- tor-project - lists.torproject.org

Notes from July 28 2016 Vegas team meeting
by Karsten Loesing 01 Aug '16

01 Aug '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for July 28 2016 meeting: Alison: 1) Support manual: Colin sent it to tor-project@ for final review, once that's finished we'll focus on translations and ways to promote and disseminate it. We're also working on a Tor glossary, and eventually will get started on an FAQ. The end goal for support stuff is to make it into a portal similar to support.twitter.com. 2) Social contract: it's done and it's here in read-only form: https://storm.torproject.org/shared/UleWiALOvWDnWxEqPcAfr49tkHaM-h7PlSmoHlR…. I need to send a mail to tor-project@ about ratifying it (I guess they will see this first anyway, but that's okay). I'm not sure the best way to do that; I can just write something brief explaining what the SC is and give folks a week or so to accept/object to it, and then if all is well I can publish it on the blog and other places. Thinking "About Tor" and the community team wiki are two places it should live. 3) Working on a lot of outreach trying to build the community team. 4) Cool stuff coming up for LFP/Tor outreach: IFLA, DCPL, Toronto Public Library, maybe Finland Roger: 0) I was at PETS last week; I'm at SponsorR meeting this week and next. 1) NSF: Good news! We're on track to get another NSF grant, for 2 years, joint with University of Illinois Chicago and Eindhoven. They funded something like 5 proposals out of 120. 2) I've been thinking a lot lately about what I should focus on once I finish traveling too much (i.e. starting in Oct). Catching up on the research side is a strong contender, especially since we're heading towards have five (five!) concurrent NSF grants. 3) David and I talked about good content for technical 33c3 talks, and Tor Browser seemed like a great option. David mailed Mike and Georg. 4) We're asking Isis to run the next bridge directory authority. Linus and Moritz and I had a good chat about a replacement (ninth) directory authority. 5) How are we doing on the blog re-do? 6) I just mailed Lunar to make sure he's still on track to start up TWN in September. 7) How are we doing on moving Storm to a weasel-run host? Nick: 1) releasing 0.2.8.6 (stable!) RSN. Have to decide whether to include some annoying solaris fixes in it. Leaning towards no. 2) We are missing a step in our dev-meeting and benefits communication. That step is that we should say "If you have not heard from XYZ by date ABC, you should assume your email was lost, and send again". 3) PETS etc. Isabela: 1) Finishing the draft of the SIDA proposal 2) Did retrospective with network-team last Monday (our second IRC retrospective!) 3) Simply Secure is progressing with our style guidelines Mike: 0) I am back to help Georg this week rebasing and tagging Tor Browser for next weeks release. 1) After that, I will be digging myself out of email and trying to come up with a plan for Tor Labs Kate: 1) Internet of Things media coverage with Nathan (Intercept, Wired, podcast, etc.) 2) Working on Q and A with Nima to pull out some key things from HOPE for human rights activists and nontechnical users 3) Snooping nodes—Edited and published statement by Donncha and Roger on blog about our positive relationship to this NEU research 4) Media strategy around Jake situation 5) Have various good newses to roll out to the media and will do so as soon timing makes sense 6) Met with a big bunch of reporters at HOPE, mainly to build relationships. It went really well. The focus was not to pitch specific things but we did bat around story ideas. They are interested in: a) Onion services rollout (stage by stage if necessary--so it's helpful to keep me in the loop about when things are coming up); b) Tor metrics Shari: 1) We put out the release ending the investigation. As expected, it’s been getting a lot of press. 2) Invitations went out for TorDev. 3) We’re rolling out benefits for all employees as of August 1. Erin the HR person has been rocking. 4) I'll be traveling to the East Coast for the rest of this week and half of next week. Visiting with family in NYC this weekend, meeting with reporters and Gunner (!) on Friday. Then heading to DC for the DRL audit next week. Meeting with Nima while I’m there. Karsten: 1) Had three (!) meetings with iwakeh since last week to coordinate MOSS award work. Wrote/tested/reviewed a lot of code. Changes are 90% to improve code quality and 10% to add features, so will be invisible to most people. But software quality matters, and soon we'll add fancy features, too. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXnwvkAAoJEC3ESO/4X7XBDQsIAMhbFtIA1uvhJ9W3d33TFtw5 HKQqP9k9bAy1AjHZpIvZOy9g+rLS+g8BuXdiHQ3kZB6YQYdgWM/VxBYr/uxw/+Et nuI4xVkZPobK5LMwXtKgaplaDAxSWf98PTQ5T2Wbmr0m2oxHDnu0EJdNxVp/W1Ug a1afc8pXW8JvxZ0H4OVCPheaRpV5Yq2BfWxl3OPFP5YTPPO3mNknp9PUO7lKsKPQ s01u5OwwEHQ9y+aZUIG548QDnsliqJ/JfI8iECzkFfuKNVhFgZjv/plMqsDPNzdA jd+jfwhNnvmOcpDNuKXW1/N1zt7rG+R4W6wAvJEvi6gbE66/rCR92NjNvV6xMnE= =tnvh -----END PGP SIGNATURE-----

1 0

The Tor Project Social Contract
by Alison 30 Jul '16

30 Jul '16

Hello good people of tor-project@! I'm excited to present to you something that a number of us core members have been working on for some time now: the Tor Project Social Contract 1.0 [1]. Modeled after the Debian Social Contract [2], the Tor Project Social Contract is a set of promises to our community about what Tor stands for and why we create it. I'm sharing it with all of you today so that we can work on ratification. I think that the best way to do this is as follows: By 6 August at 00:00 UTC, please respond to me or to the list if you accept or object to this social contract so that we can ratify this through rough consensus [3]. If objecting: Please be specific about your objections so that we can discuss changes as needed. If you respond directly to me, I will assume that you don't want your name shared with the group, but please specify if you don't want your comments shared either. NB: THIS IS NOT AN INVITATION TO EDIT BY COMMITTEE. I'm interested in feedback like "this does not represent the Tor that I know" not "I'd like this sentence reworded". Please also be kind, because this was written by humans. If accepting: your florid prose about why you love it and think it's an astonishing work of art that reflects the diligence and care exercised by the authors is quite welcome. A show of hands (writing an email that says +1) is also fine. Questions are welcome. If this is successfully ratified, I will publish it on the Tor blog and in some other places: probably the "About Tor" section of the website and on the Community Team wiki. If you have great ideas for other places this should live, let me know! Thank you for your feedback, and thank you to all of the Tor folks who worked on this, especially Lunar and Roger, who got it started. Alison [1] https://storm.torproject.org/shared/UleWiALOvWDnWxEqPcAfr49tkHaM-h7PlSmoHlR… [2] https://www.debian.org/social_contract [3] https://en.wikipedia.org/wiki/Rough_consensus

18 43

questions about new community safety documents and practices...
by stderr＠riseup.net 30 Jul '16

30 Jul '16

Hi all, I have a question about the Harassment Prevention Policy, available here: A non-text attachment was scrubbed... Name: Harassment Prevention Policy (final).pdf Type: application/pdf Size: 98932 bytes Desc: not available URL: <http://lists.torproject.org/pipermail/tor-project/attachments/20160729/c0fd…> The policy seems to conflate harassment and discrimination, specifically in this clause: "Both the Company and U.S. law also prohibit unlawful workplace harassment. Unlawful harassment is unwelcome conduct, based on a Protected Characteristic, that is sufficiently severe and pervasive to alter the terms and conditions of employment or create an intimidating, offensive, or abusive working environment. Prohibited harassment can take many forms, including, but not limited to the following, when based on a Protected Characteristic: •Making or using derogatory comments, emails, letters, epithets, slurs, or explicit jokes. •Derogatory gestures, posters, photographs, cartoons, drawings, websites, emails, text messages, or other physical or electronic media. •Touching, assaulting, impeding, or blocking normal movements." Earlier in the document, a "protected characteristic" is defined as: "It is against U.S. law and strictly against our policy for any employee or non-employee to discriminate against or harass any Company employee, contractor or volunteer on the basis of race, color, religion, national origin, ancestry, disability, medical condition, genetic information, marital status, sex, gender, gender identity, gender expression, sexual orientation, age, military or veteran status, or any other protected status (each a “Protected Characteristic”)..." Anti-discrimination statutes and policies are commonly defined around "protected classes" or "protected characteristics," since discrimination based upon other characteristics is both clearly allowed and beneficial (performance, fitness for the advertised job opening, etc.), but harassment statues and policies typically don't include references to protected classes or characteristics, since harassment is always negative and thus characteristic agnostic. Simply put: the plain language of the Tor Project's new policy would seem to allow harassment, provided that it is not *based upon* a protected characteristic. This would also seem to allow the harassment of anyone, including women, racial minorities, or other people whose rights such a policy would presumably be designed to protect, as long as that harassment is not "based upon" those characteristics. I would strongly prefer if the Tor Project would separately define harassment and discrimination. If someone is turned down for a job on the basis of their race or veteran status, that is discrimination, but not harassment. If someone receives extensive unwanted communications from a co-worker, for example including persistent late night phone calls that are unrelated to work, or extensive unwanted visits from the co-worker at one's home, etc, then this would clearly constitute harassment, provided that the complainant made it clear that these communications/visits were unwanted. However, this behavior need not be based on a "protected characteristic" and it may not necessarily take the form of sexual harassment, either. This is why harassment is typically defined as a persistent, unwanted, pattern of behavior that would cause a reasonable person to experience fear or emotional distress. Best, stderr

1 0

questions about new community safety documents and practices...
by Lane Rasberry 29 Jul '16

29 Jul '16

Hello, I just subscribed to this list hoping that this was a general discussion list for the Tor community. I think I am in the correct place, but if not, would someone redirect me? I see that there is another recent thread called, "The Tor Project Social Contract". Having text like this seems like a great idea! I subscribed to this list after reading a recent blog from headquarters at <https://blog.torproject.org/blog/statement-0> Part of the post said, "the Tor Project has created an anti-harassment policy, a conflicts of interest policy, procedures for submitting complaints, and an internal complaint review process. They were recently approved by Tor’s board of directors, and they will be rolled out internally this week." I am writing to ask if anyone can share copies of all these policies and any supporting documentation. Beyond that, I am writing to ask if they can all have free / open licenses that would be compatible for reuse in Wikipedia and Wikimedia projects. It seems like this is already routine, but sometimes it is nice to clearly indicate a licensing scheme. In Wikipedia, the community has faced similar conduct issues over the past few years. If the Tor community has a good start in developing text, policies, and processes for these things, then I might like to bring whatever insights are here into Wikipedia. Right now, Wikipedia does not have a code of conduct, and some people like me are exploring options for introducing one. Perhaps the Tor community would also find it useful to get community comments and critique for whatever equivalent documents are developed in Wikipedia. Thanks for discussing community issues in a public way. It is nice when various online communities can share ideas and best practices. yours, -- Lane Rasberry user:bluerasberry on Wikipedia 206.801.0814 lane(a)bluerasberry.com

3 3

Ethics Guidelines; crawling .onion
by Virgil Griffith 28 Jul '16

28 Jul '16

Hello all. I am preparing a longer response to the issues Isis et al mentioned. Most are interrelated, but this one is not. And I wanted to get clarification on it. Isis expressed a concern about making a list of bitcoin addresses from .onion, citing, "Consent is not the absence of saying 'no' — it is explicitly saying 'yes'." For what it's worth, ahmia.fi actually supports regex searching right out of the box. In fact, a single line of JSON spits out all known bitcoin addresses ahmia knows about. For example, here's an anonymized list going .onion -> BTC which I mined from Ahmia, * http://virgil.gr/wp-content/uploads/2016/05/btc-on-dot-onion.html [6MB] And here's the same information going BTC -> .onion * http://virgil.gr/wp-content/uploads/2016/05/btc2domains.v2.txt [2mb] If you want to check the results you can ask Juha for the JSON query to do this. Lets go out on a limb and assume that regexs are okay. Is the issue then .onion search-engines? I understand Isis's preference for there to always be affirmative consent but does that mean that until such a standard exists all search engines from onion.link, ahmia.fi, MEMEX, NotEvil, and Grams are violating official Tor community policy? ---- Here's how I currently see this. I put on my amateur legal hat and say, "Well, the Internet/world-wide-web is considered a public space. Onion-sites are like the web, but with masked speakers." * https://www.hks.harvard.edu/m-rcbg/research/j.camp_acm.computer_internet.as… * http://aims.muohio.edu/2011/02/01/is-the-internet-a-public-space/ Ergo, I would argue that, by default, content on .onion is public the same way everything else on the web is. If you don't want to be "indexed", for physical spaces you go in-doors, or for the web you put up a login. As an aside, the web-standard is actually *kinder* than physical public spaces because on the web one can have an unobstrusive /robots.txt saying, "please don't index me". Which is a great thing. Whereas some would say Tor users are "anonymous", others would instead say any and everything Tor is "private". I believe this needs to be clarified. I once proposed to Roger that he delineate the sub-types of privacy in the same way Stallman delineated his "Four Freedoms". Roger replied that he preferred using the broad catch-all term "Privacy". These confusions may be a caveat of using a broad catch-all term. Interpreting broadly, Isis is correct. However, this conclusion has a lot of unpleasant ramifications. Comments appreciated, -V P.S. Mildly related, I saw this today involving DARPA, and Tor. http://thehackernews.com/2016/05/darpa-trace-hacker.html """ The aim of Enhanced Attribution program is to track personas continuously and create “algorithms for developing predictive behavioral profiles.” """ I hope you all are aware this flows directly from MEMEX. Right? This, and MEMEX, seems a much more appropriate target for outrage. A lot of this work that numerous community members have worked on gives even me pause.

5 22

Re: [tor-project] Who is attending the OTF summit?
by Nathan Freitas 28 Jul '16

28 Jul '16

No sleep til Baltimore... I'll be there. Fri, Jul 22, 2016, at 06:12 PM, Roger Dingledine wrote: > Who here is going to the OTF summit? I hear it is mid October in > Baltimore. > > I spoke to Dan Meredith today about whether I should go -- last year he > was really sad that I wasn't there, and I told him I wasn't invited, and > he declared I was always invited to everything, so I reminded him about > it > today. > > I know they're very limited in space. I figure step zero is to learn > who else here is already signed up, so I can figure out how important > it is for me to be there. > > (And if for some reason you aren't comfortable answering on-list, you > can always answer me off-list.) > > Woo, > --Roger > > _______________________________________________ > tor-project mailing list > tor-project(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-project

3 2

Great article privacy tools workshops in DC Public Library
by Kate 26 Jul '16

26 Jul '16

Hi, This is a terrific article about the DC Public Library's privacy tools workshops; we gave a workshop there in January, 2015. This is just the kind of friendliness coupled with skillsbuilding that can help us in the long run in DC--I know that Alison is planning something there soon. https://technical.ly/dc/2016/07/26/dc-public-library-internet-privacy/ Fun fact: The reporter's twitter handle is @howisthatlegal Cheers, Katie

1 0

Fwd: Official invitation to Overdrive hacking conference, Girona
by Shari Steele 25 Jul '16

25 Jul '16

> Begin forwarded message: > > From: talks(a)overdriveconference.com > Subject: Official invitation to Overdrive hacking conference, Girona > Date: July 24, 2016 at 10:54:45 AM PDT > To: execdir(a)torproject.org > > Greetings TorProject, > > We mail from overdriveconference.com a hacking conference based in the university of Girona(Spain). We would like to invite you to our hacking conference. > > Overdriveconference is a computer security conference that will take place in the spanish city of Girona on days 25 to 27 of november 2016. The conference will focus on connecting the diferent members of the "hacker community" to share ideas, values and technical information and also think about what the hacker community is and our future. > > The conference is organized by volunteer students and teachers of the engineering department of the university of Girona currently setting up a defcon group(DC17003). > > As we admire the great work that tor project has done to help free thinkers and opressed people arround the world, we would love to have you in our conference, you are invited to join us to perform a talk about what tor project is, its present and its future goals. > > If you decide to join us to perform a talk about the project. we'll pay all the travel and stay expenses. We'll be waiting for your answer, if you agree to join we'll keep talking about the details. > > City details; http://overdriveconference.com/?page_id=509 > > Travel details: http://overdriveconference.com/?page_id=504 > > > Thank you for your attention. > > Pau, general coordinator overdrive conference. > > overdriveconference.com > udg.edu

1 0

Notes from July 21 2016 Vegas team meeting
by Karsten Loesing 25 Jul '16

25 Jul '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for July 21 2016 meeting: Alison: 1) I'm on "vacation" from 23-28 July which just means that my wifi might be intermittent 2) building the community team: doing outreach to activists, particularly women and people of color Georg: 1) Attended PETS and talked with a bunch of people about current and future projects Shari: 1) investigation is complete; press release probably tomorrow 2) TorDev invitations going out today (name TorDev?) Karsten: 1) Published a new graph showing bridge users by country and transports which dgoulet is going to present at HOPE. 2) Made good progress cleaning up codebases together with iwakeh. We're very close to zero checkstyle issues in all Java codebases. 3) Wrote down some milestones for an SOW for the MOSS award which Cass, Isabela, iwakeh, and I should finalize until end of week. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXlgOYAAoJEC3ESO/4X7XB0pEH/2Psp9IIJQzcNgNkLC51np7+ a+oTa3MxwUmXWxoH2J9RLyWU3tz/li2moUMUngJGf80yLeCBZXizrJID9PLfzd2R sGbGzygLGdpUTJwYj+Z4ZTkZmKeIwK0LmYIt0Cj/eBhvszyT3AtANGGuEapddUjG ootSiKSScJ4IK/R5pRez5ZZbWsTPOv46apJ0lZg1N0yOMq5/DCmogqZy+vOTZM4A Ey9RxHPsjtQFucYK0z9qqYxMOStiXmQe3wmtAeeMwktD+gdjYy3+wqo+e0Cm/kRi o/u/9/TKi+SV+4QVihkOPqrt8rWYiTR9z6kyNidbrdLt+8kmqy8RJaYfW6/IN1A= =C2w8 -----END PGP SIGNATURE-----

1 0

Who is attending the OTF summit?
by Roger Dingledine 22 Jul '16

22 Jul '16

Who here is going to the OTF summit? I hear it is mid October in Baltimore. I spoke to Dan Meredith today about whether I should go -- last year he was really sad that I wasn't there, and I told him I wasn't invited, and he declared I was always invited to everything, so I reminded him about it today. I know they're very limited in space. I figure step zero is to learn who else here is already signed up, so I can figure out how important it is for me to be there. (And if for some reason you aren't comfortable answering on-list, you can always answer me off-list.) Woo, --Roger

3 2