- tor-project - lists.torproject.org

Citizen Lab Summer Institute 12-14 July in Toronto-- deadline tomorrow!
by Alison 20 Apr '17

20 Apr '17

Apologies for the last minute notice, but I just found out about this and thought maybe folks on this list might want to cobble together a last minute application. >From their website: "The Citizen Lab Summer Institute (CLSI) is a meeting place for researchers and practitioners from academia, civil society, and the private sector who are working on Internet openness, security, and rights. It brings together perspectives from a wide range of backgrounds across technical and social science disciplines. Participants range from established experts to those just entering the area." https://citizenlab.org/summerinstitute/2017.html

1 0

Weekly UX meeting on Jitsi!
by Linda Naeun Lee 20 Apr '17

20 Apr '17

Hi all, We're meeting weekly on https://meet.jit.si/TorUX on Mondays at 15:00 UTC. Currently, it's going to be discussions about redesigning the website. Feel free to listen in on what is going on, if you are curious.

2 4

Fwd: Tor Research - Re: Weekly UX meeting on Jitsi!
by Linda Naeun Lee 20 Apr '17

20 Apr '17

Hello UX meeting-y people (and I've cc'ed tor-project as well, if anyone wants to give me their two cents): I have gotten an unusual request--a researcher wants to observe us. Are there guidelines on this sort of thing? My immediate gut reactions is: well, this is technically a public channel but having someone observe us and participating are different. And as a researcher, I know that people being aware that they are being observed cause them to act differently versus when they are unaware anyway (not that he shouldn't have asked for consent, he definitely should have). What are your thoughts? ---------- Forwarded message ---------- From: COLLIER Ben <s1263350(a)sms.ed.ac.uk> Date: Wed, Apr 12, 2017 at 7:10 AM Subject: Tor Research - Re: [tor-project] Weekly UX meeting on Jitsi! To: "linda(a)torproject.org" <linda(a)torproject.org> Dear Linda, I hope that this finds you well. I'm a doctoral researcher at the University of Edinburgh currently researching the Tor Project and the broader Tor community - in particular my research seeks to explore how antisurveillance tech communities discuss and express values through design processes. I've been conducting some initial interviews with members of the Tor community and I was hoping to carry out some online research - in particular sitting in on a couple of discussions like the one on Jitsi mentioned in your email below. In terms of meetings like this one, or on Tor Project's IRC channels, do you think it would be possible for me (with the consent and knowledge of participants) to observe and include these in an anonymised form in the research? If so, I'm very keen to conduct these in a mindful and respectful way, and to minimise any disruption, and would be happy to discuss the best way to do this in this particular case. I would also be very happy to feed back and discuss my findings with participants and the wider community once the research is complete. I'm also absolutely happy to answer any questions or discuss any concerns which you or any other member of the team have about my research. Very best, Ben Collier Twitter: @JohnnyHistone Scottish Centre for Crime and Criminal Justice Research: http://www.sccjr.ac.uk/about-us/people/ben-collier/ Edinburgh University PhD Student Profile: http://www.law.ed.ac. uk/research/students/viewstudent?ref=339 PhD Blog: https://bencollierblog.wordpress.com/ ------------------------------ *From:* tor-project <tor-project-bounces(a)lists.torproject.org> on behalf of Linda Naeun Lee <linda(a)torproject.org> *Sent:* 11 April 2017 20:22:14 *To:* tor-project(a)lists.torproject.org; ux(a)lists.torproject.org *Subject:* [tor-project] Weekly UX meeting on Jitsi! Hi all, We're meeting weekly on https://meet.jit.si/TorUX on Mondays at 15:00 UTC. Currently, it's going to be discussions about redesigning the website. Feel free to listen in on what is going on, if you are curious. The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

3 4

Post Doctoral Fellow Position (Australia)
by teor 20 Apr '17

20 Apr '17

Hi All, My employer is advertising the following position, which closes 23 April 1200 AEST (0300 UTC): The University of New South Wales Australian Centre for Cyber Security (ACCS) is seeking a Post-Doctoral Fellow on a 2-year contract. The position is open to candidates working in cyber security or any related area. This includes, but is not limited to machine learning, AI, knowledge management, simulation, privacy, or any area that can be applied to cyber security. For more information, including salary, benefits and potential duties, please see the following: https://www.unsw.adfa.edu.au/post-doctoral-fellow-australian-centre-cyber-s… The University of New South Wales is international well-respected, and consistently within the World Top 100 rankings. The Australian Centre for Cyber Security (ACCS) is a focal point for the research of some 60 scholars from various faculties across UNSW who conduct research work on different aspects of cyber security. The Centre is based in Canberra at the Defence Force Academy that provides both advanced research as well as undergraduate and graduate education on cyber security. ACCS serves as a national hub for policy related research and education across the full spectrum of cyber security (hardware, software, payload, networks, policy, human factors, organizational factors and the information ecosystem). ACCS offers five distinct Masters programs, an undergraduate program and supervisors a number of doctoral candidates within their research programs. -- Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org ------------------------------------------------------------------------

1 0

Network team meetings notes from 17 April 2017
by isabela 19 Apr '17

19 Apr '17

Hi! Our meeting transcript is at http://meetbot.debian.net/tor-dev/2017/tor-dev.2017-04-17-17.01.html Below our status report from this week =========== ahf: Last week: - Short week due to easter in DK Thursday + Friday. - Finished cleaning up the patches for #21662, #21663, #21664. - Started uploading patches for #21662 + #21663 + #21664 to https://gitlab.com/ahf/tor/tree/prop278/21663 for review. Should be done tonight Danish time. - All the dirty code, except streaming support, is in https://gitlab.com/ahf/tor/tree/bugs/21663 This week: - Going to work on reviewing Nick's consdiff code. - Figure out a sensible upper bound for the LZMA code. (#21665) - Add the missing header code for Prop#278 to the directory code (#21667) catalyst: - last week was mostly house-hunting in Wisconsin with spouse - week before that, refactored some baseNN code - deleted some base64 code (nopad stuff) - still a fair amount of work to do in that space, will try to outline some recommendations when i get a chance - started to look at anti-censorship stuff (sponsorM) isis: Last week: - finished specification (first draft) of social bridge distributor - talked over some parts of draft with other cryptographers - finished up some loose ends of OTF contract This week: - Finish setting up the meek tunnel to BridgeDB - Sketch out notes on UX ideas for Linda - Sketch out API for TBB team - Close out OTF contract on Friday asn: Last week: - Busy on #21859 which is gonna be used both by service and client-side of prop224 - Reviewed various HS groundwork tickets - Helped collect PT/censorship tasks that must be done on the short-term - Tried to do some extra validation of ed25519 pubkeys based on discussion with Ian. Failed. This week: - More work on e2e circuit stuff #21859 - More work on implementing the validation required for ed25519 keys Mike: Last week: - Distracted by taxes and not feeling well This week: - Will fix up #16861 and rebase Adaptive Padding patches onto it - Further Adaptive Padding work pastly: - tentative amazing results from very large kist network simulation - more simulations in progress to confirm results - paper written and submitted by May 2nd - lots of progress implementing flexible scheduler selection - added preprocessor stuff to disable kist if it is impossible to run (like on windows/osx) questions: - is a consensus param desired to set UseKIST network-wide? - if so, how do? pointers to code that does something similar? ["Yes; see use of networkstatus_get_param()". -nick] Isabela - sent out sponsor 4 march report - start prepping for team roadmap/dependecy tracking exercise Nick - Reviewed lots of prop224 backend code. - Finished "consdiffmgr" branch, which is the server-side backend for prop140. Now under review. - This week: on vacation! I'll be reviewing code, not a lot more. dgoulet - prop224 backend work with #21888 - hidden service, hidden service, hidden service

1 0

Re: [tor-project] meek-azure funding has run out
by Sina Rabbani 19 Apr '17

19 Apr '17

Dear Team, I have good news, Rabbi Rob Thomas (robt(a)cymru.com) is going to cover the costs associated with keeping meek alive. So far I have setup 2 new accounts with Amazon and Azure and working to confirm the functionality. https://d183ohpl22nq2f.cloudfront.net/ https://meek.azureedge.net/ Cloudfront is working fine and i'm trying to resolve issues with the Azure CDN. Is there a ticket I can update with these details? I think I should also bring up a backend server (bridge) and share the new config lines for the Tor Browser Bundle. I'm hoping to get all this done by Monday or sooner. Thank you David for keeping this service operational for so long and thank you Rob for keeping it alive! All the best, Sina "Be the change that you wish to see in the world." - Mahatma Gandhi ----- On Jan 19, 2017, at 2:17 AM, Yawning Angel yawning(a)schwanenlied.me wrote: > On Mon, 9 Jan 2017 20:08:03 -0800 > David Fifield <david(a)bamsoftware.com> wrote: > >> On Mon, Jan 09, 2017 at 03:06:17PM -0800, Shari Steele wrote: >> > Hey David. >> > How much money do we need for 2017? >> >> The total for meek-azure November 2015 to November 2016 was $6290.69, >> or about $525 a month on average. I believe it could go 2× or higher >> if we relaxed rate limits. meek-amazon is higher, $13756.30 or >> $1150/month over the same time period. > > Has there been any progress on finding alternative funding for this? > dcf's comments on trac indicate "no", which would be unfortunate. > > -- > Yawning Angel > > _______________________________________________ > tor-project mailing list > tor-project(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-project

7 12

Community team meeting report 19 April
by Alison 19 Apr '17

19 Apr '17

Hi everyone, The Community Team has started using MeetBot for better meeting logs and reporting. Here's our MeetBot log for today's meeting: http://meetbot.debian.net/tor-project/2017/tor-project.2017-04-19-18.01.log… Alison

1 0

Arranging new default obfs4 bridges
by David Fifield 17 Apr '17

17 Apr '17

In November 2016 there was a discussion on the tor-team list about adding some new default obfs4 bridges (Subject: Coordinating to run high capacity obfs4 bridges). The thread turned into a discussion about the same entity running both bridges and exits, and didn't go anywhere. We haven't added any new obfs4 bridges, or changed the port number of any existing bridges, since January 2017 (Tor Browser 6.5 and 7.0a1). I suspect that the 20 existing default bridges are still under high load and we could stand to have some more bridges to help share it. Are we still interested in adding new obfs4 bridges? If so, do we have any leads on who could run them?

8 16

OONI team's Status Report - March 2017
by Arturo Filastò 17 Apr '17

17 Apr '17

Hello Tor people, Below is an update on what the OONI team has been up to in March 2017: # OONI Monthly Report: March 2017 The OONI team made steady progress in March 2017. We published research reports in collaboration with our Southeast Asian partners and we participated in outreach and community engagement efforts. We released ooniprobe 2.2.0 which features our new web UI, improvements based on community feedback, and translations for 4 languages. We also developed and released a new test that examines the reachability of Telegram. Below we provide some highlights from OONI's activities in March 2017. ## Publication of research reports Over the last months the OONI team has been collaborating with digital rights organizations on the study of internet censorship in Southeast Asia. In collaboration with our partners, we published the following research reports in March: 1. The State of Internet Censorship in Thailand: https://ooni.torproject.org/post/thailand-internet-censorship/ (OONI, Sinar Project, Thai Netizen Network) Over the last 4 months, ooniprobe was run across 16 local vantage points in Thailand, through which we collected and analyzed thousands of network measurements with the aim of examining and uncovering recent censorship events in the country. Our study also includes an examination of Thailand's legal environment and network landscape. The key findings of our study confirm the blocking of 13 websites in Thailand across 6 different ISPs, including the following types of sites: * News outlets (nypost.com and dailymail.co.uk) * wikileaks.org * Circumvention tool sites (such as hotspotshield.com) * Pornography Thai ISPs appear to primarily be implementing censorship through DNS hijacking and through the use of middle boxes (HTTP transparent proxies) which serve block pages. Since sites were not found to be blocked across all networks, Thai ISPs appear to be blocking websites at their own discretion. On a positive note, the Tor network, WhatsApp, and Facebook Messenger were found to be accessible across all 16 networks in Thailand where tests were run during the testing period (6th November 2016 - 27th February 2017). 2. The State of Internet Censorship in Myanmar: https://ooni.torproject.org/post/myanmar-report/ (OONI, Sinar Project, Myanmar ICT for Development Organization) As part of our study, OONI software tests were run across 6 local vantage points in Myanmar between 25th October 2016 and 28th February 2017. These tests are designed to measure: * Blocking of websites; * Blocking of Whatsapp and Facebook Messenger; * Blocking of Tor; * Presence of middle boxes (i.e. systems that could be responsible for censorship or surveillance). Upon analysis of thousands of network measurements, we did not detect any block pages that could confirm any cases of internet censorship. Five sites, however, including those of the U.S. embassy in Myanmar and of the Organization of American States (OAS) presented signs of TCP/IP and HTTP blocking. While OONI software tests detected the presence of Blue Coat software (some types of which can potentially be used for internet censorship and surveillance) in Myanmar back in 2012, we did not detect the presence of this software in any of the 6 networks where tests were performed. On another positive note, WhatsApp, Facebook Messenger, and the Tor Network were found to be accessible in all 6 networks in Myanmar throughout the testing period. 3. Examining internet blackouts through public data sources: https://ooni.torproject.org/post/examining-internet-blackouts/ In response to community requests for the need of a methodology for measuring internet blackouts, OONI released a post which explains how we examine internet blackouts through public data sources. This post also includes an ipython notebook which shows how to automatically analyze Google traffic data with the aim of identifying internet blackouts: https://ooni.torproject.org/notebooks/internet-blackouts-google-traffic.html (https://ooni.torproject.org/notebooks/internet-blackouts-google-traffic.ipy…) ## Stable release of ooniprobe 2.2.0 The OONI team worked towards the release of ooniprobe 2.2.0 in March. The latest version of ooniprobe includes: * Re-designed web UI * New IM test for Telegram * Improvements to ooniprobe based on community feedback * Translations in 4 languages: Spanish, French, Italian and Hindi Full release notes can be found here: https://github.com/TheTorProject/ooni-probe/releases/tag/v2.2.0 ## Progress on data processing pipeline Throughout March OONI made a lot of progress on our data processing pipeline. We have been running the new iteration of the pipeline in parallel to the current pipeline and fixing various issues that we have been encourtering along the way. ## Outreach and community engagement The OONI team participated at the following events in March as part of its outreach and community engagement efforts: * Vietnam Cyber Dialogue (VCD) -- Valencia, Spain: 5th March 2017 * Internet Freedom Festival (IFF) -- Valencia, Spain: 6th-10th March 2017 * Iran Cyber Dialogue (ICD) -- Brussels, Belgium: 27th-28th March 2017 * RightsCon -- Brussels, Belgium: 29th-31st March 2017 As part of these events, the OONI team facilitated the following OONI sessions: 1. OONI Knowledge-sharing session -- Vietnam Cyber Dialogue (5th March) 2. OONI Skill-sharing session -- Vietnam Cyber Dialogue (5th March) 3. "Investigating Information Controls with OONI" -- Internet Freedom Festival (7th March) 4. "Building Community Resources for Censorship Measurement Research" in collaboration with the Citizen Lab -- Internet Freedom Festival (9th March) 5. "Measuring internet censorship during the Iranian elections" -- Iran Cyber Dialogue (28th March) 6. "Advances in measuring internet shutdowns" --- RightsCon (29th March) 7. "Collecting evidence of internet censorship in Southeast Asia and beyond" in collaboration with Sinar Project -- RightsCon (30th March) We published a blog about the above here: https://ooni.torproject.org/post/ooni-iff-rightscon/ In addition, the OONI team also attended the Tor Meeting in Amsterdam between 23rd-26th March. This provided the OONI team with the opportunity to work on its roadmap for the next 6 months. Finally, the OONI team hosted an OONI Community Meeting on https://slack.openobservatory.org/ on 21st March. As part of the meeting, the following agenda items were discussed: 1. How to set up a script to check websites accessibility via Tor Browser. It would be great to store the records on a website to stress the importance of a smooth and troubleless Tor user-experience online, pushing websites to allow Tor-users more access. 2. Brainstorming on ways to improve measurements in at-risk countries. 3. Discussion on how one can run custom tests, decks and inputs via ooniprobe. 4. Discussion on setting up a large deployment in India to detect region-specific mobile censorship. ## Userbase In March 2017 ooniprobe was run 84,829 times from 2,271 different vantage points across 170 countries around the world. This information can also be found through our stats here: https://measurements.ooni.torproject.org/stats ~ The OONI team

1 0

Summary of meek's costs, March 2017
by David Fifield 17 Apr '17

17 Apr '17

Here's the summary of meek's CDN fees for March 2017. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 all 2015 $8006.59 + $8146.83 + $1292.89 = $17446.31 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 February 2016 $986.39 + $977.85 + $445.83 = $2410.07 March 2016 $1079.49 + $865.06 + $534.71 = $2479.26 April 2016 $1169.23 + $1074.25 + $508.93 = $2752.41 May 2016 $525.46 + $1097.46 + $513.56 = $2136.48 June 2016 $0.00 + $1117.67 + $575.50 = $1693.17 July 2016 $0.00 + $1121.71 + $592.47 = $1714.18 August 2016 $0.00 + $1038.62 + $607.13 = $1645.75 September 2016 $0.00 + $932.22 + $592.92 = $1525.14 October 2016 $0.00 + $1259.19 + $646.00 = $1905.19 November 2016 $0.00 + $1613.00 + $597.76 = $2210.76 December 2016 $0.00 + $1569.84 + $1416.10 = $2985.94 January 2017 $0.00 + $1550.19 + $1196.28 = $2746.47 February 2016 $0.00 + $1454.68 + $960.01 = $2414.69 March 2016 $0.00 + $2298.75 + $0.00 = $2298.75 -- total by CDN $13138.96 + $28644.09 + $10202.06 = $51985.11 grand total https://metrics.torproject.org/userstats-bridge-transport.html?start=2017-0… During March, we changed the CDN infrastructure of meek-azure to one that is no longer operated by me, so the cost of Azure is no longer available to me. https://lists.torproject.org/pipermail/tor-project/2017-March/000999.html https://bugs.torproject.org/21342 The changeover happened on March 3. The Azure billing cycle started on March 5, so there are zero charges for March. meek-azure was completely non-functionable between March 3 and March 7, when Tor Browser 6.5.1 was released. Similarly the CDN configuration for meek-amazon is about to change too, so this will probably be the last month I am able to report its costs. https://lists.torproject.org/pipermail/tor-project/2017-April/001092.html https://bugs.torproject.org/21918 == Amazon a.k.a. meek-amazon == The Amazon cost was higher than usual--perhaps as a result of meek-azure being non-functional for a few days. EU (Ireland) 705M requests $846.50 6645 GB $533.26 Global 9M requests $9.73 42 GB $3.29 US East (Northern Virginia) 515M requests $515.60 4899 GB $389.87 -- total 1230M requests $1371.83 11587 GB $926.42 charge for alarms $0.50 https://atlas.torproject.org/#details/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == Usage of meek-azure started to recover after being switched to another backend on March 7. https://atlas.torproject.org/#details/AA033EEB61601B2B7312D89B62AAA23DC3ED8… https://atlas.torproject.org/#details/8F4541EEE3F2306B7B9FEF1795EC302F6B84D… Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

1 0