- tor-project - lists.torproject.org

Onion sites vs onion services vs hidden services
by Alison Macrina 05 May '16

05 May '16

Hi all, Colin (phoul) and I started working on the support team docs a few weeks ago, and it brought to our attention just how much onion sites/onion services/hidden services are still being used interchangeably. Since this is confusing, we checked in with folks about which one is preferred, and onion sites seems to be the clear favorite. However, internally and on Twitter, I still see us using onion services (and worse, hidden services). So, I want to propose that we choose onion sites or onion services once and for all (I'm in favor of the former because most users have no idea what is meant by "services"; it sounds too vague). Then, whenever we see somewhere on torproject.org or any of our documentation or whatever that still reads hidden services or onion services, that we kill it with fire. Thanks for reading, Alison -- Alison Macrina Library Freedom Project libraryfreedomproject.org PGP: https://libraryfreedomproject.org/contact/

10 10

Fwd: Tor logo on Toosheh website
by Nima Fatemi 04 May '16

04 May '16

Hi Wendy and others, The good people of Toosheh[1][2] want to include Tor logo on their publishers web page. Do they need special permissions? [1] https://twitter.com/torproject/status/723576179303784454 [2] https://www.wired.com/2016/04/ingenious-way-iranians-using-satellite-tv-bea… Best, -- Nima -------- Forwarded Message -------- Subject: Tor logo on Toosheh website To: Nima Fatemi <nima(a)torproject.org> Hi Nima, Thanks for the quote on Wired and taking the time to take to us. I wanted to follow up on our conversation about having Tor’s logo among other Toosheh publishers on this page <https://www.toosheh.org/publishers>. -------- / Forwarded Message --------

1 0

AuthDirBadExitCCs still in effect?
by David Fifield 03 May '16

03 May '16

Tickets #4207 and #4923 allow authorities to set the {Invalid,BadExit} flag, or reject relays, based on their country code. https://www.torproject.org/docs/tor-manual.html.en#AuthDirBadExitCCs https://bugs.torproject.org/4923#comment:14 says that 4 years ago, authorities were configured to BadExit relays in Iran and Syria. Are these restrictions still in effect? Is there a way to see what authorities have set the AuthDir{BadExit,Invalid,Reject}CCs options? Or would you have to infer it based on the votes on individual relays?

3 2

Measuring Tor's impact in the world?
by isabela 29 Apr '16

29 Apr '16

hello tor, yep, that's right :) I spent some time with our sponsors last week and at the end of the day, the question of 'how to measure tor's impact in the world' seems to be something that would be useful for us for things like: 1. grant proposal - impacts we could demonstrate 2. reports to sponsors - as a metric we could report 3. in general when we talk with people (journalists, users etc) So I thought of the following question: 'What happens to the tor network when there is an event happening in the world?' Is an easy way to do as an one off but super hard if you want to keep track of it so you can build stories around more than one event here and there. Then I thought of what world events are predicable that we could check for Tor's impact? elections... So I looked at all elections for Q1 2016, then looked at the number of direct connected users and number of users connected via bridges during those events... There were some correlation of events, you can check them here: https://docs.google.com/document/d/1MKntWAoZOcRB8rBbxl3P-VKAvyH8jf0RmqlsB2l… Of course we should also take a look for the same thing when unpredictable events happens.. like the Egyptian revolution or a shutdown of services for whatever reason (whatsapp in Brazil). Why I am sharing this? Because there are tons of smart people in this list and maybe someone has a different way to measure tor's impact in the world. Or maybe someone knows how I could automate such a thing :) (api somewhere?) Or maybe ideas of other points of data for reference. For instance, I am now thinking if x users connected on Tor means a lot or a little in a country.. that will depend on how many people are online, the number of internet penetration for that country. Yes, I know this is very simplistic way of talking about something as big as 'impact in the world'. But I have seem this information being useful in other scenario, and it did helped a lot to pass the message of what value people should think of when thinking of the product. For a long time twitter had the problem of being seeing only as a short text social media platform. But twitter wanted people to think of it as 'the platform to know what is happening now'. A platform where if an event happened in the world, twitter was the place where people would talk about it. And for a while the data science team did only this, publish correlation data of what happened at twitter during global events. I believe it did worked because that information was what people (media, mouth to mouth etc) start to pick up when anyone would talk about twitter. here is an example of the work twitter did that i am talking about: https://www.youtube.com/watch?v=SybWjN9pKQk cheers, Isabela -- PM at TorProject.org gpg fingerprint = 8F2A F9B6 D4A1 4D03 FDF1 B298 3224 4994 1506 4C7B @isa

4 5

Re: [tor-project] Measuring Tor's impact in the world?
by Nathan Freitas 29 Apr '16

29 Apr '16

On Fri, Apr 29, 2016, at 01:14 PM, isabela wrote: > So I thought of the following question: 'What happens to the tor network > when there is an event happening in the world?' This is really great, important work. > Then I thought of what world events are predicable that we could check > for Tor's impact? elections... ... > Of course we should also take a look for the same thing when > unpredictable events happens.. like the Egyptian revolution or a > shutdown of services for whatever reason (whatsapp in Brazil). I think that shutdowns of service of blocking of specific apps are another important metric. This is often when we have seen growth in Orbot downloads in a specific region. On that note, I am happy to share more detailed Orbot download information with you as part of this effort, to see how that correlate's with general Tor usage in a specific region. > Why I am sharing this? Because there are tons of smart people in this > list and maybe someone has a different way to measure tor's impact in > the world. I think beyond a list, there a great deal of researches at places like the Citizen Lab and the Berkman Center that would be eager and very capable to help with such things, as well as separate noise from actual events. > > Or maybe someone knows how I could automate such a thing :) (api > somewhere?) Unfortunately, I don't think this can be automated, but at the same time, I think just showing a few important, meaningful correlations per year would have a big impact. > Or maybe ideas of other points of data for reference. For instance, I am > now thinking if x users connected on Tor means a lot or a little in a > country.. that will depend on how many people are online, the number of > internet penetration for that country. That was definitely running through my mind as I was looking at the graphics. 200 users may seem small, but depending upon Internet usage, desktop vs mobile, and whether you have the right 200 people are all important context to have. > Yes, I know this is very simplistic way of talking about something as > big as 'impact in the world'. But I have seem this information being > useful in other scenario, and it did helped a lot to pass the message of > what value people should think of when thinking of the product. This is exactly the way my wife who works on multi-million dollar public health projects measures their impact of programs to get people to quit smoking or to reduce infection of certain disease. At some point, it all comes down to "did less people die in X region from this terrible thing?", or "how much money did we spend per person who did not die?". If that metric is inline with what the funder expected, then you get more money, and less people will die. > talk about it. And for a while the data science team did only this, > publish correlation data of what happened at twitter during global > events. I believe it did worked because that information was what people > (media, mouth to mouth etc) start to pick up when anyone would talk > about twitter. I completely agree, and am happy to support the effort to have the same kind of impact with Tor, Orbot and all related onion efforts. +n

2 1

Texas Linux Fest 2016 CFP
by Lunar 29 Apr '16

29 Apr '16

Hi! Nathan Willis who works for Linux Weekly News contacted me about a two-day event happening in Austin, Texas, USA in July. Here's what he wrote: --- 8< --- […] I'm one of the organizers of Texas Linux Fest, which is the leading community Linux-and-FOSS conference for Texas and the surrounding region. Our event is July 8th and 9th this year, in downtown Austin, TX. We'd really love it if folks from the Tor project and surrounding community can be there—be they local or from out of town. I especially wanted to draw your attention to our call for participation. We're intent on attracting a wide variety of speakers representing open source and free software, both users and developers, from all corners. The details are here: http://2016.texaslinuxfest.org/call-for-papers and the deadline is approaching. Please consider submitting a talk proposal, and we would love it if you could help us spread the word by sharing the CFP with the Tor community! If you have any questions, or if you want to know more about Texas Linux Fest in general, please get in touch! --- >8 --- -- Lunar <lunar(a)torproject.org>

2 1

Notes from April 21 2016 Vegas team meeting
by Karsten Loesing 27 Apr '16

27 Apr '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes from Apr 21 2016 meeting: Big takeaways: 1) Eight people in one hour just doesn't fit. We should think about how to be more efficient, how to triage topics, how to arrange for more time for this team, etc. 2) We all raised the topic of Tor Browser security and the recent angles around it; but we didn't get to this topic. Roger: 1) Should each of us add our lines to this notes page ourselves, so we know what we added and have more of a say in what goes out to the tor-project mailing list? Answer: yes. (But we screwed this one up this time, because I should have said "Ok, that means you all write down what we discussed and what we concluded please" but nobody did. Next time maybe!) 2) Should we have an intermediate stage between this pad and tor-project, so more internal people can help vet notes? Answer: no need for this yet, but let's make the notes review period "until Monday" rather than "overnight", so people actually can review it. 3) When will we pick dates for the Seattle dev mtg? Answer from Shari: "It will be one of the last two weeks of September. We won't finalize the dates until we finalize the venue, and we won't finalize the venue until we have an administrative assistant on board to do so. Jon Selon has accepted our offer, and he starts on Monday. Yay! So hopefully we'll be able to nail down these dates soon. See my notes below for info on the February Tor Dev meeting!" 4) Making a donate@ alias for humans, so donations@ can be for machines? Answer: Shari thinks that would be so incredibly awesome! 5) When do we get our admin assistant? Shari says: Monday!!! :) 6) Inviting Kate back to the Vegas team meetings? Answer: yes, let's do it. 7) I've been talking to Isa about getting a project leader for our circumvention side: making the balance right between academic research, implementation, and operation/deployment. Things from last week that still want attention: 8) tor blog contract details (no progress today either) Shari: 1) Isa and I talked with Pepe, who organizes IFF. He was very concerned to hear from Laura at DRL that we were considering the option of uncoupling Tor Dev from IFF and basically promised us the moon if we'd hold Tor Dev at the end of February in Valencia again next year. Conclusion: "If DRL wants us there, we should make it clear to DRL the cost that it presents to us." 2) Please look at the writing sample from grant writer candidate Cass Brewer and let me know next steps. I'd love to get her hired soon, or figure out someone else if necessary. If anyone else wants to join Kate and Isa interviewing her today, let us know. Conclusion: we are all fine with the hire so long as Kate and Isa think it's a good move. 3) Isa and I met with Laura and Steve from DRL about our SOI. They were really quite frank about what they wanted from us, which is mostly a better job of tying our work to their goals. We should probably do that with all proposals. 4) Glad I don't have any more travel for a while. Planning a trip to San Francisco mid-May. Nick: 1) Not much to report this week. Trying to get my team's work done for EOM 2) Waiting for personnel thing from Shari. 3) Waiting for TB to go out with a tor release in it. It turns out nobody is using the nightlies, so I have no very little user feedback on the most recent 0.2.8 alpha Conclusion: Nick will mail tor-talk and ask people to run them, and report issues, and be aware that they're not on the standard upgrade track. GeKo will open a ticket for "updates" for nightlies (right now they don't do updates). Georg: 1) Switched our nightlies to ESR45. 2) Getting as many things into ESR45 as we can before releasing an alpha next week. 3) Where do we want to have the OSX SDK we need for our OS X builds? Answer: leave it where it currently is and open a ticket in our bug tracker that helps thinking about a different solution. GeKo is doing that. Alison: 1) Community team met yesterday and discussed our user-facing Cloudflare strategy. We agree that multiple approaches will be most successful. Right now we've got three big ideas: mrphs's petition (either officially endorsed by Tor or not, but organized by one of our allied organizations eg EFF), shiro's creative campaign (starting in Berlin, then we hope going elsewhere), and then collecting more unique user stories (using petition platform, twitter, etc, sending to Alison). We will continue to use the hashtag #dontblocktor for all community efforts. 2) Extreme levels of busy have gotten in the way of completing the social contract, but this week Alison will finish her last edits and send them to sysqrb and Lunar, and then it'll go on to the rest of tor-internal for review. 3) Alison and phoul continue to work on the Tor Browser Manual. 4) Still recruiting team members and still need to define scope of the team. CF stuff got in the way this meeting, but hey, people showed up! Isabela: 1) Met with Laura and Steve about our SOI's -- they will send someone to the office in the summer and we will apply their feedback and submit new SOIs in September. 2) Did DRL grant writing training (more or less useful). 3) Worked on OTF full proposal - deadline now is first week of May, but 2/3 of it is done and I will try to finish it asap because I also need to work on DRL Q1 2016 report. 4) Juga finished her work on Trac - she emailed the list about it. Things looks good. 5) DRL implementers meeting was useful for me to understand how they think and their portfolio -- but now I am dead. Karsten: 1) I'm planning to shut down Tor's copy of Globe. Will that make people in this group unhappy for reasons I didn't think of? Conclusion: Let's first create tickets for all Globe features that are missing in Atlas. 2) What's the plan for monthly reports? Should people keep writing them, should teams do that, should we stop writing/requiring monthly reports, ...? Conclusion: A) We no longer pretend to demand monthly reports from individuals. B) We, led by Isabela, continue doing the funder reports for funders. C) We encourage Shari to keep doing her "how to make sure people actually do work" work (since "see if the person mailed tor-reports that month" is a crummy substitute anyway). And D) Nick is going to experiment with doing report-out summaries from the network team meetings, because we do want better answers for how to keep all the teams informed, at the right levels, of what's going on in the other teams. Mike: 1) Finished up the Tor Browser sections of the OTF proposal. I looked over the Tor section, and it may need some more tweaking, along with our need to complete the budget. I am thinking of meeting Isabela next week to help finish that. 2) Still have not heard from Kevin about the blog contract. I am not sure what the holdup is. I will try calling him. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXHw/BAAoJEC3ESO/4X7XBEVUIAIvLQSQT2getabf71sgbdov1 grGuSOk+F5xYolXa3U38jC4b50tDPiHMYV5h85UpRutsNBXTfDkrlLs0y1Jor2cj pUqH5bpM+1PED4MXVu9rBKvJlZlSz7YT1ZUoC4eoCPZ73Kit31JBoDGXHAyWv6tH /G+J2EOrBW2Lyuc+rNCACeUibJqy7lleuZDX3QfoqQEXOfTVye54TY06/Zrcmjqd ijygXcLBKYXFWwdhjzdYv7trGNIYgxBAOXBLYzBVs8Jyl6PM0tfeQ+Re+O9srwWt HHZWxR13X6H7nIoMXAxOAf96rddTqr7KgS0n28Jb/AdL5yH9bUKmqapFLuMO+Go= =FtUM -----END PGP SIGNATURE-----

6 6

Summary of meek's costs, March 2016
by David Fifield 25 Apr '16

25 Apr '16

Here's the summary of meek's CDN fees for March 2016. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 January 2015 $464.37 + $669.02 + $0.00 = $1133.39 February 2015 $650.53 + $604.83 + $0.00 = $1255.36 March 2015 $690.29 + $815.68 + $0.00 = $1505.97 April 2015 $886.43 + $785.37 + $0.00 = $1671.80 May 2015 $871.64 + $896.39 + $0.00 = $1768.03 June 2015 $601.83 + $820.00 + $0.00 = $1421.83 July 2015 $732.01 + $837.08 + $0.00 = $1569.09 August 2015 $656.76 + $819.59 + $154.89 = $1631.24 September 2015 $617.08 + $710.75 + $490.58 = $1818.41 October 2015 $672.01 + $110.72 + $300.64 = $1083.37 November 2015 $602.35 + $474.13 + $174.18 = $1250.66 December 2015 $561.29 + $603.27 + $172.60 = $1337.16 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 February 2016 $986.39 + $977.85 + $445.83 = $2410.07 March 2016 $1079.49 + $865.06 + $534.71 = $2479.26 -- total by CDN $11444.27 + $12489.51 + $2602.53 = $26536.31 grand total https://metrics.torproject.org/userstats-bridge-transport.html?graph=userst… The number of users stayed pretty flat during March 2016 at 10,000. Reminder that if you configure your own CDN or App Engine account and point it at https://meek.bamsoftware.com/, you will be using a completely unlimited bridge, which will go faster and help save money. == App Engine a.k.a. meek-google == Here is how the Google costs broke down: 6114 GB $733.72 6915 instance hours $345.77 Compared to the previous month: 5829 GB $699.50 5737 instance hours $286.89 https://atlas.torproject.org/#details/88F745840F47CE0C6A4FE61D827950B06F9E4… == Amazon a.k.a. meek-amazon == Asia Pacific (Singapore) 210M requests $252.14 423 GB $59.93 Asia Pacific (Sydney) 1M requests $2.37 10 GB $1.41 Asia Pacific (Tokyo) 16M requests $19.65 113 GB $14.88 EU (Ireland) 174M requests $209.44 1444 GB $113.87 South America (Sao Paulo) 9M requests $20.62 71 GB $17.00 US East (Northern Virginia) 96M requests $96.98 711 GB $56.29 -- total 509M requests $601.20 2775 GB $263.38 charge for alarms $0.50 https://atlas.torproject.org/#details/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == Zone 1 4991 GB $434.24 Zone 2 728 GB $100.47 -- total 5719 GB $534.71 https://atlas.torproject.org/#details/AA033EEB61601B2B7312D89B62AAA23DC3ED8… Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

1 0

Notes from April 7 2016 Vegas team meeting
by Karsten Loesing 21 Apr '16

21 Apr '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes from Apr 14 2016 meeting: Nick: 1) With Isabela I've been doing new team process stuff, see https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/Release… . We have buy-in from a lot of the team at this point. 2) I made a cert for mikeperry and GeKo to sign TB stuff on OSX. Georg seems to think it works. 3) Sometime this month or so (so, this week) I should renew our wildcard cert. Our existing cert expires May 3. Roger: 1a) https://www.petsymposium.org/2016/stipends.php is up and ready 1b) Mind if we accept $20k of PETS stipend money from Ford, and plan to send out stipends from it? #action: need an opinion from Shari, but I hope yes 2) What's our Plan for internal community vetting of new hires? What's our plan for internal community vetting of Shari's new hires? I heard Shari was going to run them past Isa and kate. That's a good start. Is that enough? Should we want more? Two things from last week that still want attention: 3) tor blog contract details 4) monthly reports? Karsten: 1) Continuing to work with iwakeh on CollecTor and metrics-lib, with most discussions taking place on Trac tickets and wiki pages. 2) Just had a useful session, also with iwakeh, to identify an FAQ for new metrics team members (where do I start? what are processes for everything?). We hope to answer many of those Q's using a small number of guides (contributor's guide, release guide, operator's guide). We have been looking at existing guides, like Google's Java Style Guide, that we'd like to adapt. Everything will go on the wiki. Georg: 1) We make progress on the esr45 transition although we are a bit behind my schedule. Nevertheless the next alpha will be esr45 based 2) We got the OS X signing going it seems and will test with a wider audience in the upcoming alpha Mike: 1. Pinged Kevin about the blog contract to try to get it locked in. No reply :/ 2. Helped Isa a bit with the tor-core 029 ticket triage. Suggested some patterns that worked for Tor Browser (primarily tagging tickets by topic rather than tracking stuff off-bugtracker, which will help with both current proposal tracking/visibility and future proposals). 3. Worked on the OTF proposal with Isabela; Hope to finish the Tor Browser sections by this weekend. 4. Worked with Nick to get a cert for our OSX Tor Browser builds Isabela: 1) meeting Laura w/ Shari this Friday. Hope to hear better news from her. I emailed DRL requesting the follow up phone call they offered in the rejection email. I also pinged Dan to see if he is around, should be good to check in with him as well. 2) Working on OTF proposal, spent yesterday working with Mike on it. I hope to share what I have for Nick to review the deliverables I am writing there -- Nick I will do it before I go to DC, so you can give me your feedback till the weekend and I can continue working on it over the weekend. Mike will follow up with Georg on TBB deliverables as well. Roger I need you to give me names with their contacts to be used as reference. (Roger has done so) 3) Had sponsorT (or PT) meeting on Monday which was good to get a lot of information on what happened the past months and to figure out what to do next. Nima got a game plan to move on and I am follow up with Yawning (currently he is working on obfs5 but will pick up other PT stuff as well). 4) Next week on implementers meetings at DRL till the 20th (Wed). 20th is also the soft deadline for OTF full proposal and deadline for sponsorT report. Alison: 1. Still getting the community team in order but have recruited a few new members. The next meeting is 20 April so I'll be pinging people all week about it. 2. phoul and I have done a lot of work on the support team manual and if I can get my LDAP account approved, he and I will push our changes out together. I anticipate we'll be working on this through next week. 3. Planning to meet with members of the community council next week to go over the draft social contract, which we'll then share with tor-internal for feedback. Probably will do the same with the membership doc. 4. Juris, qbi, I and others will soon write the OTF concept note for Tor relay community capacity building. We've had a series of meetings with the different relay operators, and with their help and Moritz's we've got enough material to write the proposal. The objective here is to give support to relay operators worldwide, and that support includes legal resources, in-person meetings, and so forth. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXEJVMAAoJEC3ESO/4X7XBwzgH/2TUVNV23Q2ujtuj/0u0eSSb npVm5gHZLg7ko+tDixLv4NpAH7ZCFvJYGG7eQP8KMySaSb3KZvcU1Ztx08IJLRqX ElOLY5H+0M8KPEdW9GqCrlQiZUSFk5jlkmjbszV2rdWxjl6lLoVaMaSxkmexK4t/ vi1Y5wwIxj5++USQQkEc6vH8cYgMJtaOts5WmGJpg2XkkFacCcY6shM+bjH47UKQ xYOx5Gmg+rQqxN3aMmdLPqYJZyv5ghOaluyLKXl7ykBqQI/5y/XnkWP4YEh589zw 32J2aEi/mW7Jh8R1jcPacXTp+obht2KANC/aJ2+xnYa6TDuVsnBD51csI0ORguw= =zczi -----END PGP SIGNATURE-----

5 6

Automatic storm.torproject.org accounts for people with @torproject.org addresses
by isis 20 Apr '16

20 Apr '16

Hello all, Asheesh Laroia of the Sandstorm team offered us an API key for Sandstorm Business, which means that there are now some extra features. One of the ones I've already enabled is that anyone who proves control of an @torproject.org email address is able to have a Sandstorm account on https://storm.torproject.org. There are additional features which likely allow us, once the server is moved to official Tor Project infrastructure (rather than a server that I personally maintain), to hook up to Tor's LDAP, which maybe requires a bit of hacking because we have a somewhat odd LDAP setup, but it should allow us to have passphrases for Sandstorm which are controlled in LDAP. This would mean that we don't need to use the "passwordless email login" anymore. Best, -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://fyb.patternsinthevoid.net/isis.txt

1 0