- tor-project - lists.torproject.org

The Tor Project Social Contract
by Alison 30 Jul '16

30 Jul '16

Hello good people of tor-project@! I'm excited to present to you something that a number of us core members have been working on for some time now: the Tor Project Social Contract 1.0 [1]. Modeled after the Debian Social Contract [2], the Tor Project Social Contract is a set of promises to our community about what Tor stands for and why we create it. I'm sharing it with all of you today so that we can work on ratification. I think that the best way to do this is as follows: By 6 August at 00:00 UTC, please respond to me or to the list if you accept or object to this social contract so that we can ratify this through rough consensus [3]. If objecting: Please be specific about your objections so that we can discuss changes as needed. If you respond directly to me, I will assume that you don't want your name shared with the group, but please specify if you don't want your comments shared either. NB: THIS IS NOT AN INVITATION TO EDIT BY COMMITTEE. I'm interested in feedback like "this does not represent the Tor that I know" not "I'd like this sentence reworded". Please also be kind, because this was written by humans. If accepting: your florid prose about why you love it and think it's an astonishing work of art that reflects the diligence and care exercised by the authors is quite welcome. A show of hands (writing an email that says +1) is also fine. Questions are welcome. If this is successfully ratified, I will publish it on the Tor blog and in some other places: probably the "About Tor" section of the website and on the Community Team wiki. If you have great ideas for other places this should live, let me know! Thank you for your feedback, and thank you to all of the Tor folks who worked on this, especially Lunar and Roger, who got it started. Alison [1] https://storm.torproject.org/shared/UleWiALOvWDnWxEqPcAfr49tkHaM-h7PlSmoHlR… [2] https://www.debian.org/social_contract [3] https://en.wikipedia.org/wiki/Rough_consensus

18 43

questions about new community safety documents and practices...
by stderr＠riseup.net 30 Jul '16

30 Jul '16

Hi all, I have a question about the Harassment Prevention Policy, available here: A non-text attachment was scrubbed... Name: Harassment Prevention Policy (final).pdf Type: application/pdf Size: 98932 bytes Desc: not available URL: <http://lists.torproject.org/pipermail/tor-project/attachments/20160729/c0fd…> The policy seems to conflate harassment and discrimination, specifically in this clause: "Both the Company and U.S. law also prohibit unlawful workplace harassment. Unlawful harassment is unwelcome conduct, based on a Protected Characteristic, that is sufficiently severe and pervasive to alter the terms and conditions of employment or create an intimidating, offensive, or abusive working environment. Prohibited harassment can take many forms, including, but not limited to the following, when based on a Protected Characteristic: •Making or using derogatory comments, emails, letters, epithets, slurs, or explicit jokes. •Derogatory gestures, posters, photographs, cartoons, drawings, websites, emails, text messages, or other physical or electronic media. •Touching, assaulting, impeding, or blocking normal movements." Earlier in the document, a "protected characteristic" is defined as: "It is against U.S. law and strictly against our policy for any employee or non-employee to discriminate against or harass any Company employee, contractor or volunteer on the basis of race, color, religion, national origin, ancestry, disability, medical condition, genetic information, marital status, sex, gender, gender identity, gender expression, sexual orientation, age, military or veteran status, or any other protected status (each a “Protected Characteristic”)..." Anti-discrimination statutes and policies are commonly defined around "protected classes" or "protected characteristics," since discrimination based upon other characteristics is both clearly allowed and beneficial (performance, fitness for the advertised job opening, etc.), but harassment statues and policies typically don't include references to protected classes or characteristics, since harassment is always negative and thus characteristic agnostic. Simply put: the plain language of the Tor Project's new policy would seem to allow harassment, provided that it is not *based upon* a protected characteristic. This would also seem to allow the harassment of anyone, including women, racial minorities, or other people whose rights such a policy would presumably be designed to protect, as long as that harassment is not "based upon" those characteristics. I would strongly prefer if the Tor Project would separately define harassment and discrimination. If someone is turned down for a job on the basis of their race or veteran status, that is discrimination, but not harassment. If someone receives extensive unwanted communications from a co-worker, for example including persistent late night phone calls that are unrelated to work, or extensive unwanted visits from the co-worker at one's home, etc, then this would clearly constitute harassment, provided that the complainant made it clear that these communications/visits were unwanted. However, this behavior need not be based on a "protected characteristic" and it may not necessarily take the form of sexual harassment, either. This is why harassment is typically defined as a persistent, unwanted, pattern of behavior that would cause a reasonable person to experience fear or emotional distress. Best, stderr

1 0

questions about new community safety documents and practices...
by Lane Rasberry 29 Jul '16

29 Jul '16

Hello, I just subscribed to this list hoping that this was a general discussion list for the Tor community. I think I am in the correct place, but if not, would someone redirect me? I see that there is another recent thread called, "The Tor Project Social Contract". Having text like this seems like a great idea! I subscribed to this list after reading a recent blog from headquarters at <https://blog.torproject.org/blog/statement-0> Part of the post said, "the Tor Project has created an anti-harassment policy, a conflicts of interest policy, procedures for submitting complaints, and an internal complaint review process. They were recently approved by Tor’s board of directors, and they will be rolled out internally this week." I am writing to ask if anyone can share copies of all these policies and any supporting documentation. Beyond that, I am writing to ask if they can all have free / open licenses that would be compatible for reuse in Wikipedia and Wikimedia projects. It seems like this is already routine, but sometimes it is nice to clearly indicate a licensing scheme. In Wikipedia, the community has faced similar conduct issues over the past few years. If the Tor community has a good start in developing text, policies, and processes for these things, then I might like to bring whatever insights are here into Wikipedia. Right now, Wikipedia does not have a code of conduct, and some people like me are exploring options for introducing one. Perhaps the Tor community would also find it useful to get community comments and critique for whatever equivalent documents are developed in Wikipedia. Thanks for discussing community issues in a public way. It is nice when various online communities can share ideas and best practices. yours, -- Lane Rasberry user:bluerasberry on Wikipedia 206.801.0814 lane(a)bluerasberry.com

3 3

Ethics Guidelines; crawling .onion
by Virgil Griffith 28 Jul '16

28 Jul '16

Hello all. I am preparing a longer response to the issues Isis et al mentioned. Most are interrelated, but this one is not. And I wanted to get clarification on it. Isis expressed a concern about making a list of bitcoin addresses from .onion, citing, "Consent is not the absence of saying 'no' — it is explicitly saying 'yes'." For what it's worth, ahmia.fi actually supports regex searching right out of the box. In fact, a single line of JSON spits out all known bitcoin addresses ahmia knows about. For example, here's an anonymized list going .onion -> BTC which I mined from Ahmia, * http://virgil.gr/wp-content/uploads/2016/05/btc-on-dot-onion.html [6MB] And here's the same information going BTC -> .onion * http://virgil.gr/wp-content/uploads/2016/05/btc2domains.v2.txt [2mb] If you want to check the results you can ask Juha for the JSON query to do this. Lets go out on a limb and assume that regexs are okay. Is the issue then .onion search-engines? I understand Isis's preference for there to always be affirmative consent but does that mean that until such a standard exists all search engines from onion.link, ahmia.fi, MEMEX, NotEvil, and Grams are violating official Tor community policy? ---- Here's how I currently see this. I put on my amateur legal hat and say, "Well, the Internet/world-wide-web is considered a public space. Onion-sites are like the web, but with masked speakers." * https://www.hks.harvard.edu/m-rcbg/research/j.camp_acm.computer_internet.as… * http://aims.muohio.edu/2011/02/01/is-the-internet-a-public-space/ Ergo, I would argue that, by default, content on .onion is public the same way everything else on the web is. If you don't want to be "indexed", for physical spaces you go in-doors, or for the web you put up a login. As an aside, the web-standard is actually *kinder* than physical public spaces because on the web one can have an unobstrusive /robots.txt saying, "please don't index me". Which is a great thing. Whereas some would say Tor users are "anonymous", others would instead say any and everything Tor is "private". I believe this needs to be clarified. I once proposed to Roger that he delineate the sub-types of privacy in the same way Stallman delineated his "Four Freedoms". Roger replied that he preferred using the broad catch-all term "Privacy". These confusions may be a caveat of using a broad catch-all term. Interpreting broadly, Isis is correct. However, this conclusion has a lot of unpleasant ramifications. Comments appreciated, -V P.S. Mildly related, I saw this today involving DARPA, and Tor. http://thehackernews.com/2016/05/darpa-trace-hacker.html """ The aim of Enhanced Attribution program is to track personas continuously and create “algorithms for developing predictive behavioral profiles.” """ I hope you all are aware this flows directly from MEMEX. Right? This, and MEMEX, seems a much more appropriate target for outrage. A lot of this work that numerous community members have worked on gives even me pause.

5 22

Re: [tor-project] Who is attending the OTF summit?
by Nathan Freitas 28 Jul '16

28 Jul '16

No sleep til Baltimore... I'll be there. Fri, Jul 22, 2016, at 06:12 PM, Roger Dingledine wrote: > Who here is going to the OTF summit? I hear it is mid October in > Baltimore. > > I spoke to Dan Meredith today about whether I should go -- last year he > was really sad that I wasn't there, and I told him I wasn't invited, and > he declared I was always invited to everything, so I reminded him about > it > today. > > I know they're very limited in space. I figure step zero is to learn > who else here is already signed up, so I can figure out how important > it is for me to be there. > > (And if for some reason you aren't comfortable answering on-list, you > can always answer me off-list.) > > Woo, > --Roger > > _______________________________________________ > tor-project mailing list > tor-project(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-project

3 2

Great article privacy tools workshops in DC Public Library
by Kate 26 Jul '16

26 Jul '16

Hi, This is a terrific article about the DC Public Library's privacy tools workshops; we gave a workshop there in January, 2015. This is just the kind of friendliness coupled with skillsbuilding that can help us in the long run in DC--I know that Alison is planning something there soon. https://technical.ly/dc/2016/07/26/dc-public-library-internet-privacy/ Fun fact: The reporter's twitter handle is @howisthatlegal Cheers, Katie

1 0

Fwd: Official invitation to Overdrive hacking conference, Girona
by Shari Steele 25 Jul '16

25 Jul '16

> Begin forwarded message: > > From: talks(a)overdriveconference.com > Subject: Official invitation to Overdrive hacking conference, Girona > Date: July 24, 2016 at 10:54:45 AM PDT > To: execdir(a)torproject.org > > Greetings TorProject, > > We mail from overdriveconference.com a hacking conference based in the university of Girona(Spain). We would like to invite you to our hacking conference. > > Overdriveconference is a computer security conference that will take place in the spanish city of Girona on days 25 to 27 of november 2016. The conference will focus on connecting the diferent members of the "hacker community" to share ideas, values and technical information and also think about what the hacker community is and our future. > > The conference is organized by volunteer students and teachers of the engineering department of the university of Girona currently setting up a defcon group(DC17003). > > As we admire the great work that tor project has done to help free thinkers and opressed people arround the world, we would love to have you in our conference, you are invited to join us to perform a talk about what tor project is, its present and its future goals. > > If you decide to join us to perform a talk about the project. we'll pay all the travel and stay expenses. We'll be waiting for your answer, if you agree to join we'll keep talking about the details. > > City details; http://overdriveconference.com/?page_id=509 > > Travel details: http://overdriveconference.com/?page_id=504 > > > Thank you for your attention. > > Pau, general coordinator overdrive conference. > > overdriveconference.com > udg.edu

1 0

Notes from July 21 2016 Vegas team meeting
by Karsten Loesing 25 Jul '16

25 Jul '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for July 21 2016 meeting: Alison: 1) I'm on "vacation" from 23-28 July which just means that my wifi might be intermittent 2) building the community team: doing outreach to activists, particularly women and people of color Georg: 1) Attended PETS and talked with a bunch of people about current and future projects Shari: 1) investigation is complete; press release probably tomorrow 2) TorDev invitations going out today (name TorDev?) Karsten: 1) Published a new graph showing bridge users by country and transports which dgoulet is going to present at HOPE. 2) Made good progress cleaning up codebases together with iwakeh. We're very close to zero checkstyle issues in all Java codebases. 3) Wrote down some milestones for an SOW for the MOSS award which Cass, Isabela, iwakeh, and I should finalize until end of week. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXlgOYAAoJEC3ESO/4X7XB0pEH/2Psp9IIJQzcNgNkLC51np7+ a+oTa3MxwUmXWxoH2J9RLyWU3tz/li2moUMUngJGf80yLeCBZXizrJID9PLfzd2R sGbGzygLGdpUTJwYj+Z4ZTkZmKeIwK0LmYIt0Cj/eBhvszyT3AtANGGuEapddUjG ootSiKSScJ4IK/R5pRez5ZZbWsTPOv46apJ0lZg1N0yOMq5/DCmogqZy+vOTZM4A Ey9RxHPsjtQFucYK0z9qqYxMOStiXmQe3wmtAeeMwktD+gdjYy3+wqo+e0Cm/kRi o/u/9/TKi+SV+4QVihkOPqrt8rWYiTR9z6kyNidbrdLt+8kmqy8RJaYfW6/IN1A= =C2w8 -----END PGP SIGNATURE-----

1 0

Who is attending the OTF summit?
by Roger Dingledine 22 Jul '16

22 Jul '16

Who here is going to the OTF summit? I hear it is mid October in Baltimore. I spoke to Dan Meredith today about whether I should go -- last year he was really sad that I wasn't there, and I told him I wasn't invited, and he declared I was always invited to everything, so I reminded him about it today. I know they're very limited in space. I figure step zero is to learn who else here is already signed up, so I can figure out how important it is for me to be there. (And if for some reason you aren't comfortable answering on-list, you can always answer me off-list.) Woo, --Roger

3 2

Notes from July 14 2016 Vegas team meeting
by Karsten Loesing 18 Jul '16

18 Jul '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for July 14 2016 meeting: Nick: 1) "Oh look at all this free time I have now that I'm not on the board!" ha ha ha 2) When does the next TB with 028 come out? Georg: 1) Would other projects that want to include Tor Browser need to become licensees? If so under which circumstances (#19652 is the background here)? <- arma will comment on that ticket to move things forward Shari: 1) Could we approve the TorDev invitee list so I can move things forward and start to invite people? 2) Transitioning the new board. 3) Rolling out insurance for organization and individuals. 4) Working with community team to prepare for HOPE, and sharing what I know with community council as they face their first challenge re: community membership. 5) Preparing to announce the conclusion of the investigation next week. NYTimes and Gizmodo are both interested in covering the announcement. 6) Hopefully things will start to calm down after next week's announcement. Isabela: 1) re: services maintainers - me, karsten and tor admin team helped cass put together a proposal for fund to get someone to help out with this 2) getting on drl q2 report 3) 97% coverage of resumes for DRL visit in August 4) with alison, shari and erin help we have a doc for some funders who asked an update on what we are doing to make tor diverse/inclusive/harassment-free community (not sure if this should be private) Kate: 1) Media and social media for board transition, including communicating with and prepping outgoing and incoming boards (all of whom have been fantastic and gracious to work with) 2) House-Senate appropriations issues problems re: language mandating restrictions regarding privacy tool funding by the Broadcasting Board of Governors 3) Clips for grant report, in conjunction with excellent volunteer David Stanton 4) Will be at HOPE so not online as normal; will check email and be available by phone 5) Paperwork and various tech problems (solved eventually) Roger: 0) spent this week doing sponsorR meetings 1) state dept funding bill: strategy suggestion 2) seattle mtg attendees 3) would you like to ask questions about the director thing 4) some exciting new onion addresses for high profile websites on the way Karsten: 1) Wrote proposal to get services admin together with Isabela and Cass. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXjH6EAAoJEC3ESO/4X7XB+fQIALmGcd7jr/M2jTefs567ZyOB okoD5gblIyW11TzGxCY4P3AXM889DmNVIR+J+HarNt8qIst/pB5A6zMvzdUZH+Nd uazxS2/uyf85sdlPZFzhn8/Fbgt3fygbrRhEEYZO/p6TrOJDAGAlojHf2rK0kK7l /zcxEjNyk5pF9qGltGczgkSVRP80Qp43EwMMjKkyIx7K2KK7w0sRzCwrJMs4NIxr t+DxEP/4065G2Gm4nWO4qpeqA7UAQoWhVqXropU81OtLz/MR11kf0KUCzrxEn3TX idSM0I+cjXA/m8Ba6tOQ00m3KF8a1P9l/Sbx4ToH8SC+78Hyu7W79eeQIryTg+g= =W8Vk -----END PGP SIGNATURE-----

1 0