- tor-project - lists.torproject.org

Fwd: Tor as client for Final Year Project?
by Shari Steele 14 Sep '16

14 Sep '16

Hey all. Anyone interested in working with Louis? Shari > Begin forwarded message: > > From: "Woods, Louis" <k1308517(a)kingston.ac.uk> > Subject: Tor as client for Final Year Project? > Date: September 13, 2016 at 1:53:27 PM PDT > To: "execdir(a)torproject.org" <execdir(a)torproject.org> > > Dear Tor, > > I am a Computer Science student at Kingston University in London. I recently concluded my software development placement year in industry, and I am about to commence my final year at university. > > I have to undertake a Final Year Project, where I have to apply my programming skills to create an application or website. I already have an idea in mind, which I also believe would be beneficial to your organisation. > > My project is a web application which works in a similar way to the software TrueCrypt/VeraCrypt (an encryption software with plausible deniability). This can be used in countries with Human Rights Abuses, as the first password is just a dummy password which decrypts unimportant information. However there may be a second password hiding sensitive information, but nobody except the user knows this. > > <>My project requires a client, which can be a person or corporation. It would help me enormously to have your well-known and respected organisation’s name on my dissertation report, as you have similar goals to my project’s focus. Essentially, I already have the idea and a plan, your input would be minimal, aside from a few discussions, feedback on features and usability, and of course written proof that you are a client so I can include this into my report. > > Depending on the success of my project you may be able to utilise it for your own purposes in the future. > > Regards, > > Louis Woods

1 0

Matt Blaze, Susan Landau and Ron Wyden in WIRED on FBI Mass Hacking
by Kate 14 Sep '16

14 Sep '16

Good morning! What a great op-ed from Matt Blaze, Susan Landau, and Senator Ron Wyden. It talks about the collateral damage that Rule 41 could cause: https://www.wired.com/2016/09/government-will-soon-able-legally-hack-anyone/ Cheers, Katie

1 0

Tor at Aaron Swartz Day in SF
by Alison 13 Sep '16

13 Sep '16

Hello, good people of Torlandia, The organizers of Aaron Swartz Day [1] would like to give Tor folks a dedicated space during their Sunday hackfest on November 6. The possibilities for this space are pretty open-ended -- we could do Tor tutorials, exciting new things coming up in the Tor world, hacking, presentations of Your Exciting Project That Uses Tor, whatever we want really. We can take up whatever amount of time we want during the day. I will be doing some kind of LFP presentation on Saturday, and am willing to organize the Sunday Tor stuff with whoever else wants to participate. If you are a Bay Area Tor person, or you'll be there the weekend of November 5-6, let's start organizing. I am in favor of organizing onlist because maybe people who can't be there in person have ideas about what we should do. This is a special event honoring Aaron's life and legacy, and I had a great time participating last year. Also, Chelsea Manning is heavily involved in this year's planning. I highly recommend participating if you are able. Alison [1] http://www.aaronswartzday.org/

2 3

Notes from September 8 2016 Vegas team meeting
by Karsten Loesing 13 Sep '16

13 Sep '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for September 8 2016 meeting: Nick: 1) I want to promote "blind hiring" for my team's next opening, whenever that is. Should I talk to Erin W about it? 2) Should/could I be on fewer MLs? 3) Any way to treat "everybody's attention" as a shared resource? 4) Coding continues. 5) Infrastructure for new folks. 6) Has anybody been reading through the replies on the "hey relay ops how can we help" thread and compiling/responding? Alison: 1) Agenda emails: getting great feedback. Now how to incorporate this into how we typically create the meeting agenda? People like the morning brainstorm session. We could use this feedback to communicate a broad overview of priorities, then use the first morning time to get identify the specific work sessions that people want to do. 2) Public hack days: outreach and planning 2a) Outreach: Katie did a save the date. We need to think about promotion to different groups. I've been in touch with some. 2b) Activities: high level/nontechnical short talks/tours about Tor, list of tickets for newcomers to work on, cool stuff in recent Tor/TBB releases, etc. 3) Metrics for relay operators: community team members are working with the metrics team to help support relay operators. We got feedback from the operators about what kinds of metrics might be valuable to them, and the biggest response we got was that they want to see some kind of recognition for their relay uptime/bandwidth. So we are working out the details of what to measure, but the result will be something like a weekly email to the community team with the relevant metrics, then one member of the team will write to that relay operator and congratulate them, organize sending them some swag, ask about how things are going generally, etc. Isabela: 1) Finished OTF proposal 2) Had kickoff meeting for Tor Browser for Android (Orfox) ISC project 3) Prep for internal launch of style guidelines 4) Prep for dev meeting 5) Organizing somethings for MOSS project to keep track of deliverables 6) Had my first meeting with OONI as part of a biweekly meeting I will have with them to help PM their projects 7) Moved to OONI-DRL proposal now 8) pre-preping for Linda start 8a) (reading UX paper Geko asked me to, getting materials for metrics.tpo.org and orfox tor button/security slide ux etc) Kate: 1) Senator Ron Wyden is pushing for a US Senate to consider bill to stop the legalization of some FBI hacking 2) Blog posts aplenty Mike: 1) Still working on Copperhead. They are having issues with the Android Open Source Project being disorganized while switching to the latest release. I am working on getting updates to work smoothly-ish through this transition. 2) Worked on the Netflow padding traffic analysis defense code. Have a new branch ready for review. 3) Helped with the OTF proposal. 4) Talked with Mozilla (with Georg, Tom Ritter, Huseby, and Richard Barnes) about what they need from us to help reduce the difference between Tor Browser and Firefox. Shari: 1) We’re gearing up for the Tor meeting in a couple of weeks. Anyone have any outstanding issues or questions? 2) I’ve told Pepe from IFF that the next Tor meeting won’t be in Valencia. IFF is 3/6-10. Does anyone from Tor want to go? Would anyone like to be on the IFF organizing committee? 3) Riseup's in trouble. I'm going to follow up with Micah to see if Tor can help. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJX17G7AAoJEC3ESO/4X7XB6OUH/A7fWtRKESkQ3UbgWGeWPkyu WgCPNSjdopM64LFkQTo4HQhiyb923mOBwO4WLJ0YluD4JvDlS8s6B37Aa9W1Km5c SXoekE0FlpMF7HRTz4Ot5CyvaNGSmYB5VFBR6hpotaqLT+WOHwCXcMfyeU8HtxQD MyjVbp9Xllvd/EKfNu6h+3Nq0L7E9guvz3NeP2b8WJfirR7mKDMFiI91HnuVK9z7 Odp/3VEZaAg5JxS57ng9PX21yagEEcEou1dn5HJn8V5EMQFot5uDaTD4IeCl2KCp VR+G/VK47ThHqZHfrfPP8pMbwBbhASofqqZpe6cj8MQvdvmdrupHUN/RSHTUmKY= =lDJ7 -----END PGP SIGNATURE-----

1 0

Updating Fallback Directories
by teor 08 Sep '16

08 Sep '16

Hi Everyone, Some time in September, I want to update the list of fallback directory mirrors for Tor 0.2.9. This means: * emailing the 85 operators in the 0.2.8 list to remind them not to change their relay details, * generating a list of new stable relays for 0.2.9, * emailing these operators (maybe 100?) to ask them if their relay will be around for 2 years, * generating a list of fallbacks for inclusion in an 0.2.9 alpha, * emailing each of these 200 operators in the 0.2.9 list to remind them not to change their relay details. I'm wondering where I should send these emails, so I'm not the only point of contact: When I first did this, I emailed tor-relays. Then I emailed some operators directly. Then recently, I CC'd tor-team. I'm concerned I'll be flooding whatever list I use with very similar messages. Or maybe I should email them directly, and put tor-team in the reply-to field? Also, if anyone would like to help out with these tasks, that would be great! (I'll be doing them in my own time.) Tim Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org

1 1

Proposal: rotate default bridge ports each release
by David Fifield 06 Sep '16

06 Sep '16

Lynn Tsai and I just published a report on the blocking of Tor Browser's default obfs4 bridges. https://www.bamsoftware.com/proxy-probe/ https://www.usenix.org/system/files/conference/foci16/foci16-paper-fifield.… One of the things we found is that the Great Firewall of China blocks the default bridges--but it takes a little while after release for them to do it. We saw delays as short as 2 days and as long as 36 days. We also found that when they block a bridge, they don't block the whole IP address; they just block a single port and other ports on the same IP remain accessible. We can take advantage of these peculiarities by opening additional obfs4 ports on the default bridges, and changing the port numbers on each release. We'd keep the old ports open for people who haven't upgraded yet, but those who upgrade will start using the new ports. This way, we can make the bridges temporarily reachable after each new release--at least until the censors figure out what we're doing and start blocking more aggressively. This is pretty easy to do on the bridge operators' part. They just need to forward a range of ports to their existing obfs4 port, something like this: iptables -A PREROUTING -t nat -i eth0 -p tcp --match multiport --dports 50000:50009 -j REDIRECT --to-port <obfs4port> Then, the Tor Browser developers can choose a fresh port in each new release.

5 7

Fwd: Applications are Open for the 2017 Voqal Fellowship
by Shari Steele 06 Sep '16

06 Sep '16

FYI > Begin forwarded message: > > From: Voqal Fellowship <lpryor-lease(a)voqal.org> > Subject: Applications are Open for the 2017 Voqal Fellowship > Date: September 6, 2016 at 9:19:42 AM PDT > To: <ssteele(a)eff.org> > Reply-To: Voqal Fellowship <lpryor-lease(a)voqal.org> > > Applications open! > Is this email not displaying correctly? > View it in your browser <http://us4.campaign-archive2.com/?u=682ab4ed01d172b33902388e1&id=0bc4d2fb23…>. > <http://voqal.us4.list-manage.com/track/click?u=682ab4ed01d172b33902388e1&id…> > Applications Now Open for 2017 Voqal Fellowship > Applications are now open for the 2017 Voqal Fellowship, which provides progressive, social entrepreneurs financial resources and mentoring to help bring an early stage idea to life. We are searching for young entrepreneurs, change-makers and thought leaders who want to launch the next “big idea” that will transform progressive politics or remedy a social inequity. > > Ideal Candidates > Ideal candidates for the fellowship are in the early stages of project development. They are driven, tech-savvy social change agents who thrive under self-direction. We are recruiting creative thinkers with a track record of advancing progressive social change and/or using innovative solutions to help communities. > > Project Requirements > One of the few early-stage fellowships, the Voqal Fellowship is designed to further progressive, social justice-oriented causes. Ideal applicants will have a specific issue or challenge they are looking to address over the course of their fellowship. Projects can be broad in scope, or a simple tool that will help resolve a social inequity or lead to progressive social change. Some of the types of projects fellows could pursue include: > Mobile Apps > Media Products > Information Access > Tools for Wrangling Big Data > Algorithms > Software for Social Change Agents > Websites > Program Details > Candidates for the latest round of the Voqal Fellowship must have three to five years of career experience and may not be enrolled in graduate school. Fellows have six months to complete their project and will receive a $30,000 stipend to build out an idea that would not be possible to accomplish with a full-time job. Additional stipends may be available to offset health insurance costs for qualifying fellows. > > Apply or Nominate Someone Today > Ready to apply? Apply now! <http://voqal.us4.list-manage.com/track/click?u=682ab4ed01d172b33902388e1&id…> > Do you know someone who would make a great Voqal Fellow? Nominate them! <http://voqal.us4.list-manage.com/track/click?u=682ab4ed01d172b33902388e1&id…> > > For more information visit the Voqal Fellowship webpage <http://voqal.us4.list-manage2.com/track/click?u=682ab4ed01d172b33902388e1&i…> or contact Leah Pryor-Lease at lpryor-lease(a)voqal.org <mailto:lpryor-lease@voqal.org>. > > follow on Twitter <http://voqal.us4.list-manage1.com/track/click?u=682ab4ed01d172b33902388e1&i…> | forward to a friend <http://us4.forward-to-friend2.com/forward?u=682ab4ed01d172b33902388e1&id=0b…> > Copyright © 2016 Voqal, All rights reserved. > You are receiving this email because of your interest in the Voqal Fellowship. > Our mailing address is: > Voqal > 825 Delaware Ave > 5th Floor > Longmont, CO 80501 > > Add us to your address book <http://voqal.us4.list-manage1.com/vcard?u=682ab4ed01d172b33902388e1&id=a92f…> > <http://www.mailchimp.com/monkey-rewards/?utm_source=freemium_newsletter&utm…> > unsubscribe from this list <http://voqal.us4.list-manage.com/unsubscribe?u=682ab4ed01d172b33902388e1&id…> | update subscription preferences <http://voqal.us4.list-manage.com/profile?u=682ab4ed01d172b33902388e1&id=a92…> > >

1 0

Notes from September 1 2016 Vegas team meeting
by Karsten Loesing 05 Sep '16

05 Sep '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for September 1 2016 meeting: Georg: 1) The GSoC project Fingerprint Central (https://fpcentral.irisa.fr/) ("our" Panopticlick tool) is done and the question is what to do with the custom statistics. Current idea is to limit access to the 10 most popular values by unauthorized users and 200 by authorized ones. 2) I helped with the OTF proposal a bit and with getting the ISC work (porting the Security Slider to Android) going 3) Who can help me understand what's up with the tbb-build machine? Maybe we are still paying for it and it is not reachable for us? Kate: 1) Exciting to see people tweet that they are starting new Tor relays 2) New bridge authority uptake is increasing: https://people.torproject.org/~karsten/volatile/running-bridges-2016-09-01.… 3) Tor traffic questions: Tor metrics are not yet reflecting new Bifroest bridge authority, but will soon :) 4) Upcoming posts: Isis (about the new bridge authority), a Q and A with an exit relay operator, new Tor Messenger beta release, GSoC student 5) We are building relationships with a wider demographic range of software devs and anti-surveillance activists--they are following us now on Twitter for the first time and encouraging others to also. 6) Diversity = bigger array of skills, access to new networks of people, and greater resilience to attack (more groups of people have our back). We're less easy to pigeonhole, too (already true if you know us well). Alison: 1) Meeting planning progress: agenda engagement is going REALLY well! 2) Public hack day promotion: positive messaging 3) Metrics for relay operators: collecting ideas here https://pad.riseup.net/p/metricsneeds, then working with metrics and community teams to use Onionoo data to better support relay operators. Thinking of other ways we can support our relay community... 4) Community docs progress: working a lot on membership docs, getting some good feedback. I'd like to get these finished at the Tor meeting, ideally. I need other people to review them with me. 5) Support desk progress: phoul is setting up support.torproject.org and we hope to be able to share soon. also working on updating old RT tickets to use in the FAQ, building the glossary. 6) Rapid response project: the community team is just getting started on Isa's idea here https://trac.torproject.org/projects/tor/wiki/org/teams/CommunityTeam/Proje… 7) Organizing Tor event at Aaron Swartz Day -- still need more Bay Area people to join us! Nick: 1) I coded this week! So did my team. 1b) Infrastructure diversions happen while coding; these are valuable. 2) Trying to advance project security policies w Georg, anyone else who can help. No time. 3) Team headcount: how do I know if I can hire? 4) Grants process: we should figure out how to improve. Shari 1) We were approved for $250k from MDF for general operating support! :) 2) Lots of grant proposals these past couple of weeks. Thanks to everyone for all of their hard work. OTF goes in today. I'm currently working on the budget. 3) Lots of meeting planning. 4) What do folks think about Amsterdam/Utrecht for next Tor meeting in March? 5) Job posting for chief grants/finance officer went up. We've got a couple of promising applicants. What should the process be? 6) Linda Lee accepted the UX lead job and starts on 9/21. Isabela: 1) organizing the kick off of the ISC tor browser mobile project 2) working on proposal for otf 3) organizing the internal launch of style guidelines 4) trying to prep for dev meeting Mike: 1) Got the Copperhead+Tor prototype build scripts working: https://github.com/mikeperry-tor/mission-improbable/. I'm using it now, but I have a couple more things to improve and then it should be ready for a much wider announcement as part of Tor Labs. I think it is time to start soliciting Tor Labs posts from tor-internal perhaps? 2) Working on the otf proposal Karsten: 1) Spent a fair amount of time on the Tonga/Bifroest migration, including updating metrics-related code to handle two concurrent bridge authorities. 2) Evaluated sanitized web server logs together with Georg to learn about Tor Browser downloads (~8M/quarter) and update pings (indicating 900k concurrent users). 3) Discussed the ExoneraTor database design with Sebastian who pretty much took over the testing; preliminary results are very promising. 4) Finally released metrics-lib/DescripTor 1.4.0. 5) Starting to prepare for the Berlin meetup next weekend. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXzWixAAoJEC3ESO/4X7XBuRQH/RUraonnI2Ipt09XUtxfOVVF vmTGCM7dpK1fvuF+EUfcBACHjPtLNH7Kkglt7G6B2ikf9wBH0CwlUiNpII9wtxLR BO1a/1xkGX41r/rn2aFJZq96o5tnDP3ReBbyf/ZOvZyu2r26tNp+Lu95WlorFSbt 6oY/7UjjGzU0Mca8hTNyaIQrrwRBIT7t062qqByX/N6ty1BGFIKgpL51GQxC5Dpz umzthvUmmvbLlpTv8JKIxNWtWN55sna+bW3kRtTxCZ8g6UdSw0EwRyBBp+MZQWjQ Cgy3gym8LUJhjulNycxRg22jFt9mPJ44bAaxS3ImfBfRIdI4u2+X4A/2JRPJ+fs= =Oxyt -----END PGP SIGNATURE-----

1 0

Metrics to help relay operators?
by Karsten Loesing 31 Aug '16

31 Aug '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Alison, moving this thread from the metrics-team@ moderation queue to this list with your permission: > Hi Metrics team, > > I was talking to Roger on IRC about how great it is that he sent > those checkin mails to everyone who runs a fast relay, and he had > an idea for the metrics and community teams to work together to > get useful lists that we could use to help give better support to > our network of relay operators. For example, a weekly mail of all > the relays that just passed the "earned a tshirt" threshold, or > some other threshold about how much bandwidth they've pushed over > a period of time, etc. The community team could then contact the > relay operator(s) and congratulate them, thank them for their > service, see if we can offer them help in any other ways, and so > forth. > > I've copied the community team here. Let's chat if you guys are > interested! > > Alison Sure, let's do this. I might not be able to hack much on this myself in the next weeks, but I'm happy to speculate how such a tool could be designed. Is there anybody in the community team (or another friendly volunteer on this list) who'd be comfortable writing a small Python script that fetches Onionoo data [1] and filters out contact information of relays matching given criteria? That's how Compass [2] was started before it became a website, and it's how the t-shirt script [3] came to life (shortly before it was forgotten). I could imagine that we start with a simple Python script that can be run whenever somebody from the community team is ready to reach out to new relay operators. We could later automate that process by letting cron run that script once per week and have it send the output to some mailing list. But that could be step two. Hope that helps as a start. All the best, Karsten [1] https://onionoo.torproject.org/ [2] https://compass.torproject.org/ [3] https://gitweb.torproject.org/metrics-tasks.git/tree/task-9889/tshirt.py -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXxT3zAAoJEC3ESO/4X7XBilwH/21JJ6HS8Nr1gfIrOWGurAQl qJBSref2NoPsXJuwG1Z038Zq6JysTRNkzZoqgmZTbILwnMAoXM8rXRZuUQnCGgxN jP5V0xjtSM6d7VRLr34JXt8pbo1Cqd1/tGzEHzsS2muUA80vZK9klv/M6O5CS0wE nqjApwD2OHRBVPq4D+MX2DxV705DJTCgCF3caA8z2nocs0oKDzC8078Wy4usc4KB l9Yf/WLyv24Ny2Uq7m8C/WkyAYEOBAQwze9/Z7leTASUaF9EtSxJKbdx1dIUexgv tTCr7mEBRqdAeKfUNUmrQxBkJdZxLUAnHGjuJrmj+GHrXawmsLkguu4dNf23sKc= =i5Pp -----END PGP SIGNATURE-----

3 4

Summary of meek's costs, July 2016
by David Fifield 30 Aug '16

30 Aug '16

Here's the summary of meek's CDN fees for July 2016. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 January 2015 $464.37 + $669.02 + $0.00 = $1133.39 February 2015 $650.53 + $604.83 + $0.00 = $1255.36 March 2015 $690.29 + $815.68 + $0.00 = $1505.97 April 2015 $886.43 + $785.37 + $0.00 = $1671.80 May 2015 $871.64 + $896.39 + $0.00 = $1768.03 June 2015 $601.83 + $820.00 + $0.00 = $1421.83 July 2015 $732.01 + $837.08 + $0.00 = $1569.09 August 2015 $656.76 + $819.59 + $154.89 = $1631.24 September 2015 $617.08 + $710.75 + $490.58 = $1818.41 October 2015 $672.01 + $110.72 + $300.64 = $1083.37 November 2015 $602.35 + $474.13 + $174.18 = $1250.66 December 2015 $561.29 + $603.27 + $172.60 = $1337.16 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 February 2016 $986.39 + $977.85 + $445.83 = $2410.07 March 2016 $1079.49 + $865.06 + $534.71 = $2479.26 April 2016 $1169.23 + $1074.25 + $508.93 = $2752.41 May 2016 $525.46 + $1097.46 + $513.56 = $2136.48 June 2016 $0.00 $1117.67 + $575.50 = $1693.17 July 2016 $0.00 $1121.71 + $592.47 = $1714.18 -- total by CDN $13138.96 + $16900.60 + $4792.99 = $34832.55 grand total https://metrics.torproject.org/userstats-bridge-transport.html?start=2016-0… The number of users recovered somewhat since the beginning of July, rising to about 7,500. It seems to be former meek-google users who are being absorbed into meek-azure and meek-amazon. If you are one of the users affected by the meek-google shutdown, see here for a workaround: https://lists.torproject.org/pipermail/tor-talk/2016-June/041699.html == App Engine a.k.a. meek-google == 0 GB $0.00 0 instance hours $0.00 https://atlas.torproject.org/#details/88F745840F47CE0C6A4FE61D827950B06F9E4… == Amazon a.k.a. meek-amazon == Asia Pacific (Singapore) 285M requests $342.71 628 GB $84.78 Asia Pacific (Sydney) 7M requests $9.27 38 GB $5.20 Asia Pacific (Tokyo) 1M requests $1.85 6 GB $0.81 EU (Ireland) 256M requests $307.53 1032 GB $79.86 South America (Sao Paulo) 18M requests $40.32 170 GB $40.51 US East (Northern Virginia) 144M requests $144.71 811 GB $63.68 -- total 713M requests $846.39 2687 GB $274.84 charge for alarms $0.50 https://atlas.torproject.org/#details/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == Zone 1 6103 GB $530.99 Zone 2 445 GB $ 61.48 -- total 6549 GB $592.47 https://atlas.torproject.org/#details/AA033EEB61601B2B7312D89B62AAA23DC3ED8… Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

1 0