- tor-project - lists.torproject.org

Fwd: decentralized web summit
by Shari Steele 06 Apr '16

06 Apr '16

Hey all. Brewster Kahle at the Internet Archive is holding a summit about a decentralized web infrastructure. I told him I’d pass this along, in case anyone out there is interested. Shari Begin forwarded message: > From: Brewster Kahle <brewster(a)archive.org> > Subject: decentralized web summit > Date: April 4, 2016 at 10:02:25 PM PDT > To: Shari Steele <shari(a)steeleforest.com> > Cc: Wendy Hanamura <wendy(a)archive.org> > > > shari-- > > we are pulling together a decentralized web summit on June 8th. I am > writing because the idea of building in reader privacy is key, but it is > difficult. > > I wonder if there is a way to build in a tor or tor-like capability into > a decentralized web infrastructure. > > Would you or yours be up for participating? the gathering is just > gaining shape, but it is 2 months away. > > http://www.decentralizedweb.net/ > > -brewster > >

2 1

Joining the community team
by Alison 06 Apr '16

06 Apr '16

Hi all, As the new community team lead, I'm hoping to revive the group and get some new members to join. I'm starting by soliciting participation on this list, though I may also reach out to a few people individually. One of the things we need to work out collectively is the purpose and scope of the team, but generally speaking we'll be working on both internal and external community matters (and defining what is meant by each), developing training materials, organizing training and public interest events, helping with the support team and documentation, gathering user stories, developing internal documents like the social contract, membership docs, etc. We have a wiki [1] and a soon-to-be public mailing list (I'm trying to figure out if it's better to delete old private archives or create a new list. You can join the old list in the meantime)[2]. We will meet today at 1800 UTC in #tor-project. If you're around and want to join us to learn more about the team, please do. Otherwise, community-minded folks can write to me (here or off-list) to talk about joining. Thanks, Alison [1] https://trac.torproject.org/projects/tor/wiki/org/teams/CommunityTeam [2] https://lists.torproject.org/cgi-bin/mailman/admin/tor-community-team

1 0

catching up on the support situation and what's next
by isabela 04 Apr '16

04 Apr '16

Hello! There has been a lot of discussion around user support. During Valencia's Dev Meeting and later in email threads. I have been talking with Colin and I want to help organize a way so everyone can collaborate in building what's next for support. We want to start with and IRCmeeting, for that please submit your vote for a meeting date/time here: http://doodle.com/poll/5dv2mtuiicebecr2 As a preparation to that meeting we would like to ask everyone to read a short report we put together: https://storm.torproject.org/shared/NfLl9mFD0_xZxxz64UEjn0xNhHPw2CpR5snRX6q… First, you will find information aboutuser support during SponsorO. We have also laid out the plan we created once that grant ended and we lost the resources we had, along with a description of what happened with each step of the plan. Finally, forthe'what's next' part of the discussion, there are links to two brain-storming documents. These are not necessarily the plan(s) we will end up going with, but may be a good starting point for determining what the plan should be. We thought that a summary of what hashappenedin the past year or so with user support would be helpful for the discussion. Let us know when is a good time to meet and continue this conversation! Cheers, Isabela& Colin -- PM at TorProject.org gpg fingerprint = 8F2A F9B6 D4A1 4D03 FDF1 B298 3224 4994 1506 4C7B @isa

3 4

Plan to shut down Tor Weather
by Karsten Loesing 04 Apr '16

04 Apr '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi everyone, I'm planning to shut down Tor Weather. For those of you who have not used Tor Weather in the past, here's what it does: Tor Weather is an email notification service that lets users subscribe for notifications related to one or more relays. These notifications can be configured to be sent out when the relay unexpectedly goes down or when it pushes enough traffic to earn its operator a Tor t-shirt. Unfortunately, Tor Weather is broken: - It is not actively maintained, nor is there an active operator running the main instance on weather.torproject.org. If it breaks, we don't have a good plan for fixing it. But since it's not broken yet, nobody is actively working on developing a better Weather. - The t-shirt notifications are misleading. Weather is promising t-shirts for relays that have not been around long enough or that provide too little bandwidth to be useful to the network, and it's almost impossible to deny a t-shirt after Weather has promised it. Also, Weather is likely not offering t-shirts to people who have long earned it, thereby confusing them. - An unreliable notification system is worse than not having a system at all. Relay operators shouldn't rely on Weather to notify them when their relay fails. They should rather set up their own system instead. There are a few possible alternatives to Weather: - We started rewriting Weather using Onionoo as data back-end in 2014 [0]. That project didn't produce working code, but somebody could pick up these efforts and finish the rewrite. - The Roster developers said that they're planning to include an email notification function in Roster [1]. - We developed a simple Python script that provides information about a relay operator's eligibility for acquiring a t-shirt [2]. None of these alternatives is a full replacement of Weather, and I don't think that we should work towards deploying an alternative anytime soon. The best scenario that I can imagine here is that, once Weather is shut down and people realize they really want to have something like it back, the relay operator community gets together and develops a thing or two. Those alternatives wouldn't run on torproject.org, but that seems secondary. I'm thinking about the following timing for shutting down Weather: - By end of month, March 31, we disable Weather's email notification functionality and place a big warning on the homepage that it will be shut down 2 months later. We also blog about this like we did when we shut down Tor Cloud [3]. - By June 30, we take the Weather host offline. Please respond to this list by March 23, which is in 1 week from now, if you strongly object to this plan. All the best, Karsten [0] https://trac.torproject.org/projects/tor/wiki/doc/weather-in-2014 [1] http://www.tor-roster.org/ [2] https://gitweb.torproject.org/metrics-tasks.git/tree/task-9889/tshirt.py [3] https://blog.torproject.org/blog/tor-cloud-service-ending-many-ways-remain-… -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJW6Z0OAAoJEC3ESO/4X7XBn5YIALAyJc+RZH/QWhqvOu3+kHqD D6+iOUxW5/fMfw0PaT1HmZcrpOT6tFU1ActS6k7BkoiJFj3nG4jmL4q63hONn8jk fbjhKxNPJx8fCo0LL7tkliviQWVCOPl9xvj5YmRX0CRTv3vs/gOvoXRwZ8HPR4vK jaSH6LT5nsgbv/9/p3mMCvDlxy8wOMuoxy1hcZPJEPYiB+7ZDXjmO3lR3tTBJUls s4GUfuvl6CkFUmz9TG2S8O7kZl8XnvY0F4/5gk8NcwegouFgdpcTOBCfcVkeBJgD fVW4Uk8f0FQOXWZbA77v4RoUbc91tAGe7H7q01Pja9Ibk6a0icmCceHG/RyFNhI= =9KGV -----END PGP SIGNATURE-----

4 7

Nice Wired article on Autonomy Cubes (Tor relays in museums)
by Kate Krauss 01 Apr '16

01 Apr '16

Hi, Nice article about Trevor's, Jake's, and Leif's work! It's really well written and discusses the tech more clearly and interestingly than I have seen before. The Artist Using Museums to Amplify Tor’s Anonymity Network http://www.wired.com/2016/04/sculpture-lets-museums-amplify-tors-anonymity-… Cheers, Katie ps: For the record, I described Jake as a journalist, artist, and technologist :) -- Kate Krauss Director of Communications and Public Policy kate(a)torproject.org @TorProject 1-718-864-6647 (works for Signal also) PGP: CC0D 9B42 DE89 D4D0 619B A606 DDEB 3937 7D18 973B

2 1

Notes from March 11, 17, 24, and 31 2016 Vegas team meetings
by Karsten Loesing 01 Apr '16

01 Apr '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi everyone, you have probably heard about the Vegas Plan, the team-based structure that we're trying to establish in Tor. If you're unsure what that is, take another look at Roger's recent posting to this list to help Alison get up to speed as new community team lead: https://lists.torproject.org/pipermail/tor-project/2016-March/000196.html What you may not have heard yet is that Vegas team leads started holding weekly IRC meetings to discuss any team-related issues with the other teams. The idea is that team leads bring problems and questions to this meeting and report back answers and relevant discussion results to their respective teams. Today we're also starting to publish notes that we're collaboratively taking at these meetings on this list as a step towards more transparency. These notes are edited lightly in order not to embarrass organizations or people who were not present at the meeting. Bear with us if these notes contain something that might have been said differently in public. We want to avoid censoring these notes too heavily or misguide Vegas team leads towards self-censoring their words at future Vegas team meetings. If you have any questions, please feel free to ask them. All the best, Karsten Notes from March 11 2016 meeting: Shari #1: Job descriptions for office admin and hr person Shari #2: grant proposal for general funding Shari #3: hiring framework Nick #1: i think i need a new time for team meetings Nick #2: work on q1 and 028 stuff, not just on the fun stuff Isabela #1: support situation - Isabela would like to review what happened and see how we can avoid confusions in the future. Also, would like to propose a summary of support work last year so people can understand what has been done in the support/translation front. Also, what is the orientation I should have in relationship to support work right now. Isabela #2: design guidelines - https://storm.torproject.org/shared/Nt4Vf6bsQlYk56gSnfBdMPTdPMhKjKhMvbr3QeI… Roger #1a: need a consensus for how to do user support best. is it writing documentation? better website? relaunching the helpdesk? Roger #1b: In Valencia, we identified that we should have a full-time user support person, to triage our support channels and do support in as scalable a way as possible. We still need that person I think. Roger #2: press team? Should it be moved to Shari's Vegas module? -- make plan for publicizing change in community team lead; Plan: Kate will move into Shari's "org" team. Roger #3: ooni team: what Vegas module should it be in? Metrics? Applications? Its own? Plan: Karsten is going to check in with Arturo periodically, to see if he needs anything, and so there's a person in the Vegas world who is paying attention to it. Roger #4: NSF proposal due EOM, Yawning helps, who else? Roger #5: little-t-tor code/design/etc. audits Karsten: contract for iwakeh working on collector dev Mike: blog $5k, hosting option for $100/mo. Answer is yes, let's do it. Mike will put together a deliverable description, Shari will put together a contract. We should be sure that they understand our privacy hopes for hosting. Roger will plan to be in the loop as we implement the actual plan. - ---------- Notes from March 17 2016 meeting: Shari: no new topics from me Nick #1: it would be good for us to make sure to succeed at paying Yawning for his work. [Isabela is following up with accounting and shari on this / said would do so to Yawning and will keep people updated] (And good to make sure we succeed in commiting to pay yawning for a certain amount of work, even though he hasn't got his company set up yet) Nick #2: wants to talk to Isa, Shari about personnel thing. Nick #3: I still need to bug Mike to get his healthcare info to Sue. Roger #1: execdir@ and press@ and others got busy since we removed the help link from the website contact page. Unclear quite how to address. Roger #2: we need a calendar. (See https://calendar.google.com/calendar/embed?src=dt92shou5q1ooe1kptubhclo4s%4… ) Roger #3: arma is still wearing too many hats. what should he actually do? first step, finish the list with all the things arma is doing; otherwise it is hard for others to come up with particular things they can help with Roger #4: on my very long plane flight last night i sat next to the US ambassador to the UN for human rights. and taught him a lot about privacy tech. if anybody wants to make use of that somehow. Isabela #0: We have a written plan for the helpdesk, it will be ready shortly Isabela #1: We need to keep at the Internews contract. If Nima can't start now, maybe we need to put out a job description and find another person. Or maybe we can get away with not needing a new person at all. Isabela #2: the bugs on tor labs: kevin fixed them. Isabela #3: I sent the design guidelines to folks (ux meeting is next) Karsten #1: can we pay iwakeh? Answer from Shari, yes, send her the contract details. Plan is 8 to 12 hours/wk, for Q2. Karsten #2: OONI and the metrics team are interacting a little bit. They will remain separate dev teams though. Karsten #3: I look forward to announcing the community team change. Georg: we are heading slowly to the esr45 transition. We dealt with an emergency this week due to yet another Firefox update. No help needed from other teams at the moment. Alison #1: Somebody needs to tell me what this vegas team thing is. Roger will send her the original vegas team emails, then Alison #2: Announcing me as new team person? Shari will draft a mail to tor-internal about it today. Alison #3: What's the scope for the community team? Roger mentions outreach, advocacy, trainings. Mike wonders about relay operators. Roger says that we, the vegas team, need to put energy into helping Alison get the right scope. Mike #1: Greatly distracted by latest Firefox update. Mike #2: Still working with Collin et al to make a Cloudflare meeting happen at RightsCon. It looks like it might be falling apart. Mike #3: I will mail Kevin a candidate list of blog deliverables today. (Also, the logging question looks resolvable, since they host things for ACLU, etc.) - ---------- Notes from March 24 2016 meeting: Shari: How should we communicate personnel changes? People who became employees recently, people who were let go recently. Conclusion is Shari should mention it in a mail to tor-internal, either for this specific purpose or in one of her periodic emails. Karsten #1: we need to redo the contract with iwakeh, since it confuses USD and EUR. Karsten #2: which sponsor letter should iwakeh use? Answer: Roger suggests M, but Karsten should check with Sue to be sure she thinks that's ok. Isabela #1: Internews contract (shari to sign and wondering if nima got back about it) Isabela #2: OTF contract for OONI. We should sign it too. Isabela #3: Here's the report on user support from last year: https://storm.torproject.org/shared/vvVKJbRiXovB37OmNWY37Ad8fCh5kOGkfMh6_u1… Isabela #4: https://github.com/simplysecure/tor/blob/master/CreativeBriefforTorProjectS… is scout's draft for a creative brief for design guidelines Isabela #5: It would be great to get Tor stickers to Rightscon. Roger #1: we should juggle people-to-sponsor-letters to start spending down the grants we should spend down. How to proceed? Roger #2: I'm going to be less consistently online from tomorrow through Apr 7. Nick #1: I am deep in Tor 028 and 029 work. Nick #2: The Network Team has a new meeting time. I encourage everybody to drop by. Nick #3: My Nick #2 from last week (personnel thing) remains. Georg: We are making progress on our esr45 transition. Still on schedule. Alison #1: I am now up to speed on the Vegas structure. I'll ask questions as needed. Alison #2: Behold: https://trac.torproject.org/projects/tor/wiki/org/teams/CommunityTeam Alison #3: We had a community team meeting yesterday. Now we have an initial todo list. Alison #4: Once the wiki page is up, and the initial todo list is done, I'll start work on a Roadmap for the team, perhaps starting from https://trac.torproject.org/projects/tor/wiki/org/meetings/2016WinterDevMee… Roger #3: Progress on picking dates for Seattle2016 meeting? - ---- Notes from March 31 2016 meeting: Alison #1: I wrote to the community team mailing list about further developing the wiki, making the list public/deleting the archives, and our agenda for meeting next week which includes talking about the purpose and scope of the team. I haven't heard anything back yet. Alison #2: This week I will start reaching out to folks individually and perhaps en masse on tor-project@tpo to develop team membership. Shari #1: Three job descriptions are done. Two are posted, the third will be posted today. Shari #2: Need Nick and Isa's help on a performance plan Shari #3: Let's get Roger or Nick or Mike to attend the Monday board meeting and summarize the Cloudflare situation. First plan is to get Mike, since he is most involved. Roger #1: Working on NSF proposal, due todayish. Roger #2: Nima and others speak of a "UX team", which is a vibrant group of Tor people who are doing neat things. Yet they have no Vegas interaction. We should think about when to turn them into a first-class Vegas team. In the mean time Isabela is their de facto advocate. Roger #3: The EU Parliament wants a briefing on Wednesday. Unclear if I can make it. Or if Jake can. Roger #4: We should take these vegas notes we have and get them to tor-project. Karsten agrees to take next steps: clean them up, write an intro that explains what's going on. Nick #1: isabela is doing great work at making sure 0.2.9 triage happens, and finding people to help finish SponsorS Q1 stuff. Nick #2: We put out an 028 alpha. Next step there is in mid April, when the next Tor Browser alpha comes out with it. Nick #3: I have some tentative plans with Isa and Shari for getting funded network team people to have more flexibility in what they're supposed to work on (right now too many people are funded to work on too narrow a scope). Nick #4: I recycled the hardware from the cambridge office and am working on getting the hard drives shredded. Isabela #1: Rightscon is this week! Isabela #2: I had a meeting with nima and micah lee on fundraising infra. I'll get notes to Shari soon. Isabela #3: Trying to get sponsorT work organized since we signed the contract with them and they want a retro report in mid april :( Isabela #4: April will be exciting, since it's Q1 reporting month, and also we need to start on the proposals for the next OTR and DRL work. Isabela #5: I'm also presenting in April at DRL. Review on slides would be welcome. Mike #1: I met with the head of trust and security cloudflare yesterday at Access. Mike #2: I'll be meeting with funders-in-this-space on Friday. Mike #3: brave.com wants to know if we want to write an extension for them. Mike #4: Mozilla assigned 2 more engineers to help Dave Huseby merge our patches. We should help them succeed. Mike #5: Tor blog hosting concerns. Matt is checking to see what they can do about the logging situation. Roger asks to make it clear that we want a "pretty good" comment spam handler that is very privacy friendly. Mike #6: I'm still worried that FPF is going to charge forward on the website fingerprinting topic without proper thought to hiring or development process. Georg #1: We will shortly move to ESR45 in our Tor Browser nightlies, and after that in an alpha. (ESR45 will land in a stable in June.) Georg #2: The OS X signing thing exists in the latest nightlies. We should try using it. Georg #3: We took over maintenance of archive.tp.o, but we don't want to do it long term. Karsten: Everything going smoothly. Iwakeh's contract is moving forward. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJW/sMjAAoJEC3ESO/4X7XBtVwH/25VHvDIidUOgC+LPcPTolhi vdJP01odB3pFg6udUNZkF1wMsx2UfmsWwuY7mS2TPrytR2TkuO8KDWLBZY/qdg75 Yq+HVnVFeMh5411jDKqlhyMw60eAGcRuTnhP8SL+KXtGhyLk8UJLBPHzHg83f+FF Ber+0U0K+MUFSzPwWuCFYItTKqjWc5qA5Hzm65SIwtCiEwamTYQ04Ht7SSxNT4uU pQLcL+9Hpab00P0gw92yU58ID/HZ/8HKEZRwgEjcmzBEwqM3rdV6ZWMeSvGXcBxK l9iV1nYkcXs8GcvUlpn2hAybaJX4kBq9z/AJ0+8Wyr/1DTb+WeqHJXIGTZFTS28= =14nu -----END PGP SIGNATURE-----

1 0

Messages for Twitter about Tor blocking?
by David Fifield 30 Mar '16

30 Mar '16

I was invited to go to Twitter and talk about Sheharbano's, Sadia's, Mobin's, Srikanth's, Vern's, Steven's, Damon's, and my research about web sites blocking Tor users: https://www.benthamsgaze.org/2016/02/23/do-you-see-what-i-see/ I'm not a Twitter user, beyond sometimes reading the web interface, so I haven't experienced blocking myself. But I've heard of Tor users being blocked by Twitter. Is there anything you'd like me to say to or ask of them? I know about the #dontblocktor hashtag (which is more often directed at CloudFlare than Twitter); I know that Leif was off Twitter for a while; I know about Marie's survey of users at https://pad.systemli.org/p/twitterdontblocktor. Anything else?

6 6

Technical Innovation grants for the Asia Pacific
by Virgil Griffith 29 Mar '16

29 Mar '16

If you're based in the Asia Pacific, I have some nice grants for you: * http://isif.asia/Grants_TechnicalInnovation * http://isif.asia/ISOC_CybersecGrant * http://www.isif.asia/researchgrant In particular, I think any research about BGP routing in Tor, or otherwise increasing security of BGP or Tor would be lovely research project that I suspect they'd accept. It would also have the side benefit of bringing Asian funders more into the Tor community. -V

1 0

Fwd: Deadline - Call for Papers Toronto - March 31
by Kate Krauss 29 Mar '16

29 Mar '16

FYI-- -------- Forwarded Message -------- Subject: Deadline - Call for Papers Toronto - March 31 Date: Tue, 29 Mar 2016 16:41:56 +0000 (GMT) From: Illena Armstrong | SC Magazine | VP Editorial <info(a)mail.scmagazineus.com> Reply-To: info(a)mail.scmagazineus.com To: kate(a)torproject.org Deadline- March 31 June 1 – 2, 2016 8:15 am - 6:00 pm ** CALL FOR PAPERS Open: January 25, 2016 Closed: March 31, 2016 ------------------------------------------------------------ Are you interested in participating as a presenter/speaker this June at SC Congress Toronto 2016? Do you have any unique insights you can share with the IT security community? After many highly successful years of SC Congress across seven cities (www.sccongress.com ( http://www.sccongress.com/, SC Congress Toronto 2016 – our fifth installment - will feature cutting-edge sessions and must-hear dialogue coming from North America’s thought leaders in IT security – with an audience consisting of up to 1,200 information security and technology professionals and business decision makers from the country’s private and public sectors. SC Congress is an ideal platform for industry luminaries to share their perspectives and experiences with the IT security community around the globe through our live Congress events in seven cities and via webcasts available for download following our events. We love new ideas, or even new ways at looking at old ideas, but what we are not interested in are submissions advocating your organization, product or service. It is also worth noting that we have a finite number of sessions, so willingness to be part of a panel and/or suggestions for the creation of panels greatly improve one’s likelihood of being chosen. The team at SC Congress is seeking practical solutions, advice and suggestions that our delegates can take back and put to work inside their businesses immediately. Only submissions that meet this mission will be considered. Please also be advised that we will not consider standalone vendor sessions for this or any Congress program. If you are a vendor sending in papers, think of a customer, a vendor-neutral analyst or another kind of vendor-neutral practitioner to be a part of your recommended session. Unique, out of the box thinking makes for great content. For ideas on topics that have gained traction in the past, please see SC Congress Toronto 2015’s agenda ( http://www.sccongress.com/toronto/agenda/section/4501/ . Please click this link and fill out the online form to enter a submission. SC CONGRESS TORONTO CALL FOR PAPERS FORM ( https://scmagazineus.wufoo.com/forms/sc-congress-toronto-call-for-papers/ Submission deadline is March 31, 2016 As well, please take care to fill out all fields in your submission. Thank you for your interest in SC Congress Toronto 2016. http://www.scmagazine.com/ ------------------------------------------------------- You are subscribed as kate(a)torproject.org To unsubscribe from promotional messages please click here http://www.pages05.net/haymarketus-scmagazineus/Forms/SCunsubscribe?spMaili… For unsubscribe problems, please reply to this e-mail All SC Magazine promotional emails are sent from the domain "mail.scmagazineus.com". When configuring e-mail or spam filter rules, please use this domain name. © 2016 Haymarket Media Inc 114 West 26th St 4th floor New York, NY 10001

1 0

Future of media and archive.tpo
by Peter Palfrader 28 Mar '16

28 Mar '16

Hey you in the To: line! You are a member of the torarchive or the tormedia unix group. Yet https://trac.torproject.org/projects/tor/wiki/org/operations/Infrastructure lists no maintainer for either archive.torproject.org or media.torproject.org. We will soon have to change the master host for both of these from aroides to some place else. This needs a person or persons who is responsible for the service. If this turns out to be nobody, this will probably mean we have to shut down these services. Please let me know if you think you are the owner of that service. Cheers, -- | .''`. ** Debian ** Peter Palfrader | : :' : The universal https://www.palfrader.org/ | `. `' Operating System | `- https://www.debian.org/

2 1