- tor-project - lists.torproject.org

Notes from August 24 2017 Vegas team meeting
by Karsten Loesing 28 Aug '17

28 Aug '17

Notes for August 24 2017 meeting: Isabela: 1) was on vacation - so catching up on all things 2) writing reports for sponsor4 deliverables that are done 3) picking up on Tor Launcher work 4) Met with Tommy to work on a proposal for OTF to pay a part-time UI designer to work with UX team for 6 months 5) wrote a self-feedback performance report to my peers/manager 6) pinged some teams/people to get meetings organized for Montreal Alison: 1) Working on getting agenda ideas for Montreal 2) Made some more updates to the support wiki with Phoul 3) One more day for contributor guidelines proposal drafting, then vote 4) Worked out letter of inquiry template for outreach funding with Tommy 5) Did first fundraising sprint, second one is today Georg: 1) I wanted to raise awareness of https://zerodium.com/program.html which is getting circulated 2) I've been catching up on things after being mostly away from keyboard last week Nick: 1) Back from vacation. Too many things to pay attention to! 2) Expect to merge working next-gen hidden services in the next 7 days. 3) Trying to coordinate timeline for launcher bootstrap-progress backend stuff with catalyst, mcs, isabela, etc. Not sure I have great visibility into the status there. 4) Our triage-and-planning process is still wonky on my team, but I think we're learning Shari: 1) lots of time working with Giant Rabbit to start end-of-year campaign 2) board meeting next week to talk about adding new members 3) talking with DRL to kick off Tor mobile grant 4) gonna send a note around about upcoming vacation (I'm out starting Tuesday of next week) 5) welcoming Tommy to his new home in Seattle; talking with him about grant strategy 6) trying to get Sukhbir as MDF tech fellow; reviewed other applicants while we wait Steph: 1) Fixing some issues with the odp and odt templates. 2) Working on our end of year fundraising campaign, sprints yesterday and today 3) Fielding inquiries, managing social media, blog calendar. New post from OONI going up Monday, will be getting the draft today 4) Talking to 2 possible speaker trainers for a half day training in Montreal. Should be able to make a decision on Tues at next comms meeting 5) Working with UX team on Onion Browser user testing survey Brad: 1) Ongoing work related to the financial statement and compliance audit for calendar year 2016 2) Also beginning work on preparation of Form 990 (annual tax return) Arturo: 1) We have been discussing quite a bit the issue of securing probe orchestration (when we will deploy the run any ooniprobe test version of it). Here: https://github.com/TheTorProject/proteus/issues/24, feedback from crypto/security people is appreciated. 2) Had calls with some researchers how we can better work together and they can help us solve some of the research problems we have. 3) We sent the first OONI push notification telling people to run ooniprobe in Angola to monitor the elections!

1 0

Idea for the Tor open hackdays
by Arturo Filastò 25 Aug '17

25 Aug '17

Hi Tor people, I would like to propose an idea for the Tor open hackdays at the Montreal dev meeting. I think we can improve how people coming to the Open hackdays are guided towards finding some interesting Tor related project to hack on. If I were a new comer, showing up to the open hackday I would probably have a hard time figuring out: a. What are all the various projects that Tor is working on and which ones would be most suited for my interests and skills b. Who are the people that I should be speaking to in order to get guidance on what and how to hack on a thing Given this, what I would like to propose is that we have a very minimal agenda for the first part of day 1 of the Open hack days, where 1 representative from each Tor team (or project) or anybody else interested in pitching their idea, gives a 10 minute max presentation telling people: - What is the project they are working on - What are some of the open problems/things they would like people to hack on - What sort of skills are needed in order to hack on them - Who they should speak to - If there is some sort of semi-planned designated time and location mention that too I would make the whole thing also open for people from the community to pitch their own ideas and recruit people to join them. What do you think? ~ Arturo

6 5

support the torproject with bridges
by Felix 23 Aug '17

23 Aug '17

Hi isis > I don't want to speak for the Tor Browser Team, but I think we'd be > happy to take you up on it. I can add your obfs4 bridges to Tor > Browser's default bridges, or—if you would be excited to write the > patch—I can show you where/what to edit. Please let me know which > you'd prefer. It's may-be better done by the experts - means not me :) > Please don't paste it here on the list, but we'll need the IP(s), > obfs4 ports, fingerprints, and bridgelines for your bridges. > The fingerprint should be in $DATA_DIRECTORY/fingerprint and > the bridgeline should be in $DATA_DIRECTORY/pt_state > /obfs4_bridgeline.txt. All is here. Where shall I ship this stuff ? > Thanks again! It's my pleasure. -- Cheers, Felix

5 8

Cloud Compute Resources for Tor Browser
by Tom Ritter 23 Aug '17

23 Aug '17

As we wrap up the GSOC, I wanted to do a retrospective on the Tor Browser development process for new people. Basically, building Tor Browser is difficult from a setup perspective (we're always working on making it easier, but it's still not trivial) and it's difficult from a resource perspective - it can take a long time to build Tor Browser. You can easy have a day where if you get two compiles in - that's a good day. Couple that with the trial and error process that new people usually have with a software project - and you have a pretty high barrier to entry. The experience with nmago this past summer illustrated how important this is. I estimate he would have been able to accomplish 33% to 50% more than he was able to accomplish if he had both a faster machine and a pre-set-up build environment. What I'd like to do to improve this situation is to provide a development instance on EC2. We can publish an image that anyone can run on their own and do development in. They would have to pay their own money to run the machine, while the host org (Tor or me) would pay a small cost each month to provide the image (I think <$3/month). Furthermore, I'd like Tor Project to _fund_ this development image for future GSOC people and potentially others on a case by case basis. GSOC is finishing, so this isn't an actual request to pay any money now. But I think we should in the future. Right now, the cost to reserve a single machine for an entire year is 2248.28. If we only did on-demand it would be 825.72 for 3 months. There is no reason we couldn't have multiple people using a single machine; aside from if two people compile at the same time they'll be fighting for resources. Depending on how often it is used this may not matter or it may matter a lot. Obviously we don't trust cloud images, but this is for developing patches which will receive code review. There is no real trust here, unless the user does something silly like put their ssh keys on it, which they should not. -tom

7 8

Brave hiring for Tor Integration
by teor 23 Aug '17

23 Aug '17

Hi, Brave Browser is currently hiring a Tor Integration Engineer: https://brave.com/jobs/?gh_jid=781438 (Needs JavaScript. Mentioned by Zack on tor-relays.) People on this list might be interested in applying. We should also work with them to make sure we understand: * their expected load on the network, and how to manage it, and * their branding, and how to manage comparisons with Tor Browser. (I'm sure there are more things we need to think about.) I would imagine it would be similar to other browser integrations that have been considered. Maybe we could develop a FAQ or standard set of questions for these. T -- Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org ------------------------------------------------------------------------

1 0

How to help people on weekends?
by Roger Dingledine 23 Aug '17

23 Aug '17

Hi folks, I've noticed an interesting trend lately. I don't have great answers but I want to raise the topic for us to think about. We used to just all work all the time, and we were burning ourselves out, so many of us have switched to focusing on more traditional "daytime on weekdays" hours. That approach has the big advantage of increased density among core developers: people are more likely to be around then. But while this approach works well for people whose day job is Tor, the casualty is people whose day job *isn't* Tor. These people show up exactly on the weekends and evenings that now have fewer Tor people around to provide quick responses, community momentum, interaction with core developers, and all of the great things that a free software community needs for health and growth. I don't have any quick fixes, but I wanted to raise this issue as a key topic for us to consider as we try to find the right balance between "people can have lives" and "we are responsive to new contributors". We are not being the best that we can be when we have 60-hour gaps on irc, mailing list threads, blog comment follow-ups, etc and those gaps line up exactly with when excited helpful volunteers show up. :) --Roger

6 6

GSoC 2017 Ahmia Status Update #6
by Pushkar Pathak 22 Aug '17

22 Aug '17

Hello everyone, This is the bi-weekly status report for Ahmia - Hidden Service Search. ## Updated documentation and removed expired pages and links The documentation of Ahmia is now fully complete and available at ahmia.fi/documentation/. [1] ## Updates to 'about' page and other minor fixes in ahmia-site [2][3] ## Django 1.11 upgrade for Ahmia Currently Ahmia supports Django1.10. >> Future tasks - I am working on to add support for advanced search features but since final evaluation deadline is on 29 Aug, I have put this on hold to review the changes I already made and prepare a report I will get back to implement Thanks, Pushkar [1]: https://github.com/ahmia/ahmia-site/commit/d3af0b72d9b175c7d3d269119f4dceeb… [2]: https://github.com/ahmia/ahmia-site/commit/6ee614ad617b0f6202e20f139e6dded4… [3]:https://github.com/ahmia/ahmia-site

1 0

Network team meeting notes from 21 August
by Nick Mathewson 22 Aug '17

22 Aug '17

Hello, all! We had a meeting yesterday. Logs at http://meetbot.debian.net/tor-dev/2017/tor-dev.2017-08-21-16.59.html Notes below: ==== Network team meeting, 21 August 2017 (1700 UTC) Announcements and requests: - review-group-22 !!!!!1! - Out this week: mikeperry, isis, ahf, maybe isabela will miss the meeting - Less than one month in 0.3.2.x merge window - Maybe review the Montreal meeting schedule I just did this morning? [dgoulet] teor: - Last week: * Holidays in sunny northern Australia * endosome can do bidirectional circuit crypt and digest, next stop, streams! [asn:https://github.com/teor2345/endosome] - This week: * Catch up on emails * Catch up on PrivCount in Tor * Re-plan PrivCount Experimental for the next few months, as the last release went over time asn Last week: - We got #20657 merged upstream! That's a huge part of prop224!!! - Fixed a few bugs in the client-side branch (#17242) and it's now in needs_review for Nick. See #17242 for more details. - Found a few more #20657 bugs and fixed them in branch `ticket20657_032_05`. Also addressed #23110 as part of it. See last comment of #17242 for more details. - Pushed fix for #23233 -- bug found by haxxpop. - Updated the prop224 upstreaming pad with the latest tickets/branches: https://pad.riseup.net/p/LPVY6AL_prop224_upstreaming This week: - This week will be more prop224 testing, debugging and bug fixing. We know there are a few more bugs on our prop224 codebase that we need to fix and this is a good time to hunt them down. - Address any review points by Nick on #17242 etc. - I will be AFK tomorrow and most of Wednesday. Will be back on Thursday. Nick: Last week: - Away on vacation - Hacked up HTTP CONNECT support #22407 - Tried to say constructive things about censorship, speech, and technology. This week: - Review lots of things. - Another 0.3.1.x release? rc? - Catch up on emails - Write proposals about authority refactoring - Maybe, write a proposal about TLS 1.3 - Try to schedule a privcount-in-tor meeting. (first, get privcount designers + implementors. Then invite everyone else.) - Finish up event and error list for torlauncher improvements (w catalyst) dgoulet: Last week: - Vacation - I found ourselves an Ubuntu packager! :D [progress]: https://bugs.launchpad.net/ubuntu/+source/tor/+bug/1710753 This week: - Catch up on all the things. - Review #17242 - Do some more prop224 testing and bug fixing - Give some love to 031/032 bugs isabela: last week: -vacation this week: - I wont be at the meeting because I am still on vacation but back tomorrow (tues 22) - I have a question to the team regarding mcs/brade wish list for Tor Launcher progres bar: https://pad.riseup.net/p/tor-client-progress / TB team needs to start building the new experience: https://marvelapp.com/3f6102d so we need to know: 1. What the network team can do on this list? and 2. how long it will take? - I also have a question to isis (but I know they won't be online till after the 22nd)re:https://trac.torproject.org/projects/tor/ticket/15967 which is another dependency the TB team has in order to build that experience. (obs: their deadline to build it is EOM November). - Once I am back from vacation I plan on picking up some sponsor4 reports of completed deliverables - Got an answer from Nick re:PT community meeting organized by Internews in Boston. I will ask them what days are more important for us to participate to see how we can do it. catalyst: Last week (2017-W33): - bug triage - HR stuff - digging into bootstrap progress reporting - blog post fallout (#23270) - wrote some hopefully helpful things on membership proposal thread (+1 --dgoulet) This week (2017-W34): - more work on bootstrap/PT progress reporting pastly: - Porting forward cell tracing code dgoulet originally wrote in order to rerun KIST experiments with the KIST we intend to merge - I now want to take up dgoulet on his offer to let me unload KIST review responsibility. I'll always be around for questions, of course. - KIST ticket is #12541

1 0

oniongit update
by Silvia [Hiro] 22 Aug '17

22 Aug '17

Hey everyone, I just wanted to send a quick update regarding oniongit and gitlab in general. So a main issue when teams started testing oniongit was the possibility to automatically sync repos on oniongit w/ repos on torgit. The idea is always that torgit is pulled by oniongit. This way oniongit doesn't write to our git repositories, but we can run code reviews with updated branches. There are mainly two ways how this can be achieved. The first possibility is that torgit push to oniongit whenever master is updated (with a post-receive hook maybe). The other possibility is that a pipeline (gitlab CI feature) is set up on oniongit to pull periodically from torgit and update the master branch. Note that if you wanted the pipeline could also run a set of tests on the branch since this is basically a docker runner that does this on a separated server. I am in the process of documenting how this can be done. In the meantime please let me know if you'd like me to set it up for you. Another update that you might find interesting is the possibility to set up confidential issues (although some have rightly said that they do not feel comfortable having a web up handling confidential bugs). [Please see https://docs.gitlab.com/ce/user/project/issues/confidential_issues.html] An issue that was also raised since the beginning regarding Trac vs Gitlab is the possibility to have components vs keywords vs labels. In gitlab everything is done w/ labels, so keep that in mind if you are thinking to test issues tracking in oniongit. [More on: https://docs.gitlab.com/ce/user/project/labels.html] [More on gitlab flow features here: https://docs.gitlab.com/ce/workflow/README.html] Please let me know if you'd like to have an account on oniongit or if you'd like to report any problems that you have found. Talk soon, -hiro

6 9

GSoC 2017 - Crash Reporter for Tor Browser: Report #6
by Nur-Magomed 21 Aug '17

21 Aug '17

Hi everyone! This is my bi-week status report for GSoC project "Crash Reporter for Tor Browser". # Crash reporter client: - Cleaned repo, code changes are collected to few patches [1]; - Working on reproduible build of Tor browser with crash reporter: I spent much time setting up rbm, finally I've managed to fix problems and started building with enabled crash reporter. # Next steps: - Test crash reporter when server side is up - Add needed crash reporter fields to white list (that will be sending) - Make TB reproducible build with crashreporter * - Consider and make some options proposed in crash reporter wiki [2] * * maybe these tasks I'll tackle after gsoc Kind regards, Nur-Magomed (nmago) [1] https://github.com/nmago/tor-browser/commits/crdevc [2] https://trac.torproject.org/projects/tor/wiki/doc/crashreporter

1 0