- tor-project - lists.torproject.org

Fwd: New Module Owners for Mobile
by Nathan Freitas 01 Jul '16

01 Jul '16

Changes at Mozilla on the mobile front. ----- Original message ----- From: Mark Finkle <mfinkle(a)mozilla.com> To: "mobile-firefox-dev(a)mozilla.org" <mobile-firefox-dev(a)mozilla.org>, "firefox-dev" <firefox-dev(a)mozilla.org> Subject: New Module Owners for Mobile Date: Fri, 1 Jul 2016 10:27:53 -0400 Today, I am transitioning module ownership of Firefox for Android and Firefox for iOS to Margaret Leibovic and Stefan Arentz, respectively. Margaret and Stefan have been leading the engineering teams on their respective projects for some time. That alone is enough to transition the module ownership, but today is also my last day at Mozilla [1], so I want to make sure nothing is left in limbo for the Mobile teams. Please join me in congratulating and supporting Margaret and Stefan. Finkle [1] http://starkravingfinkle.org/blog/2016/07/leaving-mozilla/ _______________________________________________ mobile-firefox-dev mailing list mobile-firefox-dev(a)mozilla.org https://mail.mozilla.org/listinfo/mobile-firefox-dev

1 0

Re: [tor-project] State of tshirts for volunteers running Tor relays
by Jon Selon 30 Jun '16

30 Jun '16

Hey all! Shari forwarded me the string of emails concerning the tor relay shirts. I would love to take this project on. We do have a small surplus of the relay shirts here at the Seattle office, so if someone could just point me in the right direction I will knock all this out. Where is this list of requests? Is this something I need to subscribe to? Let me know and I'll get this done. Any other information you could provide would also be greatly appreciated. Thanks, Jon

2 2

Monthly summary of various teams
by Nima Fatemi 30 Jun '16

30 Jun '16

With teams expanding in all different directions, it's getting harder and harder to catch up with what each team has been up to. Right now you'd have to sign up for all different mailing lists and show up for all different meetings to catch up with the work each team is doing... and then you wouldn't have any time to do any actual work. Would it make sense to have each team to send a summary of what they've been up to every month, to this list? or tor-reports? whichever that's more appropriate. Cheers, -- Nima 0X58C4B928A3E218F6 | @mrphs "I disapprove of what you say, but I will defend to the death your right to say it" --Evelyn Beatrice Hall

3 2

Summary of meek's costs, May 2016
by David Fifield 30 Jun '16

30 Jun '16

Here's the summary of meek's CDN fees for May 2016. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 January 2015 $464.37 + $669.02 + $0.00 = $1133.39 February 2015 $650.53 + $604.83 + $0.00 = $1255.36 March 2015 $690.29 + $815.68 + $0.00 = $1505.97 April 2015 $886.43 + $785.37 + $0.00 = $1671.80 May 2015 $871.64 + $896.39 + $0.00 = $1768.03 June 2015 $601.83 + $820.00 + $0.00 = $1421.83 July 2015 $732.01 + $837.08 + $0.00 = $1569.09 August 2015 $656.76 + $819.59 + $154.89 = $1631.24 September 2015 $617.08 + $710.75 + $490.58 = $1818.41 October 2015 $672.01 + $110.72 + $300.64 = $1083.37 November 2015 $602.35 + $474.13 + $174.18 = $1250.66 December 2015 $561.29 + $603.27 + $172.60 = $1337.16 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 February 2016 $986.39 + $977.85 + $445.83 = $2410.07 March 2016 $1079.49 + $865.06 + $534.71 = $2479.26 April 2016 $1169.23 + $1074.25 + $508.93 = $2752.41 May 2016 $525.46 + $1097.46 + $513.56 = $2136.48 -- total by CDN $13138.96 + $14661.22 + $3625.02 = $31425.20 grand total https://metrics.torproject.org/userstats-bridge-transport.html?graph=userst… As you can see, the number of users took a hit around May 13, dropping from ≈10,000 to ≈6,000. This was caused by the suspension of meek-google. You can read more about that here: https://lists.torproject.org/pipermail/tor-talk/2016-June/041699.html Reminder that if you configure your own CDN or App Engine account and point it at https://meek.bamsoftware.com/, you will be using a completely unlimited bridge, which will go faster and help save money. == App Engine a.k.a. meek-google == 3068 GB $368.17 3146 instance hours $157.29 https://atlas.torproject.org/#details/88F745840F47CE0C6A4FE61D827950B06F9E4… == Amazon a.k.a. meek-amazon == Asia Pacific (Singapore) 215M requests $258.16 651 GB $90.42 Asia Pacific (Sydney) 7M requests $9.66 54 GB $7.46 Asia Pacific (Tokyo) 1M requests $2.05 17 GB $2.28 EU (Ireland) 249M requests $299.58 1617 GB $127.67 South America (Sao Paulo) 15M requests $34.23 174 GB $40.95 US East (Northern Virginia) 126M requests $126.43 1249 GB $98.10 -- total 616M requests $730.11 3765 GB $366.88 charge for alarms $0.48 https://atlas.torproject.org/#details/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == Zone 1 5262 GB $457.76 Zone 2 404 GB $ 55.80 -- total 5666 GB $513.56 https://atlas.torproject.org/#details/AA033EEB61601B2B7312D89B62AAA23DC3ED8… Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

1 0

Unrecommended old 0.2.4.x and 0.2.5.x versions
by Roger Dingledine 30 Jun '16

30 Jun '16

Hi Peter, Sebastian, I just removed "0.2.4.23,0.2.4.24,0.2.4.25,0.2.5.8-rc,0.2.5.9-rc,0.2.5.10" from the set of Tor versions that moria1 recommends as acceptable. That's mainly because these are versions from before we added longclaw as a directory authority, so especially with dannenberg's rotated key (as of 0.2.8.1-alpha), those versions will have a tougher time believing today's consensus. According to https://packages.debian.org/search?keywords=tor there aren't any supported Debian packages that want to use those versions. I did not check Ubuntu or others. You should consider making this change too. :) Thanks, --Roger

2 1

Re: [tor-project] Globe is now retired (was: Plan to retire Globe)
by jah 30 Jun '16

30 Jun '16

Hi, Just a reminder that globe is listed as a currently available Onionoo client at https://onionoo.torproject.org/ . jah

2 1

Exit probability
by David Goulet 29 Jun '16

29 Jun '16

Hello everyone! A bit of context. Since November 2015, I've setup a Munin server that graphs some Tor network monitoring. You can have a look here: http://ygzf7uqcusp4ayjs.onion/tor-health/tor-health/index.html This email is about one of those graphs which is the Exit probability in the world. The graph has it per-continent. Here is a link to a graph with the full data since the start of my monitoring: http://ygzf7uqcusp4ayjs.onion/static/dynazoom.html?cgiurl_graph=/munin-cgi/… (Fun fact, the "Unknown" one is the IPpredator relay in "Liberia" ;) https://atlas.torproject.org/#details/BC630CBBB518BE7E9F4E09712AB0269E9DC7D… As you can see, Europe has been very dominant but lately it has grown from ~80% to 85% in the last month. While North America is going down from ~15% to 10%. I could do the exercise of graphing the top 10 countries in Europe that we exit but I _bet_ we'll end up with mostly 3 countries, Germany, France and Netherlands. (I might do this experiment actually.) To be honest, this is something that concerns me because this trend is going up for running Exits in Europe. Maybe it's because of attack on Exit relays in US? Maybe Snowden effect of USA == bad? Maybe hosting providers are too expensive in the North America? Maybe tor-servers/nos-oignons are too effective :)? I honestly don't know but that's not healthy in the long run. Of course having more in Africa and South America for starters would be amazing but that's another fight I feel like. Could we think of some outreach we could do maybe a blog post about the importance of location diversity in Exits? That running relays in the US is actually OK? or maybe just the fact that people have to stop using OVH (well OVH has a data center now in Montreal so NA!) or Hetzner or Linode? Or since Europe as a lot of countries thus multiple jurisdictions it's fine to have 85%? (is it really true with EU laws?) There. Thoughts? Cheers! David

3 2

Plan to retire Globe
by Karsten Loesing 29 Jun '16

29 Jun '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello everyone, as the subject says, I suggest that we retire Globe (currently available at https://globe.torproject.org/) The main reason is that Globe is serving a similar purpose as Atlas (available at https://atlas.torproject.org/) which it was forked from several years ago. Neither Atlas nor Globe are actively developed, they only receive critical bug fixes whenever necessary. And thanks, Philipp and Isis, for doing that! So, when deciding which of the two services we should keep, I looked at the number of daily requests to both services, which shows that Globe is used a lot less than Atlas: https://people.torproject.org/~karsten/volatile/atlas-globe-2016-04-01.png The hope is that retiring Globe could make it more likely that new developers start contributing to Atlas. It would also make it easier for us to add new feature to Atlas, because we wouldn't feel bad for not adding them to Globe, too. In any case, we're getting rid of yet one more thing. Here's a suggested timeline for retiring Globe: - By April 30, we create Trac tickets for all features we like in Globe and that are missing in Atlas. These tickets would go in component "Metrics/Atlas" in Trac. If you want to keep something in Atlas that you like in Globe, this is your chance to make that happen! - By May 15, we'll have reviewed those new tickets and decided which of them we should implement before shutting down Globe. We might send a call for help to tor-dev@ to write these patches. - By May 31 (hopefully), we'll have implemented, reviewed, merged, and deployed the missing features in Atlas, and we'll shut down Globe. We should probably add a static web page pointing to Atlas. If it takes longer than this, it takes longer, but let's use this date for now. Maybe nobody will be missing anything from Globe. We'll see. Suggestions welcome, not only if you strongly object! All the best, Karsten -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXG5afAAoJEC3ESO/4X7XBj/8H/25hssQXL5QuqVbzngTSJ8AF BchTx9l9lAclddyeaug74obAW01+ljO4PZhEZGr12FrTKtlot3PWlQTykkeqCuKh kbVDHgO4U90qSSsVX2aOB9UVlAfvNpk93c5RqdQVwa/1jx6MaMdUM3OFopm9m8ji ceJqizYBrKfL8sI4ksdz84f9u+fwClI2+2H1RMs5PhFG4gIZ/F/ZzVMbkh2ruITC gNl3tWwj46I1CicPQQfYEtaKsA2VckRNo+8N1pfpSKsHBAP6hdGbKQvTkTxRSsrO MFu+kMaF0wkaT58o2IF2FhrQdnq7rns/zAoG+L2ym+7qqEbuaqb/m3wq1jnNp1I= =NDEg -----END PGP SIGNATURE-----

8 17

List moderation or subscriber trimming on tor-talk@
by Griffin Boyce 27 Jun '16

27 Jun '16

tor-talk@ has always been fairly off-topic and subject to overflow from the cypherpunks list, but lately it seems like an endless barrage of filter-evading nonsense. I'm filtering my inbox, but it doesn't seem to help much. I filtered for subject & body content, then people omitted specific names. I filtered out specific senders, then people made new accounts. There seem to be less than ten people who never seem to be on-topic or moving any conversation forward. And indeed, many of these people are behaving the same way on other lists as well. Long-term, these people have been causing exponentially more distraction than any benefit their (rare) good points have made. While it's relatively easy for me to ignore, nearly 300 emails in two weeks would be hard to ignore for anyone who's just now subscribing to the list. And those 288 messages are filled to the brim with the most base tinfoil-hattery. So with all that said, I would like to broach the subject of moderating tor-talk, or perhaps removing those few subscribers who always seem to be off-topic. Understandably, this is a controversial topic, but I think it's critical to bring the list back to its normal functions. best, Griffin -- There are 10 kinds of people in the world: those who understand binary, those who don't, and people who didn't expect a base 3 joke.

6 23

Notes from June 23 2016 Vegas team meeting
by Karsten Loesing 27 Jun '16

27 Jun '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for June 23 2016 meeting: Georg: 1) GSoC workload is starting to increase for the Panopticlick project 2) Helped with press related things around the Selfrando paper Karsten: 1) Met with metrics team members in Berlin to talk about the new Mozilla award and to start making some plans. Roger: 0) My next several weeks are going to continue to be messes, logistics-wise. So if there is something concrete that you need from me, please let me know early and often. Sorry in advance. :( 1) We got permission to have spent the rest of our SponsorR Year2 money. That means soon I will need to sit down and map out the Year3 milestones that we will want to use. 2) We wrote a "rebuttal" for the reviews on our NSF-Eindhoven proposal. Things are looking promising but who knows. 3) I helped Shari with a first round of Seattle invite brainstorming. It's with her now, to make some decisions how much travel to fund. Also we should be sure to send the draft invite list to some sufficiently large set of people (tor-internal?) so we can learn about potential problems early. 4) Shari asked me to help move forward the donations platform thing. I need a person who can lead it, because I'm going to flake if it's just me. 5) I'm considering doing a panel the Monday before PETS in exchange for them paying for my flight (yay making money by saving money). Nick: 1) No updates, actually. Mainly doing software, trying to be helpful to Isa and my team, trying to stay focused. 2) Could use some triage help from Isabela, but it's less urgent than all the other stuff Isa is doing. 3) Hoping to discuss many of the things Roger raised above. 4) Never enough hours in the day or days in the month. Kate: 0) My request for good news about Tor work is going well. Had planned to just do blog posts (as media bombs were exploding all around) but will now to try to pitch some of this to journalists. Will also resume newsletter going forward. It was a little difficult to elicit good news from the group. People, don’t be shy! We’re doing so much interesting work! Also, if you are doing a software release, let me know if there are particular features that users (or info sec folks) will think it’s important or useful. I may not be able to figure this out without you :) Good news blog posts: Tone: Fun, interesting, friendly (which is true to these projects!) Karsten —Karsten’s Mozilla award blog post is published - yay! https://blog.torproject.org/blog/tors-innovative-metrics-program-receives-a… GeKo—I interviewed him on Selfrando; https://blog.torproject.org/blog/selfrando-q-and-georg-koppen Serene -Q and A about Snowflake is drafted and I am editing it Nick—Writing a blog post on history of Tor’s cryptography! 1) EFF/Tor Day of Action on Rule 41 (First Tor advocacy campaign ever?) Funny and pointed tweets by flexlibris and Isis to support it :) (loved them both so much) 300,000 Twitter impressions 1,000 retweets We tweeted, participated in EFF's mainstream media (a judicious amount); helped provide quotable quotes, blogged, Facebooked. Helped signal boost the proposed bill “Stop Mass Hacking Act” that would undo changes to Rule 41 Despite intentionally keeping a low profile on mainstream media (as we are a hot potato at the moment), we were quoted in BoingBoing and SC Magazine Listed as a supporter of the campaign in very good Hill article, Christian Science Monitor (also The Register TechTarget, and TechWorm Media was overwhelmingly positive; Twitter response was very positive (so--no backlash against Tor or campaign) The Hill: http://thehill.com/policy/cybersecurity/284278-google-paypal-push-back-on-c… (barely there but in a useful context in a useful article) CSM: http://www.csmonitor.com/World/Passcode/2016/0622/Google-privacy-groups-urg… SC Magazine: http://www.scmagazine.com/justices-caldwell-lauds-rule-41-changes-eff-other… Great working relationship with Rainey; we communicated in real time for two days straight; tried to set this up for tech people but no dice Planning a twitter survey to see if people learned more about Rule 41 during Day of Action (interested in any advice from Isabela) Banner for our website was super tricky—I think EFF expected us to be able to just paste it onto our website, but in the future—we should have a Tor-EFF policy and tech meeting ahead of time to discuss any issues—and especially—be able to communicate in real time with EFF tech people to ask questions. Thanks to Roger and Sebastian, who worked on it. 2) Fenton Communications: Shari, Sue, and I met with them; had a useful discussion with them about crisis communications, realized that we are already on the right track and decided not to use them. Will reserve the right to re-engage with them if all heck breaks loose or looks like it’s going to. :) 3) Funders need to help us resist FBI exploits! That is all. I hope they do. Smart people are working on it. :) Relevant: “As quietly as possible, the government is renewing its assault on your privacy” https://www.theguardian.com/commentisfree/2016/jun/22/government-privacy-fb… Alison: 1) Social contract progress 2) Getting a professional facilitator to help us talk about consent, abuse, etc at Tor-dev 3) OTF proposal for Torservers got another extension Isabela: 1) DRL - visit moved to first week of August (yay) - we (me, shari and sue) are actually going to DC for this audit thing (that is a lot of work on this front for me this month and in July) 2) DRL - next round of proposals August 26! We need to coordinate what we will do, Mobile is definite one but we should try two proposals 3) SIDA - Marcin reached out with a list of things for us to do in the process of submitting a final proposal for them by August 1st 4) Internews - so painful :( trying to get Nima to sign his contract and to invoice us. I need to start gathering the deliverables because it ends next week.. very painful but I think I will survive this project 5) Network team - catch up on 029 state of things and start working on follow ups from our last retrospective and prep our next one (we said mid July) -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXcOCrAAoJEC3ESO/4X7XB4TsH+gIMjowp+d9jjGUjjwzxhj1m DE3paDnJDSubRCD8iNB7TGc/bSrmcqmV/1VitRFkmoGBVXRNIrzJiXFGFMfmltal DPWx5CGVbqM+pUAARhUAte+kgLC2sKysWJIv+Jywbqlk638pmCAZkah5+qOQCFTj WBvkq7wVBWIWb1vxkSjzfe3cRJI0rmg/NEf6otDC/j25zf58jr/8oh/woyOwmi+z QLSHNXRXy2Wk7IUjo4Htg08DWGwyEh8CWZ4bbsa0+pYS27Ch0bImjVINcBbaQKv/ xa3r8v/8rYTlCrmjOk7d7omfGpEJV6CfK8OgPyFRzPjMHQ8xp8lVhsKnSM9U+DI= =qRhK -----END PGP SIGNATURE-----

1 0