- tor-project - lists.torproject.org

Notes from April 21 2016 Vegas team meeting
by Karsten Loesing 27 Apr '16

27 Apr '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes from Apr 21 2016 meeting: Big takeaways: 1) Eight people in one hour just doesn't fit. We should think about how to be more efficient, how to triage topics, how to arrange for more time for this team, etc. 2) We all raised the topic of Tor Browser security and the recent angles around it; but we didn't get to this topic. Roger: 1) Should each of us add our lines to this notes page ourselves, so we know what we added and have more of a say in what goes out to the tor-project mailing list? Answer: yes. (But we screwed this one up this time, because I should have said "Ok, that means you all write down what we discussed and what we concluded please" but nobody did. Next time maybe!) 2) Should we have an intermediate stage between this pad and tor-project, so more internal people can help vet notes? Answer: no need for this yet, but let's make the notes review period "until Monday" rather than "overnight", so people actually can review it. 3) When will we pick dates for the Seattle dev mtg? Answer from Shari: "It will be one of the last two weeks of September. We won't finalize the dates until we finalize the venue, and we won't finalize the venue until we have an administrative assistant on board to do so. Jon Selon has accepted our offer, and he starts on Monday. Yay! So hopefully we'll be able to nail down these dates soon. See my notes below for info on the February Tor Dev meeting!" 4) Making a donate@ alias for humans, so donations@ can be for machines? Answer: Shari thinks that would be so incredibly awesome! 5) When do we get our admin assistant? Shari says: Monday!!! :) 6) Inviting Kate back to the Vegas team meetings? Answer: yes, let's do it. 7) I've been talking to Isa about getting a project leader for our circumvention side: making the balance right between academic research, implementation, and operation/deployment. Things from last week that still want attention: 8) tor blog contract details (no progress today either) Shari: 1) Isa and I talked with Pepe, who organizes IFF. He was very concerned to hear from Laura at DRL that we were considering the option of uncoupling Tor Dev from IFF and basically promised us the moon if we'd hold Tor Dev at the end of February in Valencia again next year. Conclusion: "If DRL wants us there, we should make it clear to DRL the cost that it presents to us." 2) Please look at the writing sample from grant writer candidate Cass Brewer and let me know next steps. I'd love to get her hired soon, or figure out someone else if necessary. If anyone else wants to join Kate and Isa interviewing her today, let us know. Conclusion: we are all fine with the hire so long as Kate and Isa think it's a good move. 3) Isa and I met with Laura and Steve from DRL about our SOI. They were really quite frank about what they wanted from us, which is mostly a better job of tying our work to their goals. We should probably do that with all proposals. 4) Glad I don't have any more travel for a while. Planning a trip to San Francisco mid-May. Nick: 1) Not much to report this week. Trying to get my team's work done for EOM 2) Waiting for personnel thing from Shari. 3) Waiting for TB to go out with a tor release in it. It turns out nobody is using the nightlies, so I have no very little user feedback on the most recent 0.2.8 alpha Conclusion: Nick will mail tor-talk and ask people to run them, and report issues, and be aware that they're not on the standard upgrade track. GeKo will open a ticket for "updates" for nightlies (right now they don't do updates). Georg: 1) Switched our nightlies to ESR45. 2) Getting as many things into ESR45 as we can before releasing an alpha next week. 3) Where do we want to have the OSX SDK we need for our OS X builds? Answer: leave it where it currently is and open a ticket in our bug tracker that helps thinking about a different solution. GeKo is doing that. Alison: 1) Community team met yesterday and discussed our user-facing Cloudflare strategy. We agree that multiple approaches will be most successful. Right now we've got three big ideas: mrphs's petition (either officially endorsed by Tor or not, but organized by one of our allied organizations eg EFF), shiro's creative campaign (starting in Berlin, then we hope going elsewhere), and then collecting more unique user stories (using petition platform, twitter, etc, sending to Alison). We will continue to use the hashtag #dontblocktor for all community efforts. 2) Extreme levels of busy have gotten in the way of completing the social contract, but this week Alison will finish her last edits and send them to sysqrb and Lunar, and then it'll go on to the rest of tor-internal for review. 3) Alison and phoul continue to work on the Tor Browser Manual. 4) Still recruiting team members and still need to define scope of the team. CF stuff got in the way this meeting, but hey, people showed up! Isabela: 1) Met with Laura and Steve about our SOI's -- they will send someone to the office in the summer and we will apply their feedback and submit new SOIs in September. 2) Did DRL grant writing training (more or less useful). 3) Worked on OTF full proposal - deadline now is first week of May, but 2/3 of it is done and I will try to finish it asap because I also need to work on DRL Q1 2016 report. 4) Juga finished her work on Trac - she emailed the list about it. Things looks good. 5) DRL implementers meeting was useful for me to understand how they think and their portfolio -- but now I am dead. Karsten: 1) I'm planning to shut down Tor's copy of Globe. Will that make people in this group unhappy for reasons I didn't think of? Conclusion: Let's first create tickets for all Globe features that are missing in Atlas. 2) What's the plan for monthly reports? Should people keep writing them, should teams do that, should we stop writing/requiring monthly reports, ...? Conclusion: A) We no longer pretend to demand monthly reports from individuals. B) We, led by Isabela, continue doing the funder reports for funders. C) We encourage Shari to keep doing her "how to make sure people actually do work" work (since "see if the person mailed tor-reports that month" is a crummy substitute anyway). And D) Nick is going to experiment with doing report-out summaries from the network team meetings, because we do want better answers for how to keep all the teams informed, at the right levels, of what's going on in the other teams. Mike: 1) Finished up the Tor Browser sections of the OTF proposal. I looked over the Tor section, and it may need some more tweaking, along with our need to complete the budget. I am thinking of meeting Isabela next week to help finish that. 2) Still have not heard from Kevin about the blog contract. I am not sure what the holdup is. I will try calling him. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXHw/BAAoJEC3ESO/4X7XBEVUIAIvLQSQT2getabf71sgbdov1 grGuSOk+F5xYolXa3U38jC4b50tDPiHMYV5h85UpRutsNBXTfDkrlLs0y1Jor2cj pUqH5bpM+1PED4MXVu9rBKvJlZlSz7YT1ZUoC4eoCPZ73Kit31JBoDGXHAyWv6tH /G+J2EOrBW2Lyuc+rNCACeUibJqy7lleuZDX3QfoqQEXOfTVye54TY06/Zrcmjqd ijygXcLBKYXFWwdhjzdYv7trGNIYgxBAOXBLYzBVs8Jyl6PM0tfeQ+Re+O9srwWt HHZWxR13X6H7nIoMXAxOAf96rddTqr7KgS0n28Jb/AdL5yH9bUKmqapFLuMO+Go= =FtUM -----END PGP SIGNATURE-----

6 6

Summary of meek's costs, March 2016
by David Fifield 25 Apr '16

25 Apr '16

Here's the summary of meek's CDN fees for March 2016. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 January 2015 $464.37 + $669.02 + $0.00 = $1133.39 February 2015 $650.53 + $604.83 + $0.00 = $1255.36 March 2015 $690.29 + $815.68 + $0.00 = $1505.97 April 2015 $886.43 + $785.37 + $0.00 = $1671.80 May 2015 $871.64 + $896.39 + $0.00 = $1768.03 June 2015 $601.83 + $820.00 + $0.00 = $1421.83 July 2015 $732.01 + $837.08 + $0.00 = $1569.09 August 2015 $656.76 + $819.59 + $154.89 = $1631.24 September 2015 $617.08 + $710.75 + $490.58 = $1818.41 October 2015 $672.01 + $110.72 + $300.64 = $1083.37 November 2015 $602.35 + $474.13 + $174.18 = $1250.66 December 2015 $561.29 + $603.27 + $172.60 = $1337.16 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 February 2016 $986.39 + $977.85 + $445.83 = $2410.07 March 2016 $1079.49 + $865.06 + $534.71 = $2479.26 -- total by CDN $11444.27 + $12489.51 + $2602.53 = $26536.31 grand total https://metrics.torproject.org/userstats-bridge-transport.html?graph=userst… The number of users stayed pretty flat during March 2016 at 10,000. Reminder that if you configure your own CDN or App Engine account and point it at https://meek.bamsoftware.com/, you will be using a completely unlimited bridge, which will go faster and help save money. == App Engine a.k.a. meek-google == Here is how the Google costs broke down: 6114 GB $733.72 6915 instance hours $345.77 Compared to the previous month: 5829 GB $699.50 5737 instance hours $286.89 https://atlas.torproject.org/#details/88F745840F47CE0C6A4FE61D827950B06F9E4… == Amazon a.k.a. meek-amazon == Asia Pacific (Singapore) 210M requests $252.14 423 GB $59.93 Asia Pacific (Sydney) 1M requests $2.37 10 GB $1.41 Asia Pacific (Tokyo) 16M requests $19.65 113 GB $14.88 EU (Ireland) 174M requests $209.44 1444 GB $113.87 South America (Sao Paulo) 9M requests $20.62 71 GB $17.00 US East (Northern Virginia) 96M requests $96.98 711 GB $56.29 -- total 509M requests $601.20 2775 GB $263.38 charge for alarms $0.50 https://atlas.torproject.org/#details/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == Zone 1 4991 GB $434.24 Zone 2 728 GB $100.47 -- total 5719 GB $534.71 https://atlas.torproject.org/#details/AA033EEB61601B2B7312D89B62AAA23DC3ED8… Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

1 0

Notes from April 7 2016 Vegas team meeting
by Karsten Loesing 21 Apr '16

21 Apr '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes from Apr 14 2016 meeting: Nick: 1) With Isabela I've been doing new team process stuff, see https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/Release… . We have buy-in from a lot of the team at this point. 2) I made a cert for mikeperry and GeKo to sign TB stuff on OSX. Georg seems to think it works. 3) Sometime this month or so (so, this week) I should renew our wildcard cert. Our existing cert expires May 3. Roger: 1a) https://www.petsymposium.org/2016/stipends.php is up and ready 1b) Mind if we accept $20k of PETS stipend money from Ford, and plan to send out stipends from it? #action: need an opinion from Shari, but I hope yes 2) What's our Plan for internal community vetting of new hires? What's our plan for internal community vetting of Shari's new hires? I heard Shari was going to run them past Isa and kate. That's a good start. Is that enough? Should we want more? Two things from last week that still want attention: 3) tor blog contract details 4) monthly reports? Karsten: 1) Continuing to work with iwakeh on CollecTor and metrics-lib, with most discussions taking place on Trac tickets and wiki pages. 2) Just had a useful session, also with iwakeh, to identify an FAQ for new metrics team members (where do I start? what are processes for everything?). We hope to answer many of those Q's using a small number of guides (contributor's guide, release guide, operator's guide). We have been looking at existing guides, like Google's Java Style Guide, that we'd like to adapt. Everything will go on the wiki. Georg: 1) We make progress on the esr45 transition although we are a bit behind my schedule. Nevertheless the next alpha will be esr45 based 2) We got the OS X signing going it seems and will test with a wider audience in the upcoming alpha Mike: 1. Pinged Kevin about the blog contract to try to get it locked in. No reply :/ 2. Helped Isa a bit with the tor-core 029 ticket triage. Suggested some patterns that worked for Tor Browser (primarily tagging tickets by topic rather than tracking stuff off-bugtracker, which will help with both current proposal tracking/visibility and future proposals). 3. Worked on the OTF proposal with Isabela; Hope to finish the Tor Browser sections by this weekend. 4. Worked with Nick to get a cert for our OSX Tor Browser builds Isabela: 1) meeting Laura w/ Shari this Friday. Hope to hear better news from her. I emailed DRL requesting the follow up phone call they offered in the rejection email. I also pinged Dan to see if he is around, should be good to check in with him as well. 2) Working on OTF proposal, spent yesterday working with Mike on it. I hope to share what I have for Nick to review the deliverables I am writing there -- Nick I will do it before I go to DC, so you can give me your feedback till the weekend and I can continue working on it over the weekend. Mike will follow up with Georg on TBB deliverables as well. Roger I need you to give me names with their contacts to be used as reference. (Roger has done so) 3) Had sponsorT (or PT) meeting on Monday which was good to get a lot of information on what happened the past months and to figure out what to do next. Nima got a game plan to move on and I am follow up with Yawning (currently he is working on obfs5 but will pick up other PT stuff as well). 4) Next week on implementers meetings at DRL till the 20th (Wed). 20th is also the soft deadline for OTF full proposal and deadline for sponsorT report. Alison: 1. Still getting the community team in order but have recruited a few new members. The next meeting is 20 April so I'll be pinging people all week about it. 2. phoul and I have done a lot of work on the support team manual and if I can get my LDAP account approved, he and I will push our changes out together. I anticipate we'll be working on this through next week. 3. Planning to meet with members of the community council next week to go over the draft social contract, which we'll then share with tor-internal for feedback. Probably will do the same with the membership doc. 4. Juris, qbi, I and others will soon write the OTF concept note for Tor relay community capacity building. We've had a series of meetings with the different relay operators, and with their help and Moritz's we've got enough material to write the proposal. The objective here is to give support to relay operators worldwide, and that support includes legal resources, in-person meetings, and so forth. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXEJVMAAoJEC3ESO/4X7XBwzgH/2TUVNV23Q2ujtuj/0u0eSSb npVm5gHZLg7ko+tDixLv4NpAH7ZCFvJYGG7eQP8KMySaSb3KZvcU1Ztx08IJLRqX ElOLY5H+0M8KPEdW9GqCrlQiZUSFk5jlkmjbszV2rdWxjl6lLoVaMaSxkmexK4t/ vi1Y5wwIxj5++USQQkEc6vH8cYgMJtaOts5WmGJpg2XkkFacCcY6shM+bjH47UKQ xYOx5Gmg+rQqxN3aMmdLPqYJZyv5ghOaluyLKXl7ykBqQI/5y/XnkWP4YEh589zw 32J2aEi/mW7Jh8R1jcPacXTp+obht2KANC/aJ2+xnYa6TDuVsnBD51csI0ORguw= =zczi -----END PGP SIGNATURE-----

5 6

Automatic storm.torproject.org accounts for people with @torproject.org addresses
by isis 20 Apr '16

20 Apr '16

Hello all, Asheesh Laroia of the Sandstorm team offered us an API key for Sandstorm Business, which means that there are now some extra features. One of the ones I've already enabled is that anyone who proves control of an @torproject.org email address is able to have a Sandstorm account on https://storm.torproject.org. There are additional features which likely allow us, once the server is moved to official Tor Project infrastructure (rather than a server that I personally maintain), to hook up to Tor's LDAP, which maybe requires a bit of hacking because we have a somewhat odd LDAP setup, but it should allow us to have passphrases for Sandstorm which are controlled in LDAP. This would mean that we don't need to use the "passwordless email login" anymore. Best, -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://fyb.patternsinthevoid.net/isis.txt

1 0

[VISIBLE CHANGE] New plug-ins installed on Trac and reorg of components
by isabela 20 Apr '16

20 Apr '16

Hello Tor, tl;dr; We installed a few new plug-ins to Trac and re-organized the components - please check out and give us feedback or report any issues! I am very happy to announce that we now have new plug-ins on Trac that will hopefully make the life of those who uses it all the time a little bit less painful ;) ==> What plug-ins? Ticket Organisation Improvements: Plug-in: https://trac-hacks.org/wiki/SubcomponentsPlugin This plugin would allow for subcomponents of a component in a way that is still easy to interact with the component as a whole. Ticket Triaging Improvements: Plug-in: https://trac-hacks.org/wiki/DuplicateTicketSearchPlugin Shows a list of possibly matching/related tickets (and their current status) when you're making a new ticket. UI Improvements Plug-in https://trac-hacks.org/wiki/AutocompleteUsersPlugin Autocompletion for CC field (by "real" name and trac username). This should help remove errors where Alice thinks Bob has been CCed (but the trac username that Alice entered was typoed or doesn't exist), and then Alice gets angry that Bob didn't help/comment. Plug-in https://trac-hacks.org/wiki/DefaultCcPlugin Add a default list of people to the CC list for new tickets, based on their component. Should be helpful when a component is commonly worked on by multiple people. ==> Loving it! But what if I have some feedback? We will be collecting feedback over email or here in this pad: https://storm.torproject.org/shared/5L7ynPhbqVIKHuFfiubFgWgsfa3FPluiibmZvPy… Please use this pad especially if you have feedback on how we re-organized the components and named the master ones. If you want to just share over email list is fine. I will be aggregating them in the pad too. ==> Oops! I found a bug! If you find a bug please use Trac to file a ticket! The old 'Service - trac' component - is now under 'Internal Services': https://trac.torproject.org/projects/tor/newticket ==> Who did this? Where this came from? When I started at Tor almost one year ago I wrote this proposal for how we could be using trac to organize our work: https://docs.google.com/document/d/1luDGhBRw2eJxJ4JKlPlF2CCIqMRCFP35NRuM2sc… If you look at it you will that it actually has way more plug-ins than we actually ended up installing. The reason is that I got some great help from Isis who looked at them and gave some suggestion on what to actually use and what to not use. (Thanks Isis!!!) Later, I got a small budget to pay a person to do this gig for us. Which is how Juga got involved :) She was hired to do all the process of getting these goodies there. Once she had things working in a testing environment I sent an email to this list inviting folks to test the plug-ins where I also asked for feedback on the re-org of components, which I got from a few people and since there were no bugs we decided we could move forward with actually getting these changes into production. (thanks juga!! ps: no she is not on this list but I am thanking her anw) We also got amazing help from weasel who stet up the dev environment for juga as well as getting things on production today. (thanks weasel!!) ==> Why it took so long tho? Mostly my fault :( I was too busy to get Juga what she wanted in a good timing -- but better late than never! Ufa! that's it. If you have any technical specific questions I can get them to Juga too. Thanks everyone, hope you enjoy it. Isabela -- PM at TorProject.org gpg fingerprint = 8F2A F9B6 D4A1 4D03 FDF1 B298 3224 4994 1506 4C7B @isa

3 2

irssi and OFTC new cert
by Nima Fatemi 19 Apr '16

19 Apr '16

Hi, Those of you who use irssi to get on IRC and had OFTC cert hardcoded into your client might find this useful. OFTC has just moved to Let's Encrypt. Yay! But that means the old cert isn't valid anymore and if your irssi tries to reconnect, it's going to fail with a warning that the client has failed to verify the cert. You need to edit your irssi config file (~/.irssi/config) and remove the hardcoded ssl_cafile path. After that you need to either close your irssi and reopen it, or do a /reload and then /rmconnect oftc and then /connect oftc. Note that doing a /reload isn't enough. irssi auto reconnect doesn't read the new config. This silliness just ate about half an hour of mine. Thought I'd let others know. Best, -- Nima 0XC009DB191C92A77B | @mrphs "I disapprove of what you say, but I will defend to the death your right to say it" --Evelyn Beatrice Hall

1 0

Re: [tor-project] Notes from April 7 2016 Vegas team meeting
by Nathan Freitas 15 Apr '16

15 Apr '16

On Fri, Apr 15, 2016, at 03:16 AM, Karsten Loesing wrote: > Isabela: > 1) meeting Laura w/ Shari this Friday. Hope to hear better news from > her. I emailed DRL requesting the follow up phone call they offered in > the rejection email. I also pinged Dan to see if he is around, should > be good to check in with him as well. ... > 4) Next week on implementers meetings at DRL till the 20th (Wed). 20th > is also the soft deadline for OTF full proposal and deadline for > sponsorT report. >From my perspective in hindsight, I think neither of the SoIs emphasized mobile enough, based on the previous excitement and interest DRL seemed to express earlier in that area. I think writing a "Funding All Things Mobile Tor" SoI would likely be funded by DRL and/or OTF. We would need to go very big in the vision of supporting both Android and iOS as first tier platforms, including support for community projects like OnionShare and Ricochet. All of the core work on little t-tor, infrastructure, metrics, etc would be supported by this funding, but it is just that instead of starting with those things as end results or outputs, they become highly funded critical dependencies. If Tor Project as an organization isn't prepared to propose such a thing directly, then I am happy to, either as Guardian Project or through a partner like Internews who is currently funding our work on pluggable transports and mobile browsers. All the best, Nathan

2 1

CCP Grey on the Crypto Backdoor
by Tom Ritter 14 Apr '16

14 Apr '16

https://www.youtube.com/watch?v=VPBH1eW28mo CCP Grey makes awesome youtube videos, this one is particularly relevant to us. Might be worth tweeting =) -tom

1 0

Starting a Ph.D. in September
by isis 14 Apr '16

14 Apr '16

Hello, I'm very happy to announce I'll be starting a position as a Ph.D. researcher in Applied Cryptography at the Institute for Computing and Information Sciences of Radboud Universiteit in Nijmegen, starting in September this year. I'll be working with Lejla Batina as my supervisor, and Joan Daemen and Peter Schwabe as advisors. My topic is broadly "make tor's crypto better". More specifically, it's "make tor post-quantum"; beyond that, it could reasonably include working with other cryptographers to design some of the weirder constructions which tor needs, e.g. the 509-byte chained wide-block cipher that Nick's been going on about. The position lasts for four years, but covers only 50% of my time, because my supervisor and I are in full agreement that it would be more beneficial — both to Tor and to my thesis — if the other 50% of my time is spent doing development for Tor. As a non-academic, I feel that this is a somewhat unique opportunity. I've no desire to publish papers just for the sake of publishing something with my name on it — I care about improving Tor. My hope is that this Ph.D. results in the design and implementation of things that we've needed for a while. Best Regards, -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://fyb.patternsinthevoid.net/isis.txt

13 12

Re: [tor-project] Starting a Ph.D. in September
by Nathan Freitas 13 Apr '16

13 Apr '16

On Wed, Apr 13, 2016, at 03:48 PM, isis wrote: > I'm very happy to announce I'll be starting a position as a Ph.D. > researcher > in Applied Cryptography at the Institute for Computing and Information > ♥Ⓐ isis agora lovecruft doctor lovecruft has a nice sound and look to it. Thanks for working to protect the future.

1 0