- tor-project - lists.torproject.org

Arranging new default obfs4 bridges
by David Fifield 18 Apr '17

18 Apr '17

In November 2016 there was a discussion on the tor-team list about adding some new default obfs4 bridges (Subject: Coordinating to run high capacity obfs4 bridges). The thread turned into a discussion about the same entity running both bridges and exits, and didn't go anywhere. We haven't added any new obfs4 bridges, or changed the port number of any existing bridges, since January 2017 (Tor Browser 6.5 and 7.0a1). I suspect that the 20 existing default bridges are still under high load and we could stand to have some more bridges to help share it. Are we still interested in adding new obfs4 bridges? If so, do we have any leads on who could run them?

8 16

OONI team's Status Report - March 2017
by Arturo Filastò 17 Apr '17

17 Apr '17

Hello Tor people, Below is an update on what the OONI team has been up to in March 2017: # OONI Monthly Report: March 2017 The OONI team made steady progress in March 2017. We published research reports in collaboration with our Southeast Asian partners and we participated in outreach and community engagement efforts. We released ooniprobe 2.2.0 which features our new web UI, improvements based on community feedback, and translations for 4 languages. We also developed and released a new test that examines the reachability of Telegram. Below we provide some highlights from OONI's activities in March 2017. ## Publication of research reports Over the last months the OONI team has been collaborating with digital rights organizations on the study of internet censorship in Southeast Asia. In collaboration with our partners, we published the following research reports in March: 1. The State of Internet Censorship in Thailand: https://ooni.torproject.org/post/thailand-internet-censorship/ (OONI, Sinar Project, Thai Netizen Network) Over the last 4 months, ooniprobe was run across 16 local vantage points in Thailand, through which we collected and analyzed thousands of network measurements with the aim of examining and uncovering recent censorship events in the country. Our study also includes an examination of Thailand's legal environment and network landscape. The key findings of our study confirm the blocking of 13 websites in Thailand across 6 different ISPs, including the following types of sites: * News outlets (nypost.com and dailymail.co.uk) * wikileaks.org * Circumvention tool sites (such as hotspotshield.com) * Pornography Thai ISPs appear to primarily be implementing censorship through DNS hijacking and through the use of middle boxes (HTTP transparent proxies) which serve block pages. Since sites were not found to be blocked across all networks, Thai ISPs appear to be blocking websites at their own discretion. On a positive note, the Tor network, WhatsApp, and Facebook Messenger were found to be accessible across all 16 networks in Thailand where tests were run during the testing period (6th November 2016 - 27th February 2017). 2. The State of Internet Censorship in Myanmar: https://ooni.torproject.org/post/myanmar-report/ (OONI, Sinar Project, Myanmar ICT for Development Organization) As part of our study, OONI software tests were run across 6 local vantage points in Myanmar between 25th October 2016 and 28th February 2017. These tests are designed to measure: * Blocking of websites; * Blocking of Whatsapp and Facebook Messenger; * Blocking of Tor; * Presence of middle boxes (i.e. systems that could be responsible for censorship or surveillance). Upon analysis of thousands of network measurements, we did not detect any block pages that could confirm any cases of internet censorship. Five sites, however, including those of the U.S. embassy in Myanmar and of the Organization of American States (OAS) presented signs of TCP/IP and HTTP blocking. While OONI software tests detected the presence of Blue Coat software (some types of which can potentially be used for internet censorship and surveillance) in Myanmar back in 2012, we did not detect the presence of this software in any of the 6 networks where tests were performed. On another positive note, WhatsApp, Facebook Messenger, and the Tor Network were found to be accessible in all 6 networks in Myanmar throughout the testing period. 3. Examining internet blackouts through public data sources: https://ooni.torproject.org/post/examining-internet-blackouts/ In response to community requests for the need of a methodology for measuring internet blackouts, OONI released a post which explains how we examine internet blackouts through public data sources. This post also includes an ipython notebook which shows how to automatically analyze Google traffic data with the aim of identifying internet blackouts: https://ooni.torproject.org/notebooks/internet-blackouts-google-traffic.html (https://ooni.torproject.org/notebooks/internet-blackouts-google-traffic.ipy…) ## Stable release of ooniprobe 2.2.0 The OONI team worked towards the release of ooniprobe 2.2.0 in March. The latest version of ooniprobe includes: * Re-designed web UI * New IM test for Telegram * Improvements to ooniprobe based on community feedback * Translations in 4 languages: Spanish, French, Italian and Hindi Full release notes can be found here: https://github.com/TheTorProject/ooni-probe/releases/tag/v2.2.0 ## Progress on data processing pipeline Throughout March OONI made a lot of progress on our data processing pipeline. We have been running the new iteration of the pipeline in parallel to the current pipeline and fixing various issues that we have been encourtering along the way. ## Outreach and community engagement The OONI team participated at the following events in March as part of its outreach and community engagement efforts: * Vietnam Cyber Dialogue (VCD) -- Valencia, Spain: 5th March 2017 * Internet Freedom Festival (IFF) -- Valencia, Spain: 6th-10th March 2017 * Iran Cyber Dialogue (ICD) -- Brussels, Belgium: 27th-28th March 2017 * RightsCon -- Brussels, Belgium: 29th-31st March 2017 As part of these events, the OONI team facilitated the following OONI sessions: 1. OONI Knowledge-sharing session -- Vietnam Cyber Dialogue (5th March) 2. OONI Skill-sharing session -- Vietnam Cyber Dialogue (5th March) 3. "Investigating Information Controls with OONI" -- Internet Freedom Festival (7th March) 4. "Building Community Resources for Censorship Measurement Research" in collaboration with the Citizen Lab -- Internet Freedom Festival (9th March) 5. "Measuring internet censorship during the Iranian elections" -- Iran Cyber Dialogue (28th March) 6. "Advances in measuring internet shutdowns" --- RightsCon (29th March) 7. "Collecting evidence of internet censorship in Southeast Asia and beyond" in collaboration with Sinar Project -- RightsCon (30th March) We published a blog about the above here: https://ooni.torproject.org/post/ooni-iff-rightscon/ In addition, the OONI team also attended the Tor Meeting in Amsterdam between 23rd-26th March. This provided the OONI team with the opportunity to work on its roadmap for the next 6 months. Finally, the OONI team hosted an OONI Community Meeting on https://slack.openobservatory.org/ on 21st March. As part of the meeting, the following agenda items were discussed: 1. How to set up a script to check websites accessibility via Tor Browser. It would be great to store the records on a website to stress the importance of a smooth and troubleless Tor user-experience online, pushing websites to allow Tor-users more access. 2. Brainstorming on ways to improve measurements in at-risk countries. 3. Discussion on how one can run custom tests, decks and inputs via ooniprobe. 4. Discussion on setting up a large deployment in India to detect region-specific mobile censorship. ## Userbase In March 2017 ooniprobe was run 84,829 times from 2,271 different vantage points across 170 countries around the world. This information can also be found through our stats here: https://measurements.ooni.torproject.org/stats ~ The OONI team

1 0

Summary of meek's costs, March 2017
by David Fifield 17 Apr '17

17 Apr '17

Here's the summary of meek's CDN fees for March 2017. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 all 2015 $8006.59 + $8146.83 + $1292.89 = $17446.31 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 February 2016 $986.39 + $977.85 + $445.83 = $2410.07 March 2016 $1079.49 + $865.06 + $534.71 = $2479.26 April 2016 $1169.23 + $1074.25 + $508.93 = $2752.41 May 2016 $525.46 + $1097.46 + $513.56 = $2136.48 June 2016 $0.00 + $1117.67 + $575.50 = $1693.17 July 2016 $0.00 + $1121.71 + $592.47 = $1714.18 August 2016 $0.00 + $1038.62 + $607.13 = $1645.75 September 2016 $0.00 + $932.22 + $592.92 = $1525.14 October 2016 $0.00 + $1259.19 + $646.00 = $1905.19 November 2016 $0.00 + $1613.00 + $597.76 = $2210.76 December 2016 $0.00 + $1569.84 + $1416.10 = $2985.94 January 2017 $0.00 + $1550.19 + $1196.28 = $2746.47 February 2016 $0.00 + $1454.68 + $960.01 = $2414.69 March 2016 $0.00 + $2298.75 + $0.00 = $2298.75 -- total by CDN $13138.96 + $28644.09 + $10202.06 = $51985.11 grand total https://metrics.torproject.org/userstats-bridge-transport.html?start=2017-0… During March, we changed the CDN infrastructure of meek-azure to one that is no longer operated by me, so the cost of Azure is no longer available to me. https://lists.torproject.org/pipermail/tor-project/2017-March/000999.html https://bugs.torproject.org/21342 The changeover happened on March 3. The Azure billing cycle started on March 5, so there are zero charges for March. meek-azure was completely non-functionable between March 3 and March 7, when Tor Browser 6.5.1 was released. Similarly the CDN configuration for meek-amazon is about to change too, so this will probably be the last month I am able to report its costs. https://lists.torproject.org/pipermail/tor-project/2017-April/001092.html https://bugs.torproject.org/21918 == Amazon a.k.a. meek-amazon == The Amazon cost was higher than usual--perhaps as a result of meek-azure being non-functional for a few days. EU (Ireland) 705M requests $846.50 6645 GB $533.26 Global 9M requests $9.73 42 GB $3.29 US East (Northern Virginia) 515M requests $515.60 4899 GB $389.87 -- total 1230M requests $1371.83 11587 GB $926.42 charge for alarms $0.50 https://atlas.torproject.org/#details/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == Usage of meek-azure started to recover after being switched to another backend on March 7. https://atlas.torproject.org/#details/AA033EEB61601B2B7312D89B62AAA23DC3ED8… https://atlas.torproject.org/#details/8F4541EEE3F2306B7B9FEF1795EC302F6B84D… Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

1 0

Moving on
by Joshua Gay 15 Apr '17

15 Apr '17

Hello, I wanted to let you all know that in the near future, Tor Project will be starting the process of finding a new Communications Director. Unfortunately, I was unable to do the job, and so I will be stepping down from my role when my replacement is hired. But, until then, I will be continuing to help with press inquiries as well as wrapping-up and sharing some of the work (research, planning, etc) that I began. While I am sad that things didn't work, it was my sincere pleasure to have met and worked with many of you and I am grateful for having been given the opportunity to help Tor Project. If you have any questions or would like my help on something (proofread a blog post?), please don't hesitate to ask! My email address is <joshuagay(a)riseup.net>, and I will also continue to lurk on IRC (jgay) in #tor-project and elsewhere. Best, Josh

1 0

Network team meeting notes from 10 April 2017
by Nick Mathewson 13 Apr '17

13 Apr '17

Hi! Our meeting transcript is at http://meetbot.debian.net/tor-dev/2017/tor-dev.2017-04-10-16.59.html Below are the status reports from this week ======== Nick: * reviewed code, merged a bunch * worked on consensus diff stuff (more). Now I have a labeled storage system that can manage consensuses and make diffs in worker threads. Next up is actually putting things there as they arrive; actually launching the "build a diff" stuff, and the tests. * This week, planning to try to get consensus diff code ready for some kind of review by end of week. * Mostly off IRC next week; going on trip with family (kid is on a school break) ASN says: - Worked on the recent onion address and ed25519 threads that started in [tor-dev], and tried to figure out which things are worth doing. I opened two action item threads: https://lists.torproject.org/pipermail/tor-dev/2017-April/012164.html https://lists.torproject.org/pipermail/tor-dev/2017-April/012163.html I'd appreciate feedback from Ian (at least) before I proceed here. Ian still hasn't replied but I suspect he will just do it later. Otherwise, I'll ping him. - Worked some more on prop279 (Name System API). - Started working on an API for setting up e2e crypto on rendezvous circuits which is meant to be used by clients and services (#21859). This week: - Engage more with the ed25519/onion address tor-dev threads I posted above. - Think more of the size of HS descriptors and about the recent solutions proposed in #21693. - Continue e2e circuit work on #21859. - Revise HS ntor branch based on nick's latest review. - Figure out GSoC. AHF says: - Helped review #21869 for Nick. - Had an Amsterdam follow-up meeting with Karsten + Samdney regarding Sponsor4 efforts impact on the metrics team. See: https://pad.riseup.net/p/chikeuBN1OUh - Merged various fixes to proposal #278 (from `ahf/prop-278-fixes` on Gitlab). - Build tool fixing and testing patches for lzma2/zstd code landing (bug #21662 + 21663) Other stuff: - Getting more into Rust. - Looked at GSoC proposals. Doesn't look like there was any submissions for the IPv6 proposal though. - Wrote an email to the tor-relays to hear if tor-fw-helper is used by anybody: so far only one person have replied that they are using it. - Reviewed issues #21841, #21842 - Bug triaging task: not many new issues on trac. This week: - Finishing off the remaining assigned issues for the current sponsor4 efforts. - Figure out if the compression API can do what we want it to do: storagedir, directory connections, xxx - Discuss with Nick about doing additional measurements and compare it to the measurements we did in early March. - I'm off for some of Thursday and Friday (easter holidays in Denmark). Catalyst is out this week. pastly says: Not much that Tor would care about yet - got scheduler switching via function pointers and a torrc option working - removed more testing-only code - currently debugging an issue with the kist scheduler that is difficult to reproduce - plan is to add a new type of cell to signal lots of extra debugging on the circuit - this code will only ever be ran in Shadow dgoulet says: - Worked on implementing mandatory ed25519 cert as link specifier for intro point in #20657 (prop224 service). - Wrote prop224 patch and code for #21871. - With #21871, finalize the introduction point legacy support for prop224 in #20657. - Implemented INTRODUCE replay cache support in #20657. - Reviewed #16861 this morning. All my comments are in the Gitlab. - Moved code out of #20657 massive development branch for early upstream inclusion. Every ticket about it have been put as child of #21888. - Fixed couple of 031 tickets as well. - This week will be resolving ticket in 031 and continue #20657 with service upload descriptor code and unit tests. Mike: - Most of my week last week was spent preparing for and meeting with Mozilla - This week I will look over the #16861 review. - Some time may be consumed by taxes :/

1 0

[Proposal] Social Contract
by Alison 11 Apr '17

11 Apr '17

Hi everyone, Last year we wrote a Social Contract with a set of promises to our users about our standards for making Tor. When we agreed on this document, we didn't have a formal set of voting guidelines [1] in place. Now that we have those, I'd like us to officially ratify the Social Contract according to our voting procedure. I am opening up the Social Contract proposal (attached) for discussion. Please first read the voting guidelines linked below, then give your feedback on the proposal in this thread. You may also create a new proposal for discussion. The discussion phase will run until 10 April. Please do not wait until the last minute to give substantive feedback. After the discussion phase, I'll initiate a vote. Alison [1] https://gitweb.torproject.org/community/policies.git/tree/voting.txt

7 18

new mailing list and IRC for Global South discussions
by Alison 11 Apr '17

11 Apr '17

Hi all, We have two new communication channels for discussing all things Tor in the Global South: a mailing list [1] and an IRC channel, which is #tor-south on OFTC. If you aren't sure how to use IRC, here are some instructions [2]. These channels were borne out of two discussions [3][4] at the Amsterdam Meeting about building community in the Global South, aka the majority world. Please join us if you're interested in working on that! Thanks to sukhe for creating the mailing list and ilv for creating the IRC channel (at least, I think it was you, since you're op!). Alison [1] https://lists.torproject.org/cgi-bin/mailman/listinfo/global-south [2] https://wiki.mozilla.org/IRC. These instructions are for a Mozilla IRC server, so instead of irc.mozilla.org you'll use OFTC. The OFTC server addresses are: irc.oftc.net:6667 (alternative ports: 6668-6670, 7000) or irc.oftc.net:6697 for SSL (alternative port: 9999) (SSL is recommended). [3] https://trac.torproject.org/projects/tor/wiki/org/meetings/2017Amsterdam/No… [4] https://trac.torproject.org/projects/tor/wiki/org/meetings/2017Amsterdam/No…

2 1

SHA2017: Who is coming?
by Nurmi, Juha 10 Apr '17

10 Apr '17

Hi, I am going to SHA2017 this summer. Who is coming? Shall we have a meeting there? Regards, Juha

2 1

Tails report for March, 2017
by intrigeri 10 Apr '17

10 Apr '17

Hi, the report about Tails activity in March is online: https://tails.boum.org/news/report_2017_03/ Spoiler alert: the "Reproducible Builds" section includes amazing news. Due to popular demand, an HTML version is attached, for your offline reading pleasure :) Cheers, -- intrigeri

1 0

Notes from April 6 2017 Vegas team meeting
by Karsten Loesing 10 Apr '17

10 Apr '17

Notes for April 6 2017 meeting: Nick: 1) Network team continuing post-meeting: stuff's ok. 2) new tor-0.3.0.5-rc released; stable should be soon. 3) +1 on isabela's team meeting idea 4) + lots on doing _something_ to get more teamwise coordination. These meetings aren't doing that. 5) Nick's kid on spring break week-after-next; Nick will be offline more than usual Georg: 1) We made progress towards our transition to ESR52; there are first nightly builds available for testing; the announcement went to tbb-dev: https://lists.torproject.org/pipermail/tbb-dev/2017-April/000501.html 2) There was quite some interest in Amsterdam to get micropayment tools integrated into Tor Browser; we should have a position on that and a plan 3) Who is triaging user experience issues on trac (linda?) (the ux team?) (nobody?)? <- currently it seems "nobody" is the answer but Isabela is looking for a better solution Karsten: 1) Resolving remaining issues of OnionPerf deployment. 2) Simulating improved directory-request statistics for user number estimates. 3) Wrote down objectives and key results (OKRs) for Q2/2017. https://trac.torproject.org/projects/tor/wiki/org/teams/MetricsTeam#Objecti… Shari: 1) Heading to San Francisco for quick trip to meet with Mozilla. 2) Job description for grantwriter position was posted today. 3) Plans to talk with flexlibris next week about Global South stuff that came up at the Tor meeting. 4) Working with Jon to finalize dates for Montreal meeting so we can solicit input and start making plans. Isabela; 1) ISC project is over - submitted final report to them and will work on a blog post about our work at orfox - loop the team in it as well 2) Following up with SIDA, OTF proposals (that are in process) 3) working on march report for sponsor4 and build a spreadsheet for sponsor4 progress track 4) trying to finish the user growth strategy update - want to send to vegas leads for feedback first and then to internal 5) My goal right now is to get each team to build a roadmap and to think of dependencies they have with other teams and by when they would need those. Once we have that, my next step will be to figure out dependencies between teams. 6) I am off on Friday April 14.

1 0