- tor-project - lists.torproject.org

Notes from August 25 2016 Vegas team meeting
by Karsten Loesing 29 Aug '16

29 Aug '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for August 18 2016 meeting: Shari: 1) Working with Gunner and Alison on the semi-annual Tor meeting agenda. 2) Working with our lawyer on his presentation for the meeting. 3) Reviewing DRL grant proposals. Nick: 0) Vacation was lovely, got a bit of programming done. 1) Trying to program 1a) Distracted by need to put out two releases 1b) Distracted by grants stuff Kate: 1) Fact sheets--organizing their finishing; hoping to hire artist/web designer for a bit of freelance design 2) Blog posts from GSoC student and HOPE 3) Had stomach bug Tuesday and Wednesday 4) Seeking new good news to promote after Labor Day :) Isabela: 1) working with the ux team to prepare for internal launch of our style guidelines and how we will roll it out 2) working on DRL proposals - deadline is tomorrow (august 26) 3) got reports out to otf and drl 4) coordinating with ux team and network team some ideas of sessions for dev meeting (trac session, style guidelines session etc) Alison: 1) Tor meeting agenda planning 1a) we need to talk about agenda priorities (from this team and getting individual community member engagement); One from Shari:" I’d really like there to be a discussion about a theme for our end-of-year fundraising campaign. Last year it was “This Is What a Tor Supporter Looks Like.” What should it be this year?" 1b) welcoming new people: buddy system, welcome event 1c) creating a "safer space" 2) Working on HOPE wrapup post 3) Community team continuing to work on the support portal 4) and membership docs Karsten: 1) Drafted a first schedule for the Berlin meeting together with Georg. https://trac.torproject.org/projects/tor/wiki/org/meetings/2016BerlinMeetup 2) Almost released metrics-lib 1.4.0 together with iwakeh, but ran into a bug and postponed the release. 3) Worked a lot on the ExoneraTor database redesign I started with Sebastian the week before. 4) Commented a bit on grants in response to questions by Isabela and Cass. Roger: 1) Doing all my logistics Mike: 1) I got image signing working for CopperHead - I now have a script that takes the official copperhead images, adds in Google Apps and OrWall, and produces verified-boot compatible images. I'm still working out some bugs with OrWall and the keyboard, and need to figure out how updates are going to work, but concept is now more or less proven. 2) Been helping a bit with the DRL Tor Browser Mobile proposal. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXw/RwAAoJEC3ESO/4X7XBZYMH/i0m1E8h/M8OR/eiaVZQ0yJy zMJqx20DmmPAGgzqdHk/MlZKt9EXoNho4Mg96BA5p4sB+RmQ6/ksDIkkPp1uFNmt Em3xifkJ2Ie7TVFHkjtd9wiwDowJr++44ht1yXk9BIdMgEFrKnCo852TjTUGBd5R IElY/BMLNiE49hnmyw+vTHx98OH2eDPfr+RuBnYN1FaGKdAJbCMYidcYojQUfKwS 8TuqWn/WsjZUjHrOUflBsrTBZ3RuEokbv2vOtW8HnVuj2NRyDsFLGNfNQKBsCSNA Lv62DOxBn7TkMy2C54lEZAoVQZ3xpNVJ72W2geQuWAall0alyKRFvTxk/9Jh2l0= =qKsA -----END PGP SIGNATURE-----

1 0

New Bridge Authority
by isis agora lovecruft 26 Aug '16

26 Aug '16

Hello all, Today, I am very excite to take a field trip (!!) to a datacenter (!!!) with some most excellent folks from Greenhost (DrWhax and Sacha!!!). We will be racking a server and installing an OS on it, and getting it ready to be a new Bridge Authority to replace Tonga. Earlier this week, David Goulet and I got a Bridge Authority up and running in a test network, so perhaps a logical step will be to put the new Bridge Auth into the test network and ensure that it's at least cursorily behaving. The new Bridge Auth needs a name. Suggestions welcome. :) Best regards, -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://fyb.patternsinthevoid.net/isis.txt

16 21

I'm offline Aug 29 - Sep 13
by Roger Dingledine 24 Aug '16

24 Aug '16

Hi everybody, Here's a reminder that I'll be offline Aug 29 - Sep 13 inclusive. And I mean actually offline with no devices. So if there's something critical that you need me to do before I disappear, now is a great time to remind me of it. Items on my current high priority todo list: * Get the SponsorM (NSF) annual report in, so the program manager can have a chance to review it and tell us what changes she wants. I'll aim to coordinate with somebody smart to cover for me while I'm gone in case they throw some surprise last-minute time-critical questions at us. Based on past experience there is a good chance they will. :( * Get the SponsorV (NSF) annual report in, if Micah Sherr (prof at Georgetown who is ) finishes his first draft of it in time. * Get the "here are the tickets and stuff that we did for year 2" list to SponsorR so they can pay us for year 2 and so they can start the paperwork for year 3. * Try to get my upcoming travel under control, along with expenses and reimbursements. Aren't logistics fun! * Follow up to Shari about some future funding opportunities and whether they match our mission enough for us to go for them. * What else am I missing? --Roger

1 0

Rapid response against censorship
by isabela 22 Aug '16

22 Aug '16

Hello Tor, I took the freedom to create a project under the Community Team wiki which is an attempt to create a rapid response program against censorship events. In the past months we did a little bit of that, by tweeting in PT to people in Brazil teaching them to use Tor when Brazuka judge blocked Whatsapp, we tweeted reaching out to Uganda folks also in an attempt to get as many people to know about Tor as possible when the government was blocking social media during the elections, and most recently we tweeted in TR when the government blocked Social Media during the coup event last month. One might say: 'well if social media is blocked why you using to teach people how to circumvent the blockade?'. What works here is the 'mouth to mouth' outreach, while many in the country where the censorship event might not be able to access social media, relatives and friends abroad can still do it and they are in communication with those inside the country. As an immigrant living abroad I can tell you that *it is a thing* I for instance called my family and told them to use orbot so we could still talk with Whatsapp while the blockade was happening. Of course we could do more and spread the word via email lists and other venues and communication channels. We also could be more prepared and have messages already translated in multiple languages so it's easier to have something in the right language for the population we want to reach. We can try to document these events and our actions to respond to it as well e.g. https://blog.torproject.org/blog/tracking-impact-whatsapp-blockage-tor There is many things we could be building here to have such a program in place! I started this wiki: https://trac.torproject.org/projects/tor/wiki/org/teams/CommunityTeam/Proje… Just to show how we can start organizing this things -- those phrases there are just examples, not the real thing right now. I was wondering if the Community Team and others would be into this idea and would like to help improve that page. Maybe we can even do it during the hacking day of the dev meeting! What y'all think of that? Cheers, Isabela -- PM at TorProject.org gpg fingerprint = 8F2A F9B6 D4A1 4D03 FDF1 B298 3224 4994 1506 4C7B @isa

4 4

Notes from August 18 2016 Vegas team meeting
by Karsten Loesing 22 Aug '16

22 Aug '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for August 18 2016 meeting: Georg: 1) I helped a bit with the OTF proposal 2) The tbb-build machine is still not reachable. Who can move this forward? Shari: 1) Lots of planning for the meeting formerly known as TorDev. Question: Will people be hanging out in Seattle for the weekend after the meeting for hacking? If so, can we estimate how many people might stay so we can make sure we've got a good space for this to happen? 2) Trying to get a handle on our funding proposal processes. Worked on a job description for a grants manager, talking with team on how to make budgets look more like other nonprofit funding proposals, sent note to OTF asking for some specific guidance. 3) Reached out to a couple of community members to offer them the opportunity to talk about all that's been happening. 4) Trying to help think about the organization of the UX team. Mike: 1) Finally got email working again over the weekend. I think I didn't lose any, but not sure. 2) Helped with OTF budget revamp. Isabela: 1) OTF proposal deadline moved to sept 1st! 2) I will need someone to review my grammar at drl reports 3) documenting 'rapid response' plan in the wiki -- katie and alison will probably want to be involved here 4) starting to work on wireframes for metrics team \o/ 5) working on priorities with network team since we are in the last mile with 2 contracts 6) prep for proposals deadline on august 26 Karsten: 1) met with Sebastian; worked on databases for website statistics and TB downloads and on fixing ExoneraTor by making its database smaller 2) talked to isabela and then made some preliminary plans for extending scope of metrics to client and application statistics, based on sanitized website logs, possibly GetTor requests, possibly app store statistics, etc. 3) made plans with iwakeh to put out two new releases of metrics tools this month -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXuqLSAAoJEC3ESO/4X7XBkwkIAMCr/1Nbi7SMRMPMR8LEv34C T1JRs8WeiSjeGogze2qpeRcJYCtq4HsbWCCEjOvpxfS+70kDDe/jZag6wc/1HsPr TPnYe+yl3Dp9j8jBYE40ixDd/ESQiYa/dA6ScsaFaUXb6dbxghzJKxHwE+oHXxjU i340LP4IG5waF0kz7IRPT+w1flm/UYbfMlg//HeVNdOWbdAfuf2qs1Y0xQCiDy3Q eMQMVS4LBjm5NCZnr4YEoS9t6jHIv+q5Bb6lbibUD1EIW5yE9f+gQVz18hfHGqUg ZSJYjDYcObhF5P9unduagdn7Z1tQRzRcVEvlvzZhmRl+bm9PZKTEvFL8igPr7LI= =c/mI -----END PGP SIGNATURE-----

1 0

A Vote of No Confidence in Shari Steele: A Proposal For A Tor Relay Operator Strike.
by stderr＠riseup.net 19 Aug '16

19 Aug '16

It has recently come to light that the Tor Project chose Franklin Bynum as the “outside counsel” to investigate the allegations sexual assault and sexual harassment against Jacob Appelbaum. Frank Bynum is in a romantic relationship with one of the principle complainant in that investigation, Alison Macrina. In addition, Shari Steele allowed Macrina to become extensively involved in the investigation of Appelbaum’s conduct, despite the fact that she is an interested party in that investigation, since she claimed to have been taken advantage of by him. This is completely unacceptable and unprofessional conduct by Tor’s executive director. If the allegations against Appelbaum are true or substantially true, then this is a gross disservice to victims, since Shari’s actions robbed the process of any appearance of impartiality or legitimacy. If the allegations against Appelbaum are false or false in part, then this just as bad or possibly worse. Either way, Shari’s actions needlessly exposed the Tor Project to civil liability, by creating an obvious appearance of bias, when she allowed Bynum and Macrina to conduct the investigation. Shari Steele has failed in her fiduciary duty towards the project. The Tor Project should not expect volunteers to offer their time and resources, when Tor’s leadership is sending a clear signal that it will condone the preferential treatment of some community members over others, that it may aid and abet public shaming campaigns, and that it will simultaneously undermine the credibility of people who come forward with abuse complaints by poisoning the investigation with obvious bias. Tor needs an impartial, professionally-minded executive director who can insure that influential members of the Tor community do not abuse their power, whether they engage in unwanted sexual advances or expose the project to liability through irresponsible public shaming campaigns. I call upon other relay operators to conduct a coordinated 24 hour shutdown of the Tor network, in order to send a clear vote of “no confidence” in Shari Steele. It’s time for a new executive director and a saner, less favoritism-ridden and personality-driven Tor Project. This is neither an endorsement of Jacob Appelbaum nor an endorsement of the accusations against him. At this point the Tor Project’s conduct is so reprehensible, that it doesn’t matter who is in the right — the leadership needs to go. https://medium.com/@stderr/a-vote-of-no-confidence-in-shari-steele-380e327d…

5 4

Notes from August 11 2016 Vegas team meeting
by Karsten Loesing 16 Aug '16

16 Aug '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for August 11 2016 meeting: Isabela: 1) finished sida proposal ! 2) have many reports pending that I am trying to work on while I am not working on grant proposals :( 3) trying to get 029 to a realistic state by eow 4) got names/resumes for service maintainer position -- didn't have time to review them yet :( 5) synced with Arturo - I will start having a bi-weekly sync with the OONI team starting in September to help them be on track for deliverables etc Kate: 1) Fastly blog post 2) Multiple media requests 3) Released Social Contract to the media; meh response (however, it got a positive response on social media). OTI liked it Mike: 1) My mail server is offline due to FDC being a horrible ISP. Hopefully will have it relocated soon, though doing so is going to cost me time. I also may or may not be losing mail right now. 2) I'm still working on a Tor Phone prototype based on Copperhead. I've almost got Verified Boot working. Maybe will be able to launch Tor Labs next week or the week after with details. Nick: 1) On vacation next week! I will check email every day or two. I will avoid IRC. Call if there is an emergency. 2) Overwhelmed wrt 029 triage, OTF reply, sponsorV listing. 3) Overwhelmed with people dropping 1-2 hour tasks on me. Roger: 1) I'm on vacation next week too! I will probably be more online than Nick though. 2) My meeting with the SponsorR program manager went well last week. Now it remains for us to actually build and deploy the new onion services design. 3) I submitted a no-cost-extension request for SponsorM which caused a landslide of chaos that I am now riding. 4) I'm still trying to get Mike Perry to talk to Jeremy Epstein about his secure browser ideas. 5) I think we should consider having internal funding proposal deadlines, followed by internal red-teaming of the proposals. 6) I got invited to do a keynote in March and they offered me a $20k honorarium(!) I've asked them to give it to Tor since that's how I think these things should work. 7) NSF grant with UIC is progressing, and we have some decisions to make, to ensure it turns into the kind of project we want it to. Georg: 1) I've been dealing with my backlog after my vacation 2) I helped a bit with the SIDA proposal 3) I dealt with some fallout from bug 19890 4) How can we move bug 19652 forward (getting Whonix to use Tor Browser officially)? <- Georg will answer on the bug Alison: 1) social contract is getting amazing reception, including a note from Chelsea Manning: https://twitter.com/xychelsea/status/763535177683382273. I still need to add this to the website in "About Tor" but we should talk about what else could go in a values/ethics subcategory there 2) Phoul and I have been working on fixing Tor support and we'd like to start working on a support portal, support.torproject.org, modeled after support.twitter.com and using the new Tor Browser manual, Tor glossary, and some revised versions of the old templates from the support desk. Phoul can do the design. 3) continuing work on other community governance docs, planning some Tor Dev stuff with gunner, contacting other community councils, doing lots of trainings Shari: 1) In San Francisco this week to meet with Gunner and our attorney about TorDev meeting plans. 2) Preparing for board meeting on Monday. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXss07AAoJEC3ESO/4X7XBLHIH/iGgIQmtn6HAtp0T9QjopaaU svy3w+6oKMpqIHuDc7hjvq3bODF86hDOUvp4KiVAqSxiuY5Ma/XjiEZTGNLr/Y+k TMxMUj95MXlVOlNcj5LMG+4qoxC7XbwwiHYINmbOlNtYJvE4BI65/StmryoF2Qcg lXHcAl4buerfzxIgCUz+qABAeyqVyVVu+5P4u3JEqOInObXl5qkTGpeSvdL7jKkq WI0g1s5GJmHxm09VBFjmIWRo+JMPB5MCcQ2tNKiAA2iz8jP3MVe6d+KhmBrhxJSX ZgC8YrA3RSjKekbI2qB/tBdRSf0BXz2UP+QA6ilcVeVRjvuAjUjN9P3dHEgGcxg= =G4S0 -----END PGP SIGNATURE-----

1 0

Fwd: TCP Flaw in Linux Servers Allows Web Traffic Hijacking
by Shari Steele 13 Aug '16

13 Aug '16

> Begin forwarded message: > > From: "Vass, Bill" > Subject: TCP Flaw in Linux Servers Allows Web Traffic Hijacking > Date: August 11, 2016 at 8:21:34 AM PDT > To: Shari Steele <Ssteele(a)torproject.org> > > Assume your techies are watching. > > http://news.softpedia.com/news/tcp-flaw-in-linux-servers-allows-web-traffic… > > > Sent from a mobile device

3 2

Sandstorm is now running on TPO infrastructure
by isis agora lovecruft 10 Aug '16

10 Aug '16

Hello excellent people, With much thanks to weasel, https://storm.torproject.org is now running on Tor Project infrastructure (rather than a personal server of mine, as it was on before). [0] If you have stuff in Sandstorm that you care about, please make sure it's still there and everything looks okay. In a week or so, I will shut down the old server. Please let me know if you have any other issues with Sandstorm; I'm happy to help. [0]: https://bugs.torproject.org/19255 Best regards, -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://fyb.patternsinthevoid.net/isis.txt

3 2

Re: [tor-project] The Tor Project Social Contract
by Nathan Freitas 08 Aug '16

08 Aug '16

On Tue, Aug 2, 2016, at 07:59 AM, Lunar wrote: > Hi! > > Mike Perry: > > I hate to be late to the party, and I hate to start a libre/free/open > > flamewar, but I am concerned about the specific language "free of cost" > > with respect to our tools in Point #3. > > […] > > I see nothing wrong with paid versions of Tor tools, paid hardware, or > > paid access, so long as the implementations of security-critical > > components are open source and auditable. Maybe others disagree? > > I disagree. :) > > Wealth is already an important factor in one's ability to enjoy freedoms > of opinion, expression, and association. If we agree that you can't > really exercise these freedoms in the digital world without tools like > Tor, I think such access to these tools should not be restricted by > how much money you can spend on it. > > While I agree that we should find ways to cover costs of production, > or that I think it's ok to sell hardware with Tor preinstalled, > I believe we should try to find business models that aim to balance the > wealth disparities of this world, because I want our work to help > balance power. I agree with both of you in different ways. Requiring a user to be able to compile to get something free is not good enough. Some longer thoughts below, but I think the spirit of what we say should be "Always Free, but Pay What You Can". Using Onion Browser as an example, it is great that Mike Tigas has been able to independently support his work on that project by charging a small fee for the open-source software he builds. However, it has also severely limited adoption, and pushed users to less trustworthy apps, because there are many people who don't have the ability to purchase apps on iOS due to not having a credit card or being in a country where paid apps are not supported (like Iran, I believe). With iOS, there is no way to sideload from a free app store without making your device insecure, so the only "free as in beer" and secure way to get Onion Browser is to know someone who has a Mac, is an iOS developer, and who is willing to link your device to their IDE setup. What I would like to see from Onion Browser, and from all Tor-related apps/projects/community members that choose to support this contract, is to offer a free version always, and then a pro/premium pay version, or a "pay what you can" option, that is functionality equivalent. That way, novice users will always have access without any impediments due to their economic situation. This is also a model that I would like to adopt for Orbot and Orfox, and any app store that offers a built-in, easy payment system. Again, users would not be required to use this, but for people who already opt-in and are comfortable providing their payment information, then it is an easy way for Tor projects to gain sustainable grassroots support. On the hardware front, we are already working with Copperhead to sell premium-priced Nexus phones flashed with their open-source OS, that may someday have Orbot built into it. Copperhead offers their ROM free of charge for anyone to flash to a Nexus device, but again, that is a very serious impediment for non-technical users. What I am trying to setup there is a "buy one, give one" program, or again, a "pay what you can" system, that is backed by those who can afford to donate money along with their purchases. > > Here's an attempt to reword to capture my thinking: > > > > 3. Our tools are universally available to access, use, adapt, and distribute > > Ok with the rewording here. Perhaps we could define "universally available" a bit more to ensure that in includes non-technical end-users? This means that we are talking about more than just "we publish the source code". Best, Nathan

9 16