- tor-project - lists.torproject.org

Yes, dist.torproject.org is messed up
by Roger Dingledine 29 Sep '17

29 Sep '17

Since you're all about to encounter a user asking you this question: Yes, https://dist.torproject.org/ is messed up. And yes, there are new versions of Tor Browser out today, and they are all trying to update, and they are now all giving their users confusing errors like "The update could not be verified" and "The requested URL /torbrowser/7.0.6/tor-browser-linux64-7.0.6_en-US.tar.xz was not found on this server." The short answer is to sit tight and wait, and everything should sort itself out over the coming 24 hours. Unless you're one of the few people who can help fix it, in which case, please help us make everything sort itself out. :) --Roger

1 1

notes from usdoj panel talk
by Roger Dingledine 29 Sep '17

29 Sep '17

Hi folks, Last week I was on a panel with a bunch of US Department of Justice prosecutors who specialize in child exploitation cases. I wrote notes for all the things I wanted to say, and of course my plan didn't stay intact once the panel discussions began, but here are the notes for posterity. Maybe they will be useful next time I (or you!) find ourselves in this situation. --Roger Three points as general Tor intro: * Tor's history, including funding -- NRL, EFF, State Dept, Darpa, NSF * Two pieces to the "metadata security" that Tor provides: the core Tor component that hides your IP address, and Tor Browser which deals with application-level fingerprints. * Millions of users use Tor every day -- ordinary people, activists, censored people, militaries and law enforcement. That variety is part of what makes it safe to use for all of them. [Story about Dutch cop anonymity system if we want it.] Follow-up question: The core Tor part? Why is Tor different from a standard proxy or VPN? * Distributed trust -- privacy by design, not privacy by promise. * Relays are run by community, 100gbit of traffic on average [Story about anonymizer if we want it] * Transparency for Tor is key: design docs, specs, source code, but also global engagement as real human beings. (It's not a contradiction for privacy people to believe in transparency. Privacy is about choice, and we feel that choosing to be transparent is the best way to establish and grow trust with our communities.) * Ok, so what are hidden services? Most people use Tor to reach websites and other services safely. Onion services (aka hidden services) are special addresses inside Tor that flip that around: people can reach *you* safely. - better security built-in - can be faster since not competing with exit traffic - reduced vulnerability surface area - mobility * We measured what fraction of Tor traffic has to do with onion services: 3%. - Something like 7000 onion service websites up at a given time https://blog.torproject.org/some-statistics-about-onions - Compare to 2.5M-or-more users *each day* (That's not nothing, but it is tiny. If you find somebody trying to scare you with huge numbers and pictures of icebergs, make sure you understand their business model before buying their product or believing their claims.) * Some examples of interesting onion services? [Pause while we get distracted by other panelists] "Securedrop" is a tool for people to communicate securely with journalists -- the New York Times, the Guardian, the Washington Post, Toronto Globe and Mail, the AP, etc all run onion sites. (Compare to the FBI's tipline, where they pay Cloudflare to mitm it.) Ricochet Onionshare * The biggest website that has an onion service? Facebook. In April of last year they posted that 1 million people accessed Facebook over Tor in that month. That's .1% of their user base! * Onion services protect different metadata than https, and it's about giving the users choice. onion services features: - stronger security, built-in: - encryption - authentication, so no dependency on the crappy CA model - authorization, so untrusted people can't even reach the webserver - can be faster since not competing with exit traffic - reduced vulnerability surface area - mobility Surprising (to this audience) users of onion services: Facebook mobile Debian updates IoT operators Activist blogger platform example Govt and law enforcement ------- Child exploitation sites/users are bad for Tor! They're bad for society in general, but they're bad for Tor in particular. We don't want them as users. See also the discussion at the end of https://lists.torproject.org/pipermail/tor-talk/2015-April/037538.html What are onion services "most" used for? It depends how you count: Internet Watch Foundation annual report has hidden services listed as "<1%" of the problem: https://www.iwf.org.uk/report/2015-annual-report Terbium Labs "dark web" report concludes the majority of onion service content is legal: https://terbiumlabs.com/darkwebstudy.html I hear bad people use google drive and dropbox for better bandwidth. But all that said, I don't want to say there is no problem. * What are some ways of screwing up your security while using Tor? Opsec mistakes; metadata fingerprinting; browser exploits; traffic analysis. NSA/GCHQ quote about Tor: King of low-latency anonymity systems UN HR report endorsing Tor. ---- Contradictions for the audience to think about: - If Tor works, you don't hear about it. So it's easy to overlook or undercount the "good" users. - Sometimes investigators have to choose between being able to discover victims vs being able to bust people. - If there is some approach that is able to compromise bad people, the same approach can compromise good people. - Often, the bad guys work harder on their security than the good guys. - If we make Tor stronger, we make it stronger for all. - There are many ways to be bad on the Internet, and fewer ways to be safe. Central to Tor is the topic of power imbalances: those who have power are less in need of Tor's protections than the most vulnerable populations. Matt Blaze's great quote about politicians who ask for crypto backdoors: "You can put a man on the moon, so surely you can put a man on the sun!" ---- Problems with "govt hacking" as a solution to "bad people": - 1) Secrecy: we as society need to have an informed discussion, and if governments won't tell us what they do, how can society make a good decision? - NSA's goals, the existence of other countries makes this even harder. - 2) The Feds lose their zero-days, and that hurts everybody. Cf "Shadow brokers". - 3) When mass surveillance becomes the cheapest and easiest option for fighting any crime... "Well sure, maybe you trust the people in power now... but what if the people in power change?" I bet US govt people are especially sensitive to this argument this year. In many ways this is the same as the Apple encryption discussion, and the "https everywhere" discussion.

2 1

New meetbot plan: #tor-meeting and nowhere else
by Roger Dingledine 28 Sep '17

28 Sep '17

Background on meetbot: it is the irc bot that we use to help coordinate our various Tor team irc meetings, and record results for posterity and transparency. See e.g. http://meetbot.debian.net/tor-dev/2017/ http://meetbot.debian.net/tor-project/2017/ So far we've had an ad hoc schedule and location for irc meetings, spread around both #tor-project and #tor-dev. After an incident with our meetbot where we accidentally left it logging #tor-dev all weekend, we've decided to take a more defensive approach: we will hold the meetbot-mediated sessions in a new channel, called #tor-meeting. So, if you want to use meetbot -- and feel free to do so -- you should move your meeting to #tor-meeting. It might be wise to tell the folks at the previous location that you're doing it elsewhere, so people can join and watch / participate if they want. One downside could be that the meetings won't have as many random bystanders watching them, so maybe fewer people will get pulled in. But we can resolve that, maybe even more successfully, with better report-backs. I think the upside of making it clearer whether there is something logging, and publishing the logs to the internet, is worth trying this new approach. --Roger

1 0

Network team meeting notes, 25 Sep
by Nick Mathewson 26 Sep '17

26 Sep '17

Hi! Our meeting notes for yesterday are below. We had a problem with meetbot, and don't have logs for this week; with luck we'll have that straightened out by next week. Network team meeting, 25 September 2017 Last week's notes: how did we do? https://lists.torproject.org/pipermail/tor-project/2017-September/001447.ht… After this meeting, please: * Check everything assigned to you in 0.3.1 and 0.3.2. Should it be? Should it be deferred? * Check new and needs-info stuff in 0.3.1 and 0.3.2. Anything there that you should/could be handling? * Mark essential 0.3.2.2-alpha stuff with "0.3.2.2-alpha-must". teor: * Last week (or two): * Fixed a nasty bug in Experimental PrivCount that ignored most connection events * Added intro and rend failure reasons to Experimental PrivCount * Fixed a bug in Tor's HS stats noise, but we're missing a function (#23414) * anyone want to write a working round_int64_to_next_multiple_of? * Found a bunch of little bugs in Tor connections and HS v3, fixed some of them * Fixed some tor-spec bugs, reviewed others * Did some thinking about the longclaw move (we'll be fine) #23592 * Fell down the single onion service v3 IPv6 hole, trying to dig out again #23493 * This week: * Count the number of simultaneous connections per IP in Experimental PrivCount * Complete the HSDir events for Experimental PrivCount * Get ready to travel to the dev meeting * I'll be on leave next week, until the hackfest / dev meeting Nick: * Last week: - 5 releases on monday - Worked on a bunch of spec-related fixes. - Removed many tickets from 032 -- look for "032-deferred" or "032-unreached" items in Unspecified - Reviewed and merged a whole bunch of fixes - Tried to help diagnose a bunch of bugs and continue to triage things. - Worked on small/persistent/annoying bugs - Integrated scan-build to run nightly as part of my tor-auto stuff. - Automated lintchanges as part of "make check" * This week: - Sleep more - Help ahf and isis with release, targetting early next week (Monday?) - Continue fixing bugs - Write more proposals for 033 and beyond - Encourage people to defer, fix, fix, defer, etc. - Time permitting, look forward to sponsor8 stuff. - Montreal prep Mike: - Still sick and feverish.. Seeing doctor today... [asn: sounds like a lovecraft diary! get well soon!!!] dgoulet: * Last week: - Bug hunting on KIST and HSv3. Analyzing logs and trying to figure out what happened. - Addressing tickets in 032 related to scheduler and hidden service. - Review tickets in the 032 milestone - Some ticket triage happened as well. * This week: - Pretty much the same as above, I plan to continue addressing 032 tickets especially the hidden service v3 ones. - Work out with teor and asn the single onion service v3 IPv6 fix (#23493) komlo (offline): - Final round of review for protover-rust from isis- if all goes well, I will be submitting a patch early next week. - Preparing for the Rust hackfest in Montreal- will update the schedule based on asn's feedback this week. pastly: * last week: - help dgoulet fix KIST bugs * this week: - keep fixing KIST bugs as they appear catalyst: Last week (2017-W38): - Opened some tickets about streamlining release engineering - Fixed some clock skew reporting issues - Wrote some commentary about bootstrap progress reporting details in #22266 - Found #23623 (get_voting_schedule getting called 10k times in 1 second) - Lots of troubleshooting about possible bridge bypass (#20532) - Reviewed a bunch of things This week (2017-W39): - Montreal travel prep - More analysis of #20532 - More work on improving bootstrap progress and error reporting ahf: Last week: Sponsor 4: - Reviewed: #23568. Sponsor 8: - Had some problems with Android Oreo and some of the debugging scripts I used. - Refactored some of the Doze handling in Orbot and added some logging for myself to be able to debug some timing more easily on host. Misc: - Got through the Rust book and started toying around with a small program. - The test hub ircd for ng onion got a small makeover after we reached some limits. - Wrote a description of a chanserv feature we might like to see for OFTC. This week: Sponsor 4: - Fix #23551. Sponsor 8: - Finish some loose ends: help with the survey where I can + get content on the "bandwidth test" HS. - Start upstreaming some of the code for tor that I'm using to debug things with. Misc: - Prepare to roll a release for next week (with Isis + Nick) - should we talk about this during the week? - Go over the interview with BestVPN Q/A with Steph. - Look at tickets for 0.3.1 and 0.3.2 in trac that needs to be closed/pushed forward. - More Rust. asn Last week: - prop224 is currently in a controllable state. Most code has been merged, and all open tickets are non-critical things (don't impact security or reachability in a major way). We are now entering a deeper testing and bugfixing stage. - Made a wiki page for prop224: https://trac.torproject.org/projects/tor/wiki/doc/NextGenOnions and established a small testing hub on a friendly IRC network. We currently have about 15 testers but we need more! Check out: https://trac.torproject.org/projects/tor/wiki/doc/NextGenOnions#Howtoconnec… - More testing, bugfixing and test writing for prop224. Worked on #23621, #23603, #23159, #23641. Also see https://lists.torproject.org/pipermail/tor-dev/2017-September/012451.html - More debugging for some elusive discnnects on prop224 clients/services: #23543 Are we seeing too many client disconnects with prop224 or is it normal relay on a 6 hop circuit? We see lots and lots truncate cells with normal reasons (channel closed, or ended). - Managed a few hackerone bugs. - Triaged a few prop224 tickets that were on 0.3.2. - Did some preparation for the PhD. This week: - Need to figure out what to do with the open IPv6 + prop224 bugs (i.e. #23493). Delay until Montreal for discussion, or handle the first part now? - More testing and dogfooding of prop224. We should have a Tor Browser with 0.3.2.1-alpha soon so more testing will happen :) - Work on the various open prop224 tickets: #23621, #23603, etc. - Prepare for Montreal meeting. - Do reviews as needed. isis: last week: - finished farfetchd CAPTCHA server #15967 - ristretto standardisation meeting (also for vxeddsa and ristretto-based sigs) - took a day off to do political organisation work - started the moat backend #22871 - scheduling meeting sessions for montréal - this week: - ask for a server to deploy farfetchd? not sure if it should be a separate VM but it could be - more scheduling for meeting session - releasing 0.3.2.2-alpha isabela Last week: - finished time allocation update with brad (will check with nick on sending the relevant changes to network team) - started coordinating with Alison on contacts for tests/measurements we need to do for sponsor8 - send invoices reports related to sponsor8 - missed meeting cuz I was on bus (traveling) This week: - finishing survey for apps developers (sponsor8) - finish text for download measurement test - finish obtain contacts for download tests - finish error paths and msgs for progress bar (i know catalyst is looking for this) - wondering how moat api is doing (question for isis) - trying to figure out who can call in for PT community meeting organized by internews

1 0

Notes from September 21 2017 Vegas team meeting
by Karsten Loesing 22 Sep '17

22 Sep '17

Notes for September 21 2017 meeting: Roger: 1) The CCC call for proposals is out. We should build a great plan and do it. Deadline Oct 15. 2) The RightsCon call for proposals is out too. Could we do a cool coalition session? 3) Steph: I'm 80% of the way done updating anonbib for the last few years. I ought to do a blog post once I (if I) finish. [steph: will make a note to check in with you!] 4) Capture-the-onion contest idea not dead; write-up still on my todo list. Georg: 1) Cloudflare related sessions at Montreal meeting. Which do we want? 2) Our bug bounties and the Zerodium proposal. Do we want some coordination/statement with HackerOne? <- currently not needed 3) Upcoming releases including new Tor versions; the alphas should have sandboxing enabled on all platforms Nick: 1) We've put out a bunch of releases, including security fixes. 0.3.1. took longer to stabilize than we had planned. We're trying some things to try to make 0.3.2 stabilize faster than we had expected. In particular, we're trying to make sure that our alpha releases come out frequently (every 2-3 weeks). We'll try to make sure that they come out in good time for TB alpha releases, but some of them will miss TB alpha releases. 2) Sharing more responsibility on network team. Isis is running our meeting-calendar coordination. Ahf and Isis will try putting out the next alpha release. 3) Where are we with the Boston PT meeting right after the Montreal meeting? Alison: 1) I'll be doing lots of meeting prep from now until we get to Montreal, including getting the schedule completed, organizing the buddy system, and making a plan for the open hacking days. 2) Other stuff: working on LFP/IMLS press release and recruiting, Giant Rabbit meetings, finding people to do sponsor8 testing in various countries, sukhe is in India doing outreach. Karsten: 1) Preparing for in-person team meeting in Berlin next week. 2) Working on a roadmap draft to be discussed next week and shared with the other teams by/before Montreal. Shari: 1) traveling this week and next and trying not to fall behind in email (I'll be in San Francisco next week) 2) working with Giant Rabbit on end-of-year campaign 3) trying to finish text for grant submission 4) working with Alison and Gunner on Montreal meeting logistics 5) scheduling unconscious bias training for 1-1/2 hours on Thursday morning in Montreal Arturo: 1) We have been working on releasing the new version of OONI Probe with custom URI support. This will allow people to embed links on their website to encourage people to run ooniprobe. Do you know of some organisations that run popular websites that would be interested in having a "Run OONI Probe" Widget? 2) Working with Elio on the design of OONI stuff has been great! The OONI design system is moving along very nicely: http://openobservatory.github.io/design/, we now have many more elements specced out and are already using them in new designs. 3) <Bikeshed>We have reached consensus on renaming some of the OONI software to a more consistent scheme (s/ooniprobe/OONI Probe/, s/OONI Measurements/OONI API/)</Bikeshed> Isabela: 1) Working with Brad on organizing the time allocation for teams and start migrating to the new funding model 2) UX team is getting all mocks of the website redesign ready for Montreal session 3) Priority is with Tor Launcher deliverable - I've been late with the progress bar work 4) We got an invitation to submit full proposal for designer position with UX team - working on that with tommy 5) Got sponsor8 tasks organized with network team 6) Not going to GSOC - got hiro in touch with FOSDEM folks - trying to get Nick to go to Chile - will be at Tor Diversity Program meeting in NYC (with freebsd community) - will be at makerfair this weekend might take some stickers to put on EFF table or something. Steph: 1) coordinating Montreal speaker training and pre-work interviews and background info for Lyndon. we’re full at 15 participants. 2) happy about upcoming blog on KIST Tommy drafted with help from Rob, Matt, Nick. publishing next week. want us to have more content like this. published post on Montreal open hack days 3) rate of new followers still climbing on twitter even though other numbers (like mentions) have gone down post DS. ~9,700 new followers in past 28 days 4) Working with GR on fundraising campaign, checking in again later today Brad: 1) Working with Isa to finalize the updated time allocation budgets for each employee 2) Next step will be to send prelim budgets to Vegas team for review/comments 3) Planning to send out new budgets to employees prior to Montreal

1 0

Fwd: LibrePlanet 2018: Let's talk about Freedom. Embedded.
by isabela 21 Sep '17

21 Sep '17

Should we be there? -------- Forwarded Message -------- Subject: LibrePlanet 2018: Let's talk about Freedom. Embedded. Date: Wed, 20 Sep 2017 08:19:03 -0400 From: Georgia Young, FSF <info(a)fsf.org> Reply-To: Georgia Young, FSF <info(a)fsf.org> To: Isabela Bagueros <isabela(a)torproject.org> Free Software Foundation */Read online: https://www.fsf.org/blogs/community/libreplanet-2018-lets-talk-about-freedo… Dear Isabela Bagueros, Here at the Free Software Foundation, we've been planning for LibrePlanet 2018, and guess what? It's the *tenth anniversary* of this free software community conference, and it's happening March 24th-25th, 2018 in the Boston area! The call for sessions <https://my.fsf.org/lp-call-for-sessions> is open now, until November 2nd, 2017. General registration <https://my.fsf.org/civicrm/event/info?reset=1&id=71> and exhibitor and sponsor registration <https://libreplanet.org/2018/sponsors/> are also open. Pre-order a LibrePlanet 10th anniversary t-shirt <https://shop.fsf.org/tshirts-hoodies/libreplanet-2018> when you register to attend! *Do you want to discuss or teach others about a topic relevant to the free software community? You've got until Thursday, November 2nd, 2017 at 10:00 EDT (14:00 UTC) to submit your session proposals <https://my.fsf.org/lp-call-for-sessions>.* LibrePlanet <https://www.libreplanet.org/2018> is an annual conference for free software enthusiasts and everyone who cares about the intersection of technology and social justice. For the past nine years, LibrePlanet has brought together free software developers, policy experts, activists, hackers, students, and people who are at the beginning of their free software journeys. LibrePlanet 2018 will feature programming for all ages and experience levels. If you're new to the community or to the LibrePlanet conference, check out last year's conference site <https://libreplanet.org/2017/> and session videos <https://media.libreplanet.org/u/libreplanet/tag/libreplanet-2017-video/>, including the opening keynote, a look at the 21st century techno-surveillance state by Kade Crockford of the Massachusetts chapter of the ACLU <https://media.libreplanet.org/u/libreplanet/m/when-we-fight-we-win-technolo…>. What kinds of sessions are we looking for? Each year, LibrePlanet offers both technical talks and sessions examining the intersection of free software and activism, culture, and current events. Here are a few examples of talks or sessions you might propose: * An examination of how free software can aid in an aspect of life that is important to you, like education, medicine, social movements, or community organizing * A workshop (for beginners or experienced users) on how to use a free software program or free hardware project * A project sprint, where new and current contributors to a free software project can meet and work together on an aspect of the project * An introduction to free software licensing, copyleft, or a deep dive into a current legal issue * An update on your free software project Check out talk recordings from LibrePlanet 2017 <https://media.libreplanet.org/u/libreplanet/tag/libreplanet-2017-video/> for more ideas. LibrePlanet's 10th anniversary theme is "Freedom. Embedded." Embedded systems are everywhere, in cars, digital watches, traffic lights, and even within our bodies. Proprietary software is everywhere, its sinister aspects woven throughout the devices permeating our lives. We've come to expect that our phones monitor our activity and share that data with big companies, and that governments enforce digital restrictions management (DRM). In a society reliant on embedded systems, how do we defend computer user freedom? How do we insist on copylefted code, protect ourselves against government and corporate surveillance, and move toward a freer world? For many people, digital freedom seems like a pipe dream. We change the narrative and make free software the norm, instead of walled gardens, denial of the right to repair, and DRM. The FSF is committed to increasing participation by people belonging to groups traditionally underrepresented at free software conferences, including women, people of color, and transgender and nonbinary people. If you are comfortable sharing demographic information on the proposal form, please do. Your proposal will not be judged negatively should you choose to omit information about your identity. The LibrePlanet conference also has a safe space policy <https://libreplanet.org/2018/safe-space-policy/>, because we want everyone who attends to feel comfortable, cared for, and able to enjoy the conference without worrying about harassment. The policy applies to all conference sessions, so keep that in mind when you write your proposal. We will hold IRC office hours in the #libreplanet channel on irc.freenode.org so you can ask questions about the call for sessions and get feedback on your proposal before you submit -- we will announce hours and dates for these feedback sessions soon. You may also contact us at campaigns(a)fsf.org <mailto:campaigns@fsf.org> any time between now and the submission deadline if you have questions about your submission. LibrePlanet has thrived for a decade thanks to the interesting ideas and generous spirit found in the free software community. We hope you will want to be part of LibrePlanet 2018. Submit a proposal now! <https://my.fsf.org/lp-call-for-sessions>. Gratis admission for FSF members Members <https://my.fsf.org/join> (and students with valid ID) attend LibrePlanet gratis. FSF Associate Membership starts at just $10/month and comes with many benefits <https://www.fsf.org/associate/benefits>. Need help attending LibrePlanet? The FSF is able to offer a limited amount of funding to bring conference participants to LibrePlanet from all around the world. You can apply for a scholarship <https://my.fsf.org/lp-scholarship-application> through Thursday, November 30th, 2017 at 10:00 EST (15:00 UTC). Scholarship recipients will be notified by early January. If you don't need a scholarship, you can help those with financial need attend LibrePlanet 2018 by making a contribution to the conference's scholarship fund <https://my.fsf.org/civicrm/contribute/transact?reset=1&id=60> now, or when you register for LibrePlanet. Volunteering LibrePlanet is supported by dozens of volunteers, without whom this community event would not happen -- and volunteers attend LibrePlanet gratis. Applications for most LibrePlanet volunteer opportunities will be available soon, but if you would like to help with advance outreach (spreading the word about LibrePlanet in online communities, your networks, and by posting flyers at schools and community spaces), please email campaigns(a)fsf.org <mailto:campaigns@fsf.org>. Free Software Award nominations Each year at LibrePlanet, the FSF presents its annual Free Software Awards. Nominations for the awards <https://www.fsf.org/awards/> are open through Sunday, November 5th, 2017 at 18:59 EST (23:59 UTC). Promotional opportunities LibrePlanet is a good place to spread the word about your organization to the free software community. You can sponsor LibrePlanet or have a table in our exhibit hall (or both!). Our exhibit hall is at the center of the LibrePlanet venue, and sponsors are highly visible at the conference and in our promotional materials. The FSF and LibrePlanet are heavily member-supported, and we appreciate the support of organizations that embrace free software. Apply to exhibit <https://libreplanet.org/2018/sponsors/> at LibrePlanet 2018 or email us at campaigns(a)fsf.org <mailto:campaigns@fsf.org> if you are interested in being a sponsor. Happy hacking, Georgia Young Program Manager Follow us on GNU social <https://status.fsf.org/fsf> | Subscribe to our blogs via RSS <https://fsf.org/blogs/RSS> | Join us as an associate member <https://www.fsf.org/jf> Sent from the Free Software Foundation, 51 Franklin St, Fifth Floor Boston, Massachusetts 02110-1335 UNITED STATES Unsubscribe <https://my.fsf.org/civicrm/mailing/unsubscribe?reset=1&jid=154049&qid=28213…> from this mailing list. Stop all email <https://my.fsf.org/civicrm/mailing/optout?reset=1&jid=154049&qid=28213998&h…> from the Free Software Foundation, including Defective by Design, and the Free Software Supporter newsletter.

2 1

Tails report for August 2017
by sajolida 21 Sep '17

21 Sep '17

https://tails.boum.org/news/report_2017_08/

1 0

For technical users: Please help us test next-gen onions!
by George Kadianakis 21 Sep '17

21 Sep '17

Hello people, this is an email for technical people who want to help us test next-gen onion services. The current status of next-gen onion services (aka prop224) is that they have been fully merged into upstream tor and have also been released as part of tor-0.3.2.1-alpha: https://blog.torproject.org/tor-0321-alpha-released-support-next-gen-onion-… Unfortunately, there is still no tor browser with tor-0.3.2.1-alpha so these instructions are for technical users who have no trouble building tor on their own. We are still in a alpha testing phase and when we get more confident about the code we plan to release a blog post (probs during October). Until then we hope that people can help us test them. To do so, we have setup a *testing hub* in a prop224 IRC server that you can and should join (ideally using a VPS so that you stick around). Here are some basic instructions: 1) First of all, clone tor from git: $ git clone https://gitweb.torproject.org/tor.git and then build it: $ ./autogen.sh && ./configure && make 2) Setup a basic torrc for your tor client: ==== SocksPort 9008 RunAsDaemon 0 SafeLogging 0 DataDirectory /home/user/tmp/tor Log notice stdout Log notice file /home/user/tmp/hsclient/tor.log Log info file /home/user/tmp/hsclient/torinfo.log === and start up tor using the above torrc. Or setup your own torrc, you might find your own bugs that way ;) 3) Setup your torsocks so that it connects to SocksPort 9008. I do that by editing /etc/tor/torsocks.conf and setting `TorPort 9008`, but YMMV based on your distro, etc. 4) Now setup a socat tunnel to the prop224 ircd: socat TCP4-LISTEN:4250,bind=localhost,fork,reuseaddr SOCKS4A:localhost:gff4ixq3takworeuhkubzz4xh2ulytoct4xrpazkiykhupalqlo53ryd.onion:6697,socksport=9250 Check out the onion address! It's heavy! 5) Now start up your irc client and point it ot the tunnel. I use irssi, so you can do: /server -ssl localhost 4250 /join #prop224 6) Now detach your screen and lurk in that channel. Also monitor your log files to see if any warnings or bugs appeared. If we see your client misbehaving we might ask you to give us some logs etc. If any other tests are required we will notify you through the IRC testing hub. Cheers and thanks for testing :) See you on the other side of the moon!

2 3

Network team meeting notes, 2017 October 18
by Nick Mathewson 18 Sep '17

18 Sep '17

Hi! We had a meeting. Our logs are at http://meetbot.debian.net/tor-dev/2017/tor-dev.2017-09-18-16.59.html And I'll copy our meeting pad here, for reference: Network team meeting, 18 September 2017 Last week's notes: how did we do? https://lists.torproject.org/pipermail/tor-project/2017-September/001439.ht… Nick: * Last week: * Reviewed and merged and triaged, to try to get ready for 0.3.2 * Got clang scan-build working on master again; found several bugs. * Worked on numerous spec-fixes and other-fixes for master * Discussed privcount at meeting; tried to find next steps. * This week: * New releases for Tor >= 0.2.8 * First stable release for 0.3.1 (0.3.1.7) * First release for Tor 0.3.2.x * Triage most things out of 0.3.2.x * Finish spec and documentation patches in 0.3.2.x * Confer with others on sponsor8 stuff, try to start getting more useful there. * Write proposals about: authority splitting, TLS 1.3, ... * Take another look at proposed PTv2 spec draft * Make scan-build part of our regular process. * Program, if I am lucky :) * What happened with 0.3.1? * Time to make 0.3.2 stable. * Merge window closed until after the dev meeting. Hack, and review -- but it'll sit. Consider bug-hunting? * 3 weeks remaining until we start doing montreal stuff. Who should be planner? Not me! [isis volunteers] asn Last week: - Got lots of prop224 fixes and improvements merged upstream: #23457, #23455, #23019, #23466, #23310, #23387 - Did more testing and debugging of prop224 (see #23543). - Wrote spec fixes for prop224 (#23130) - Reviewed #22805 and #23355. - Opened a UX ticket for torbrowser + prop224 (#23545) This week: - Test and fix more prop224 bugs. - Do reviews as required. - Triage 0.3.2 prop224 tickets - Start dogfooding prop224 even more (get some tpo stuff to run on hsv3, and maybe get a tor browser going) dgoulet: * Last week: - Multiple fixes for prop224 got in upstream for the 032 alpha. - KIST was merged upstream (#12541) last friday \o/ - Some tickets reviewed for review-group-23. * This week: - See how prop224 and KIST works out in their first alpha. - Many bugs are opened for 032 on prop224 and KIST so will try to address those as much as possible. - Review tickets for 032 milestone. pastly: last week: KIST merged \o/ this week: help with KIST tickets; boring not-Tor stuff Mike: Last week: - Worked on #23100 and #23114. These need to be done + merged for prop247 [asn: anything I can do here?] This week: - Finish up #23100 and #23114 for merge. - Work on #23101, which also needs to be done for good prop247 results. ahf: Last week: Sponsor 8: - Sponsor 8 meeting with Nick+Isa+Taylor. - Setup a HS to use for survey. Awaiting text for the site from Isa. - Upgraded to Android 8 "Oreo" on a device to see how the aggressive handling of background processes works. - Use a tor process with Orbot where I limit the amount of timed events that is triggered. Misc: - Started reading the Rust book and read some Rust code. Plan is to do a small control port library like the Python ones we have. - Upgrading the Prop224 IRC setup when there is need for it. This week: Sponsor 8: - Turn the tasks from the S8 meeting into tickets + go over the already created S8 tickets and mark them with the correct keywords. - See if I can get the event timing code to work nicely with the Doze functionality on Android(!) Misc: - Get back to the BestVPN interview that Steph set up about Tor. - Look into coverity issues from Friday and Saturday last week. (Already done by Nick apparantly!) - Coverity + Bug triage duties this week. - Talk to OFTC about some nice-to-have features. catalyst: Last week (2017-W37): - Lots of client clock skew research. It turns out to cause some pretty awful UX, including long hangs with no feedback to the user. - Fixed a couple of clock skew related bugs (#23506, #23532) for clients with clocks in the past. - Investigated client clock skew bugs for clients with clocks in the future. Turns out to be harder to correct (directory download schedules and behavior; whether to contact an authority or not, etc.). - Reviewed some patches. - sponsor8 meeting This week (2017-W38): - More investigation of clock skew bugs where the client clock is in the future. Somehow have to distinguish "we were asleep and have stale cached directory info" vs "we are in the future". isis: last week: - working on #15967 (the captcha server, farfetchd), it's done but i want a few more unittests to be sure that i'm matching the behaviours i told the Tor Launcher team it would have in the spec this week: - deployed farfetched - writing the moat server on top of it (this should be super easy because like 80% of the API is just passing back and forth the responses to/from farfetchd, but with the added step that, at the end, if the captcha was right, they get bridges) - checking in on the intern and reviewing his code [asn: we got intern? who is it?]

1 0

Re: [tor-project] Who needs a 34c3 ticket?
by dawuud 17 Sep '17

17 Sep '17

Hi. Nevermind, I no longer need a voucher code. I have a ticket now. On Sun, Sep 17, 2017 at 12:10:53AM +0000, dawuud wrote: > > Hi. I just now realized that I want to attend congress this year. > Is the 34c3 ticket token train still running? > > > Cheers, > David > > On Wed, Sep 13, 2017 at 02:37:54PM -0400, Griffin wrote: > > On 2017-09-12 14:48, Roger Dingledine wrote: > > > On Fri, Sep 01, 2017 at 12:33:27AM -0400, Roger Dingledine wrote: > > > > So, if you are coming and you need a way to buy a ticket, and you are > > > > a contributor to the Tor world in some useful way, please let us know! > > > > We'd love to help more people from the Tor community to be there and > > > > help spread the word about Tor, and 'now' is a much better time than > > > > 'later' to help you get a ticket. > > > > > > Reminder that we have vouchers that you could use. Let us know! > > > > > > --Roger > > > > If there's a spare voucher, I'd love to have it =) > > > > ~Griffin > > _______________________________________________ > > tor-project mailing list > > tor-project(a)lists.torproject.org > > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-project

1 0