- tor-project - lists.torproject.org

Fwd: Volunteer Work
by Shari Steele 08 Dec '16

08 Dec '16

Hey all. Anyone have ideas for Kyle (who is apparently a high school student)? Feel free to respond to him directly, and let me know if you do. Shari > Begin forwarded message: > > From: Kyle Ahern <kyleeahern(a)gmail.com> > Subject: Volunteer Work > Date: December 7, 2016 at 2:20:52 PM PST > To: execdir(a)torproject.org > > Hello, I have to do 24 hours community service with a nonprofit organization. I need a signed letter with the official letterhead of the organization on it and the number of hours I worked. > > I know there is a lot of ways to support the tor project, but I was wondering if there are any ways I can volunteer where the hours can be reasonably proven by you and that you guys would sign off on. > > I live in St. Louis, MO (United States). I have been considering running a tor relay for some time. I have dabbled in Linux with some terminal commands. After having a tor relay up and running on my ip address (maybe some google search history and screenshots or a desktop recording) would this be something you would be willing to sign off on for some number of hours? > > Thanks for the freedom you guys provide! > Kyle Ahern >

2 1

CFP Cryptorave 2017
by ilv＠torproject.org 07 Dec '16

07 Dec '16

The event will be on May 5-6, 2017. It would be good to have Tor people there (last year they had live translation from english to portuguese). ----- Forwarded message from CryptoRave <contato(a)cryptorave.org> ----- Date: Mon, 05 Dec 2016 20:38:04 +0000 From: CryptoRave <contato(a)cryptorave.org> To: cryptorave-boletim(a)lists.riseup.net Subject: [cryptorave-boletim] A CryptoRave inicia hoje a chamada de trabalhos para sua 4ª edição, em 2017! A CryptoRave é o maior evento de segurança e privacidade do Brasil. Organizada voluntariamente, aberta e gratuita, o evento anual tem o objetivo de disseminar a criptografia, o direito à privacidade, a cultura de segurança, noções de anonimato e os perigos da vigilância por Estados e empresas. O início das inscrições de propostas de atividade será dia 05 de dezembro de 2016 com prazo final de 31 de março de 2017, à meia-noite. Não deixe para a última hora! A abertura de inscrições para trabalho voluntário durante o evento - uma nobre e fundamental atividade com a qual temos muito orgulho de contar - será em abril de 2017. A realização de atividades em grande número, como fazemos na CryptoRave, requer recursos. Estimule a sua comunidade a colaborar com o financiamento coletivo do evento. Para mais informações sobre o Chamado Para Atividades (CPA), acesse: https://cpa.cryptorave.org/pt-BR/CR2017/cfp/session/new * * * Proposição de atividades ------------------------ A CryptoRave aceita e estimula a inscrição de atividades em diversos formatos: apresentação musical, literatura, exibição de filme ou instalação artística, palestra, debate, oficina, jogo, mão-na-massa, colaboração em projeto FOSS (free/libre/open software/source), exposição. A CryptoRave desde sua primeira edição tem uma explícita política anti-assédio e o compromisso de manter um espaço seguro para mulheres, pessoas LGBTQ e quaisquer outras minorias sociais. Incentivamos que estas pessoas enviem atividades e se envolvam nos trabalhos voluntários do evento. Para submeter a sua proposta, você deve primeiro criar uma conta neste site (ver abaixo) e depois criar um evento.O preenchimento de dados pessoais como nome, sobrenome e sexo é opcional. É necessário um e-mail válido. Todas as propostas serão avaliadas considerando: - Adequação aos temas: privacidade, segurança e criptografia - Diversidade de gênero, geográfica e de formato - Inovação da proposta - Atualidade da proposta - As atividades que forem merchandising de produtos serão automaticamente desclassificadas. - Não há compensação financeira ou contrapartida da CryptoRave para a realização de atividades. - Não serão aceitas propostas enviadas por outros meios como twitter e facebook ou fora do prazo estipulado. - Dúvidas devem ser encaminhadas para o e-mail: contato ARROBA cryptorave.org. Sugestões de temas e tópicos para as atividades ----------------------------------------------- - Criptografia: do básico ao avançado. Teoria e implementações. - Segurança para ativistas e defensores de direitos humanos. - Segurança para cidadãos e consumidores na era da Informação. - Gênero e Privacidade: diversidade na segurança digital. - Violações do direito a privacidade e liberdade de expressão. - Como governos violam a privacidade: espionagem e vigilância no Brasil e no mundo. - Como empresas violam a privacidade: coleta de dados, lucro e direito do consumidor. - A contra ofensiva cidadã: hacking, hacktivismo, hacking das coisas, fuzzing, exploits e segurança ofensiva. - Hardware, cripto dispositivos e open hardware. - Ciberguerra e ativismo cibernético na rede. - Hardening de sistemas operacionais. - Soberania computacional, descentralização e federação de redes. - Dissidentes políticos, denunciantes e vazamentos de informações – sistemas tecnológicos e éticos. - Sistemas eletrônicos de governos e vulnerabilidades. Registre a sua atividade: https://cpa.cryptorave.org/pt-BR/CR2017/cfp/session/new -- https://cryptorave.org/ https://twitter.com/cryptoravebr https://facebook.com/cryptorave ----- End forwarded message -----

1 0

Help with 'Tor at the heart' blog posts
by isabela 06 Dec '16

06 Dec '16

Hi there, As you've probably noticed, we've been doing a series of blog posts in December on projects that are able to accomplish their mission better because Tor exists. You can see the previous daily blog posts for the donation drive here: https://blog.torproject.org/category/tags/heart-internet-freedom I am reaching out to this list to ask for help. You can: * pick a project and write a draft of a blog post about it * email a POC (point of contact) of a project and ask if they have time to write a draft themselves - or if not, they can always send to us the main points we should be sure to include in the post so we can write it ourselves * take the information a project POC sent us and put together a blog post about it Or anything else you can help with! We created this spreadsheet where we are trying to keep track of the status of each blog post. The dates suggested for each post are not fixed in stone, so we can move things around. In fact, the earlier we can get write-ups the better, so we have flexibility to make sure every day is covered. We are also open to other topic suggestions if you think of anything we missed. https://docs.google.com/spreadsheets/d/17Rh0CATwCH1du64pcOyAYSXmSN9Ft7Mt2Lg… If you can help us by working on any of these posts or helping to coordinate things, just do it ;) but please keep this spreadsheet updated. Also if you have specific questions, you can send them to this thread or email directly to the task force working on our fundraising campaign: donation-drivers(a)torproject.org Thanks in advance for your help! Isabela

2 2

Notes from December 1 2016 Vegas team meeting
by Karsten Loesing 05 Dec '16

05 Dec '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for December 1 2016 meeting: Nick: 1) The team has done well with me totally distracted by finishing the Guard stuff for Sponsor U. I finished it yesterday, and I think it went well. 2) Not too much to add. Coding is a fun and rewarding activity. 3) I think we should put out 0.2.8/0.2.9 releases some time soon-ish? 4) I want a roadmap. I should make one. Georg: 1) We wrapped up SponsorU items; it seems we get all required things into the next alpha release. 2) I've been distracted by the chemspill releases for the SVG 0-day exploit. 3) I provided feedback for the DRL proposal. 4) I started with planning for the coming weeks (post-SponsorU-time). Alison: 1) Global South outreach: South America, India, getting funding for the folks who want to do this 2) Support desk: TB manual is up on transifex, Colin is steadily chipping away at tasks for support.torproject.org 3) I will have a blog post ready soon to promote some of our training materials 4) November was an incredibly busy month for me with LFP stuff, but now that it's December I can focus more on Tor, especially working on community docs, building outreach capacity, working on Rapid Response and OONI connection, and building the support portal. 5) Do you want full LFP updates on here too? Looks like the answer is yes! I will start adding LFP updates for the next meeting. Kate: 1) Counseling Tor people about media interactions 2) SVG 0-day exploit press coordination - Thanks for everyone's responsiveness! 3) Isabela and Erin are tweeting now from @torproject--hope others will be able to soon. 4) Excited that at least some Tor press clips will appear in press room of Tor website soon--we have many many, including lots of non-English ones. 5) Participated in Mozilla's MOSS tweet chat, which Mozilla was pleased by :) 6) Dealing with various other reporter requests 7) Edited multiple blog posts (Mission Improbable, etc.) 8) Wrote and distributed short press release about Mission Improbable Android Tor phone prototype; made some press calls; garnered some media attention (didn't go full-force because it's an early prototype and there was concern about overpromising) Ars Technica, CNNews.ru, Портал Naked Science, CURVED (Germany), FredZone (France), Programmez! (France), Next INpact (France), Svět Androida, Numerama (French), TooLinix (French), etc. (I should list this stuff more often--oh well) Roger: 1) We need to have a shared vision for handling blog post comments in December 2) I'm going to Seattle on Wednesday 3) I talked to our NSF program manager 4) I'm buried in logistics stuff still 5) I'm mostly back from my surgery Mike: 1) Finished up the mission improbable post with help from Katie - talked to some reporters; fixed bugs, merged patches (yay!) * The plan seems to have more or less worked in terms of getting developer attention 2) Working on "Technology in the Darkest Timeline" post for guidance for tech companies * Struggling a bit with structure. Have 9-10 General Principles, and an outline of specific suggestions for Google, Apple, and Mozilla * Not sure if this should be one post, two posts, or four * Could use some review of the general principals * Our mail situation makes me sad. Many places think my mail is spam when I use @torproject.org (but not my personal mail). * (SPF and DKIM on my own domains has fixed my problems for them, but not for @torproject.org) * I may have to stop using @torproject.org as my email address. Isabela: 1) Did: 2016 summary of Metric Team work for MOSS 2) Did: ISC orfox security slider work report 3) Doing: random donation campaign stuff 4) Did: prep for MOSS chat 5) Doing: closing sponsorU contract - report of all deliverables finished and prep for final invoice 6) Update: hiro tasks are now organized here (she is also in touch with qbi for tasks from him): https://storm.torproject.org/shared/tKdKao9GZx50q8chdnsa1p2DP46lUNyDxE2s8U8… * website press page has been updated * next is the people's page 7) Update: linda is working with metrics team and ooni on their respective ux projects / projects are documented on ux wiki page and we are creating a kanban board on storm to keep track of all projects the ux team are or will work on 8) Did: got headcounts for ux and network team for 2017 budget 9) Doing: helping with drl full proposal review 10) Doing: Global south: vinicius has been doing great outreach in Brazil and got a bunch of people to run bsd tor relays / i am in touch with noisebridge bc they have a fund for relays in Brazil - plan is to connect them with vinicius and a couple of other people / also need to: 1. follow up with other folks who wants to help 2. build wiki page 11) I will be on vacation from December 8th till 12th / then again on the first week of January Shari: 1) Been working on end-of-year blog posts. 2) Sending emails to former donors and TWN subscribers to tell them about our end-of-year campaign. 3) There's a board meeting on Monday. Arturo: 1) Hired a designer to do the UX work and collected some of the design assets for them here: https://github.com/openobservatory/design 2) Made a release candidate for ooniprobe 2.1.0 that includes IM tests and support for checking reachability of Tor Bridges (only via tcp_connect at the moment) 3) ooniprobe 2.0.2 is not packaged for debian and ubuntu. Announcement for it coming out soon. 4) We published the notes for the OONI meeting in berlin. You can find them here: https://github.com/OpenObservatory/gatherings/tree/master/internal/2016-11-… -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBCAAGBQJYRSCsAAoJEC3ESO/4X7XBr+sH+wVZdRLpT3rcSoxM5bQYJXBe 14EYlnbJb0nC4M2+01DPBpukZmEbZUtIX+C/tEvpvIw1W2KNmEYMwJrUteqDsO5A +T1xkp+UknNxFQQWMvDL28bXXY5+dh/0Yt3eFBT6JY43Yam+Xz7zpmYexsPR28m1 0lPI3klrdc1zqgrnsoBZrkP21XoOg8qCySyvIwlkzk/XDcHblJ5f9PdraGWgdEnO rhgUDOUkt5JEFQ/KATsPqMS1DidWrAj83XnLF1AS4S5BhMVIyWHXG93hdFsvquzX yBM5WmtLyE++VO4Kj6zkIwK2JnTXqKAH3bRft9+zSIVu9Skaf4aUZJBYaVqJ59M= =/HQH -----END PGP SIGNATURE-----

1 0

Help curate December blog comments during donations drive
by Roger Dingledine 04 Dec '16

04 Dec '16

Hi everybody, If you haven't noticed our 30-posts-in-30-days December blog donation drive extravaganza, check out https://blog.torproject.org/category/tags/heart-internet-freedom All these blog posts are generating a lot of attention, including many more users interacting with us via the blog comments. That's great! But we need your help keeping up -- making sure the questions there have useful answers, and the comments there have thoughtful responses. There are three especially useful ways you (yes you, please please please) can help: A) Look through each of the recent blog posts periodically, and find things that you can answer or things that you can be helpful on. Don't be shy! The more variety of Tor people we have the smoother everything will go. B) Notice useful comments/questions that need particular expertise, and bring them to the attention of the team that can answer them. A great example is https://blog.torproject.org/blog/tor-02810-released#comment-223817 where it looks like maybe Tor Browser is using an OpenSSL version that is about to go unsupported, and if so we should open a ticket about that. Maybe each team should designate a point person for questions related to their topic? Blog comments move more in reddit-time or twitter-time, so batching the answers once a week won't be as good as we can be. C) Go through and approve non-spam comments so they go live on the blog (and delete the spam ones). Our current blog system is old and klunky, and we've opted not to tie in third-party spy sites for distinguishing spam, but the tradeoff is that we handle comment approval manually for now. The glorious future will bring us a newer Drupal with more ways to streamline comments, but we're not there quite yet. If you don't have a blog account, and you need one, let me know and I'll hook you up. Special thanks to everybody who has been helping out so far! --Roger

2 1

Some emails asking for donations had a wrong link
by Sebastian Hahn 03 Dec '16

03 Dec '16

Hey, unfortunately there was a small issue with sending out some of our donation drive emails. If you or someone you know is confused about an email with a link that asks for username/login information, please disregard that mail and wait for a second one that should have the corrected link. If you don't get a second mail, please get in touch! Thanks and sorry for the trouble Sebastian

1 0

(FWD) TODAY: 7:30pm 5-134: Reproducible Builds
by Roger Dingledine 30 Nov '16

30 Nov '16

A shout-out to Tor, from a totally different world. I've added the phrase 'reproducible builds' to our 'projects that are succeeding at their goals because of Tor' riseup pad. :) --Roger ----- Forwarded message from Lenny Foner <foner(a)media.mit.edu> ----- Date: Wed, 30 Nov 2016 10:55:26 -0500 From: Lenny Foner <foner(a)media.mit.edu> To: cluedump-announce(a)mit.edu Subject: TODAY: 7:30pm 5-134: Reproducible Builds Please join us today, at 7:30pm in 5-134, for a Cluedump by Valerie Young on Reproducible Builds: We trust FOSS software because we can read the source code. Or, at least, we trust FOSS software because we trust the community who reads and writes the source code. But users do not download source code and compile programs themselves; they download binaries. Binaries can be exploited in many ways, from a compromised developer to a compromised compiler, and without reproducible builds, we are not capable of independently verifying that a given binary came from the publicly available source code. "'Reproducible builds?'" you might ask in confusion, "Are you implying the compilation of software is not deterministic?" Turns out, yes! "Reproducible Builds" is the umbrella term for the wide FOSS effort to make the build chain of all software deterministic and transparent. In this talk, I will give a brief history of the reproducible builds effort from Tor's original success to the ongoing work of the Debian community to create an entirely reproducible operating system. You will leave with a clear understanding of the nuances and challenges of achieving reproducible builds and a clear vision for the exciting future where reproducible builds are the norm. Bio: Valerie Young is a Debian contributor and secretary for the board of directors of Software in the Public Interest. She studied physics and computer science at Boston University, worked at athenahealth for a few years, and is presently on vacation between paying jobs to chill and write free software. Snacks will be served! For more information, or if you'd like to give a Cluedump, please contact us at cluedumps(a)mit.edu. Anyone can give a Cluedump: undergraduates, graduate students, researchers, faculty, alumni, or those from outside MIT. To see prior Cluedumps, some of which have supplementary information, see http://cluedumps.mit.edu/. Add Cluedumps to your calendar at https://sipb.mit.edu/calendar/. (bcc'd to dorm lists; NaN for bc-talk) --------------------------------------------------------------------------- SIPB Cluedumps are one-to-two hour informal technical talks about any topic of interest to the MIT computer community. To receive future SIPB Cluedump announcements, be sure to subscribe to the cluedump-announce mailing list. What is SIPB? More so than a traditional computer club, SIPB is a student group with deep roots in the culture and implementation of computer technology at MIT. SIPB is a community---a group of computer enthusiasts working together to learn and create. As a group, SIPB develops and maintains many technologies in official use at MIT, such as the operating system you use at Athena clusters. But, more than anything, SIPB is an opportunity for people of any major or background to come together, learn new skills, and make ideas come to life. Come learn more, get involved with one of many projects, or create your own! http://sipb.mit.edu/ ----- End forwarded message -----

1 0

identifying fellow travelers
by Shari Steele 30 Nov '16

30 Nov '16

Hey all. As part of our end-of-year campaign, we’re going to highlight some projects that rely on or build on Tor, emphasizing how Tor is at the heart of Internet freedom while at the same time highlighting some of the cool things others are working on. I’d like to highlight one project per day for the month of December. I’ve started to collect some projects on this pad: https://pad.riseup.net/p/q0iJkHTMLBkF But I know I’m missing some—probably some good ones. So my apologies in advance if I missed something important that you’re working on—please know that it’s my ignorance and nothing personal. I’d appreciate it if people here could fill in the missing projects. Also, is one of your projects highlighted here? I would be delighted if you’d be willing to share a couple of paragraphs on why Tor is important to your project, along with a link to whatever page you’d like us to send people to when they read the blog post. If you can’t supply anything, I’ll come up with something, but I bet it would be better if you wrote it yourself! Thanks in advance for your help with this! Shari

7 6

Belated thanks to George and David
by Allen Gunn 30 Nov '16

30 Nov '16

Hello all, With both general gratitude and a spirit of shouting out folks who do great ambassador work for Tor, I wanted to thank George R and David F for contributing so much about two weeks back at our Nonprofit Software Development Summit. George explained Tor architecture to a bunch of participants who say they are now inspired to run relays and set up onion sites, and also had a number of how-to side conversations. David explained pluggable transports and a number of other Tor features during our demo fest and contributed richly to other sessions. We are grateful to have this type of super-valuable sharing take place at the Dev Summit, and I just wanted to state that publicly. Thanks you two, you both rock. peace, gunner -- Allen Gunn Executive Director, Aspiration +1.415.216.7252 www.aspirationtech.org Aspiration: "Better Tools for a Better World" Read our Manifesto: http://aspirationtech.org/publications/manifesto Follow us: Facebook: www.facebook.com/aspirationtech Twitter: www.twitter.com/aspirationtech --

1 0

Turning on timing obfuscation (iat-mode=1) for some default bridges
by David Fifield 30 Nov '16

30 Nov '16

I propose that we turn on the obfs4's optional packet size and timing obfuscation on some of the default Tor Browser bridges. The packet size and timing obfuscation can be off (iat-mode=0) or on (iat-mode=1). Currently, all of the default bridges, and probably ≈100% of BridgeDB bridges, have it turned off (iat-mode=0). As far as I know, iat-mode=1 has never really been tried in practice. The reason I propose trying it is the current blocking situation in Kazakhstan. According to reports, obfs4 (along with meek and vanilla Tor) are blocked there--not only the built-in default bridges, but also secret bridges from BridgeDB. A user on IRC has been experimenting with the Kazakh firewall; the blocking seems to be some sort of probabilistic traffic analysis--it doesn't always block and the rate of blocking depends on the network load. That user would like to have iat-mode=1 set on some of the default bridges to see if it gets through the firewall. Here are details on the Kazakhstan situation: https://bugs.torproject.org/20348 So I'm thinking it's a good idea to turn on iat-mode=1 on, say, 20% of the default bridges. That'll also be a good hedge against potential future blocking, as we can see if the bridges that use size and timing obfuscation are more resistant. It is safe for the server to turn on iat-mode=1 while the client still has iat-mode=0; the obfuscation will only apply in one direction but the connection will still work. ---- Addendum on how to activate iat-mode=1 on the server If you built obfs4proxy from source, and you are using commit a7a2575cab or later, you just need to add one line to your torrc: ServerTransportOptions obfs4 iat-mode=1 Unfortunately this commit is not yet in a released version. If you are using a released version, such as obfs4proxy-0.0.6, then you need to specify every other possible parameter in addition to iat-mode. Find the file <datadir>/pt_state/obfs4_state.json, and convert the JSON syntax into key=value syntax in a ServerTransportOptions, for example if obfs4_state.json contains {"node-id":"0af6c84b644856255dd858b2b189725db6ded51a","private-key":"d04e61ea38757ef67131a3032709e26bbf77a370aadf3950180fbf797973b365","public-key":"fedde584dc36265f9071ab6f7d845a9ae9e3cea5b9c956b252c1c7849aa2d006","drbg-seed":"5bb4dd59f507a89660c4d313f598ed56f4e9e0a620e129af","iat-mode":0} then add this to torrc: ServerTransportOptions obfs4 node-id=0af6c84b644856255dd858b2b189725db6ded51a private-key=d04e61ea38757ef67131a3032709e26bbf77a370aadf3950180fbf797973b365 public-key=fedde584dc36265f9071ab6f7d845a9ae9e3cea5b9c956b252c1c7849aa2d006 drbg-seed=5bb4dd59f507a89660c4d313f598ed56f4e9e0a620e129af iat-mode=1 You will know you need to do this if, when you try to set iat-mode=1 by itself, you get the tor.log error: [warn] Server managed proxy encountered a method error. (obfs4 missing argument 'private-key')

4 6