- tor-project - lists.torproject.org

Which domains have onion addresses with EV Certs
by Paul Syverson 10 May '16

10 May '16

Does anyone have a list of domains with EV Certs for onion addresses or know where to easily obtain such? Juha, I didn't see any obvious indicator of this at ahmia, but maybe you keep track of this somehow? Alternatively, if people have specific names of companies or domains (beyond Facebook) that have Certs for both their registered domain names and their onion addresses I'd appreciate hearing about them. Thanks. aloha, Paul

7 11

Notes from April 28 2016 Vegas team meeting
by Karsten Loesing 09 May '16

09 May '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for Apr 28 2016 meeting: Georg: 1) We worked on our Tor Browser releases and got them out. 2) In the next weeks we will work on stabilizing ESR45 based code for the 6.0 stable release being due in about 4 weeks. 3) I worked on a replacement/change for our OTF sandbox deliverable. Kate: 1) Facebook press: Coordinated closely with Alec Muffett from Facebook; published simple press release; spoke to TechCrunch and Daily Dot; got a flood of positive press from other outlets based on Alec's short Facebook blog post. 2) Edman media strategy and statement (on statement: conferred with colleagues, drafted statement with Shari, fact checked with Roger, Nick and others, sent to Daily Dot reporter.) 3) Reviewed bug report for Nick 4) Met with Nick and Shari on media issues. 5) Coordinated interviews with Daily Dot (Facebook article, article on Edman, also article on Internet censorship), Motherboard (CloudFlare), Forbes (Exit relays and Seattle raid) PBS (for Internet documentary--Nick is being interviewed tomorrow), Gizmodo interview with Shari, WBAI radio interview for Shari, spoke to Wired about new Iranian satellite service that distributes Tor software and animation as well as Tails. 6) Spoke to Jake--all is going very well on his trip to island nation; talk went well, he met with only local Tor relay operator and made contacts with local internet freedom community. 7) Published second issue of newsletter for funders and external nontechnical audiences who aren't following Tor closely (different from TWN). 8) Met with nontechnical volunteer David to discuss work. 9) Social media: Tweeting and posting to Facebook. 10) Worked on onion services fact sheet which includes examples of good uses of onion services - still needs work. 11) Want to participate in collaboration with health clinic using onion service to share sensitive info with patients, etc.; asking Tor for a letter indicating we want to collaborate. Requires short "we are collaborating" letter from Shari. Mike: 1) Talked to Kevin and Matt about the blog. Matt gave us some technical suggestions related to avoiding logging IPs. 2) Figuring out how to handle an OTF about a deliverable with Georg and Isa. Nick: 1) There will be some work to onboard Jon. Need somebody to spin him up on PGP/XMPP/something so I can start sending him passwords he will need. 2) Handling transition stuff from Katherine's and Tom's departure. This includes email wrangling. 3) Got a UDRP complaint from Joker. Need to send them faxes. Will do on Monday. 4) End-of-month process for deliverables seems to be going well; we will find that we had lots of stuff that just couldn't get finished by EOM. 5) Will be distracted today and tomorrow preparing for interview for internet history documentary; more good work to come in May. 6) Bug retrospective seems very promising; we should maybe spread the other practice so that other teams to do stuff like this. 7) Will try very hard not to be working this weekend. My stress levels are up, and I need to unwind. 8) Helping Isa with reports has gotten easier since we started getting better about tracking sponsors. 9) Haven't made progress migrating us away from SVN for a while. 10) Have made a tiny bit of progress trying code review tools. 11) Hoping that TBB 6.0a5 comes out today so users can test the tor in in. Isabela: 1) Waiting on a couple of things from Sue Abt: * a) W9 for OONI to get the money for their grant * b) Finance report for sponsorT 2) need to apply changes on how we are reporting things to DRL - they requested this from everyone at the implementers meeting. Done so far: * clean up of the narrative report - need review from Roger (PT part), Nick(Testing part), Shari?(Outreach part) - by review I mean facts (if I missed anything) and English :) * initiated conversation on how to simplify our F-Indicators reports - we have 3 different sets going on... is a big mess that I inherited :( * plan on building a M&E for our project with them * start to look at what is needed to get our extension going for sponsorS contract - to make sure it ends on the right date (EOQ3) 3) working today with Mike on OTF full proposal (2/3 is done already) - -- plan to get it to Roger to give it a LaTex beauty magic by EOW (Chad said is ok to submit it by first week of May) 4) working with Mike and Geko on negotiating with OTF to change a deliverable on our contract 5) working with Nick and Yawning - on defining deliverables for Yawning to work on so we can build a contract with him 6) Richard Brooks want to write a SOI to DRL for a project with he GENI network where we can deploy VMs on it for PT testing, or to run bridges etc - is it useful for us? Do we want to do it? Alison: 1) finishing up OTF proposal for Torservers.net (worked with Juris and Moritz and other Torservers folks) which aims to build community capacity for Tor relay operators. 2) Kate will put Alison in touch with Forbes reporter who is writing about relay operator stuff2. Started conversation with EFF folks about a community response to CloudFlare issues. 3) Community docs that are still slowly being worked on: social contract, membership doc, and support docs. Alison has had a very very busy two weeks of trainings! But after this week, the membership doc and social contract have been bumped up in priority. 4) Still working to grow the community team! a few more activists and folks on Tor-teachers mailing list have reached out to me, so I hope soon to have a critical mass. Karsten: 1) Not much to report this week. Trying to keep team members productive by responding to questions and reviewing patches. The CollecTor improvement project is going really well. 2) Globe retirement is going okay. We're creating a list of things to add to Atlas before dumping Globe, but I don't see any major blockers there. 3) Created a graph or two for this week's Sponsor R event. Shari: 1) This is the last week for Tom and Katherine as Tor Project contractors. We need to offboard them and wish them the best. Hopefully they'll remain active in the Tor community. 2) A lot of new people have started here, and the Seattle office is rocking. I’m planning to send a personnel note around tomorrow to tor-internal. Will include new office contact information. 3) Sent note to DRL about uncoupling TorDev from IFF. Expect to hear back from them this week. 4) We have close to a draft anti-discrimination/anti-harassment policy finished. I will run it by the Vegas team and then distribute to tor-internal. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXKcpsAAoJEC3ESO/4X7XBK04H/RnwJExgAB29oFwi6Fq4FHvp u1XdQ/t0VEyp27rbSXMQvk7NydmE/3bnN+ASihIxsvrTt3CUUSI5tFb9fc9Afx7c af6JB2xWpezGLo6RFhs2hiipA6cpDuwH0oTf0giyv96gHxp9ltGUQtAGs/Pk+XtD ywZYgWXP0+R3gJ1YyX7GqIs5QYUUlegv85GEmkIHAuF/JOxNqu7qqEKLf1KbSihy 8MNTNs50sG97W7XPwiwJTjykUSJQl6U96WhYVYJl8TX3V7h5qc/7N2FyTSDVGdbv KOL/5d1jkL7cF0biaWC8JdlrDzSHNlBzGRbBVre4ZMFs97w9JQ3ij4B2C6Y14FY= =qRj8 -----END PGP SIGNATURE-----

5 4

Teaching lawmakers about Tor for rule 41 amendment
by Roger Dingledine 06 May '16

06 May '16

Hi Alison, Kate, Check out https://theintercept.com/2016/04/28/supreme-court-gives-fbi-more-hacking-po… I think this is a really important outreach topic. A) We should reach out to the senators who are planning to fight the changes, to offer to teach them more about Tor and more about the Internet, see if they have any questions or concerns, etc. I bet there are some staffers somewhere who are working on exactly this topic, and everything they know about Tor they learned from one scary video about the dark web. We should teach them how Tor works, why people need it, and why a diversity of types of users is key to its security. B) At the same time, we should learn what their talking points are, so we can be better at educating people about the issue. In particular, one of the quotes in the article says it's "possibly the broadest expansion of extraterritorial surveillance power since the FBI's inception", but at the same time, I can totally picture people saying "Oh come on, it's just Tor, how can that be such a big change?" We would be smart to have concrete non-Tor examples of what these new powers would allow, so everybody can understand that these changes aren't just about Tor. Thanks! --Roger

5 5

Onion sites vs onion services vs hidden services
by Alison Macrina 05 May '16

05 May '16

Hi all, Colin (phoul) and I started working on the support team docs a few weeks ago, and it brought to our attention just how much onion sites/onion services/hidden services are still being used interchangeably. Since this is confusing, we checked in with folks about which one is preferred, and onion sites seems to be the clear favorite. However, internally and on Twitter, I still see us using onion services (and worse, hidden services). So, I want to propose that we choose onion sites or onion services once and for all (I'm in favor of the former because most users have no idea what is meant by "services"; it sounds too vague). Then, whenever we see somewhere on torproject.org or any of our documentation or whatever that still reads hidden services or onion services, that we kill it with fire. Thanks for reading, Alison -- Alison Macrina Library Freedom Project libraryfreedomproject.org PGP: https://libraryfreedomproject.org/contact/

10 10

Fwd: Tor logo on Toosheh website
by Nima Fatemi 04 May '16

04 May '16

Hi Wendy and others, The good people of Toosheh[1][2] want to include Tor logo on their publishers web page. Do they need special permissions? [1] https://twitter.com/torproject/status/723576179303784454 [2] https://www.wired.com/2016/04/ingenious-way-iranians-using-satellite-tv-bea… Best, -- Nima -------- Forwarded Message -------- Subject: Tor logo on Toosheh website To: Nima Fatemi <nima(a)torproject.org> Hi Nima, Thanks for the quote on Wired and taking the time to take to us. I wanted to follow up on our conversation about having Tor’s logo among other Toosheh publishers on this page <https://www.toosheh.org/publishers>. -------- / Forwarded Message --------

1 0

AuthDirBadExitCCs still in effect?
by David Fifield 03 May '16

03 May '16

Tickets #4207 and #4923 allow authorities to set the {Invalid,BadExit} flag, or reject relays, based on their country code. https://www.torproject.org/docs/tor-manual.html.en#AuthDirBadExitCCs https://bugs.torproject.org/4923#comment:14 says that 4 years ago, authorities were configured to BadExit relays in Iran and Syria. Are these restrictions still in effect? Is there a way to see what authorities have set the AuthDir{BadExit,Invalid,Reject}CCs options? Or would you have to infer it based on the votes on individual relays?

3 2

Measuring Tor's impact in the world?
by isabela 29 Apr '16

29 Apr '16

hello tor, yep, that's right :) I spent some time with our sponsors last week and at the end of the day, the question of 'how to measure tor's impact in the world' seems to be something that would be useful for us for things like: 1. grant proposal - impacts we could demonstrate 2. reports to sponsors - as a metric we could report 3. in general when we talk with people (journalists, users etc) So I thought of the following question: 'What happens to the tor network when there is an event happening in the world?' Is an easy way to do as an one off but super hard if you want to keep track of it so you can build stories around more than one event here and there. Then I thought of what world events are predicable that we could check for Tor's impact? elections... So I looked at all elections for Q1 2016, then looked at the number of direct connected users and number of users connected via bridges during those events... There were some correlation of events, you can check them here: https://docs.google.com/document/d/1MKntWAoZOcRB8rBbxl3P-VKAvyH8jf0RmqlsB2l… Of course we should also take a look for the same thing when unpredictable events happens.. like the Egyptian revolution or a shutdown of services for whatever reason (whatsapp in Brazil). Why I am sharing this? Because there are tons of smart people in this list and maybe someone has a different way to measure tor's impact in the world. Or maybe someone knows how I could automate such a thing :) (api somewhere?) Or maybe ideas of other points of data for reference. For instance, I am now thinking if x users connected on Tor means a lot or a little in a country.. that will depend on how many people are online, the number of internet penetration for that country. Yes, I know this is very simplistic way of talking about something as big as 'impact in the world'. But I have seem this information being useful in other scenario, and it did helped a lot to pass the message of what value people should think of when thinking of the product. For a long time twitter had the problem of being seeing only as a short text social media platform. But twitter wanted people to think of it as 'the platform to know what is happening now'. A platform where if an event happened in the world, twitter was the place where people would talk about it. And for a while the data science team did only this, publish correlation data of what happened at twitter during global events. I believe it did worked because that information was what people (media, mouth to mouth etc) start to pick up when anyone would talk about twitter. here is an example of the work twitter did that i am talking about: https://www.youtube.com/watch?v=SybWjN9pKQk cheers, Isabela -- PM at TorProject.org gpg fingerprint = 8F2A F9B6 D4A1 4D03 FDF1 B298 3224 4994 1506 4C7B @isa

4 5

Re: [tor-project] Measuring Tor's impact in the world?
by Nathan Freitas 29 Apr '16

29 Apr '16

On Fri, Apr 29, 2016, at 01:14 PM, isabela wrote: > So I thought of the following question: 'What happens to the tor network > when there is an event happening in the world?' This is really great, important work. > Then I thought of what world events are predicable that we could check > for Tor's impact? elections... ... > Of course we should also take a look for the same thing when > unpredictable events happens.. like the Egyptian revolution or a > shutdown of services for whatever reason (whatsapp in Brazil). I think that shutdowns of service of blocking of specific apps are another important metric. This is often when we have seen growth in Orbot downloads in a specific region. On that note, I am happy to share more detailed Orbot download information with you as part of this effort, to see how that correlate's with general Tor usage in a specific region. > Why I am sharing this? Because there are tons of smart people in this > list and maybe someone has a different way to measure tor's impact in > the world. I think beyond a list, there a great deal of researches at places like the Citizen Lab and the Berkman Center that would be eager and very capable to help with such things, as well as separate noise from actual events. > > Or maybe someone knows how I could automate such a thing :) (api > somewhere?) Unfortunately, I don't think this can be automated, but at the same time, I think just showing a few important, meaningful correlations per year would have a big impact. > Or maybe ideas of other points of data for reference. For instance, I am > now thinking if x users connected on Tor means a lot or a little in a > country.. that will depend on how many people are online, the number of > internet penetration for that country. That was definitely running through my mind as I was looking at the graphics. 200 users may seem small, but depending upon Internet usage, desktop vs mobile, and whether you have the right 200 people are all important context to have. > Yes, I know this is very simplistic way of talking about something as > big as 'impact in the world'. But I have seem this information being > useful in other scenario, and it did helped a lot to pass the message of > what value people should think of when thinking of the product. This is exactly the way my wife who works on multi-million dollar public health projects measures their impact of programs to get people to quit smoking or to reduce infection of certain disease. At some point, it all comes down to "did less people die in X region from this terrible thing?", or "how much money did we spend per person who did not die?". If that metric is inline with what the funder expected, then you get more money, and less people will die. > talk about it. And for a while the data science team did only this, > publish correlation data of what happened at twitter during global > events. I believe it did worked because that information was what people > (media, mouth to mouth etc) start to pick up when anyone would talk > about twitter. I completely agree, and am happy to support the effort to have the same kind of impact with Tor, Orbot and all related onion efforts. +n

2 1

Texas Linux Fest 2016 CFP
by Lunar 29 Apr '16

29 Apr '16

Hi! Nathan Willis who works for Linux Weekly News contacted me about a two-day event happening in Austin, Texas, USA in July. Here's what he wrote: --- 8< --- […] I'm one of the organizers of Texas Linux Fest, which is the leading community Linux-and-FOSS conference for Texas and the surrounding region. Our event is July 8th and 9th this year, in downtown Austin, TX. We'd really love it if folks from the Tor project and surrounding community can be there—be they local or from out of town. I especially wanted to draw your attention to our call for participation. We're intent on attracting a wide variety of speakers representing open source and free software, both users and developers, from all corners. The details are here: http://2016.texaslinuxfest.org/call-for-papers and the deadline is approaching. Please consider submitting a talk proposal, and we would love it if you could help us spread the word by sharing the CFP with the Tor community! If you have any questions, or if you want to know more about Texas Linux Fest in general, please get in touch! --- >8 --- -- Lunar <lunar(a)torproject.org>

2 1

Notes from April 21 2016 Vegas team meeting
by Karsten Loesing 27 Apr '16

27 Apr '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes from Apr 21 2016 meeting: Big takeaways: 1) Eight people in one hour just doesn't fit. We should think about how to be more efficient, how to triage topics, how to arrange for more time for this team, etc. 2) We all raised the topic of Tor Browser security and the recent angles around it; but we didn't get to this topic. Roger: 1) Should each of us add our lines to this notes page ourselves, so we know what we added and have more of a say in what goes out to the tor-project mailing list? Answer: yes. (But we screwed this one up this time, because I should have said "Ok, that means you all write down what we discussed and what we concluded please" but nobody did. Next time maybe!) 2) Should we have an intermediate stage between this pad and tor-project, so more internal people can help vet notes? Answer: no need for this yet, but let's make the notes review period "until Monday" rather than "overnight", so people actually can review it. 3) When will we pick dates for the Seattle dev mtg? Answer from Shari: "It will be one of the last two weeks of September. We won't finalize the dates until we finalize the venue, and we won't finalize the venue until we have an administrative assistant on board to do so. Jon Selon has accepted our offer, and he starts on Monday. Yay! So hopefully we'll be able to nail down these dates soon. See my notes below for info on the February Tor Dev meeting!" 4) Making a donate@ alias for humans, so donations@ can be for machines? Answer: Shari thinks that would be so incredibly awesome! 5) When do we get our admin assistant? Shari says: Monday!!! :) 6) Inviting Kate back to the Vegas team meetings? Answer: yes, let's do it. 7) I've been talking to Isa about getting a project leader for our circumvention side: making the balance right between academic research, implementation, and operation/deployment. Things from last week that still want attention: 8) tor blog contract details (no progress today either) Shari: 1) Isa and I talked with Pepe, who organizes IFF. He was very concerned to hear from Laura at DRL that we were considering the option of uncoupling Tor Dev from IFF and basically promised us the moon if we'd hold Tor Dev at the end of February in Valencia again next year. Conclusion: "If DRL wants us there, we should make it clear to DRL the cost that it presents to us." 2) Please look at the writing sample from grant writer candidate Cass Brewer and let me know next steps. I'd love to get her hired soon, or figure out someone else if necessary. If anyone else wants to join Kate and Isa interviewing her today, let us know. Conclusion: we are all fine with the hire so long as Kate and Isa think it's a good move. 3) Isa and I met with Laura and Steve from DRL about our SOI. They were really quite frank about what they wanted from us, which is mostly a better job of tying our work to their goals. We should probably do that with all proposals. 4) Glad I don't have any more travel for a while. Planning a trip to San Francisco mid-May. Nick: 1) Not much to report this week. Trying to get my team's work done for EOM 2) Waiting for personnel thing from Shari. 3) Waiting for TB to go out with a tor release in it. It turns out nobody is using the nightlies, so I have no very little user feedback on the most recent 0.2.8 alpha Conclusion: Nick will mail tor-talk and ask people to run them, and report issues, and be aware that they're not on the standard upgrade track. GeKo will open a ticket for "updates" for nightlies (right now they don't do updates). Georg: 1) Switched our nightlies to ESR45. 2) Getting as many things into ESR45 as we can before releasing an alpha next week. 3) Where do we want to have the OSX SDK we need for our OS X builds? Answer: leave it where it currently is and open a ticket in our bug tracker that helps thinking about a different solution. GeKo is doing that. Alison: 1) Community team met yesterday and discussed our user-facing Cloudflare strategy. We agree that multiple approaches will be most successful. Right now we've got three big ideas: mrphs's petition (either officially endorsed by Tor or not, but organized by one of our allied organizations eg EFF), shiro's creative campaign (starting in Berlin, then we hope going elsewhere), and then collecting more unique user stories (using petition platform, twitter, etc, sending to Alison). We will continue to use the hashtag #dontblocktor for all community efforts. 2) Extreme levels of busy have gotten in the way of completing the social contract, but this week Alison will finish her last edits and send them to sysqrb and Lunar, and then it'll go on to the rest of tor-internal for review. 3) Alison and phoul continue to work on the Tor Browser Manual. 4) Still recruiting team members and still need to define scope of the team. CF stuff got in the way this meeting, but hey, people showed up! Isabela: 1) Met with Laura and Steve about our SOI's -- they will send someone to the office in the summer and we will apply their feedback and submit new SOIs in September. 2) Did DRL grant writing training (more or less useful). 3) Worked on OTF full proposal - deadline now is first week of May, but 2/3 of it is done and I will try to finish it asap because I also need to work on DRL Q1 2016 report. 4) Juga finished her work on Trac - she emailed the list about it. Things looks good. 5) DRL implementers meeting was useful for me to understand how they think and their portfolio -- but now I am dead. Karsten: 1) I'm planning to shut down Tor's copy of Globe. Will that make people in this group unhappy for reasons I didn't think of? Conclusion: Let's first create tickets for all Globe features that are missing in Atlas. 2) What's the plan for monthly reports? Should people keep writing them, should teams do that, should we stop writing/requiring monthly reports, ...? Conclusion: A) We no longer pretend to demand monthly reports from individuals. B) We, led by Isabela, continue doing the funder reports for funders. C) We encourage Shari to keep doing her "how to make sure people actually do work" work (since "see if the person mailed tor-reports that month" is a crummy substitute anyway). And D) Nick is going to experiment with doing report-out summaries from the network team meetings, because we do want better answers for how to keep all the teams informed, at the right levels, of what's going on in the other teams. Mike: 1) Finished up the Tor Browser sections of the OTF proposal. I looked over the Tor section, and it may need some more tweaking, along with our need to complete the budget. I am thinking of meeting Isabela next week to help finish that. 2) Still have not heard from Kevin about the blog contract. I am not sure what the holdup is. I will try calling him. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXHw/BAAoJEC3ESO/4X7XBEVUIAIvLQSQT2getabf71sgbdov1 grGuSOk+F5xYolXa3U38jC4b50tDPiHMYV5h85UpRutsNBXTfDkrlLs0y1Jor2cj pUqH5bpM+1PED4MXVu9rBKvJlZlSz7YT1ZUoC4eoCPZ73Kit31JBoDGXHAyWv6tH /G+J2EOrBW2Lyuc+rNCACeUibJqy7lleuZDX3QfoqQEXOfTVye54TY06/Zrcmjqd ijygXcLBKYXFWwdhjzdYv7trGNIYgxBAOXBLYzBVs8Jyl6PM0tfeQ+Re+O9srwWt HHZWxR13X6H7nIoMXAxOAf96rddTqr7KgS0n28Jb/AdL5yH9bUKmqapFLuMO+Go= =FtUM -----END PGP SIGNATURE-----

6 6