- tor-project - lists.torproject.org

Network Team meeting notes, 2 Oct 2017
by Nick Mathewson 02 Oct '17

02 Oct '17

Hi, all! You can see the logs from this week's network team meeting at http://meetbot.debian.net/tor-meeting/2017/tor-meeting.2017-10-02-16.59.html . Below are the notes we typed into the meeting pad. ============= Tor network team meeting pad, 2 Oct 2017 Note new meeting location: #tor-meeting on OFTC! (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) Last week's notes: * https://lists.torproject.org/pipermail/tor-project/2017-September/001457.ht… Discussion topics: Things to do before Montreal: * Teams rotation for October: https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/TeamRot… * RSVP for team dinner in montreal! See network-team ML for info. * Learn some Rust! https://github.com/chelseakomlo/rust_kata * Sleep; take care of yourselves; try not to show up burned-out. ;) * RUST HACKATHON STARTS 10:30am on Monday; please arrive by 10:00am! Nick: * Last week * Wrote a bunch of unit tests * Did some research on async io in Rust * Hunted a few bugs (including 8185, 23690); helped with some others * Helped some with upcoming 0.3.2.2-alpha * Reviewed and merged various tickets * Looked at test coverage diffs between 0.3.1 and 0.3.2: we have some problems. Summary: although our coverage rate is up, we have ~500 more uncovered lines than we had before. To find out where they are, have a look at https://people.torproject.org/~nickm/volatile/coverage-diff-summary . For epecific lines, see https://people.torproject.org/~nickm/volatile/coverage-diff.xz . For history: * 0.2.9: 30014 uncovered; 27157 covered: 47.50% covered * 0.3.0: 29520 uncovered; 30288 covered: 50.64% covered * 0.3.1: 30629 uncovered; 34805 covered: 53.19% covered * 0.3.2: 31138 uncovered; 38385 covered: 55.21% covered * This week * Meet with isabela for misc planning * PETS review * Encourage people to defer, fix, fix, defer, etc. * Time permitting, look forward to sponsor8 stuff. * New England Systems Verification Day (Friday) * Montreal prep TBD * Help more with 0.3.2.2-alpha stuff * Prep for 0.3.1.8 as needed? dgoulet: * Last week: - Work on prop224 tickets. We've postponed the IPv6 + Single onion service discussion until Montreal. - Spent some time debugging scheduler KIST issues which turned out to be more deeper issues within tor: #23709, #23710, #23711, #23712 - Worked on ticket from the 032 milestone including review/triage/patches. Nothing big though, most of it was hs/sched related. * This week: - Continue the 032 milestone work. Some prop224 and scheduler stuff needs to be done for the stable. - I want to prep for the IPv6 hackfest in Montreal next week with teor. Many issues in the hidden service subsystem that I want to document properly before that. - Need some prep as well for the circuit building expiring logic for hidden service for which I want/need to sit down with Mike for this in Montreal (mostly related to #3733). teor: (offline, leave this week) Last week: * finish off a bunch of experimental PrivCount features and bug fixes * review Shamir secret sharing proposal * prepare to travel to Montreal (so many bits of paper!) * I think there's some tor coding I forgot, too This week: * week off: rest, casual coding, enjoy Montreal ahf: Last week: Sponsor 4: - Fixed Zstd regression in #23551 Sponsor 8: - Roger found an issue with the HS we used to do our download test with. We fixed this using JavaScript to download the file in the browser and report back the results to the server. Release work: - Meeting with Isis and Nick about what needs to be done before the release. - Reviewed: #23691, #23690 This week: - Roll 0.3.2.2-alpha together with Isis. - Prepare for Montreal meeting. Leaving on Friday (and will by in the air almost the entire day). - Finish Rust toy project. - Update the Sponsor 8 HS to allow the testers to specify their country when doing the testing. - Go over things I haven't gotten around to in the last week: go over old bugs, end of month tasks asn Last week: - Reviewed #23662 and #23603 for prop224. Worked on #23493. - Reviewed #23100. - Worked on #23672. Now ready for merge.. - Did some more debugging on #21969 ("missing primary guard descriptors"). This bug is still alive and a more edge-casey than before so harder to debug. It occured on my service a few days ago, and left it hanging for 28 hours until I restarted it. We also received more reports of this on trac. Needs more hardcore debugging + #23671 + #23670. - Helped tommy with the upcoming blog post calling for prop224 testing. - Revamped the prop224 wiki page some more: https://trac.torproject.org/projects/tor/wiki/doc/NextGenOnions This week: - More prop224 testing/bugfixing/planning. - Prepare for Montreal meeting. - More reviews as needed. catalyst: last week (2017-W39): - bug triage - reviewed some patches (including #23643 -- Type-check struct members that are passed to confparse) - more #20532 investigation - Tor Launcher progress bar meeting - fixed a leak in tests (#23691) this week (2017-W40): - somewhat slowed down by respiratory virus - Montreal travel prep - patches for #20532 - more bootstrap progress reporting improvements komlo: last week: - Submitted #22840 (review for this would be great before Montreal) this week: - prep for rust hackfest pastly: last week: more kist bug wrangling with dgoulet isabela: Last week: - Worked on progress bar error msgs and synced with catalyst+mcs https://docs.google.com/document/d/1jZNFYXzii7A6gCTJtvpO-PAO-WNZa2RuEEXYJwx… - Got tests for our network speed done in a some of our target countries, hope to have 100% coverage for october tests (was important to have measurements for september tho) This week: - organize prep work for team roadmap session in montreal - get devs survey done in form format and send it to developers: https://storm.torproject.org/shared/_OX6xP4qVbt5BObbZ5EhCSWOh7snk3O_5iqoaes… isis: last week: - preparation for releasing 0.3.2.2-alpha - more work on the captcha server to fix some bugs found while writing tests #15697 - started on moat backend #22871 - organising meeting sessions this week: - finish #22871 - go over komlo's rust protover patches on #22840

1 0

Notes from September 28 2017 Vegas team meeting
by Karsten Loesing 02 Oct '17

02 Oct '17

Notes for September 28 2017 meeting: Karsten: 1) We accidentally left MeetBot running for a couple of days after out last team meeting in #tor-dev which led to logging the channel all the time and which prevented the network team from using MeetBot. I can't rule out that we'll make the same mistake again, nor can other teams. Should we move all public team meetings to #tor-meeting instead and use MeetBot there? I'm happy to do it, but it makes even more sense if most/all teams do it. Conclusion: yes, we're going to try it. Roger will send mail to tor-project explaining the plan. [Update 2017-09-30: Turns out we did *not* log half a week of #tor-dev; we just confused MeetBot in a way that it did not allow the network team to start a new meeting: http://meetbot.debian.net/tor-dev/2017/tor-dev.2017-09-21-14.29.log.html] 2) We're currently meeting in Berlin to make a team roadmap for the next 12 months. We're probably going to publish it next week and discuss it with other teams in Montreal. Alison: 1) Montreal meeting planning continues apace. I'm still soliciting ideas for the working sessions. 2) Lots of prep for my IMLS grant. I hope to have the application for participants completed this week. 3) Outreachy applications are rolling in. 4) Helping Isa find volunteers for Sponsor8 activities. Roger: 1) Mozilla all-hands meeting, let's tell people a plan for who should be there. Plan: Roger will mail tor-project@. 2) Brad: I'm doing an NSF proposal, due Oct 10. You could influence the budget allocations. 3) Membership secretary is in place: Damian is our new membership secretary. 4) OONI and Tor bundling: their mobile version doesn't have Tor in it, because iOS. That's sad, and we should help them fix it. Plan: have a session in Montreal to nail down whatever short term fixes we can do. 5) I'm doing a poor job as execdir-to-frontdesk conduit. I wonder if we should try listing the frontdesk on the contact page, with a big warning next to it. Plan: I will work with Alison to craft an amazing sentence for the contact page, and we'll swap frontdesk in and execdir out. 6) What did we do with the FOSDEM invite answers? Plan: The comms@ team is going to discuss how we coordinate talk proposals so we can be proactive rather than just trying to respond. Also, some proposals need to draw from many parts of Tor, so we need a shift in how we as an org approach them. Georg: 1) Releases should get out pretty soon; the alpha Tor Browser contains the missing content sandboxing and the first Tor alpha in the 0.3.2 series 2) I started reviewing the Cloudflare CAPTCHA bypass extension 3) Who is doing the CCC talk coordination? <- I'll start a thread on tor-internal to get the decision process going [GeKo] Nick: 1) We're moving forward on various projects in the Network team: mostly trying to fix bugs for the 0.3.2.x release series. 2) Remember: Isis and Ahf are putting out the next 0.3.2.2-alpha release. 3) Did we wind up with a boston PT meeting plan? Steph: 1) doing pre-work for Montreal speaker training. Talking with Lyndon again today about press. 2) Outreach apps coming in. Alison, Tommy, and I participated in a twitter chat this week. 3) doing prep with GR for fundraising campaign, giving feedback on acknowledgement letters. chatting again today. 4) helping with OONI comms, following launch process. Iran report blog post coming today 6) mapping out blog content calendar with Tommy, KIST post will go out early next week (held back bc of lots of content this week). Post on onion testing coming up 7) joining publiccode.eu call that publicly financed software developed for the public sector be made Free and Open Source Software Isabela: 1) working on sponsor8 indicators for Q1 2) coordinating tasks for designer proposal with TB team and UX team - writing activities and future plans summaries for tommy to use in the proposal (due oct 4th) 3) working with network and tb team on sponsor4 tor launcher new experience 4) Linda is finishing up website redesign mocks for me to get it printed for Montreal discussion session / Antonella is also helping out the team, she is creating components from bootstrap using our style guideline (colors fonts etc) - this will be super helpful for anyone that wants to build sites or pages for their projects following our guidelines 5) Hiro is one of the 'consumers' of Antonella's bootstrap resource - she is working on newsletter archive and signup/unsubscribe pages - she is also finishing up our survey tool (which we will use for a brand survey for onion browser and a needs finding survey for network team) 6) DRL responded to modularization proposal from core tor - we need to reduce budget from 900k to 700k, and apply as cost extension of current sponsor8 grant. Arturo: 1) We launched ooni-run: https://run.ooni.io yay! 2) Just published the Iran report: https://ooni.torproject.org/post/iran-internet-censorship/ 3) We have been discussing how to make the life easier for mobile developers that want to integrate Tor into their app, using MK as a test case. See: https://github.com/measurement-kit/measurement-kit/issues/86 4) Deploying OONI API and the new pipeline this week. Shari: 1) working on end-of-year fundraising 2) anything to bring up about Montreal? 3) mapping Tor - will add this to the Montreal meeting agenda under the title "Tor on a bus."

2 1

OONI Monthly Report: September 2017
by Arturo Filastò 29 Sep '17

29 Sep '17

# OONI Monthly Report: September 2017 The OONI team completed all deliverables for its current contract with the OTF. ## Stable release of Measurement API We released the stable version of OONI's new measurement API, which is available here: https://api.ooni.io/. The OONI API is based on the stable release of our data processing pipeline, which has been re-engineered over the last year to detect censorship events around the world faster and more accurately. We added the following to the OONI API: * API endpoints for listing and filtering anomalous measurements * API endpoints for downloading full reports We changed the following: * Reverse sorting in `by_date` view and hide measurements from time travellers * Better API documentation thanks to redoc based on OpenAPI 2.0 * Improve request validation thanks to connexion base on OpenAPI * Oonify the UI * Better testing ## Stable release of the OONI data processing pipeline We now have a much stronger data processing pipeline (https://github.com/TheTorProject/ooni-pipeline/pull/62) The scheduling of the pipeline is based on Airflow which is more robust than our prior luigi based solution. By doing this we have been able to reduce the number of silent outages going undetected for weeks. The new version of the pipeline allows for much quicker feedback and interation, allowing us to run meaningful SQL queries that return result within minutes (not hours). This is also the foundation for building our new OONI measurements API. We feel confident that the pipeline is going to easily scale to up to 100 GB of network measurement data per day. The current rate is of ~20GB of measurements per day and we are able to process this amount of data within an hour (~10 min for compression, ~10 min for sanitisation, ~30 min for inserting it into the DB), so we have some margin for scaling up to 100GB a day without significant modifcations to our infrastructure. Currently the data is being processed in 24 hour batches, but based on the stats above, we are aiming to reduce that to 12h, 8h and eventually 1h. The pipeline has been designed to be modular and allow us to easily ingest network measurement data from other projects too. Currently the pipeline is analysing the data looking for blockpages and signs of DNS manipulation. We have plans for adding heuristics for detecting also more advanced insights in future versions. For the future of the pipeline see: https://github.com/TheTorProject/ooni-pipeline/milestone/2 ## Implement visualisations for the measurements interface Elio Qoshi has started working for OONI as a designer. With him we have started to define the overall design and style of all OONI related content. Some of this work has been integrated into our living style guide available at the following URL: http://openobservatory.github.io/design. Part of the work also includes data visualisations that are used to visualise OONI data (see, for example, the BarChart component). ## Data visualisations for reports and blogs Thanks to the work on the design front, we have started creating templates and guidelines for making charts that much such a task easier in the future. See: https://github.com/OpenObservatory/design/issues/2. We created data visualizations based on our new style guide that are included in the following reports: 1. Cuba: https://ooni.torproject.org/post/cuba-internet-censorship-2017/#findings 2. Iran: https://ooni.torproject.org/post/iran-internet-censorship/#findings ## Published research report on internet censorship in Iran In collaboration with ASL19, ARTICLE 19, and Small Media, we published a research report on internet censorship in Iran. The report is available here: https://ooni.torproject.org/post/iran-internet-censorship/ We also published a summary of the report on the Tor blog: https://blog.torproject.org/internet-censorship-iran-findings-2014-2017 ## Stable release of Orchestrator We released the stable version of Probe Orchestration. This features: * Support for sending push notifactions to all mobile probes that include a message * Support for having them run custom tests via the OONI Run custom URI scheme * Better unittesting that also speak to the database to ensure everything is working as expected See: https://github.com/TheTorProject/proteus/pull/28 For the time being we have decided to postpone including support for instrumenting probes to run measurements, following possible security concerns, see: https://github.com/TheTorProject/proteus/issues/24. Once we have come up with a more solid specification and a proof of concept implementation of this scheme, we would greatly appreciate feedback and maybe a third party security audit of our proposed approach. ## OONI Run We released OONI Run, a custom URI scheme for OONI Probe mobile apps that enables users to: * Engage others with testing the sites and running the OONI Probe tests (included in OONI mobile apps) of their choice * Embed an OONI Probe widget to monitor the blocking of their site around the world OONI Run is available here: https://run.ooni.io/ We also published a blog post that explains OONI Run: https://ooni.torproject.org/post/ooni-run/ ## Community We hosted our monthly community meeting on https://slack.openobservatory.org on 29th September 2017 at 14:00 UTC. We discussed the following: 1. OONI Run: Questions and feedback 2. Announcement of OONI API release: Questions ## Userbase In September 2017 ooniprobe was run 81,258 times from 1,595 different vantage points across 149 countries around the world. This information can also be found through our stats here: https://api.ooni.io/stats ~ The OONI team

1 0

UX team September summary
by Linda Naeun Lee 29 Sep '17

29 Sep '17

Hi all, September was another successful month for the UX team. This month, we: - met in person in NYC and designed torproject.org. (ticket <https://trac.torproject.org/projects/tor/ticket/22121>, archive of wireframes <https://drive.google.com/open?id=0B36YkvDtVNK_MU5ObVhEY1JBRUE>) - agreed on the new design of Tor launcher, and getting the progress bar to behave correctly and have nice icons (launcher design ticket <https://trac.torproject.org/projects/tor/ticket/23261>, progress bar behavior ticket <https://trac.torproject.org/projects/tor/ticket/22266>, icons ticket <https://trac.torproject.org/projects/tor/ticket/23486>) - finalized the Onion Browser branding survey and started to build the survey application to host the survey ourselves (ticket <https://trac.torproject.org/projects/tor/ticket/23376>) - started to work on a live style guide with all the bootstrap elements stylized in a Tor way (ticket <https://trac.torproject.org/projects/tor/ticket/23411>, preview prototype <https://marvelapp.com/6c5ce44>) - updated the metrics website with new style guidelines (ticket <https://trac.torproject.org/projects/tor/ticket/23383>) - started to building the Tor monthly newsletter (ticket <https://trac.torproject.org/projects/tor/ticket/23437>) Yay, Linda N. Lee Current Key: https://pgp.mit.edu/pks/lookup?search=lindanaeunlee GPG Fingerprint: FA0A C9BE 2881 B347 9F4F C0D7 BE70 F826 5ED2 8FA2

1 0

Yes, dist.torproject.org is messed up
by Roger Dingledine 29 Sep '17

29 Sep '17

Since you're all about to encounter a user asking you this question: Yes, https://dist.torproject.org/ is messed up. And yes, there are new versions of Tor Browser out today, and they are all trying to update, and they are now all giving their users confusing errors like "The update could not be verified" and "The requested URL /torbrowser/7.0.6/tor-browser-linux64-7.0.6_en-US.tar.xz was not found on this server." The short answer is to sit tight and wait, and everything should sort itself out over the coming 24 hours. Unless you're one of the few people who can help fix it, in which case, please help us make everything sort itself out. :) --Roger

1 1

notes from usdoj panel talk
by Roger Dingledine 29 Sep '17

29 Sep '17

Hi folks, Last week I was on a panel with a bunch of US Department of Justice prosecutors who specialize in child exploitation cases. I wrote notes for all the things I wanted to say, and of course my plan didn't stay intact once the panel discussions began, but here are the notes for posterity. Maybe they will be useful next time I (or you!) find ourselves in this situation. --Roger Three points as general Tor intro: * Tor's history, including funding -- NRL, EFF, State Dept, Darpa, NSF * Two pieces to the "metadata security" that Tor provides: the core Tor component that hides your IP address, and Tor Browser which deals with application-level fingerprints. * Millions of users use Tor every day -- ordinary people, activists, censored people, militaries and law enforcement. That variety is part of what makes it safe to use for all of them. [Story about Dutch cop anonymity system if we want it.] Follow-up question: The core Tor part? Why is Tor different from a standard proxy or VPN? * Distributed trust -- privacy by design, not privacy by promise. * Relays are run by community, 100gbit of traffic on average [Story about anonymizer if we want it] * Transparency for Tor is key: design docs, specs, source code, but also global engagement as real human beings. (It's not a contradiction for privacy people to believe in transparency. Privacy is about choice, and we feel that choosing to be transparent is the best way to establish and grow trust with our communities.) * Ok, so what are hidden services? Most people use Tor to reach websites and other services safely. Onion services (aka hidden services) are special addresses inside Tor that flip that around: people can reach *you* safely. - better security built-in - can be faster since not competing with exit traffic - reduced vulnerability surface area - mobility * We measured what fraction of Tor traffic has to do with onion services: 3%. - Something like 7000 onion service websites up at a given time https://blog.torproject.org/some-statistics-about-onions - Compare to 2.5M-or-more users *each day* (That's not nothing, but it is tiny. If you find somebody trying to scare you with huge numbers and pictures of icebergs, make sure you understand their business model before buying their product or believing their claims.) * Some examples of interesting onion services? [Pause while we get distracted by other panelists] "Securedrop" is a tool for people to communicate securely with journalists -- the New York Times, the Guardian, the Washington Post, Toronto Globe and Mail, the AP, etc all run onion sites. (Compare to the FBI's tipline, where they pay Cloudflare to mitm it.) Ricochet Onionshare * The biggest website that has an onion service? Facebook. In April of last year they posted that 1 million people accessed Facebook over Tor in that month. That's .1% of their user base! * Onion services protect different metadata than https, and it's about giving the users choice. onion services features: - stronger security, built-in: - encryption - authentication, so no dependency on the crappy CA model - authorization, so untrusted people can't even reach the webserver - can be faster since not competing with exit traffic - reduced vulnerability surface area - mobility Surprising (to this audience) users of onion services: Facebook mobile Debian updates IoT operators Activist blogger platform example Govt and law enforcement ------- Child exploitation sites/users are bad for Tor! They're bad for society in general, but they're bad for Tor in particular. We don't want them as users. See also the discussion at the end of https://lists.torproject.org/pipermail/tor-talk/2015-April/037538.html What are onion services "most" used for? It depends how you count: Internet Watch Foundation annual report has hidden services listed as "<1%" of the problem: https://www.iwf.org.uk/report/2015-annual-report Terbium Labs "dark web" report concludes the majority of onion service content is legal: https://terbiumlabs.com/darkwebstudy.html I hear bad people use google drive and dropbox for better bandwidth. But all that said, I don't want to say there is no problem. * What are some ways of screwing up your security while using Tor? Opsec mistakes; metadata fingerprinting; browser exploits; traffic analysis. NSA/GCHQ quote about Tor: King of low-latency anonymity systems UN HR report endorsing Tor. ---- Contradictions for the audience to think about: - If Tor works, you don't hear about it. So it's easy to overlook or undercount the "good" users. - Sometimes investigators have to choose between being able to discover victims vs being able to bust people. - If there is some approach that is able to compromise bad people, the same approach can compromise good people. - Often, the bad guys work harder on their security than the good guys. - If we make Tor stronger, we make it stronger for all. - There are many ways to be bad on the Internet, and fewer ways to be safe. Central to Tor is the topic of power imbalances: those who have power are less in need of Tor's protections than the most vulnerable populations. Matt Blaze's great quote about politicians who ask for crypto backdoors: "You can put a man on the moon, so surely you can put a man on the sun!" ---- Problems with "govt hacking" as a solution to "bad people": - 1) Secrecy: we as society need to have an informed discussion, and if governments won't tell us what they do, how can society make a good decision? - NSA's goals, the existence of other countries makes this even harder. - 2) The Feds lose their zero-days, and that hurts everybody. Cf "Shadow brokers". - 3) When mass surveillance becomes the cheapest and easiest option for fighting any crime... "Well sure, maybe you trust the people in power now... but what if the people in power change?" I bet US govt people are especially sensitive to this argument this year. In many ways this is the same as the Apple encryption discussion, and the "https everywhere" discussion.

2 1

New meetbot plan: #tor-meeting and nowhere else
by Roger Dingledine 28 Sep '17

28 Sep '17

Background on meetbot: it is the irc bot that we use to help coordinate our various Tor team irc meetings, and record results for posterity and transparency. See e.g. http://meetbot.debian.net/tor-dev/2017/ http://meetbot.debian.net/tor-project/2017/ So far we've had an ad hoc schedule and location for irc meetings, spread around both #tor-project and #tor-dev. After an incident with our meetbot where we accidentally left it logging #tor-dev all weekend, we've decided to take a more defensive approach: we will hold the meetbot-mediated sessions in a new channel, called #tor-meeting. So, if you want to use meetbot -- and feel free to do so -- you should move your meeting to #tor-meeting. It might be wise to tell the folks at the previous location that you're doing it elsewhere, so people can join and watch / participate if they want. One downside could be that the meetings won't have as many random bystanders watching them, so maybe fewer people will get pulled in. But we can resolve that, maybe even more successfully, with better report-backs. I think the upside of making it clearer whether there is something logging, and publishing the logs to the internet, is worth trying this new approach. --Roger

1 0

Network team meeting notes, 25 Sep
by Nick Mathewson 26 Sep '17

26 Sep '17

Hi! Our meeting notes for yesterday are below. We had a problem with meetbot, and don't have logs for this week; with luck we'll have that straightened out by next week. Network team meeting, 25 September 2017 Last week's notes: how did we do? https://lists.torproject.org/pipermail/tor-project/2017-September/001447.ht… After this meeting, please: * Check everything assigned to you in 0.3.1 and 0.3.2. Should it be? Should it be deferred? * Check new and needs-info stuff in 0.3.1 and 0.3.2. Anything there that you should/could be handling? * Mark essential 0.3.2.2-alpha stuff with "0.3.2.2-alpha-must". teor: * Last week (or two): * Fixed a nasty bug in Experimental PrivCount that ignored most connection events * Added intro and rend failure reasons to Experimental PrivCount * Fixed a bug in Tor's HS stats noise, but we're missing a function (#23414) * anyone want to write a working round_int64_to_next_multiple_of? * Found a bunch of little bugs in Tor connections and HS v3, fixed some of them * Fixed some tor-spec bugs, reviewed others * Did some thinking about the longclaw move (we'll be fine) #23592 * Fell down the single onion service v3 IPv6 hole, trying to dig out again #23493 * This week: * Count the number of simultaneous connections per IP in Experimental PrivCount * Complete the HSDir events for Experimental PrivCount * Get ready to travel to the dev meeting * I'll be on leave next week, until the hackfest / dev meeting Nick: * Last week: - 5 releases on monday - Worked on a bunch of spec-related fixes. - Removed many tickets from 032 -- look for "032-deferred" or "032-unreached" items in Unspecified - Reviewed and merged a whole bunch of fixes - Tried to help diagnose a bunch of bugs and continue to triage things. - Worked on small/persistent/annoying bugs - Integrated scan-build to run nightly as part of my tor-auto stuff. - Automated lintchanges as part of "make check" * This week: - Sleep more - Help ahf and isis with release, targetting early next week (Monday?) - Continue fixing bugs - Write more proposals for 033 and beyond - Encourage people to defer, fix, fix, defer, etc. - Time permitting, look forward to sponsor8 stuff. - Montreal prep Mike: - Still sick and feverish.. Seeing doctor today... [asn: sounds like a lovecraft diary! get well soon!!!] dgoulet: * Last week: - Bug hunting on KIST and HSv3. Analyzing logs and trying to figure out what happened. - Addressing tickets in 032 related to scheduler and hidden service. - Review tickets in the 032 milestone - Some ticket triage happened as well. * This week: - Pretty much the same as above, I plan to continue addressing 032 tickets especially the hidden service v3 ones. - Work out with teor and asn the single onion service v3 IPv6 fix (#23493) komlo (offline): - Final round of review for protover-rust from isis- if all goes well, I will be submitting a patch early next week. - Preparing for the Rust hackfest in Montreal- will update the schedule based on asn's feedback this week. pastly: * last week: - help dgoulet fix KIST bugs * this week: - keep fixing KIST bugs as they appear catalyst: Last week (2017-W38): - Opened some tickets about streamlining release engineering - Fixed some clock skew reporting issues - Wrote some commentary about bootstrap progress reporting details in #22266 - Found #23623 (get_voting_schedule getting called 10k times in 1 second) - Lots of troubleshooting about possible bridge bypass (#20532) - Reviewed a bunch of things This week (2017-W39): - Montreal travel prep - More analysis of #20532 - More work on improving bootstrap progress and error reporting ahf: Last week: Sponsor 4: - Reviewed: #23568. Sponsor 8: - Had some problems with Android Oreo and some of the debugging scripts I used. - Refactored some of the Doze handling in Orbot and added some logging for myself to be able to debug some timing more easily on host. Misc: - Got through the Rust book and started toying around with a small program. - The test hub ircd for ng onion got a small makeover after we reached some limits. - Wrote a description of a chanserv feature we might like to see for OFTC. This week: Sponsor 4: - Fix #23551. Sponsor 8: - Finish some loose ends: help with the survey where I can + get content on the "bandwidth test" HS. - Start upstreaming some of the code for tor that I'm using to debug things with. Misc: - Prepare to roll a release for next week (with Isis + Nick) - should we talk about this during the week? - Go over the interview with BestVPN Q/A with Steph. - Look at tickets for 0.3.1 and 0.3.2 in trac that needs to be closed/pushed forward. - More Rust. asn Last week: - prop224 is currently in a controllable state. Most code has been merged, and all open tickets are non-critical things (don't impact security or reachability in a major way). We are now entering a deeper testing and bugfixing stage. - Made a wiki page for prop224: https://trac.torproject.org/projects/tor/wiki/doc/NextGenOnions and established a small testing hub on a friendly IRC network. We currently have about 15 testers but we need more! Check out: https://trac.torproject.org/projects/tor/wiki/doc/NextGenOnions#Howtoconnec… - More testing, bugfixing and test writing for prop224. Worked on #23621, #23603, #23159, #23641. Also see https://lists.torproject.org/pipermail/tor-dev/2017-September/012451.html - More debugging for some elusive discnnects on prop224 clients/services: #23543 Are we seeing too many client disconnects with prop224 or is it normal relay on a 6 hop circuit? We see lots and lots truncate cells with normal reasons (channel closed, or ended). - Managed a few hackerone bugs. - Triaged a few prop224 tickets that were on 0.3.2. - Did some preparation for the PhD. This week: - Need to figure out what to do with the open IPv6 + prop224 bugs (i.e. #23493). Delay until Montreal for discussion, or handle the first part now? - More testing and dogfooding of prop224. We should have a Tor Browser with 0.3.2.1-alpha soon so more testing will happen :) - Work on the various open prop224 tickets: #23621, #23603, etc. - Prepare for Montreal meeting. - Do reviews as needed. isis: last week: - finished farfetchd CAPTCHA server #15967 - ristretto standardisation meeting (also for vxeddsa and ristretto-based sigs) - took a day off to do political organisation work - started the moat backend #22871 - scheduling meeting sessions for montréal - this week: - ask for a server to deploy farfetchd? not sure if it should be a separate VM but it could be - more scheduling for meeting session - releasing 0.3.2.2-alpha isabela Last week: - finished time allocation update with brad (will check with nick on sending the relevant changes to network team) - started coordinating with Alison on contacts for tests/measurements we need to do for sponsor8 - send invoices reports related to sponsor8 - missed meeting cuz I was on bus (traveling) This week: - finishing survey for apps developers (sponsor8) - finish text for download measurement test - finish obtain contacts for download tests - finish error paths and msgs for progress bar (i know catalyst is looking for this) - wondering how moat api is doing (question for isis) - trying to figure out who can call in for PT community meeting organized by internews

1 0

Notes from September 21 2017 Vegas team meeting
by Karsten Loesing 22 Sep '17

22 Sep '17

Notes for September 21 2017 meeting: Roger: 1) The CCC call for proposals is out. We should build a great plan and do it. Deadline Oct 15. 2) The RightsCon call for proposals is out too. Could we do a cool coalition session? 3) Steph: I'm 80% of the way done updating anonbib for the last few years. I ought to do a blog post once I (if I) finish. [steph: will make a note to check in with you!] 4) Capture-the-onion contest idea not dead; write-up still on my todo list. Georg: 1) Cloudflare related sessions at Montreal meeting. Which do we want? 2) Our bug bounties and the Zerodium proposal. Do we want some coordination/statement with HackerOne? <- currently not needed 3) Upcoming releases including new Tor versions; the alphas should have sandboxing enabled on all platforms Nick: 1) We've put out a bunch of releases, including security fixes. 0.3.1. took longer to stabilize than we had planned. We're trying some things to try to make 0.3.2 stabilize faster than we had expected. In particular, we're trying to make sure that our alpha releases come out frequently (every 2-3 weeks). We'll try to make sure that they come out in good time for TB alpha releases, but some of them will miss TB alpha releases. 2) Sharing more responsibility on network team. Isis is running our meeting-calendar coordination. Ahf and Isis will try putting out the next alpha release. 3) Where are we with the Boston PT meeting right after the Montreal meeting? Alison: 1) I'll be doing lots of meeting prep from now until we get to Montreal, including getting the schedule completed, organizing the buddy system, and making a plan for the open hacking days. 2) Other stuff: working on LFP/IMLS press release and recruiting, Giant Rabbit meetings, finding people to do sponsor8 testing in various countries, sukhe is in India doing outreach. Karsten: 1) Preparing for in-person team meeting in Berlin next week. 2) Working on a roadmap draft to be discussed next week and shared with the other teams by/before Montreal. Shari: 1) traveling this week and next and trying not to fall behind in email (I'll be in San Francisco next week) 2) working with Giant Rabbit on end-of-year campaign 3) trying to finish text for grant submission 4) working with Alison and Gunner on Montreal meeting logistics 5) scheduling unconscious bias training for 1-1/2 hours on Thursday morning in Montreal Arturo: 1) We have been working on releasing the new version of OONI Probe with custom URI support. This will allow people to embed links on their website to encourage people to run ooniprobe. Do you know of some organisations that run popular websites that would be interested in having a "Run OONI Probe" Widget? 2) Working with Elio on the design of OONI stuff has been great! The OONI design system is moving along very nicely: http://openobservatory.github.io/design/, we now have many more elements specced out and are already using them in new designs. 3) <Bikeshed>We have reached consensus on renaming some of the OONI software to a more consistent scheme (s/ooniprobe/OONI Probe/, s/OONI Measurements/OONI API/)</Bikeshed> Isabela: 1) Working with Brad on organizing the time allocation for teams and start migrating to the new funding model 2) UX team is getting all mocks of the website redesign ready for Montreal session 3) Priority is with Tor Launcher deliverable - I've been late with the progress bar work 4) We got an invitation to submit full proposal for designer position with UX team - working on that with tommy 5) Got sponsor8 tasks organized with network team 6) Not going to GSOC - got hiro in touch with FOSDEM folks - trying to get Nick to go to Chile - will be at Tor Diversity Program meeting in NYC (with freebsd community) - will be at makerfair this weekend might take some stickers to put on EFF table or something. Steph: 1) coordinating Montreal speaker training and pre-work interviews and background info for Lyndon. we’re full at 15 participants. 2) happy about upcoming blog on KIST Tommy drafted with help from Rob, Matt, Nick. publishing next week. want us to have more content like this. published post on Montreal open hack days 3) rate of new followers still climbing on twitter even though other numbers (like mentions) have gone down post DS. ~9,700 new followers in past 28 days 4) Working with GR on fundraising campaign, checking in again later today Brad: 1) Working with Isa to finalize the updated time allocation budgets for each employee 2) Next step will be to send prelim budgets to Vegas team for review/comments 3) Planning to send out new budgets to employees prior to Montreal

1 0

Fwd: LibrePlanet 2018: Let's talk about Freedom. Embedded.
by isabela 21 Sep '17

21 Sep '17

Should we be there? -------- Forwarded Message -------- Subject: LibrePlanet 2018: Let's talk about Freedom. Embedded. Date: Wed, 20 Sep 2017 08:19:03 -0400 From: Georgia Young, FSF <info(a)fsf.org> Reply-To: Georgia Young, FSF <info(a)fsf.org> To: Isabela Bagueros <isabela(a)torproject.org> Free Software Foundation */Read online: https://www.fsf.org/blogs/community/libreplanet-2018-lets-talk-about-freedo… Dear Isabela Bagueros, Here at the Free Software Foundation, we've been planning for LibrePlanet 2018, and guess what? It's the *tenth anniversary* of this free software community conference, and it's happening March 24th-25th, 2018 in the Boston area! The call for sessions <https://my.fsf.org/lp-call-for-sessions> is open now, until November 2nd, 2017. General registration <https://my.fsf.org/civicrm/event/info?reset=1&id=71> and exhibitor and sponsor registration <https://libreplanet.org/2018/sponsors/> are also open. Pre-order a LibrePlanet 10th anniversary t-shirt <https://shop.fsf.org/tshirts-hoodies/libreplanet-2018> when you register to attend! *Do you want to discuss or teach others about a topic relevant to the free software community? You've got until Thursday, November 2nd, 2017 at 10:00 EDT (14:00 UTC) to submit your session proposals <https://my.fsf.org/lp-call-for-sessions>.* LibrePlanet <https://www.libreplanet.org/2018> is an annual conference for free software enthusiasts and everyone who cares about the intersection of technology and social justice. For the past nine years, LibrePlanet has brought together free software developers, policy experts, activists, hackers, students, and people who are at the beginning of their free software journeys. LibrePlanet 2018 will feature programming for all ages and experience levels. If you're new to the community or to the LibrePlanet conference, check out last year's conference site <https://libreplanet.org/2017/> and session videos <https://media.libreplanet.org/u/libreplanet/tag/libreplanet-2017-video/>, including the opening keynote, a look at the 21st century techno-surveillance state by Kade Crockford of the Massachusetts chapter of the ACLU <https://media.libreplanet.org/u/libreplanet/m/when-we-fight-we-win-technolo…>. What kinds of sessions are we looking for? Each year, LibrePlanet offers both technical talks and sessions examining the intersection of free software and activism, culture, and current events. Here are a few examples of talks or sessions you might propose: * An examination of how free software can aid in an aspect of life that is important to you, like education, medicine, social movements, or community organizing * A workshop (for beginners or experienced users) on how to use a free software program or free hardware project * A project sprint, where new and current contributors to a free software project can meet and work together on an aspect of the project * An introduction to free software licensing, copyleft, or a deep dive into a current legal issue * An update on your free software project Check out talk recordings from LibrePlanet 2017 <https://media.libreplanet.org/u/libreplanet/tag/libreplanet-2017-video/> for more ideas. LibrePlanet's 10th anniversary theme is "Freedom. Embedded." Embedded systems are everywhere, in cars, digital watches, traffic lights, and even within our bodies. Proprietary software is everywhere, its sinister aspects woven throughout the devices permeating our lives. We've come to expect that our phones monitor our activity and share that data with big companies, and that governments enforce digital restrictions management (DRM). In a society reliant on embedded systems, how do we defend computer user freedom? How do we insist on copylefted code, protect ourselves against government and corporate surveillance, and move toward a freer world? For many people, digital freedom seems like a pipe dream. We change the narrative and make free software the norm, instead of walled gardens, denial of the right to repair, and DRM. The FSF is committed to increasing participation by people belonging to groups traditionally underrepresented at free software conferences, including women, people of color, and transgender and nonbinary people. If you are comfortable sharing demographic information on the proposal form, please do. Your proposal will not be judged negatively should you choose to omit information about your identity. The LibrePlanet conference also has a safe space policy <https://libreplanet.org/2018/safe-space-policy/>, because we want everyone who attends to feel comfortable, cared for, and able to enjoy the conference without worrying about harassment. The policy applies to all conference sessions, so keep that in mind when you write your proposal. We will hold IRC office hours in the #libreplanet channel on irc.freenode.org so you can ask questions about the call for sessions and get feedback on your proposal before you submit -- we will announce hours and dates for these feedback sessions soon. You may also contact us at campaigns(a)fsf.org <mailto:campaigns@fsf.org> any time between now and the submission deadline if you have questions about your submission. LibrePlanet has thrived for a decade thanks to the interesting ideas and generous spirit found in the free software community. We hope you will want to be part of LibrePlanet 2018. Submit a proposal now! <https://my.fsf.org/lp-call-for-sessions>. Gratis admission for FSF members Members <https://my.fsf.org/join> (and students with valid ID) attend LibrePlanet gratis. FSF Associate Membership starts at just $10/month and comes with many benefits <https://www.fsf.org/associate/benefits>. Need help attending LibrePlanet? The FSF is able to offer a limited amount of funding to bring conference participants to LibrePlanet from all around the world. You can apply for a scholarship <https://my.fsf.org/lp-scholarship-application> through Thursday, November 30th, 2017 at 10:00 EST (15:00 UTC). Scholarship recipients will be notified by early January. If you don't need a scholarship, you can help those with financial need attend LibrePlanet 2018 by making a contribution to the conference's scholarship fund <https://my.fsf.org/civicrm/contribute/transact?reset=1&id=60> now, or when you register for LibrePlanet. Volunteering LibrePlanet is supported by dozens of volunteers, without whom this community event would not happen -- and volunteers attend LibrePlanet gratis. Applications for most LibrePlanet volunteer opportunities will be available soon, but if you would like to help with advance outreach (spreading the word about LibrePlanet in online communities, your networks, and by posting flyers at schools and community spaces), please email campaigns(a)fsf.org <mailto:campaigns@fsf.org>. Free Software Award nominations Each year at LibrePlanet, the FSF presents its annual Free Software Awards. Nominations for the awards <https://www.fsf.org/awards/> are open through Sunday, November 5th, 2017 at 18:59 EST (23:59 UTC). Promotional opportunities LibrePlanet is a good place to spread the word about your organization to the free software community. You can sponsor LibrePlanet or have a table in our exhibit hall (or both!). Our exhibit hall is at the center of the LibrePlanet venue, and sponsors are highly visible at the conference and in our promotional materials. The FSF and LibrePlanet are heavily member-supported, and we appreciate the support of organizations that embrace free software. Apply to exhibit <https://libreplanet.org/2018/sponsors/> at LibrePlanet 2018 or email us at campaigns(a)fsf.org <mailto:campaigns@fsf.org> if you are interested in being a sponsor. Happy hacking, Georgia Young Program Manager Follow us on GNU social <https://status.fsf.org/fsf> | Subscribe to our blogs via RSS <https://fsf.org/blogs/RSS> | Join us as an associate member <https://www.fsf.org/jf> Sent from the Free Software Foundation, 51 Franklin St, Fifth Floor Boston, Massachusetts 02110-1335 UNITED STATES Unsubscribe <https://my.fsf.org/civicrm/mailing/unsubscribe?reset=1&jid=154049&qid=28213…> from this mailing list. Stop all email <https://my.fsf.org/civicrm/mailing/optout?reset=1&jid=154049&qid=28213998&h…> from the Free Software Foundation, including Defective by Design, and the Free Software Supporter newsletter.

2 1