- tor-project - lists.torproject.org

Summary of meek's costs, August 2016
by David Fifield 03 Oct '16

03 Oct '16

Here's the summary of meek's CDN fees for August 2016. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 January 2015 $464.37 + $669.02 + $0.00 = $1133.39 February 2015 $650.53 + $604.83 + $0.00 = $1255.36 March 2015 $690.29 + $815.68 + $0.00 = $1505.97 April 2015 $886.43 + $785.37 + $0.00 = $1671.80 May 2015 $871.64 + $896.39 + $0.00 = $1768.03 June 2015 $601.83 + $820.00 + $0.00 = $1421.83 July 2015 $732.01 + $837.08 + $0.00 = $1569.09 August 2015 $656.76 + $819.59 + $154.89 = $1631.24 September 2015 $617.08 + $710.75 + $490.58 = $1818.41 October 2015 $672.01 + $110.72 + $300.64 = $1083.37 November 2015 $602.35 + $474.13 + $174.18 = $1250.66 December 2015 $561.29 + $603.27 + $172.60 = $1337.16 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 February 2016 $986.39 + $977.85 + $445.83 = $2410.07 March 2016 $1079.49 + $865.06 + $534.71 = $2479.26 April 2016 $1169.23 + $1074.25 + $508.93 = $2752.41 May 2016 $525.46 + $1097.46 + $513.56 = $2136.48 June 2016 $0.00 + $1117.67 + $575.50 = $1693.17 July 2016 $0.00 + $1121.71 + $592.47 = $1714.18 August 2016 $0.00 + $1038.62 + $607.13 = $5400.12 -- total by CDN $13138.96 + $17939.22 + $4792.99 = $35871.17 grand total https://metrics.torproject.org/userstats-bridge-transport.html?start=2016-0… The number of users continued to rise last month, getting almost to 10,000, about the level it was at before the meek-google shutdown. (There's a big dip near the end of the month, but it doesn't seem to have lasted long.) That means that meek-azure and meek-amazon are under increased load compared to before--about 7 TB/month for meek-azure and 3 TB/month for meek-amazon. If I get a chance, I'm going to try installing an ECDSA (as opposed to RSA) certificate on meek-azure, and see if it relieves the CPU load. If you are one of the users affected by the meek-google shutdown, see here for a workaround: https://lists.torproject.org/pipermail/tor-talk/2016-June/041699.html == Amazon a.k.a. meek-amazon == Asia Pacific (Singapore) 77M requests $93.24 428 GB $57.27 Asia Pacific (Sydney) 6M requests $7.52 33 GB $4.51 Asia Pacific (Tokyo) 1M requests $1.38 7 GB $0.95 EU (Ireland) 299M requests $359.00 997 GB $77.22 Global 1M requests $1.91 6 GB $0.48 South America (Sao Paulo) 22M requests $49.82 177 GB $42.23 US East (Northern Virginia) 247M requests $247.36 1214 GB $95.24 -- total 655M requests $760.23 2865 GB $277.90 charge for alarms $0.50 https://atlas.torproject.org/#details/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == Zone 1 6731 GB $585.61 Zone 2 156 GB $ 21.52 -- total 6887 GB $607.13 https://atlas.torproject.org/#details/AA033EEB61601B2B7312D89B62AAA23DC3ED8… Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

2 2

Notes from September 22 2016 Vegas team meeting
by Karsten Loesing 26 Sep '16

26 Sep '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for September 22 2016 meeting: Nick: 1) Deliverables for mid-oct looks -- hard. Still, we will try. Some may get implemented in Oct, but land in 0.3.0 :( 2) Are we out in front of funding? 3) I have maybe 10 hours of work time left pre-leaving-for-meeting. What should I do? 4) Need an 028. Shari: 1) Lots of getting ready for the big meeting next week. 2) Hosting Linda and Isa, who arrived yesterday. :) Alison: 1) Tor Meeting Public Days! 1a) Kate and Alison are doing outreach now. 1b) Still working on project ideas for new people for the public hack days. We may have a better sense of these by the end of the core meeting. 2) Tor Meeting Core Contributor Days! 2a) Roadmapping sessions: possibly Tuesday morning review previous roadmap or work we've done in the last six months, Tuesday afternoon deep team work that ends in a roadmapping session? Sounds like this conflicts with what Isa has planned for Thursday so we will work it out together and report back. 2b) gunner and I are working out the agenda based on the emails and agenda suggestions on the wiki 3) Community team members are working on the metrics for relay operators project, updating the Tor brochures, creating the Rapid Response (to censorship events) program, and the support platform (including all related stuff like building out a glossary and finishing up the Tor manual). We hope to get a lot of work done on all of these next week! Kate: 1) Continuing to work on the Stop Mass Hacking Act. Awareness is spreading, but senators only care about phone calls and voice mails. How can we translate retweets into phone calls? 2) Multiple upcoming articles in the media about Tor (onion services, film with Nick in it, etc.) 3) Nice blog post by George about Donncha's Onion Balance software 4) Firefox vulnerability: PR fallout fell our way because of user-focused, quick action from GeKo and others to put out a new version of the browser asap. Karsten: 1) Worked on even shinier Shiny prototype, this time with Tor Browser downloads/updates by platform, channel, and locale: https://tor-metrics.shinyapps.io/webstats2/ 2) Had a roadmapping session with iwakeh to plan the upcoming 6--9 months for the metrics team. 3) Question about Sponsor X: Should we prioritize finishing tasks in order to invoice for them early, or can we plan tasks and subtasks to do urgent things first even if that means completing more tasks towards the end? (Answer from Shari: do the urgent things first.) Georg: 1) Worked on the emergency 6.0.5 release and related fallout 2) Continuing mainly SponsorU work Roger: 1) What's the story on our blog replacement plan? 2) I have spent the last while paying my dues (our dues, I guess) on having so many NSF grants. It looks like there's more work coming after this work, so I should think about how to get people lined up for delegating things to them. Mike: 1) Mostly recovered from my laptop failure (Now running Qubes - Yay!), but behind on lots of things I wanted to get done before the Tor meeting :/ Isabela: 1) Linda started! we met and set up a plan for her first two months 2) OONI proposal to DRL metrics grant has been submitted 3) working on OTF report and on their feedback to our grant proposal 4) preparing teams meetings for dev meeting (i am behind with the applications team one :/) -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJX6Nb+AAoJEC3ESO/4X7XBwRQH/3VyiEMqmpy5fkym3/sThXtU EaFIc9rEk0a4u0/nkZpcki/wWozOPUgX82z9QyOvJJtUiHqo+WkZ6ymHoGJ8Ghv+ cLSjPvwZCi8O5Nt+Q1GJH81RY9Cd5QN9f71U6y3L1tFvFUDPjcR6j4jcm3kfd05I jNejbXO8vSLQa+1QREHdXt7SZAG+xI5a6TkSYqNrj432AaHtAAzFZHecgVPXtpnW D3beKniKUQDZ3Jbp5sk9X34FHlK0cbJPF1InChZNs70iRRTbfEcydAA0DFAVOfZ+ 28oxt4w7kaNFEJQ/CE4nGO/+KTLZ4wmayra6wvFvyjiztT16LHY2Zmu66NRbgiE= =DQCC -----END PGP SIGNATURE-----

1 0

Notes from September 15 2016 Vegas team meeting
by Karsten Loesing 19 Sep '16

19 Sep '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for September 15 2016 meeting: Roger: 1) Back online but single-mindedly focusing on NSF (SponsorM) site visit, send me a fresh mail if you need anything. Nick: 1) Tons of deliverables between now and end-of-oct. Going to be busy. Adding extra work is deprecated. 2) Timeline for hiring? A: Grant manager asap, then techies once next big grant approved. 3) To do (or discuss at meeting): we need somebody directing our infosec. How? Budget? 4) Topic for meeting: project-wide software security policy. 5) Topic for meeting: we need to brainstorm stuff in advance for future proposals. 6) annual/biannual reviews? Kate: 1) Trying to get a reporter to film herself starting a Tor middle relay 2) More blog posts on the way--For instance, will publish the one that Nathan and I and others wrote about being safe while using mobile 3) Blogged about Rule41 (which will allow FBI hacking unless Congress acts) and am using social media to raise awareness of issue and get ppl to call their Senators (will roll out plan for non-US people soon but for now: retweet! retweet!) 4) Last night I linked a subplot on Mr. Robot (Elliot hacks the FBI) to the fact that the FBI is about to hack us—got lots of people to call their US Senators, lots of attention to the Stop Mass Hacking Act, 300,000 Twitter impressions, 450 retweets, and 65 new Twitter followers. --Will follow up with what you can do if you are not from the USA 5) Will be in SF for the week after the dev meting and am lining up meetings with policy folks and reporters. Let me know if there’s someone you think I should meet—am also going to stop by NOiseBridge. 6) We have PhotoShop and Illustrator—all hail Shari and Jon and Erin - Thank you! Alison: 1) Tor meeting agenda planning continues -- lots of ideas from meeting attendees. Will share summary with the group after gunner, Shari, and I meet on Monday. 2) Nima finally has all info for the public hack days and is making a flyer for outreach. We're only sending it out digitally -- Twitter and email -- because we don't have a ton of capacity for this, especially on Saturday and Sunday. 3) We need some people to act as point persons on the Saturday and Sunday hackdays. I'm trying to figure out who these people could be. I can do it Friday, but then I leave Seattle. 4) Community team is working on the "metrics for relay ops" project and on improving communication with relay ops generally. 5) Colin is nearly finished the support manual and will have a blog post ready for review soon. Other support stuff being worked on: glossary, FAQ, and platform for support.torproject.org. We'll have some things to share at the meeting. 6) I didn't get enough people to commit to doing the Tor event at Aaron Swartz Day (in SF in November) so I emailed Lisa Rein to say we should probably give that time to someone else. -- wait, maybe we can actually be there. I will circle back with Lisa about this. Isabela: 1) Prep for dev meeting - organizing team meetings; organize Linda's onboard -> will email the ux list today announcing her, got a quote from her too. Should i fwd to tor internal as well? 2) Guidelines are out -- working on collecting feedback from the community and preparing for dev meeting session 3) working on wireframes for metrics and something for orfox project too (ISC above) so when FE dev comes in we can speed up process 4) Interviewed ppl for the services admin position from ford foundation grant 5) replying to giant rabbit requests - review design, get server set up etc Georg: 1) Was in Berlin for the meetup. I think it was a success on many levels 2) Dealt with release preparations and trying to get as much stuff into the upcoming alpha as possible 3) We should think about possible talks for 33c3 Karsten: 1) Helped organize and attended the Berlin meetup. Discussed many things, including ExoneraTor with Sebastian, webstats with GeKo and boklm, and metrics plans with iwakeh and others. 2) Helped with job interviews for a service admin position. 3) Set up a new visualization (https://tor-metrics.shinyapps.io/webstats/) using Shiny, which is "an open source [...] web framework for building web applications using R". This is one possible future of the Tor Metrics website, but we're not there yet. Mike: 1) Updated my android work to the new release of copperhead based on Android Nougat. Seems mostly working still. Some minor annoying snags remain, though. Shari: 1) Getting ready for Tor meeting. 2) Getting ready for two board meetings at the Tor meeting. 3) Working with Giant Rabbit on getting our donation database ready for end-of-year fundraising. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJX34wDAAoJEC3ESO/4X7XByeoH/1atCQQsM2e0VARoASY4nJ1R DCR9CUPUpSrLd4leMm537ingQyCX4vxkzbalR2Sy89jyb5wPlkV7WNADF9ywsJmm QxBS2wVkMeN6DQ3ZdbJJuP6t0J0VJxFUBxNcnBDXce7l3B5L38C7e1+Khqi+5aMp uXqGVRnQzR51sd3PUjsWLd5oLhqIEp4pWNQj4YiNR4/NrpDKY3b7CK1zyKjHPVkF kQlqtrZQaWQ4Zp/epsVuxbncJPcD4w2oL8Laa6YpYZi9scleBRvZd+f7q5aPuYpQ LL2tLCxQkW46Jzv7LKtJc16sy+TeU/AVjm4UyIdGzbkdfAn/IFd0OKa7g93CfYc= =7ulp -----END PGP SIGNATURE-----

1 0

Human rights and encryption op-ed in Foreign Policy
by Cindy Cohn 15 Sep '16

15 Sep '16

Hi all, My partner, Patrick Ball, wrote a great piece in Foreign Policy linking together the need for strong encryption and human rights in the US and around the world. https://www.foreignaffairs.com/articles/2016-09-14/case-against-golden-key?… Worth a tweet? Cindy *********************************** Cindy Cohn Executive Director Electronic Frontier Foundation 815 Eddy Street San Francisco, CA 94109 (415) 436-9333 x108 ----Cindy(a)eff.org <mailto:Cindy@eff.org> ---- www.eff.org <http://www.eff.org/> Join EFF! https://supporters.eff.org/donate

4 5

Fwd: Tor as client for Final Year Project?
by Shari Steele 14 Sep '16

14 Sep '16

Hey all. Anyone interested in working with Louis? Shari > Begin forwarded message: > > From: "Woods, Louis" <k1308517(a)kingston.ac.uk> > Subject: Tor as client for Final Year Project? > Date: September 13, 2016 at 1:53:27 PM PDT > To: "execdir(a)torproject.org" <execdir(a)torproject.org> > > Dear Tor, > > I am a Computer Science student at Kingston University in London. I recently concluded my software development placement year in industry, and I am about to commence my final year at university. > > I have to undertake a Final Year Project, where I have to apply my programming skills to create an application or website. I already have an idea in mind, which I also believe would be beneficial to your organisation. > > My project is a web application which works in a similar way to the software TrueCrypt/VeraCrypt (an encryption software with plausible deniability). This can be used in countries with Human Rights Abuses, as the first password is just a dummy password which decrypts unimportant information. However there may be a second password hiding sensitive information, but nobody except the user knows this. > > <>My project requires a client, which can be a person or corporation. It would help me enormously to have your well-known and respected organisation’s name on my dissertation report, as you have similar goals to my project’s focus. Essentially, I already have the idea and a plan, your input would be minimal, aside from a few discussions, feedback on features and usability, and of course written proof that you are a client so I can include this into my report. > > Depending on the success of my project you may be able to utilise it for your own purposes in the future. > > Regards, > > Louis Woods

1 0

Matt Blaze, Susan Landau and Ron Wyden in WIRED on FBI Mass Hacking
by Kate 14 Sep '16

14 Sep '16

Good morning! What a great op-ed from Matt Blaze, Susan Landau, and Senator Ron Wyden. It talks about the collateral damage that Rule 41 could cause: https://www.wired.com/2016/09/government-will-soon-able-legally-hack-anyone/ Cheers, Katie

1 0

Tor at Aaron Swartz Day in SF
by Alison 13 Sep '16

13 Sep '16

Hello, good people of Torlandia, The organizers of Aaron Swartz Day [1] would like to give Tor folks a dedicated space during their Sunday hackfest on November 6. The possibilities for this space are pretty open-ended -- we could do Tor tutorials, exciting new things coming up in the Tor world, hacking, presentations of Your Exciting Project That Uses Tor, whatever we want really. We can take up whatever amount of time we want during the day. I will be doing some kind of LFP presentation on Saturday, and am willing to organize the Sunday Tor stuff with whoever else wants to participate. If you are a Bay Area Tor person, or you'll be there the weekend of November 5-6, let's start organizing. I am in favor of organizing onlist because maybe people who can't be there in person have ideas about what we should do. This is a special event honoring Aaron's life and legacy, and I had a great time participating last year. Also, Chelsea Manning is heavily involved in this year's planning. I highly recommend participating if you are able. Alison [1] http://www.aaronswartzday.org/

2 3

Notes from September 8 2016 Vegas team meeting
by Karsten Loesing 13 Sep '16

13 Sep '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for September 8 2016 meeting: Nick: 1) I want to promote "blind hiring" for my team's next opening, whenever that is. Should I talk to Erin W about it? 2) Should/could I be on fewer MLs? 3) Any way to treat "everybody's attention" as a shared resource? 4) Coding continues. 5) Infrastructure for new folks. 6) Has anybody been reading through the replies on the "hey relay ops how can we help" thread and compiling/responding? Alison: 1) Agenda emails: getting great feedback. Now how to incorporate this into how we typically create the meeting agenda? People like the morning brainstorm session. We could use this feedback to communicate a broad overview of priorities, then use the first morning time to get identify the specific work sessions that people want to do. 2) Public hack days: outreach and planning 2a) Outreach: Katie did a save the date. We need to think about promotion to different groups. I've been in touch with some. 2b) Activities: high level/nontechnical short talks/tours about Tor, list of tickets for newcomers to work on, cool stuff in recent Tor/TBB releases, etc. 3) Metrics for relay operators: community team members are working with the metrics team to help support relay operators. We got feedback from the operators about what kinds of metrics might be valuable to them, and the biggest response we got was that they want to see some kind of recognition for their relay uptime/bandwidth. So we are working out the details of what to measure, but the result will be something like a weekly email to the community team with the relevant metrics, then one member of the team will write to that relay operator and congratulate them, organize sending them some swag, ask about how things are going generally, etc. Isabela: 1) Finished OTF proposal 2) Had kickoff meeting for Tor Browser for Android (Orfox) ISC project 3) Prep for internal launch of style guidelines 4) Prep for dev meeting 5) Organizing somethings for MOSS project to keep track of deliverables 6) Had my first meeting with OONI as part of a biweekly meeting I will have with them to help PM their projects 7) Moved to OONI-DRL proposal now 8) pre-preping for Linda start 8a) (reading UX paper Geko asked me to, getting materials for metrics.tpo.org and orfox tor button/security slide ux etc) Kate: 1) Senator Ron Wyden is pushing for a US Senate to consider bill to stop the legalization of some FBI hacking 2) Blog posts aplenty Mike: 1) Still working on Copperhead. They are having issues with the Android Open Source Project being disorganized while switching to the latest release. I am working on getting updates to work smoothly-ish through this transition. 2) Worked on the Netflow padding traffic analysis defense code. Have a new branch ready for review. 3) Helped with the OTF proposal. 4) Talked with Mozilla (with Georg, Tom Ritter, Huseby, and Richard Barnes) about what they need from us to help reduce the difference between Tor Browser and Firefox. Shari: 1) We’re gearing up for the Tor meeting in a couple of weeks. Anyone have any outstanding issues or questions? 2) I’ve told Pepe from IFF that the next Tor meeting won’t be in Valencia. IFF is 3/6-10. Does anyone from Tor want to go? Would anyone like to be on the IFF organizing committee? 3) Riseup's in trouble. I'm going to follow up with Micah to see if Tor can help. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJX17G7AAoJEC3ESO/4X7XB6OUH/A7fWtRKESkQ3UbgWGeWPkyu WgCPNSjdopM64LFkQTo4HQhiyb923mOBwO4WLJ0YluD4JvDlS8s6B37Aa9W1Km5c SXoekE0FlpMF7HRTz4Ot5CyvaNGSmYB5VFBR6hpotaqLT+WOHwCXcMfyeU8HtxQD MyjVbp9Xllvd/EKfNu6h+3Nq0L7E9guvz3NeP2b8WJfirR7mKDMFiI91HnuVK9z7 Odp/3VEZaAg5JxS57ng9PX21yagEEcEou1dn5HJn8V5EMQFot5uDaTD4IeCl2KCp VR+G/VK47ThHqZHfrfPP8pMbwBbhASofqqZpe6cj8MQvdvmdrupHUN/RSHTUmKY= =lDJ7 -----END PGP SIGNATURE-----

1 0

Updating Fallback Directories
by teor 08 Sep '16

08 Sep '16

Hi Everyone, Some time in September, I want to update the list of fallback directory mirrors for Tor 0.2.9. This means: * emailing the 85 operators in the 0.2.8 list to remind them not to change their relay details, * generating a list of new stable relays for 0.2.9, * emailing these operators (maybe 100?) to ask them if their relay will be around for 2 years, * generating a list of fallbacks for inclusion in an 0.2.9 alpha, * emailing each of these 200 operators in the 0.2.9 list to remind them not to change their relay details. I'm wondering where I should send these emails, so I'm not the only point of contact: When I first did this, I emailed tor-relays. Then I emailed some operators directly. Then recently, I CC'd tor-team. I'm concerned I'll be flooding whatever list I use with very similar messages. Or maybe I should email them directly, and put tor-team in the reply-to field? Also, if anyone would like to help out with these tasks, that would be great! (I'll be doing them in my own time.) Tim Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org

1 1

Proposal: rotate default bridge ports each release
by David Fifield 06 Sep '16

06 Sep '16

Lynn Tsai and I just published a report on the blocking of Tor Browser's default obfs4 bridges. https://www.bamsoftware.com/proxy-probe/ https://www.usenix.org/system/files/conference/foci16/foci16-paper-fifield.… One of the things we found is that the Great Firewall of China blocks the default bridges--but it takes a little while after release for them to do it. We saw delays as short as 2 days and as long as 36 days. We also found that when they block a bridge, they don't block the whole IP address; they just block a single port and other ports on the same IP remain accessible. We can take advantage of these peculiarities by opening additional obfs4 ports on the default bridges, and changing the port numbers on each release. We'd keep the old ports open for people who haven't upgraded yet, but those who upgrade will start using the new ports. This way, we can make the bridges temporarily reachable after each new release--at least until the censors figure out what we're doing and start blocking more aggressively. This is pretty easy to do on the bridge operators' part. They just need to forward a range of ports to their existing obfs4 port, something like this: iptables -A PREROUTING -t nat -i eth0 -p tcp --match multiport --dports 50000:50009 -j REDIRECT --to-port <obfs4port> Then, the Tor Browser developers can choose a fresh port in each new release.

5 7