tor-project

tor-project@lists.torproject.org

16 participants
2324 discussions

Help curate December blog comments during donations drive
by Roger Dingledine 04 Dec '16

04 Dec '16

Hi everybody, If you haven't noticed our 30-posts-in-30-days December blog donation drive extravaganza, check out https://blog.torproject.org/category/tags/heart-internet-freedom All these blog posts are generating a lot of attention, including many more users interacting with us via the blog comments. That's great! But we need your help keeping up -- making sure the questions there have useful answers, and the comments there have thoughtful responses. There are three especially useful ways you (yes you, please please please) can help: A) Look through each of the recent blog posts periodically, and find things that you can answer or things that you can be helpful on. Don't be shy! The more variety of Tor people we have the smoother everything will go. B) Notice useful comments/questions that need particular expertise, and bring them to the attention of the team that can answer them. A great example is https://blog.torproject.org/blog/tor-02810-released#comment-223817 where it looks like maybe Tor Browser is using an OpenSSL version that is about to go unsupported, and if so we should open a ticket about that. Maybe each team should designate a point person for questions related to their topic? Blog comments move more in reddit-time or twitter-time, so batching the answers once a week won't be as good as we can be. C) Go through and approve non-spam comments so they go live on the blog (and delete the spam ones). Our current blog system is old and klunky, and we've opted not to tie in third-party spy sites for distinguishing spam, but the tradeoff is that we handle comment approval manually for now. The glorious future will bring us a newer Drupal with more ways to streamline comments, but we're not there quite yet. If you don't have a blog account, and you need one, let me know and I'll hook you up. Special thanks to everybody who has been helping out so far! --Roger

2 1

Some emails asking for donations had a wrong link
by Sebastian Hahn 03 Dec '16

03 Dec '16

Hey, unfortunately there was a small issue with sending out some of our donation drive emails. If you or someone you know is confused about an email with a link that asks for username/login information, please disregard that mail and wait for a second one that should have the corrected link. If you don't get a second mail, please get in touch! Thanks and sorry for the trouble Sebastian

1 0

(FWD) TODAY: 7:30pm 5-134: Reproducible Builds
by Roger Dingledine 30 Nov '16

30 Nov '16

A shout-out to Tor, from a totally different world. I've added the phrase 'reproducible builds' to our 'projects that are succeeding at their goals because of Tor' riseup pad. :) --Roger ----- Forwarded message from Lenny Foner <foner(a)media.mit.edu> ----- Date: Wed, 30 Nov 2016 10:55:26 -0500 From: Lenny Foner <foner(a)media.mit.edu> To: cluedump-announce(a)mit.edu Subject: TODAY: 7:30pm 5-134: Reproducible Builds Please join us today, at 7:30pm in 5-134, for a Cluedump by Valerie Young on Reproducible Builds: We trust FOSS software because we can read the source code. Or, at least, we trust FOSS software because we trust the community who reads and writes the source code. But users do not download source code and compile programs themselves; they download binaries. Binaries can be exploited in many ways, from a compromised developer to a compromised compiler, and without reproducible builds, we are not capable of independently verifying that a given binary came from the publicly available source code. "'Reproducible builds?'" you might ask in confusion, "Are you implying the compilation of software is not deterministic?" Turns out, yes! "Reproducible Builds" is the umbrella term for the wide FOSS effort to make the build chain of all software deterministic and transparent. In this talk, I will give a brief history of the reproducible builds effort from Tor's original success to the ongoing work of the Debian community to create an entirely reproducible operating system. You will leave with a clear understanding of the nuances and challenges of achieving reproducible builds and a clear vision for the exciting future where reproducible builds are the norm. Bio: Valerie Young is a Debian contributor and secretary for the board of directors of Software in the Public Interest. She studied physics and computer science at Boston University, worked at athenahealth for a few years, and is presently on vacation between paying jobs to chill and write free software. Snacks will be served! For more information, or if you'd like to give a Cluedump, please contact us at cluedumps(a)mit.edu. Anyone can give a Cluedump: undergraduates, graduate students, researchers, faculty, alumni, or those from outside MIT. To see prior Cluedumps, some of which have supplementary information, see http://cluedumps.mit.edu/. Add Cluedumps to your calendar at https://sipb.mit.edu/calendar/. (bcc'd to dorm lists; NaN for bc-talk) --------------------------------------------------------------------------- SIPB Cluedumps are one-to-two hour informal technical talks about any topic of interest to the MIT computer community. To receive future SIPB Cluedump announcements, be sure to subscribe to the cluedump-announce mailing list. What is SIPB? More so than a traditional computer club, SIPB is a student group with deep roots in the culture and implementation of computer technology at MIT. SIPB is a community---a group of computer enthusiasts working together to learn and create. As a group, SIPB develops and maintains many technologies in official use at MIT, such as the operating system you use at Athena clusters. But, more than anything, SIPB is an opportunity for people of any major or background to come together, learn new skills, and make ideas come to life. Come learn more, get involved with one of many projects, or create your own! http://sipb.mit.edu/ ----- End forwarded message -----

1 0

identifying fellow travelers
by Shari Steele 30 Nov '16

30 Nov '16

Hey all. As part of our end-of-year campaign, we’re going to highlight some projects that rely on or build on Tor, emphasizing how Tor is at the heart of Internet freedom while at the same time highlighting some of the cool things others are working on. I’d like to highlight one project per day for the month of December. I’ve started to collect some projects on this pad: https://pad.riseup.net/p/q0iJkHTMLBkF But I know I’m missing some—probably some good ones. So my apologies in advance if I missed something important that you’re working on—please know that it’s my ignorance and nothing personal. I’d appreciate it if people here could fill in the missing projects. Also, is one of your projects highlighted here? I would be delighted if you’d be willing to share a couple of paragraphs on why Tor is important to your project, along with a link to whatever page you’d like us to send people to when they read the blog post. If you can’t supply anything, I’ll come up with something, but I bet it would be better if you wrote it yourself! Thanks in advance for your help with this! Shari

7 6

Belated thanks to George and David
by Allen Gunn 30 Nov '16

30 Nov '16

Hello all, With both general gratitude and a spirit of shouting out folks who do great ambassador work for Tor, I wanted to thank George R and David F for contributing so much about two weeks back at our Nonprofit Software Development Summit. George explained Tor architecture to a bunch of participants who say they are now inspired to run relays and set up onion sites, and also had a number of how-to side conversations. David explained pluggable transports and a number of other Tor features during our demo fest and contributed richly to other sessions. We are grateful to have this type of super-valuable sharing take place at the Dev Summit, and I just wanted to state that publicly. Thanks you two, you both rock. peace, gunner -- Allen Gunn Executive Director, Aspiration +1.415.216.7252 www.aspirationtech.org Aspiration: "Better Tools for a Better World" Read our Manifesto: http://aspirationtech.org/publications/manifesto Follow us: Facebook: www.facebook.com/aspirationtech Twitter: www.twitter.com/aspirationtech --

1 0

Turning on timing obfuscation (iat-mode=1) for some default bridges
by David Fifield 30 Nov '16

30 Nov '16

I propose that we turn on the obfs4's optional packet size and timing obfuscation on some of the default Tor Browser bridges. The packet size and timing obfuscation can be off (iat-mode=0) or on (iat-mode=1). Currently, all of the default bridges, and probably ≈100% of BridgeDB bridges, have it turned off (iat-mode=0). As far as I know, iat-mode=1 has never really been tried in practice. The reason I propose trying it is the current blocking situation in Kazakhstan. According to reports, obfs4 (along with meek and vanilla Tor) are blocked there--not only the built-in default bridges, but also secret bridges from BridgeDB. A user on IRC has been experimenting with the Kazakh firewall; the blocking seems to be some sort of probabilistic traffic analysis--it doesn't always block and the rate of blocking depends on the network load. That user would like to have iat-mode=1 set on some of the default bridges to see if it gets through the firewall. Here are details on the Kazakhstan situation: https://bugs.torproject.org/20348 So I'm thinking it's a good idea to turn on iat-mode=1 on, say, 20% of the default bridges. That'll also be a good hedge against potential future blocking, as we can see if the bridges that use size and timing obfuscation are more resistant. It is safe for the server to turn on iat-mode=1 while the client still has iat-mode=0; the obfuscation will only apply in one direction but the connection will still work. ---- Addendum on how to activate iat-mode=1 on the server If you built obfs4proxy from source, and you are using commit a7a2575cab or later, you just need to add one line to your torrc: ServerTransportOptions obfs4 iat-mode=1 Unfortunately this commit is not yet in a released version. If you are using a released version, such as obfs4proxy-0.0.6, then you need to specify every other possible parameter in addition to iat-mode. Find the file <datadir>/pt_state/obfs4_state.json, and convert the JSON syntax into key=value syntax in a ServerTransportOptions, for example if obfs4_state.json contains {"node-id":"0af6c84b644856255dd858b2b189725db6ded51a","private-key":"d04e61ea38757ef67131a3032709e26bbf77a370aadf3950180fbf797973b365","public-key":"fedde584dc36265f9071ab6f7d845a9ae9e3cea5b9c956b252c1c7849aa2d006","drbg-seed":"5bb4dd59f507a89660c4d313f598ed56f4e9e0a620e129af","iat-mode":0} then add this to torrc: ServerTransportOptions obfs4 node-id=0af6c84b644856255dd858b2b189725db6ded51a private-key=d04e61ea38757ef67131a3032709e26bbf77a370aadf3950180fbf797973b365 public-key=fedde584dc36265f9071ab6f7d845a9ae9e3cea5b9c956b252c1c7849aa2d006 drbg-seed=5bb4dd59f507a89660c4d313f598ed56f4e9e0a620e129af iat-mode=1 You will know you need to do this if, when you try to set iat-mode=1 by itself, you get the tor.log error: [warn] Server managed proxy encountered a method error. (obfs4 missing argument 'private-key')

4 6

Cross-team OONI and Tor Browser project: default bridge checking
by Roger Dingledine 29 Nov '16

29 Nov '16

Hi folks, It looks like two of the default obfs3 bridges in Tor Browser have been broken for a while -- maybe for many months. I only noticed by accident today. I was about to open a ticket for the Tor Browser team to automate checking them, so they can proactively notice and fix things if they break. But then I thought, hey, OONI should be doing that testing from all over the world, right? There are these tickets from the past: https://trac.torproject.org/projects/tor/ticket/12544 https://trac.torproject.org/projects/tor/ticket/6414 Maybe this is a great collaboration point between the Tor Browser team and the OONI team? (For best collaboration, we might want to find a way to have it be more than the tor browser team saying "hey ooni, can you do this for us, thanks". :) --Roger

6 10

Fwd: [Netfreedom] IFF Call for Proposals--final submission deadline Nov. 28!
by Shari Steele 25 Nov '16

25 Nov '16

> Begin forwarded message: > > From: Sarah Bushman <sbushman(a)irex.org> > Subject: [Netfreedom] IFF Call for Proposals--final submission deadline Nov. 28! > Date: November 17, 2016 at 7:54:15 AM PST > To: netfreedom(a)lists.cymru.com > > Dear colleagues, > > *IFF Call for Proposals - Final Stretch until November 28th!* > > We're just TWO WEEKS out from the November 28th deadline to submit your session and workshop proposals for the 2017 IFF. > > IFF is by you and for you, so we need your voices in the agenda. Diverse and inclusive discussion means stronger support and solutions for the challenges we, as a community, face. Submit your ideas here: https://internetfreedomfestival.org/host-a-session/ <https://internetfreedomfestival.org/host-a-session/> > > Contact us at team(a)internetfreedomfestival.org <mailto:team@internetfreedomfestival.org> for questions. We look forward to seeing you in Valencia in March! > -- > > > Sarah E. Bushman > > Program Officer > > IREX/USA > > 1275 K Street, NW, Ste. 600 > > Washington, DC 20005 > > 202-628-8188 <tel:202-628-8188> x129 > > Skype: sarahbushman > > > > _______________________________________________ > Netfreedom mailing list > Netfreedom(a)lists.cymru.com > https://lists.cymru.com/mailman/listinfo/netfreedom

2 1

Tor Project Job Opening - Core Developer
by Erin Wyatt 23 Nov '16

23 Nov '16

Hello Everyone, We are looking to hire a Core Developer for the network team. We did recently hire a core developer who will start in February, this opening is in addition to that position. This is an open call and the application deadline is December 31, 2016. Please help us spread the word! If you have someone in mind, refer them to the job posting link on our website (below). If not, you can still help by posting, forwarding, and/or retweeting links to the position! Tor Project website: https://www.torproject.org/about/jobs-coredev.html.en <https://www.torproject.org/about/jobs-coredev.html.en> Twitter: https://twitter.com/torproject/status/801515058131931136 <https://twitter.com/torproject/status/801515058131931136> Thank you! Have a great week. Cheers, Erin Wyatt HR Manager ewyatt(a)torproject.org GPG Fingerprint: 35E7 2A9F 6655 45F9 2CB6 6624 BA0C 9400 F80F 91CE ricochet:65mmrt6kp6qgvpgm

1 0

Blog spam hygiene and a plan for the future
by Roger Dingledine 22 Nov '16

22 Nov '16

tl;dr: if you do a blog post and you enable comments (great), please disable comments when you're done paying attention to your post. Hi folks, If you do blog posts, please help us figure out a better plan going forward. My hobby this past weekend was cleaning up spam comments from the blog. The spam is now gone, and there remain approximately 740 (!) non-spam comments that are in the 'unpublished' state, across dozens of blog posts. In the medium to long term, our infrastructure for handling spam comments will get better, since Mike's friends are working on migrating the blog to a newer Drupal and hosting it in a place that will get updates more consistently. In the mean time though: (and probably these plans will serve us well post-migration too) A) I think our #1 problem is when people do a blog post, allow comments, maybe process and respond to comments for a while, but then forget about the post and let the spam comments pile up. The spam comments then make it harder for other people to find real comments, and things spiral out of control. A2) So if you're doing a blog post, and you want to interact with users, please do enable comments! Just be sure to deal with comments as they show up, and switch the post back to 'read only' when you're no longer planning to deal with them. A3) I don't want to force all people who write blog posts to be the ones who will handle the comments. What a great role for our teams! Maybe each team should self-organize to have a plan for responding to comments on their posts? The small teams can ask the larger ones for help; it will work best if people (1) communicate and (2) give advance warning for posts that will need extra attention. B) During this spam purge I turned off new comments on posts from: ailanthus alison arma art asn boklm gk isabela isis karsten mikeperry nickm phoul sukhbir weasel Most of those posts still have unapproved comments though. If you want, you could go back to your posts and approve some old comments, to help put a dent in that 740 figure. C) Who is still handling blog comments? I think it's down to just Georg, with Mikeperry temporarily on it because he just did a post? Once upon a time it was just me, and then Yawning took a shift for some months, and then for a while we had a "if you do a blog post, you need to either disable comments, or handle the comments for your blog post" policy -- and then I fear it's falling back to just Georg. D) To be clear, I'm not saying we should approve all of the non spam posts. Some of them are crazy distracting multi page rants, for example, and if our goal is to have a focused discussion of the topic of that blog post, it makes no sense to approve everything that isn't selling shoes. I think Georg and I feel strongly that it's valuable to have a way of interacting with our users that doesn't require them to sign up for the full modern cloud identity infrastructure in order to participate. In summary: If you want to help, please do! --Roger

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

tor-project