- tor-project - lists.torproject.org

April 2017 Report for the Tor Browser Team
by Georg Koppen 02 May '17

02 May '17

Hi all! In April we made two releases, Tor Browser 6.5.2[1], and Tor Browser 7.0a3[2]. Tor Browser 6.5.2 picked up Firefox security bug fixes and provided fixes for a broken Twitter experience and a crash bug affecting users on Windows. Additionally, we updated the bridges we ship in Tor Browser. The alpha release was the first one based on Firefox ESR 52. There were a lot of changes related to switching to this new major Firefox version.[3] We got great bug reports from our alpha testers and either already resolved those issues or are still working on doing so for the next alpha release which is planned for mid-May. There was no new release in the hardened series and there won't be one in the future either. Rather, users on this series got updated to the latest alpha version. We discontinued the hardened series as we heard numerous reports from users being confused about it being called "hardened" while including debugging tools as well.[4] We recommend using the Sandboxed Tor Browser from now on instead.[5] Apart from doing release work we focused on getting Tor Browser 7.0 more stable and on making our build system faster and more scalable.[6] We are about to switch our official nightly builds to using rbm, our new reproducible builds manager. The full list of tickets closed by the Tor Browser team in April is accessible using the TorBrowserTeam201704 tag in our bug tracker[7]. For May we plan to do another Tor Browser alpha release picking up the latest changes and testing them. If all goes well we should be ready to release Tor Browser 7.0 by end of May/begin of June. The tickets we want to have solved by then are currently tagged with the `tbb-7.0-must-alpha` and `tbb-7.0-must` keywords.[8] Besides working on getting Tor Browser 7 into stable shape we plan to continue our build system improvements and spend further time on integrating our Panopticlick instance into our Q&A environment[9]. All tickets on our radar for this month can be seen with the TorBrowserTeam201705 tag in our bug tracker.[10] Georg [1] https://blog.torproject.org/blog/tor-browser-652-released [2] https://blog.torproject.org/blog/tor-browser-70a3-released [3] https://lists.torproject.org/pipermail/tor-qa/2017-April/000892.html [4] https://blog.torproject.org/blog/discontinuing-hardened-tor-browser-series [5] https://www.torproject.org/projects/torbrowser.html.en#downloads-sandbox [6] https://trac.torproject.org/projects/tor/ticket/17379 [7] https://trac.torproject.org/projects/tor/query?status=closed&keywords=~TorB… [8] https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… [9] https://trac.torproject.org/projects/tor/ticket/6119 [10] https://trac.torproject.org/projects/tor/query?keywords=~TorBrowserTeam2017…

1 0

April 2017 report for the metrics team
by Karsten Loesing 02 May '17

02 May '17

Hello Tor, hello world! Below you'll find the highlights of Tor metrics team work done in April 2017. On behalf of the Tor metrics team, Karsten Added French, Romanian, and Swedish translations to the ExoneraTor website [1], in addition to existing languages English and German, and made all languages available via links in the footer rather than relying on the user to configure their browser for any given language. All new languages have been translated by the Transifex community [2] and reviewed by Tor people. [1] https://exonerator.torproject.org/ [2] https://www.transifex.com/otf/torproject/ Replaced Tor performance measurements gathered by Torperf (torperf, moria, siv) with measurements performed by OnionPerf (op-hk, op-nl, op-us) on CollecTor [3] and Metrics [4]. [3] https://collector.torproject.org/recent/torperf/ [4] https://metrics.torproject.org/torperf.html Published Tor Technical Report 2017-04-001 [5] titled "Privacy analysis of Tor's in-memory statistics" that "analyzes which possibly sensitive, potentially personally identifying data is stored in memory of Tor relays and bridges or reported to the directory authorities and makes suggestions to reduce the collection and temporary storage of such data." [5] https://research.torproject.org/techreports/privacy-in-memory-2017-04-28.pdf Made a couple more usability and robustness enhancements to Atlas [6], including adding a red/green indicator to easily distinguish currently running relays [7], adjusting the size of a kilobyte to tor's [8], reducing redundant custom CSS and external resources [9, 10], and removing confusingly empty fields when no data is available [11]. [6] https://atlas.torproject.org/ [7] https://trac.torproject.org/projects/tor/ticket/6355 [8] https://trac.torproject.org/projects/tor/ticket/21822 [9] https://trac.torproject.org/projects/tor/ticket/22056 [10] https://trac.torproject.org/projects/tor/ticket/21699 [11] https://trac.torproject.org/projects/tor/ticket/22039 Lost CollecTor and Onionoo mirrors run on a community-contributed host, and set up a new CollecTor mirror on a Tor host kindly provided by SUNET [12]. [12] https://www.sunet.se/about-sunet/

1 0

UX team April 2017 summary
by Linda Naeun Lee 01 May '17

01 May '17

Hello! In April, the UX team did three major things: 1) research and design work for torproject.org 2) started building content for support.torproject.org 2) coordinating with mobile developers on features 3) better team organization and project management 1) Got the necessary research done for redesigning torproject.org (#21222). Since we now have a handle on how the website is structured, how we want the new website structured, and what content we want where, we can start moving forward with wireframing. The research tasks are all grouped in #22120 as its sub-tickets for your viewing pleasure. 2) We wrote over 100 questions and answers for the upcoming support portal ( https://gitweb.torproject.org/support-portal.git/tree/plain) These questions cover frequently asked questions during the download and install process, troubleshoot the most common errors with Tor Browser, and address a wide array of other questions. 3) Isabela and Linda joined the weekly #tor-mobile scrums, where we got to listen to what's going on with tor-mobile (we are glad that there is better communication here now!) and give feedback on the their features. They're working on better user-facing error messages when a connection fails, and how they can make use of the waiting time when connecting to educate users about Tor and its features. 4) We now have a regular UX team meeting (Mondays 1500 UTC @ https://meet.jit.si/TorUX) with an agenda (https://pad.riseup.net/p/tor-ux agenda), a team roadmap to keep track of tasks to do this month and the following months (https://storm.torproject.org/grain/XaENCFTXJzFYWgxSnK4mgJ/) and create/triage tickets to keep track of work. Major thanks to Antonela, Alison, and Colin for doing such great work this month! ヽ(•◡•)ﾉ, Linda

1 0

Network team meeting notes and status updates, 5/1
by Nick Mathewson 01 May '17

01 May '17

Below are the status updates from our weekly meeting. The notes and logs are at http://meetbot.debian.net/tor-dev/2017/tor-dev.2017-05-01-16.59.html ================================ Updates for network team meeting, 1 May 2016 Happy international workers day Happy may day Um and also........... https://en.wikipedia.org/wiki/Loyalty_Day (No, people don't actually observe that, afaik.) ============= Discussion: * feature freeze may 15 (?) * 032 priorities * dgoulet's tickets questions * Mike wants to discuss is_client wrt #16861, #21406, and #21585 * rust proposal ============= To do after meeting * Everyone update milestone progress on isabela's roadmap storm pad. * Plan 032 planning ============= ahf: I'll be missing from the meeting today to celebrate May 1st, feel free to ask questions on IRC and I'll respond when I'm online again. Last week: Sponsor4: - Landed patches for new compression backend: #21662, #21663, #21664, #22066, and #22085. - Reviewed #22061, #22051, #21648, #22065, and #21646. - Fixed #21665, but the code have not landed yet. Misc: - Fixed minor build-system issue on OS X (bug #13802). This week: Sponsor4 (ordered): - Working on the last prop278 (for now?) bug: #21667 - Figure out what's next for Sponsor4 or help out with 0.3.1 bugs or XXX (depending on what is most urgent). Misc: - Coverity duty. Nick: (I have a dentist appointment this morning; I think I'll be back to the meeting on time.) - Last week * Nearly done with prop140 stuff: diffs are generated and compressed and I have the code to serve them. * Also refactored some sucky APIs. directory_initiate_request_routerstatus_rend(), anyone? I think we should declare open season on any function taking more than 6 or 7 arguments. * Moved a bunch of stuff out of 0.3.1 based on triage * Released 0.3.0.6 (stable!) - This week * Catch up on hard design-y emails * Finish prop140 implementation (!!!1!) * Help ahf as needed with prop278 stuff. * Try the gitlab instace * Create a review-group * Review lots of stuff * UX-TorLauncher meeting later today asn: Last week: - Worked on #21859. Unittests mainly - Opened #22052 based on lessons from #21859. - Implemented the ed25519 torsion validation at #22006. Branch is pushed and looks good, but it needs a bit more work needed before needs_review: Ian suggested we do this check for all network-received ed25519 keys, so I need to make sure I actually validate all of them. - Opened #21969 but haven't had time to think about it. - Started looking at guard discovery stuff again. This week: - Finalize #21859. Put it in needs_review. - Finalize #22006. Put it in needs_review. - More work on guard discovery. Mike: Last week: - Did triage. Wasn't a whole lot to triage that week. - Updated #16861 some more for dgoulet; I have a question about a couple other bugs - Did a little more work on Sponsor2 stuff - Some coordination with Mozilla; some rusting This week: - Tor Launcher meeting and discussion - Sponsor2 work continues dgoulet: Last week: - Worked on #20657 unit testing. Also, rebased that branch onto master resolving conflicts from the refactor of directory.c. - Final review and test of #16861 (mikeperry netflow). - Worked on #22060 which turns out to be a bit more tricky than expected. - Addressed asn's review for #21978. - Worked on random 031 tickets: #22042, #22034, #21715, #21293, - We got #13802 merged finally! Thanks to pastly and nickm's feedback! - We had some bad-relays business to take care of and help out a bit with asn on some next steps for Guard discovery stuff for HS. This week: - Finishing test coverage of #20657 and prepare it for early 032 merge. - Integrate asn's work on circuit e2e #21859 with #20657. - Depending on the state of things for the prop224 service implementation, I might start the client implementation big branch! catalyst: Last week: * started sketching out new baseXX APIs that will be more robust and less error-prone (#19531). e.g., given our calling patterns it actually makes sense for encoding functions to return void, unless they're allocating memory or lengths are variable. almost all of our base32 and base16 uses involve fixed-size arrays, so having assertions for length checks might actually be the right thing. * did more analysis about PT arguments (#12930). filed #22088 with proposed minor PT spec changes to mitigate this issue. * looked at Tor Launcher usability stuff This week: * 15-minute fixes * Tor Launcher usability meeting * more digging into control port stuff and bootstrap progress reporting to improve Tor Launcher usability isis: last week: - took the week off - worked with dcf to finish getting the meek-bridgedb channel set up this week: - sort out new contract - several meetings regarding roadmapping and the new distributor komlo: - have more time this month so can be on irc more during the day! - Reviewed Sebastian's intial Rust integration patch - Fixed up my partial implementation of protover in Rust from Sebastian's review - This week: - Work with Sebastian on writing a "Rust in Tor" document - we have a rough working draft. - Continue with finishing a full protover implementation in Rust Sebastian: Opened https://trac.torproject.org/projects/tor/ticket/22106 for initial Rust integration work Isabela: Last week: - had a call with drl on our proposal - got good clarification - bugged folks on roadmap :) - organized meeting for tor launcher automation feature definition. This week: - working on April report to OTF - replying to DRL follow up questions on our proposal / also emailing a summary of the proposal deliverables to folks involved on it. - doing another check on roadmaps. and emailing tor project all teams roadmaps

1 0

Notes from April 27 2017 Vegas team meeting
by Karsten Loesing 01 May '17

01 May '17

Notes for April 27 2017 meeting: Alison: 1) did a training in Atlantic City NJ this week; next week I've got a few events in Boston and Rhode Island. 2) starting to work on the Community Team roadmap and organizing our tasks into trac tickets 3) lots more content completed for the support portal 4) working on the membership guidelines again and will propose them after the CC vote is completed. 5) working on Global South meeting info gathering 6) doing preliminary stuff for Montreal meeting Shari: 1) I'm in New York this week, meeting with funders and others. 2) Offered job to a new writer, and he seemed to have accepted. We'll announce after we receive it in writing! 96 people applied for that job! 3) Still waiting for decision from our favored communications director candidate. If he doesn't commit by next week, we'll open it up and start circulating the job description. 4) Reviewing OTF metrics proposal and writing up the budget. Arturo: 1) Probe orchestration prototype almost complete: https://github.com/thetorproject/proteus 2) Held a community meeting on Tuesday 3) Coordinated with translators for the Arabic, Farsi, and Russian translations of ooniprobe (which are expected to be included in the next ooniprobe release) 4) Meeting with the Localization Lab about next steps in terms of localizing our tools, methodologies, and documentation 5) This week OONI partners are hosting OONI workshops at the Internet Freedom Festival in Lagos, Nigeria 6) There will be a OONI workshop at CryptoRave (https://cryptorave.org) in Brazil Georg: 1) Ongoing work on getting Tor Browser 7.0 into stable shape (release planning/bug triage etc.) 2) Roadmapping taking dependencies to other teams/Mozilla into account Nick: 1) Work goes on. New Tor release out yesterday. TB users should have it in a month or so. Sponsor4 deliverables on-track for 0.3.1. 2) 0.3.1 feature freeze may 15; tell your friends 3) meeting with folks Monday to coordinate tor launcher stuff; potential opportunities / problems to consider as we move ahead. 4) speaking at MIT class on 10 May ; Bostonians should feel free to crash 5) using new format at our team meetings: pad -based status updates, plus additional discussion on IRC Mike: 1) Got a mail from Mitchell introducing me to Jofish, the Mozilla IoT person. 2) Also meeting about the Tor Launcher bridge automation 3) Trying to get Ben Rosenfeld involved in Trademark notices. Not hearing from Wendy? 4) Continue working on Tor padding and playing with Rust (and triaging Tor tickets). Karsten: 1) Continued writing funding proposal that is due April 30. 2) Made plans to add a second CollecTor instance and a full Onionoo mirror on tpo hosts. 3) Added translations and language selection to https://exonerator.torproject.org/. 4) Finished technical report on privacy of Tor's in-memory statistics that will be published by end of this week. Isabela: 1) Working on OTF proposal with Metrics team 2) Following up on answers for DRL 3) Dependencies Dependencies Dependencies - working on organizing them with teams. Automation feature for Tor Launcher is the main one that cross many teams, hopefully on Monday we will meet and get everyone on the same page there. 4) Linda is working on site-mapping the current site and the new ones in order to organize the content for each new portal and make sure we are not missing anything. 5) Hiro got a gitlab instance working for Network team to test and this will be the beginning of 'moving away from trac' mission. She is also working on migrating the blog -> https://trac.torproject.org/projects/tor/ticket/22013 6) OMG need to finish my report on user growth strategy :(

1 0

Damian's Status Report - April 2017
by Damian Johnson 30 Apr '17

30 Apr '17

Hi all! Here's my status report for this month... http://blog.atagar.com/april2017/ Cheers! -Damian

1 0

Re: [tor-project] Moving on
by Joshua Gay 28 Apr '17

28 Apr '17

Hi again, I just wanted to let provide an update to my previous email to let everyone know that my last official day as Communications Director for Tor Project, Inc will be on April 30th (this Sunday). Best, Josh On 04/14/2017 04:57 PM, Joshua Gay wrote: > Hello, > > I wanted to let you all know that in the near future, Tor Project will > be starting the process of finding a new Communications Director. > Unfortunately, I was unable to do the job, and so I will be stepping > down from my role when my replacement is hired. But, until then, I will > be continuing to help with press inquiries as well as wrapping-up and > sharing some of the work (research, planning, etc) that I began. > > While I am sad that things didn't work, it was my sincere pleasure to > have met and worked with many of you and I am grateful for having been > given the opportunity to help Tor Project. If you have any questions or > would like my help on something (proofread a blog post?), please don't > hesitate to ask! My email address is <joshuagay(a)riseup.net>, and I will > also continue to lurk on IRC (jgay) in #tor-project and elsewhere. > > Best, > > Josh > > -- Joshua Gay Communications Director Tor Project https://torproject.org GPG: 59F4 F183 7CC2 7193 3850 21A9 5211 5F6F E922 09E1

1 0

Notes from April 20 2017 Vegas team meeting
by Karsten Loesing 25 Apr '17

25 Apr '17

Notes for April 20 2017 meeting: Alison: 1) Support portal 1.1) adding lots of content, figuring out how it'll fit with the the rest of the website redesign 1.2) we still don't have a timeline/date for a testing site because we're waiting to hear about the funding first 1.3) we're meeting weekly about this and the outreach portal 2) Outreach portal 2.1) began sitemapping and organizing content ideas (training, brochures, localization) 3) Global South 3.1) researching GS meeting locations for March 2018 or September 2018 3.2) ilv set up a new bandwidth server in Santiago 3.3) LFP made it to round two of the Lush Digital Fund, which could get us about $12k for Global South outreach 3.4) connected NoiseTor to ilv to make plans for Global South relay support 3.5) we now have two comms channels for Global South chatter: #tor-south and tor-south(a)lists.tpo 4) Trainings 4.1) Sukhbir is speaking about Tor at Google India's Open Data Camp in Bangalore 4.2) ilv is speaking at Cryptorave 4.3) LFP trainings 4.3.1) last week: Tennessee Library Association Conference, Univ of Michigan, Political Research Associates, ALA 4.3.2) upcoming: New Jersey Library Association Conference, New Hampshire Library Association Conference 4.4) second Rocnation Tor training is May 10 5) commsdir interviews 6) connecting with some people in Turkey about Tor blocking 7) social contract vote ends 25 April 8) Phoul is working with Jon to send tshirts and stickers to active Transifex translators 9) reviewing results from the Tor Meeting survey and starting to plan for Montreal 10) next: LFP is working on a survey of all our participating libraries to find out what Tor stuff they're doing 11) traveling next week, the week after, and a lot throughout May, now that I think about it Nick: 1) On vacation this week 2) All's well! 3) I owe Isabela a bunch of answers for different spreadsheets and things once I'm back. Roger: 1) Where are we on the new blog? 2) I'm going to update the sponsors page soon; let me know of any new sponsors. 3) There's a recent press request that it would be wise for somebody to handle. 4) I'll be traveling much of the next two weeks. Mike: 1) Working on netflow and adaptive padding patches 2) Reading about and learning Rust Arturo: 1) The OONI team is applying to the CitizenLab Summer Institute 2) Making progress on the probe orchestration and data processing pipeline 3) SuperQ is helping us setup better monitoring of our infrastructure (https://github.com/TheTorProject/ooni-sysadmin/pull/106) isabela: 1) roadmap + dependencies track process started with network, tbb, metrics and ux teams - I wonder if OONI and Community want to do this too 2) starting to pick up NSF stuff this week / hopefully this work will be organized (eventually) within network team's roadmap 3) writing an article about orbot and orfox to a brazuka magazine/newsletter Georg: 1) New Tor Browser releases got out; 7.0a3 alpha is the first one based on Firefox 52 ESR 2) We stopped the hardened Tor Browser series; blog post etc. should go out soon 3) Bug bounty program is moving slowly towards being publicly available

4 3

Linda away for the day (~˘▾˘)~ <eom>
by Linda Naeun Lee 25 Apr '17

25 Apr '17

1 0

Network team meeting notes from 24 April 2017
by Nick Mathewson 24 Apr '17

24 Apr '17

Hi! Our meeting transcript is at: http://meetbot.debian.net/tor-dev/2017/tor-dev.2017-04-24-16.59.html Below are the status reports from this week: ==================== Network team meeting pad update notes, 24 April 2017 nick: * was on vacation. * finished consdiffmgr branch (merged today) * reviewed a bit * Refactored directory request api * This week: * aiming to get consdiff implementations mostly done; will depend on compression status. * aiming to review and merge much more, especially compression * Aiming to help others with priorities etc * What am I forgetting? * Concerning topics: * Review backlog. * **Revision backlog** dgoulet: - Worked on some small 031 tickets, most of them in needs_review or merged. - Finalize the prop224 service hashring and upload descriptor code. (#20657) - Working on adding unit test coverage to #20657 (ongoing work is in branch ticket20657_031_02) - Tickets from the prop224 groundwork are getting merged (#21888). Yay! More ticket to come such as #21979 (load and configure service). This week: - Second round of review on #16861 (mike's branch) - Continue on unit testing for #20657 while adding more and more ticket for upstream merge by pieces. - Resolve some 031 tickets. ahf: Last week (unordered): Sponsor4: - Monday was easter holiday. - Got #21662, #21663, and #21664 reviewed (first round). - Reviewed #21647 for Nick. - Do coverage runs for the compression code and start adding `LCOV_EXCL_*` in appropiate places and fix tests. This week (ordered): Sponsor4: - Working on cleaning-up things from the #21662, #21663, and #21664 review: currently missing to fix refactoring the different compression test cases into one compression test suite. - Finish coverage fixes. - Fix #22051 (make non-streaming compression API use the streaming compression API). - Handle upper-bound of memory usage in LZMA code (postponed from last week). - Look into next steps for Sponsor4: measurements? pastly: - so much paper writing - the original "vanilla" Tor scheduler has some configurable limits. - They are never effective in practice (chosen conservatively and never hit). - The vanilla sched is called many times per ms. The intra-tor process queueing times are ~0. Therefore, 100MB (the limits Scheduler{Low,High}WaterMark__) of data never accumulate in the outbufs. - I also plan on removing SchedulerMaxFlushCells__ in favor of a static 1000 (its default). Such a large value makes the sched behave like Tor did before it even had a global sched: one socket at a time. This further cleans the line between the "vanilla" and "kist" schedulers - Maybe max flush cells should be configurable still, but for many other reasons, it isn't useful. - (end for brevity) - They were added to make the scheduler KIST-like. - I plan on removing them. My new scheduler should be used for KIST behavior - As mentioned in previous meetings, it's easy to switch between schedulers Sebastian: * Have been oxidating. Unfortunately, a big part of the planned rust integration won't be as nice as it could be, because Rust doesn't want to guarantee interface stability for allocing across an FFI border, even if we can ensure that the same allocator is used. * consdiff code compiles on debian stretch, on amd64 (probably x64 too, haven't tested) * Found a couple of bugs in the C consdiff code, nothing major. * Working on final touches, next up is blog post. Will send draft to network-team list before posting. catalyst: * bug triage. not very many new tickets needed adjusting. * looked at #12930. still working out how the data flow from SMETHOD ARGS to Bridge config lines work, along with quoting, etc. will probably propose some spec revisions to exclude problematic characters from args as a short-term workaround. * looked at snowflake proxy (the browser crowdsourced proxy component) * helped gather info on some macOS Tor Browser 7.0a3 bugs (default search engine, etc.) * wrote regression test for #22034 (GETINFO extra-info/digest/) * obfs4 often fails for me on Tor Browser 7.0a3 in macOS, but meek and obfs3 work. obfs4 in 6.5.2 also works. trying to get more info about this. could learn useful background for improving bootstrap feedback. * a little distracted by buying a house Mike: Last Week: * Updated #16861 based on dgoulet's review. Let me know if I should squash/rebase again. * Did some work on protocol negotiation for Adaptive Padding * Started learning Rust. It's pretty nice! This week: * More Adaptive Padding, more Rust * Bug Triage asn: Last week: * About 80% to doing the ed25519 validation. Pushed branch at #22006 . Lots of head beating with crypto math -- Ian helped. * Talked with blockstack people. They will publish a plan for blockstack integration with Tor in two weeks. (ask me for more info) * Reviewed a bunch of prop224 groundwork tickets (#21888) * Did some unittests for my WIP rend circuit crypto branch #21859 * Opened #21969 since it seems the "We're missing descriptors for some of our primary entry guards" bug is still with us. * GSoC stuff Next week: * The Roadmap Email * Finish up the ed25519 validation code #22006 * Take care of some more ed25519 prop224 business (#22052) * Continue work on the e2e circuit stuff (#21859). ETA probably next week EOF Isabela * Working with teams on roadmaps&dependencies - need help adding tasks related to NSF grants and sponsorR - two dependencies people have related to this team: tbb+ux depend on isis bridges work (already following up with her via email) and maybe on the implementation of the automation for tor launcher (pt selection) * DRL sent us more questions related to our proposal - working on answering those and will have a call with them this week * Will share this week the DRL propsal tasks with all the teams who will be working on them isis: Last week: * finished OTF work * set up meek-server and also meek reflector on AppEngine for bridgedb channel to new distributor * released draft design of distributor * did status reports and billing and paperwork things This week: * Taking time off because I've not started at Tor yet (also another personal reason)

1 0