tor-project

tor-project@lists.torproject.org

16 participants
2324 discussions

Support meeting pt2
by Colin Childs 23 May '16

23 May '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi all, It is time for another support meeting! Below is a Doodle[1] link, please indicate which times you are available. If none of the times work for you and you really wanted to attend, please send me an email and I will see about adding a different time slot to the Doodle or look into other ways to include you in the meeting . Thanks! [1]: http://doodle.com/poll/48wzda3yn54nxam9 - -- Colin Childs Tor Project https://www.torproject.org Twitter: @Phoul -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJXO4H8AAoJEJWQHABkmqq5CGUP+wQWxUNY5QqVJksIa/pKPCsC bstBukBOm5TdtfnJ0t/RnEbF3mexBrjipr1ya/z41dKsfEsH5n3/Kq/nzRETMsbM +vzWEgeYWyXNcvRIfbXV1UosU7jGIrmyDoDJWfmMQ9oExEBnXCY+QBpWTxoj0vEZ W6ClPFR0ID9i5+ZRI8SpKhegJDit5mrYwIsampT3VWjIAeJat/onv32VkAlVzxC1 W7dSSioP4n3xZuRfmoOgC/vkepqoBrX1HWZnEer+one9BQchBgQ0lKg0/783Jf6h Mq9A2M112etam/sN+Bna9J6fBLtiRNS9UOXn5+mwOuf/A0q8D6TuFFhaICSecP9Z bBONDr3Ai0FJLsxDO2Li30t1O2sh9syQSDPHeGyyXqEwwKfIx+l132H7ZhI+Xy9p 5/+WIN/jMS9NGzJcszM8Bs3U30C7egsh/JOmwYnaFv3eojdmCjkzQboHxHw6rI6O GbvFKT4O8/0c34Cv8kVMNYhHiWssfna++azPO9mwjmuFaeY0TXPRmLGG48GUs5HF n5STs0aliEUIknXH8KY/a6miO7SS9BboPQ7Cy5wQGx5NTQ/09lv88GphQNMJLoFl GOrpPly43b/2lzNsYS+HfK+H8O8BZjnW5CEMpe/hUNdivvZyFPzPwAAQ5kkEY7b1 vFNzIR8Rii74AEjv7Zw+ =388e -----END PGP SIGNATURE-----

3 3

Summary of meek's costs, April 2016
by David Fifield 21 May '16

21 May '16

Here's the summary of meek's CDN fees for April 2016. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 January 2015 $464.37 + $669.02 + $0.00 = $1133.39 February 2015 $650.53 + $604.83 + $0.00 = $1255.36 March 2015 $690.29 + $815.68 + $0.00 = $1505.97 April 2015 $886.43 + $785.37 + $0.00 = $1671.80 May 2015 $871.64 + $896.39 + $0.00 = $1768.03 June 2015 $601.83 + $820.00 + $0.00 = $1421.83 July 2015 $732.01 + $837.08 + $0.00 = $1569.09 August 2015 $656.76 + $819.59 + $154.89 = $1631.24 September 2015 $617.08 + $710.75 + $490.58 = $1818.41 October 2015 $672.01 + $110.72 + $300.64 = $1083.37 November 2015 $602.35 + $474.13 + $174.18 = $1250.66 December 2015 $561.29 + $603.27 + $172.60 = $1337.16 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 February 2016 $986.39 + $977.85 + $445.83 = $2410.07 March 2016 $1079.49 + $865.06 + $534.71 = $2479.26 April 2016 $1169.23 + $1074.25 + $508.93 = $2752.41 -- total by CDN $12613.50 + $13563.76 + $3111.46 = $29288.72 grand total https://metrics.torproject.org/userstats-bridge-transport.html?graph=userst… The number of users again stayed pretty flat during April 2016 at 10,000. Reminder that if you configure your own CDN or App Engine account and point it at https://meek.bamsoftware.com/, you will be using a completely unlimited bridge, which will go faster and help save money. == App Engine a.k.a. meek-google == Here is how the Google costs broke down: 6942 GB $833.06 6723 instance hours $336.17 https://atlas.torproject.org/#details/88F745840F47CE0C6A4FE61D827950B06F9E4… == Amazon a.k.a. meek-amazon == Asia Pacific (Singapore) 231M requests $278.22 594 GB $84.85 Asia Pacific (Sydney) 3M requests $4.06 17 GB $2.36 Asia Pacific (Tokyo) 881K requests $1.06 5 GB $0.70 EU (Ireland) 256M requests $307.32 2040 GB $161.79 South America (Sao Paulo) 9M requests $20.08 71 GB $16.90 US East (Northern Virginia) 120M requests $120.72 953 GB $75.70 -- total 621M requests $731.46 3683 GB $342.30 charge for alarms $0.50 https://atlas.torproject.org/#details/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == Zone 1 5183 GB $450.88 Zone 2 421 GB $ 58.05 -- total 5603 GB $508.93 https://atlas.torproject.org/#details/AA033EEB61601B2B7312D89B62AAA23DC3ED8… Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

1 0

The Akamai slide Alec posted
by Ian Goldberg 20 May '16

20 May '16

Does anyone know where we can get more information about the stats behind this slide: https://twitter.com/AlecMuffett/status/730773970383982592 The slide says: 1:11,500 non-Tor IPs contained malicious requests 1:380 Tor exit nodes contained malicious requests The way it's worded, it sounds like they're saying "1/11500 of the non-Tor IP addresses we saw sent malicious requests, and 1/380 of the Tor exit node IP addresses we saw sent malicious requests", but I'm finding that hard to believe, since 1/380 of the Tor exit node IP addresses is ~3 IP addresses. It's unlikely that all malicious Tor traffic was confined to 3 exit nodes. (But interesting if true.) Were they perhaps being a little loose and really meant "1/11500 TCP connections coming from non-Tor IP addresses, and 1/380 TCP connections coming from Tor exit nodes, contained malicious requests"? Thanks, - Ian

2 2

dates for Seattle TorDev
by Shari Steele 20 May '16

20 May '16

Hey all. We’ve settled on dates for the next TorDev meeting. It will be in Seattle from September 26-30. We’re working on securing a block of rooms and will send more information soon. Shari

1 0

brief downtime of some services, including mail
by Peter Palfrader 19 May '16

19 May '16

Hey, just a quick heads-up. The friendly people who host some of our hardware have to shuffle things around in their racks. As a result, two of our machines that host a couple of VMs will be down for a few hours starting around 1600Z. Services that will be down include mail, lists, rt, torperf, gettor, translation, compass, jenkins. If all goes well, things should be back a few hours later. Cheers, -- | .''`. ** Debian ** Peter Palfrader | : :' : The universal https://www.palfrader.org/ | `. `' Operating System | `- https://www.debian.org/

1 1

Notes from May 12 2016 Vegas team meeting
by Karsten Loesing 17 May '16

17 May '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for May 12 2016 meeting: Mike: 1) I reviewed a bunch of sandboxing tech for Tor Browser. I think I have the outlines of what a sandbox would look like that blocks some/most/all of the information obtained by the FBI exploit (we'll likely do best on Linux and Mac, but can still block proxy bypass on windows). I will be sending that to the Tor Browser team shortly. 2) Got an email from Disconnect. They are working to restore Google searches.. Georg: 1) We worked on getting the ESR45 based Tor Browser into stable shape (there are still things left to do) 2) I worked on our search engine situation (Disconnect does not have Google results anymore) Nick: 1) Doing code review and encouraging others by formal pressures: Till the needs-review tickets of May 10 are reviewed, I'm not reviewing other (non-critical) stuff. [Talking with Isabela about this, and applying structural pressure. It's going fine.] 2) Need to get SVN access to Seattle folks. I need to hear from Shari about whether it's internal or corp+internal. (Is Shari on?). [Outcome: Shari says Jon should have access. So I added him.] 3) Resolved UDRP with help from Peter and Wendy. Put my Google voice # as the contact. Now I am getting 4-5 no-message calls there per day. (I have ringing disabled.) [Outcome: waiting for decision on which phone number should get all the phonespam.] Isabela: 1) Pick up SIDA proposal 2) tomorrow is DRL call I sent an email about it 3) sent a blog post for fact check to Roger and Nick Katie: 1) CloudFlare meeting and next steps 2) FBI exploit hearing happening today in Washington State. Mozilla has requested that it see the exploit first. 3) Isis media and training going well so far :) 4) Rule 41 5) Fastly opportunity Shari: 1) Talking with Duck Duck Go to see if their search engine might be a good way to go for Tor Browser. 2) Talking with Laura Cunningham from DRL to see if I can get a good read on whether they really want TorDev in Valencia in 2017. 3) Jake's back. How can he best engage? Karsten: 1) Reviewed CollecTor patches and discussed design changes with iwakeh. 2) Spent some time writing a possible funding proposal for metrics work. 3) Please read responses to notes posted to tor-project@ and respond if people ask questions about your notes. Alison 1) Still collecting user feedback around CloudFlare stuff. Contacted all of the allies that were on my list, heard from only one, and that one hasn't told me yet if I can share their comments with the group. 2) Reaching out to allied people (journalists, activists, attorneys, etc) to see about getting more varied involvement in the community team 3) Continuing to work on the membership doc, social contract, and support manual here and there in the midst of hectic travel and speaking schedule. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXOueAAAoJEC3ESO/4X7XBVgcH/09pGr0Pq6zAxPbqPiXML+Su f+ZxDQpftO+QRmWHOR2mzakpudIZIjUBgJkp41zSxfqsbQ2luwG+/bfZZGAdqm0F hDHFNZPJG0pQ0k2fhHNVl3ngsnYrGoMxLukRahgpzEl4hwpFJQUWiWvv0hNhHcIW +zbSSIbVbJJbhH3N4726TmxAzQxQFKCcTaSPtQzwxWcVlgexz2vFVcfEM+TPWfGy AA+ZC+1Pcr4qBB/v25ryK4OM5LWRpXVbkA6wZjuALXWfy+npQEokgHF4E/gRwZj9 SO2gvAFnSbUgTmez0GWVs+sCUgrTz8PihvQnKAkzRwdRqL+0wjDjZllqgE3xK6M= =Jfvw -----END PGP SIGNATURE-----

1 0

Re: [tor-project] Google lifted sanctions on Iran
by Nathan Freitas 16 May '16

16 May '16

On Sat, May 14, 2016, at 04:07 PM, Nima Fatemi wrote: > Good news! Google finally lifted sanctions on Iran. This means Iranians > are no more censored from both ends and can now take advantage of > censorship circumvention techniques like meek-google. Any practical impact on Google Play downloads? I've been seeing those as tracked from Iran for quite awhile now, but perhaps people were still using VPNs? > Heck, I think we can even accept GSoC students from Iran, now. Oh yes, put me down for mentoring that, for sure! +n

1 0

Re: [tor-project] Launching Ethics Guidelines
by isis 16 May '16

16 May '16

Virgil Griffith transcribed 10K bytes: > I accidentally put tor-project@ on the To: field. Sorry about that. A *likely* story. I put tor-project@ back in the To: field. > Although I personally don't consider this content to be dangerous, at > least one person will consider it so, and I'd rather not antagonize > that person. Heh. > I renamed the URL to: [snipped the URL] > Share as you see fit. I'll refrain from stooping to your level, thanks. > -V The above URL to dropbox which Virgil gave me contains extremely detailed logs of user behaviour, including: - timestamp accurate to the second - IP addresses (where only the final octet is scrubbed, reducing the set of possible IPs in question to ~253) - onion service requested - full URI requested - onion service response code > On Thu, May 12, 2016 at 5:43 PM, Virgil Griffith <i(a)virgil.gr> wrote: > > Apparently tor-assistants@ no longer exists? Well, here's the logs. > > Share with whomever you think is appropriate. > > > > ============================================================ > > The earlier dates were on a different hard drive. Here's the oldest > > date I have on hand: Jan 25, 2016. > > > > https://dl.dropboxusercontent.com/u/3308162/2016-01-25.log.gz This file was replaced with a new one, which says the following: > Oops! Didn't mean to post this URL to a public mailing list. My goof. > > I renamed the file and sent the new URL to isis and Matt Finkel. If you > want the data, talk to either of them. I trust each of them to distribute > the data however they see fit. > > In releasing this day's worth of data, my goal is concretize the discussion > of how much de-anonymizing power this data provides. > > I claim two things: > (a) Forbidding any Tor community member from using Google Ads on a > Tor-related website is overbroad. > (b) The de-anonymizing power of onion.link's minimized logs is > substantially less than Google Ads (or equivalent). > > If (a) is not true, reasonable next candidates for banishment include, and > are not limited to: > > * Grams http://grams7enufi7jmdl.onion [onionsite] > * DailyDot http://www.dailydot.com/tags/tor [clearnet] > * DeepDotWeb http://deepdot35Wvmeyd5.onion [double whammy! DeepDotWeb > tracks users on its onionsite *AND* clearnet > https://www.deepdotweb.com/] > > And last I checked these were popular upstanding onionsites. > > Obviously some people will dislike (a). And thus some people will dislike > (b). And that's okay. The community (obviously) doesn't wish to > unanimously approve of every Tor onion-site. The question is whether using > an ad-network is a bannable offense. > > Given (a) is not a bannable offense, and additionally badness(b) < > badness(a). Ergo (b) not a bannable offense. To my knowledge, The Daily Dot has never attempted to sell Tor user data to INTERPOL. > > SHA1: f5eaab44c04e483ffe24c58ec558fdfaefb610b2 > > > > I forthrightly attest that: > > > > (1) these logs are socially very interesting, but not actively dangerous. > > > > (2) these logs are substantially less dangerous than running Google > > ads, which was the alternative. > > > > Rebuttals are welcome on tor-project@ . > > > > If you want to see the minimized logs for a specific day I can do that too. Hmm… I think I've heard the word "minimised" in reference to bulk metadata collection before… -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://fyb.patternsinthevoid.net/isis.txt

2 1

Google lifted sanctions on Iran
by Nima Fatemi 15 May '16

15 May '16

Hey all, Good news! Google finally lifted sanctions on Iran. This means Iranians are no more censored from both ends and can now take advantage of censorship circumvention techniques like meek-google. Heck, I think we can even accept GSoC students from Iran, now. Big kudos to those who worked hard to make this happen. Thought I'd share this news with you. Best, -- Nima 0XC009DB191C92A77B | @mrphs "I disapprove of what you say, but I will defend to the death your right to say it" --Evelyn Beatrice Hall

2 1

Fwd: Launching Ethics Guidelines
by Tom Ritter 14 May '16

14 May '16

I saw https://trac.torproject.org/projects/tor/wiki/org/meetings/2015SummerDevMee… and it notes "Create thread on tor-dev." I couldn't find that thread. But since the below is relevant for this, I figured I'd forward it here. He says not to be intimidated by the length of the document, but I am anyway. Unsurprisingly the tl;dr section was the most appealing to me: http://networkedsystemsethics.net/index.php?title=Networked_Systems_Ethics#… ---------- Forwarded message ---------- From: Bendert Zevenbergen <bendert.zevenbergen(a)oii.ox.ac.uk> Date: 3 May 2016 at 10:08 Subject: [OTF-Talk] Launching Ethics Guidelines Dear All, Today I’m launching the outcome of my OTF information controls fellowship on the Ethics of Networked Systems Research: http://networkedsystemsethics.net. Here a short explanation: These Networked System Ethics guidelines aim to underpin a meaningful cross-disciplinary conversation between gatekeepers of ethics standards and researchers about the ethical and social impact of technical Internet research projects. At heart of this work is the iterative reflexivity methodology that guides stakeholders to identify and minimize risks and other burdens. These must be mitigated to the largest extent possible by adjusting the design of the project before data collection takes place. The aim is thus to improve the ethical considerations of individual projects, but also to streamline the proceedings of ethical discussions in Internet research (or product development) generally. The primary audience for these guidelines is technical researchers (e.g. computer science, network engineering, as well as social science) and gatekeepers of ethics standards at institutions, academic journals, conferences, and funding agencies. It would be great if these guidelines do get used beyond academic research in civil society, product development, or otherwise. This is not just my work, but these guidelines were developed in cooperation with many great people who attended workshops worldwide. Here’s a workshop report and a case study that show how this work developed: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2666934 http://bdes.datasociety.net/council-output/case-study-no-encore-for-encore/ I’m very interested to hear if you have applied these guidelines to your projects, or whether you have comments on this work! Feel free to forward this email..! Many thanks to OTF for making this possible and their excellent support! Ben ------------------------------------------------ Ben Zevenbergen DPhil (PhD) Candidate Oxford Internet Institute University of Oxford Senior Fellow Open Technology Fund

11 24

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

tor-project