- tor-project - lists.torproject.org

Re: [tor-project] Onion sites vs onion services vs hidden services
by Nathan Freitas 26 May '16

26 May '16

On Wed, May 4, 2016, at 10:41 AM, Paul Syverson wrote: > On Wed, May 04, 2016 at 07:36:23AM +0000, Yawning Angel wrote: > > On Wed, 4 May 2016 01:30:13 +0000 > > Alison Macrina <alison(a)libraryfreedomproject.org> wrote: > > > So, I want to propose that we choose onion sites or onion services > > > once and for all (I'm in favor of the former because most users have > > > no idea what is meant by "services"; it sounds too vague). Then, > > > whenever we see somewhere on torproject.org or any of our > > > documentation or whatever that still reads hidden services or onion > > > services, that we kill it with fire. > > > > Disagree, because this further reinforces the idea that the internet is > > centered around port 80/443, and is nonsensical given some of our > > prominent use cases ("Ricochet is based around Tor onion services" vs > > "Ricochet is based around Tor onion sites". One of these statements is > > correct, and one is not). > > To further Yawning's point and provide an example of using both terms: > Ricochet is an onion service in which each Ricochet client > creates a local onionsite that others connect to. Actually, for me, the user of the word "service" is something that is a machine-readable endpoint, an API or protocol, while "site" is a meant to have some human-facing aspect that is able to be browsed or read through a web browser or something of that nature. I would say that Ricochet is only an onionservice, while something like SecureDrop or Globaleaks would be an onionsite that offers onionservices as part of the application. +n

8 7

Is there a mission statement / list of goals for Tor Project?
by Virgil Griffith 25 May '16

25 May '16

This seems like an obvious question, but https://www.torproject.org/about/overview.html gives me no clear answer. ----- I've gotten conflicting reports on the goals of Tor ranging among: * protecting Tor users and HSs * preventing linking of IP addresses to internet traffic regardless of whether someone is a Tor user * developing and enabling privacy-enhancing technologies * furthering human rights * furthering "internet freedom" * furthering "privacy" Each of these is a fine and good thing. However, the current ambiguity makes it unclear what to do when these individually good things conflict. For example, Tor2web enables linking of client IP addresses to internet traffic. Which is bad. However, it also "furthers human rights" as it's the largest whistleblowing platform. How to adjudicate? When are we, as agents of Tor Project, serving "the ideology of Tor" versus our own personal ideology? Clarifying this is a standard part of organizational maturity. For example, Greenpeace does a similar thing: * http://www.greenpeace.org/eastasia/about/mission/ * http://www.greenpeace.org/international/en/about/our-core-values/ While different people will have slightly different ideas of what constitutes the "Tor ideology", and we don't want to wantonly pick fights, it seems reasonable for management to triage these individually good things into different tiers. Because right now I see people claiming orthogonal things as Tor Project's ideology. -V

2 3

Fwd: Cambridge Offices Officially Closed
by Shari Steele 24 May '16

24 May '16

Begin forwarded message: > From: Susan Abt <sueabt(a)gmail.com> > Subject: Cambridge Offices Officially Closed > Date: May 24, 2016 at 3:07:08 PM PDT > To: Shari Steele <ssteele(a)torproject.org> > > Shari, > > The office are officially closed! > > Sue The Tor Project, Inc., administrative offices new contact information: Our mailing address is: 217 1st Ave S #4903 Seattle, WA 98194 Our physical address is: 80 S Washington #203 Seattle, Washington 98104

1 0

Fwd: [Festival] Job Opportunities Ahead!
by Shari Steele 24 May '16

24 May '16

Hey all. A couple of interesting employment opportunities. One for IFF, the other for Internews. Shari Begin forwarded message: > From: IFF Team <team(a)internetfreedomfestival.org> > Subject: [Festival] Job Opportunities Ahead! > Date: May 24, 2016 at 10:00:09 AM PDT > To: festival(a)ta3m.org > > Hi all, > > We have two interesting job opportunities to share with you today: > > *Creative Project Manager for the Internet Freedom Festival at IREX*: > https://www.irex.org/careers/all-positions?p=job%2FoYB82fwt > > *Technologist for the Human Rights team at Internews*: > http://chm.tbe.taleo.net/chm04/ats/careers/requisition.jsp?org=INTERNEWS&cw… > > Not for you? Pass the offers around! > > Are you also looking for talent? Let us know and we'll help you spread > the word. > > Have a great day, > The IFF Team > > -- > The Internet Freedom Festival Team > @InternetFF | www.internetfreedomfestival.org > > PGP: 2E1D CC33 A362 0BD6 236E 540A F60A 89AD 6FF9 7A2F > > _______________________________________________ > Festival mailing list > Festival(a)ta3m.org > https://lists.ghserv.net/mailman/listinfo/festival

1 0

Fwd: Save the Date - Berlin Privacy Lab and Pizza - May 25
by isis 24 May '16

24 May '16

----- Forwarded message from Dave Huseby <dhuseby(a)mozilla.com> ----- > From: Dave Huseby <dhuseby(a)mozilla.com> > Subject: Save the Date - Berlin Privacy Lab and Pizza - May 25 > Date: Mon, 23 May 2016 16:06:43 -0700 > Message-ID: <57438D03.9070002(a)mozilla.com> > User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.7.2 > To: undisclosed-recipients: ; > Delivered-To: <isis+torproject(a)patternsinthevoid.net> > > Hi Georg and Isis, > > I was asked to forward this announcement for the first Privacy Lab in > Berlin. Would you mind forwarding this on to the Tor Project people? > > Thanks! > > --dave > > > > > Join Mozilla on May 25 for a *workshop on the Internet of Things and > Privacy*. > > To start the workshop, we'll share some IoT and Privacy research; then > we'll work as a group on how to hack the research for a German audience. > > Detailed agenda will be coming soon. > > Did we mention pizza? Please RSVP here > <https://www.eventbrite.com/e/privacy-lab-berlin-iot-and-privacy-worksho > p-tickets-25517489498>. > > Capacity is limited to 40 people. > > For more information on Privacy Lab checkout ourwiki > <https://wiki.mozilla.org/Privacy/Privacy_Lab/Berlin>. > > When > Wednesday, May 25, 2016 from 6:00 PM to 8:00 PM > > Where > Mozilla Berlin Office > 6, Voltastraße 5, 13355 Germany, Treppe, Berlin, Germany > > > > -- > -- > Stacy Martin > Senior Manager, Privacy and Engagement > Mozilla > 2 Harrison Street, Suite 700, San Francisco, CA > 916-390-4845 (cell) > stacy(a)mozilla.com <mailto:stacy@mozilla.com> > > ----- End forwarded message ----- -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://fyb.patternsinthevoid.net/isis.txt

1 0

people.tpo down
by Peter Palfrader 23 May '16

23 May '16

Hi, just fwi. perdulce (aka people.tpo) has been down since Friday->Saturday night. The out-of-band management system is failing at stopping/starting it. We have opened a ticket with the hoster, but so far haven't heard back from them. Cheers, -- | .''`. ** Debian ** Peter Palfrader | : :' : The universal https://www.palfrader.org/ | `. `' Operating System | `- https://www.debian.org/

1 1

Notes from May 19 2016 Vegas team meeting
by Karsten Loesing 23 May '16

23 May '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for May 19 2016 meeting: Kate: 1) Update on Rule 41 2) Negotiated with CNN lawyers to remove random, bad video that originally accompanied Isis interview (not a different weird but ok video dominates the page, and they have created a hilarious piece of art of Isis jumping from a US flag to a German flag) 3) Have attempted to talk down a CNBC reporter from Dark Web article; sent statement and referred her to Matt Blaze, Chris Soghoian and EFF 4) Fast.ly meeting 5) Scheduling the next CloudFlare meeting 6) Meeting with volunteer to work on Press Kit 7) Put out Asn’s blog post to reporters 8) We need headshots - photographer at dev meeting? 9) Crazy idea: Tor Security Day! Pick 5 security goals for the group (everyone can PGP easily, everyone has an encrypted hard drive, everyone is on Signal or knows how to use Tails) and then we choose a day where collectively up our infosec as an organization. Remember, the weakest link can affect the strongest links! Georg: 1) We are finalizing Tor Browser 6.0. Planned release date is next Friday (May 27). 2) I worked on our search engine situation (Disconnect is falling back to Bing see: https://trac.torproject.org/projects/tor/ticket/19115) We decided to make sure the fallback in Tor Browser 6.0 is not Bing but DuckDuckGo and that I am writing an email to Disconnect coordinating with them and asking about the search volume of Tor users per day and whether that dropped due to Google results being not available anymore. 3) I read and commented on a draft of the membership document 4) I spent some time thinking about the replacement for our e10s Y2 deliverable. We are planning to do browser independent sandboxing work instead and are currently defining its scope. Nick: 1) Isabela repeatedly saves my team from confusion. Go Isabela! 2) I don't have any banking set up on BoA yet. Should I ping them, or delegate it? 3) Has Shari now got the ability to read svn, decrypt passwords, and share them with Seattleites as appropriate? This is pretty important. I'm not policy-boss, so I shouldn't be password dispenser. Alison: 1) thanks for all your edits on the membership doc! I will incorporate them and send back another draft before it goes to tor-internal@. let's talk about it! 2) the rest of the community docs will follow -- that is, the social contract and the community council guidelines. it may make sense to send these all to tor-internal at the same time, since they refer to each other. 3) community team participation still continues to be an issue. I've been pinging a lot of folks to see if they might want to get involved. most people are pretty busy! 4) LFP has a bunch of cool events coming up -- international librarians conference, some UK dates, ALA, Toronto. thinking of how/if this might be valuable to share with tor-project@. this is why we really need TWN. 5) eager to get on Rule 41 advocacy and training. Shari: 1) DRL coming to visit the Seattle office on June 27-28. This is a standard visit they do to all of their grantees. 2) Meeting with EFF last week - They're going to organize a meeting between us and CloudFlare and may be willing to do an activism campaign if that is unsuccessful. 3) Talked with Giant Rabbit about creating our donation infrastructure. They've sent me a contract. Roger: 1) Still excited about the new Tor blog. Any news? Answer: Mike moved the thread with Kevin forward a bit. 2) FYI: My next 4 months are going to be even messier, logistics-wise and schedule-wise, than the last few months. :( Karsten: 1) Wrote documentation for metrics-lib (Java library to parse Tor descriptors used by Metrics, Onionoo, etc.) and discussed many improvements to developing/building/releasing/running CollecTor (Tor descriptor archive). The medium-term goal is that Metrics doesn't depend as much on a single person anymore. 2) Thought more about funding proposal and started a list of research papers citing Tor Metrics, which already became quite a list (50+ entries). Didn't start with the Metrics calendar or video of calendar just yet. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXQwO4AAoJEC3ESO/4X7XBjykH/Ax48ihz5dlKl+LKXJ6a/blE Q36tP9CjJgoveNpJ10fxoQaKYSLpIJknlk6LQRnNzgw3AOK1nR4jRWxcpcL/tEdB pf4qEdS91FIXRaNdcxVopBy1Kib4m0bXHN08/BALO5jfzaUtSl/hsWnUS1kyNAhK EzzG//B1MQGkG4/krJAqAnfAlh3MUGOF+7qYcdysCfY/Wd60vk4z57aiDUYNZO+Q sMwE1Q13hzKHwApcP1c4uTE+XYfR4leFxily/joSwVUjB53R7xcTnb/c7nwO4sjj a+yjOs5lY1Wy3inDxBPXb++mSpCxGDjKyMczwexEtuI99Wgj/UbrVBHsNhMzfgA= =xio0 -----END PGP SIGNATURE-----

2 1

Support meeting pt2
by Colin Childs 23 May '16

23 May '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi all, It is time for another support meeting! Below is a Doodle[1] link, please indicate which times you are available. If none of the times work for you and you really wanted to attend, please send me an email and I will see about adding a different time slot to the Doodle or look into other ways to include you in the meeting . Thanks! [1]: http://doodle.com/poll/48wzda3yn54nxam9 - -- Colin Childs Tor Project https://www.torproject.org Twitter: @Phoul -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJXO4H8AAoJEJWQHABkmqq5CGUP+wQWxUNY5QqVJksIa/pKPCsC bstBukBOm5TdtfnJ0t/RnEbF3mexBrjipr1ya/z41dKsfEsH5n3/Kq/nzRETMsbM +vzWEgeYWyXNcvRIfbXV1UosU7jGIrmyDoDJWfmMQ9oExEBnXCY+QBpWTxoj0vEZ W6ClPFR0ID9i5+ZRI8SpKhegJDit5mrYwIsampT3VWjIAeJat/onv32VkAlVzxC1 W7dSSioP4n3xZuRfmoOgC/vkepqoBrX1HWZnEer+one9BQchBgQ0lKg0/783Jf6h Mq9A2M112etam/sN+Bna9J6fBLtiRNS9UOXn5+mwOuf/A0q8D6TuFFhaICSecP9Z bBONDr3Ai0FJLsxDO2Li30t1O2sh9syQSDPHeGyyXqEwwKfIx+l132H7ZhI+Xy9p 5/+WIN/jMS9NGzJcszM8Bs3U30C7egsh/JOmwYnaFv3eojdmCjkzQboHxHw6rI6O GbvFKT4O8/0c34Cv8kVMNYhHiWssfna++azPO9mwjmuFaeY0TXPRmLGG48GUs5HF n5STs0aliEUIknXH8KY/a6miO7SS9BboPQ7Cy5wQGx5NTQ/09lv88GphQNMJLoFl GOrpPly43b/2lzNsYS+HfK+H8O8BZjnW5CEMpe/hUNdivvZyFPzPwAAQ5kkEY7b1 vFNzIR8Rii74AEjv7Zw+ =388e -----END PGP SIGNATURE-----

3 3

Summary of meek's costs, April 2016
by David Fifield 21 May '16

21 May '16

Here's the summary of meek's CDN fees for April 2016. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 January 2015 $464.37 + $669.02 + $0.00 = $1133.39 February 2015 $650.53 + $604.83 + $0.00 = $1255.36 March 2015 $690.29 + $815.68 + $0.00 = $1505.97 April 2015 $886.43 + $785.37 + $0.00 = $1671.80 May 2015 $871.64 + $896.39 + $0.00 = $1768.03 June 2015 $601.83 + $820.00 + $0.00 = $1421.83 July 2015 $732.01 + $837.08 + $0.00 = $1569.09 August 2015 $656.76 + $819.59 + $154.89 = $1631.24 September 2015 $617.08 + $710.75 + $490.58 = $1818.41 October 2015 $672.01 + $110.72 + $300.64 = $1083.37 November 2015 $602.35 + $474.13 + $174.18 = $1250.66 December 2015 $561.29 + $603.27 + $172.60 = $1337.16 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 February 2016 $986.39 + $977.85 + $445.83 = $2410.07 March 2016 $1079.49 + $865.06 + $534.71 = $2479.26 April 2016 $1169.23 + $1074.25 + $508.93 = $2752.41 -- total by CDN $12613.50 + $13563.76 + $3111.46 = $29288.72 grand total https://metrics.torproject.org/userstats-bridge-transport.html?graph=userst… The number of users again stayed pretty flat during April 2016 at 10,000. Reminder that if you configure your own CDN or App Engine account and point it at https://meek.bamsoftware.com/, you will be using a completely unlimited bridge, which will go faster and help save money. == App Engine a.k.a. meek-google == Here is how the Google costs broke down: 6942 GB $833.06 6723 instance hours $336.17 https://atlas.torproject.org/#details/88F745840F47CE0C6A4FE61D827950B06F9E4… == Amazon a.k.a. meek-amazon == Asia Pacific (Singapore) 231M requests $278.22 594 GB $84.85 Asia Pacific (Sydney) 3M requests $4.06 17 GB $2.36 Asia Pacific (Tokyo) 881K requests $1.06 5 GB $0.70 EU (Ireland) 256M requests $307.32 2040 GB $161.79 South America (Sao Paulo) 9M requests $20.08 71 GB $16.90 US East (Northern Virginia) 120M requests $120.72 953 GB $75.70 -- total 621M requests $731.46 3683 GB $342.30 charge for alarms $0.50 https://atlas.torproject.org/#details/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == Zone 1 5183 GB $450.88 Zone 2 421 GB $ 58.05 -- total 5603 GB $508.93 https://atlas.torproject.org/#details/AA033EEB61601B2B7312D89B62AAA23DC3ED8… Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

1 0

The Akamai slide Alec posted
by Ian Goldberg 20 May '16

20 May '16

Does anyone know where we can get more information about the stats behind this slide: https://twitter.com/AlecMuffett/status/730773970383982592 The slide says: 1:11,500 non-Tor IPs contained malicious requests 1:380 Tor exit nodes contained malicious requests The way it's worded, it sounds like they're saying "1/11500 of the non-Tor IP addresses we saw sent malicious requests, and 1/380 of the Tor exit node IP addresses we saw sent malicious requests", but I'm finding that hard to believe, since 1/380 of the Tor exit node IP addresses is ~3 IP addresses. It's unlikely that all malicious Tor traffic was confined to 3 exit nodes. (But interesting if true.) Were they perhaps being a little loose and really meant "1/11500 TCP connections coming from non-Tor IP addresses, and 1/380 TCP connections coming from Tor exit nodes, contained malicious requests"? Thanks, - Ian

2 2