you have anything to add to my TODO list? 1) NSF report marathon update: Three reports are in and approved! One is due in two days but technically it's not ours to write. The fifth is due in a month and is on track. 2) SponsorR is ending real soon now. We should wrap up and invoice them. 3) My future hobby: getting the network team to adopt bwauth 4) Capture The Onion contest, and Tor Village at Defcon next year 5) I've been playing 34c3 ticket fairy. Do you need one? Does anybody on your team? 6) Next week I go to NYC to work on website stuff, and Seattle 7) In mid Sept, I might be on a Tor Hidden Services panel in Baltimore 8) In Oct, I'm on a "National Priorities in Computing Research" panel in DC 9) I started trying to find a time to visit SIDA. Maybe I'll try to bring Alison. Georg: 1) We finished the hiring process for the Tor Browser team (there will be a new team member starting mid-September) and are starting to go over applications for the mobile browser position. 2) Work on a new stable release and Sponsor 4 is ongoing. 3) I wrestled with getting a bug bounty paid out. Do we want to have bug bounty related Tor swag? (Hint: I think "yes") If so, how do we get that project going? Isabela: 1) last week - sponsor4 - got deliverable completion reports for TB out for invoices - ux - worked with linda on planning for the upcoming weeks of work, helped with onion browser survey. worked with tommy on designer grant proposal - met with drl for project kick off - homework for me from this meeting is to review M&E of sponsor 8 and communicate with the team what the expections are for this first quarter of project 2) this week - sponsor4 writing network team deliverable completion report for us to invoice - ux - shipped designer grant proposal got to a good version with onion browser survey preparing ticket to move it to hiro to build it. found a place (with arma help) for us to meet in NYC next week and work on the website redesign - also do prep work for this meeting. - writing blog post about orfox work and our focus on mobile 3) brazil update - the brazukas want to write a report on the state of relays in brazuka land Steph: 1) Helped launch OONI Cuba report, edited post, shared, contacted media. 2) Working on Onion Browser survey with UX team 3) Got proposals from 2 possible speaker trainers for Oct 14 half day Montreal training, decision likely next week when Shari is back 4) Working w Isa on Orfox blog post to be published next week. Planning other content w Tommy. 5) Fundraising campaign on hold after 2 meetings. Arturo: 1) We published a report on internet censorship in Cuba: https://ooni.torproject.org/post/cuba-internet-censorship-2017/. It was covered by Amnesty (https://medium.com/amnesty-insights/cubas-internet-paradox-776213c8ddb0) Motherboard (https://motherboard.vice.com/en_us/article/vbbjxm/here-are-the-41-websites-…, was happy to see they used one of our charts in their article featuring the OONI logo) and more to come. 2) Started to convert the style guide Elio made (https://github.com/OpenObservatory/design/issues/3) into a "Living Style Guide" (https://github.com/OpenObservatory/design/pull/4) http://openobservatory.github.io/design/ 3) Seems like we have mostly sorted out the design issues related to securing our probe orchestration system. See: https://github.com/TheTorProject/proteus/issues/24, https://github.com/TheTorProject/proteus/issues/26, https://github.com/TheTorProject/proteus/issues/27. Alison: 1) LFP won about $250,000 from the Institute of Museum and Library Services!!!!!! 2) The membership guidelines are finally out for a vote! Go vote! 3) LFP is getting a website and logo redesign. 4) Tor meeting agenda: I didn't get a ton of responses. Should we put out another call for agenda items? [Isabela: I think we will get more responses once we share a draft, seeing others ideas help ppl think of what is missing or what to suggest] 5) I may meet up with Roger today to talk about getting more global coverage for the speakers bureau. Karsten: 1) Released Onionoo protocol version 4.1 which adds a "version" parameter and removes bridge clients objects' beta fields "countries", "transports", and "versions". 2) Planning to have a team meeting in the last week of September in Berlin and bring results/questions to Montreal two weeks later.

1 0

New desktop browser developer, and other open positions!
by Erin Wyatt 29 Aug '17

29 Aug '17

Hello everyone! Good news — the Browser Team has just finished recruiting for the desktop browser position, so we have a new employee starting the third week of September! I’ll send an email introduction soon. Yay! :) In related news, we have three other positions open at the moment, and we need your help publicizing them! Specifically, we’re looking for two browser developers for mobile (Android), and one Android developer. Please see our jobs pages for more information: https://www.torproject.org/about/jobs.html.en <https://www.torproject.org/about/jobs.html.en> Please tweet/post/forward the job postings to any person, organization, mailing list, or social media platform that you think might be helpful. Thank you! Cheers, Erin Wyatt HR Manager ewyatt(a)torproject.org GPG Fingerprint: 35E7 2A9F 6655 45F9 2CB6 6624 BA0C 9400 F80F 91CE

1 0

Network team meeting notes: 28 Aug 2017
by Nick Mathewson 28 Aug '17

28 Aug '17

Hi, folks! Another week, another meeting. You can see the IRC logs from http://meetbot.debian.net/tor-dev/2017/tor-dev.2017-08-28-17.01.html . Here are the notes from our pad: ===== Network team meeting, 28 August 2017 (1700 UTC) Announcements and requests: - PA request from HS team: We need some help with review-group-22 since all our prop224 tickets are blocked by this review group. We've already reviewed most of the tickets; there are 2 left which would be great if were handled by other team members since we have tons of other prop224 stuff to tend to. Thanks! :) - 031 stable release? Triage, Bug fixing, ... so we can meet the release deadline? People out: - ahf (returning wednesday). teor: - Last week: * Caught up on emails * Caught up on other admin * Re-planed PrivCount Experimental for the next few months * Tried to work out how to generate random floating point numbers that are good enough for Laplace noise (current hidden service stats) and Gaussian noise (PrivCount in Tor). Turns out floating point is really lumpy. https://trac.torproject.org/projects/tor/ticket/23061 * Told people that I want to limit the amount of work I do on fallback directories: https://lists.torproject.org/pipermail/tor-project/2017-August/001405.html - This week: * Work out how many onion addresses an HSDir should expect to see https://github.com/privcount/privcount/issues/397 * Try to stop adding features to PrivCount 1.1.0 so we can actually do the release komlo (offline) - Last week: - Fixed up Rust protover from isis's review - This week: - Pair with isis to finish up Rust protover, submit it for wider review hopefully by next week - Send out Rust kata for the Rust hack day in Montreal, if people want to work on it beforehand nickm (out from Wednesday through next Monday) - Last week * Lots of review and merge, especially hidden service client-side stuff * Working on the aftermath there * Lots of tiny tickets in 0.3.2.x. * Starting to triage some 0.3.2.x stuff; discussed stragegy with isa - This week * Only around 2 days. Planning to review patches and triage 0.3.2.x. * Didn't get 0.3.1.x-rc out last week. Maybe can make progress this week? Still bugs to fix. #22752 seems blocker-ish. * Going to hack some low-hanging sponsor8 efficiency stuff, time permitting. * going to try to empty my inbox - Queries dgoulet: - Last week: * prop224 client upstream merge (YAY!!!) which lead to bug hunting lots of issues. Some relevant tickets I worked on are #23300 and #23308. * Reviewed tickets in review-group-22 including the big KIST one from pastly in #12541. * I've addressed some tickets in 031 milestone as well. More work there remaining for the stable release. - This week: * Wrapping up many bugs for prop224 so we can get it in a good state before the 032 feature freeze. This means continue integration testing and hopefully tackling #23310 sooner rather than later. * Follow up with pastly on KIST scheduler and try to make it in time for the feature freeze deadline. * I'll prioritize 031 tickets review/revision this week so we can meat our release deadline. pastly: last week: NRL stuff this week: NRL stuff, meet with dgoulet about KIST haxxpop: few weeks ago: run the hs desc fuzzing and found a bug #23233 [Good stuff! --dgoulet] << d(^ ^) this week: I will continue the fuzzing on the inner layer of descriptor asn Last week: - We got the client-side of prop224 merged (#17242). We are basically 3/4 of the way done for prop224. The rest 1/4 of work is testing, bugfixes, unittests, and quality of implementation improvements! There are lots of them. See our pad for more details: https://pad.riseup.net/p/LPVY6AL_prop224_upstreaming - Spent lots of time testing our prop224 branches for bugs related to hsdir indices and overlap period. Found a few and fixed them: #23157, #23110, #23309, #23335 - Wrote patches for more prop224 issues: #23056, #23343 - Reviewed #19418, #22779, #22802, #17242 as part of review-group-22. This week: - This week we hope to get all the current prop224 blocker bugs merged upstream, so that we have a common branch to work from. See our pad above for more details. - We need to keep testing prop224 and writing unittests. We keep finding new bugs :-) - Maybe write a few more stuff in #23126 about how to do hsv3 statistics. isabela Last week: - caught up on emails after looong vacation - chated with networkers about 0.3.2 triage and all the long backlog we have, how to organize it over the different upcoming releases (033 and 034) - tried to coordinate dependencies TB team has on network team for Tor Launcher UI udpate (progress bar and moat api) This week: - write sponsor4 deliverable completion report - following up on dependencies (question for catalyst and isis and nick?) - just checking in if things are moving on and if there is any udpates/blocker we should be scary about (TB dependencies) - plan to check in with sponsorR deliverables completion - and to check in with sponsor8 work (how is it going etc, I need to pair this up with what we wrote at M&E which is a looong story but no worries #wegotthis) - if all goes well I also plan on getting us started with roadmap planning (for montreal) catalyst: last week (2017-W34): - looked at floating point nastiness (#23061) -- I should probably drop it but I want to make sure we explicitly say things like "we don't care about holes in the range where we lose precision" - poked some more at bootstrap progress reporting - somewhat distracted by general awfulness in the world (and family in Houston) this week (2017-W35): - travel arrangements for Montreal - figure out how to incrementally retrofit a higher-level state machine that tracks bootstrap progress based on lower level events (so lower level code won't have to break abstractions to report boostrap progress) - review #23149 - ask pointed questions about how much precision we need in #23061 isis: last 2 weeks: - vacation - brief amounts of work to fix some issues with the bridge authority and talk to the intern this week: - moat backend #22817 - montréal arrangements -- Nick

1 0