- tor-project - lists.torproject.org

meek-google suspension
by David Fifield 03 Jul '16

03 Jul '16

I managed to get some information on why meek-google got suspended on App Engine. There was a botnet that used Tor and the public meek instance for command communication. They shut it down for that reason. I still haven't gotten any kind of official communication from Google Cloud Platform. I wrote a guide on how people can set up their own personal instance. https://lists.torproject.org/pipermail/tor-talk/2016-June/041699.html I figure the botnet risk is far less this way, without a single central service to freeload off of. Though of course far fewer people will be able to follow these steps than were able to use a default configuration. Because I can't see just setting up a new account under the circumstances, I'm planning to ask the Tor Browser devs to remove the non-functional meek-google option.

4 3

Welcome Elio Qoshi - designer who will help us at the UX team!
by isabela 02 Jul '16

02 Jul '16

Hello there! I would like to send this introduction because you will might see Elio on emails, face to face meetings and on irc. As you might know, last year we start building our UX team by inviting individuals and organizations to join and help us - we had our first f2f meeting in Valencia Dev meeting this year! The first project that came out of it was to work on a style guideline for Tor that will help us define the foundation of new designs we produce. Simply Secure (you might remember Amee at our dev meeting as well) will help us with this project and have done a lot of work preparing for it already, like hiring a designer! They actually hired two because just like when you are coding, is good to have a reviewer, anything done with a second pair of eyes will be done better :) Elio will be the designer working on the Style guidelines and Philip Lammert, from our community and who has also being involved on building up our UX team, will be working with Elio as a design reviewer. A little bit about Elio on his own words: "I have been involved with Design at Mozilla, Fedora, FSFE, I2P and many other projects, so I'm excited to help out with branding at Tor. Really, it's a privilege to work for Tor so I look forward to our time together! You can find more about me on my personal blog https://elioqoshi.me " Say hi to Elio if you see him around on irc o/ Cheers, isabela -- PM at TorProject.org gpg fingerprint = 8F2A F9B6 D4A1 4D03 FDF1 B298 3224 4994 1506 4C7B @isa

2 1

Fwd: New Module Owners for Mobile
by Nathan Freitas 01 Jul '16

01 Jul '16

Changes at Mozilla on the mobile front. ----- Original message ----- From: Mark Finkle <mfinkle(a)mozilla.com> To: "mobile-firefox-dev(a)mozilla.org" <mobile-firefox-dev(a)mozilla.org>, "firefox-dev" <firefox-dev(a)mozilla.org> Subject: New Module Owners for Mobile Date: Fri, 1 Jul 2016 10:27:53 -0400 Today, I am transitioning module ownership of Firefox for Android and Firefox for iOS to Margaret Leibovic and Stefan Arentz, respectively. Margaret and Stefan have been leading the engineering teams on their respective projects for some time. That alone is enough to transition the module ownership, but today is also my last day at Mozilla [1], so I want to make sure nothing is left in limbo for the Mobile teams. Please join me in congratulating and supporting Margaret and Stefan. Finkle [1] http://starkravingfinkle.org/blog/2016/07/leaving-mozilla/ _______________________________________________ mobile-firefox-dev mailing list mobile-firefox-dev(a)mozilla.org https://mail.mozilla.org/listinfo/mobile-firefox-dev

1 0

Re: [tor-project] State of tshirts for volunteers running Tor relays
by Jon Selon 01 Jul '16

01 Jul '16

Hey all! Shari forwarded me the string of emails concerning the tor relay shirts. I would love to take this project on. We do have a small surplus of the relay shirts here at the Seattle office, so if someone could just point me in the right direction I will knock all this out. Where is this list of requests? Is this something I need to subscribe to? Let me know and I'll get this done. Any other information you could provide would also be greatly appreciated. Thanks, Jon

2 2

Monthly summary of various teams
by Nima Fatemi 01 Jul '16

01 Jul '16

With teams expanding in all different directions, it's getting harder and harder to catch up with what each team has been up to. Right now you'd have to sign up for all different mailing lists and show up for all different meetings to catch up with the work each team is doing... and then you wouldn't have any time to do any actual work. Would it make sense to have each team to send a summary of what they've been up to every month, to this list? or tor-reports? whichever that's more appropriate. Cheers, -- Nima 0X58C4B928A3E218F6 | @mrphs "I disapprove of what you say, but I will defend to the death your right to say it" --Evelyn Beatrice Hall

3 2

Summary of meek's costs, May 2016
by David Fifield 30 Jun '16

30 Jun '16

Here's the summary of meek's CDN fees for May 2016. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 January 2015 $464.37 + $669.02 + $0.00 = $1133.39 February 2015 $650.53 + $604.83 + $0.00 = $1255.36 March 2015 $690.29 + $815.68 + $0.00 = $1505.97 April 2015 $886.43 + $785.37 + $0.00 = $1671.80 May 2015 $871.64 + $896.39 + $0.00 = $1768.03 June 2015 $601.83 + $820.00 + $0.00 = $1421.83 July 2015 $732.01 + $837.08 + $0.00 = $1569.09 August 2015 $656.76 + $819.59 + $154.89 = $1631.24 September 2015 $617.08 + $710.75 + $490.58 = $1818.41 October 2015 $672.01 + $110.72 + $300.64 = $1083.37 November 2015 $602.35 + $474.13 + $174.18 = $1250.66 December 2015 $561.29 + $603.27 + $172.60 = $1337.16 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 February 2016 $986.39 + $977.85 + $445.83 = $2410.07 March 2016 $1079.49 + $865.06 + $534.71 = $2479.26 April 2016 $1169.23 + $1074.25 + $508.93 = $2752.41 May 2016 $525.46 + $1097.46 + $513.56 = $2136.48 -- total by CDN $13138.96 + $14661.22 + $3625.02 = $31425.20 grand total https://metrics.torproject.org/userstats-bridge-transport.html?graph=userst… As you can see, the number of users took a hit around May 13, dropping from ≈10,000 to ≈6,000. This was caused by the suspension of meek-google. You can read more about that here: https://lists.torproject.org/pipermail/tor-talk/2016-June/041699.html Reminder that if you configure your own CDN or App Engine account and point it at https://meek.bamsoftware.com/, you will be using a completely unlimited bridge, which will go faster and help save money. == App Engine a.k.a. meek-google == 3068 GB $368.17 3146 instance hours $157.29 https://atlas.torproject.org/#details/88F745840F47CE0C6A4FE61D827950B06F9E4… == Amazon a.k.a. meek-amazon == Asia Pacific (Singapore) 215M requests $258.16 651 GB $90.42 Asia Pacific (Sydney) 7M requests $9.66 54 GB $7.46 Asia Pacific (Tokyo) 1M requests $2.05 17 GB $2.28 EU (Ireland) 249M requests $299.58 1617 GB $127.67 South America (Sao Paulo) 15M requests $34.23 174 GB $40.95 US East (Northern Virginia) 126M requests $126.43 1249 GB $98.10 -- total 616M requests $730.11 3765 GB $366.88 charge for alarms $0.48 https://atlas.torproject.org/#details/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == Zone 1 5262 GB $457.76 Zone 2 404 GB $ 55.80 -- total 5666 GB $513.56 https://atlas.torproject.org/#details/AA033EEB61601B2B7312D89B62AAA23DC3ED8… Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

1 0

Unrecommended old 0.2.4.x and 0.2.5.x versions
by Roger Dingledine 30 Jun '16

30 Jun '16

Hi Peter, Sebastian, I just removed "0.2.4.23,0.2.4.24,0.2.4.25,0.2.5.8-rc,0.2.5.9-rc,0.2.5.10" from the set of Tor versions that moria1 recommends as acceptable. That's mainly because these are versions from before we added longclaw as a directory authority, so especially with dannenberg's rotated key (as of 0.2.8.1-alpha), those versions will have a tougher time believing today's consensus. According to https://packages.debian.org/search?keywords=tor there aren't any supported Debian packages that want to use those versions. I did not check Ubuntu or others. You should consider making this change too. :) Thanks, --Roger

2 1

Re: [tor-project] Globe is now retired (was: Plan to retire Globe)
by jah 30 Jun '16

30 Jun '16

Hi, Just a reminder that globe is listed as a currently available Onionoo client at https://onionoo.torproject.org/ . jah

2 1

Exit probability
by David Goulet 29 Jun '16

29 Jun '16

Hello everyone! A bit of context. Since November 2015, I've setup a Munin server that graphs some Tor network monitoring. You can have a look here: http://ygzf7uqcusp4ayjs.onion/tor-health/tor-health/index.html This email is about one of those graphs which is the Exit probability in the world. The graph has it per-continent. Here is a link to a graph with the full data since the start of my monitoring: http://ygzf7uqcusp4ayjs.onion/static/dynazoom.html?cgiurl_graph=/munin-cgi/… (Fun fact, the "Unknown" one is the IPpredator relay in "Liberia" ;) https://atlas.torproject.org/#details/BC630CBBB518BE7E9F4E09712AB0269E9DC7D… As you can see, Europe has been very dominant but lately it has grown from ~80% to 85% in the last month. While North America is going down from ~15% to 10%. I could do the exercise of graphing the top 10 countries in Europe that we exit but I _bet_ we'll end up with mostly 3 countries, Germany, France and Netherlands. (I might do this experiment actually.) To be honest, this is something that concerns me because this trend is going up for running Exits in Europe. Maybe it's because of attack on Exit relays in US? Maybe Snowden effect of USA == bad? Maybe hosting providers are too expensive in the North America? Maybe tor-servers/nos-oignons are too effective :)? I honestly don't know but that's not healthy in the long run. Of course having more in Africa and South America for starters would be amazing but that's another fight I feel like. Could we think of some outreach we could do maybe a blog post about the importance of location diversity in Exits? That running relays in the US is actually OK? or maybe just the fact that people have to stop using OVH (well OVH has a data center now in Montreal so NA!) or Hetzner or Linode? Or since Europe as a lot of countries thus multiple jurisdictions it's fine to have 85%? (is it really true with EU laws?) There. Thoughts? Cheers! David

3 2

Plan to retire Globe
by Karsten Loesing 29 Jun '16

29 Jun '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello everyone, as the subject says, I suggest that we retire Globe (currently available at https://globe.torproject.org/) The main reason is that Globe is serving a similar purpose as Atlas (available at https://atlas.torproject.org/) which it was forked from several years ago. Neither Atlas nor Globe are actively developed, they only receive critical bug fixes whenever necessary. And thanks, Philipp and Isis, for doing that! So, when deciding which of the two services we should keep, I looked at the number of daily requests to both services, which shows that Globe is used a lot less than Atlas: https://people.torproject.org/~karsten/volatile/atlas-globe-2016-04-01.png The hope is that retiring Globe could make it more likely that new developers start contributing to Atlas. It would also make it easier for us to add new feature to Atlas, because we wouldn't feel bad for not adding them to Globe, too. In any case, we're getting rid of yet one more thing. Here's a suggested timeline for retiring Globe: - By April 30, we create Trac tickets for all features we like in Globe and that are missing in Atlas. These tickets would go in component "Metrics/Atlas" in Trac. If you want to keep something in Atlas that you like in Globe, this is your chance to make that happen! - By May 15, we'll have reviewed those new tickets and decided which of them we should implement before shutting down Globe. We might send a call for help to tor-dev@ to write these patches. - By May 31 (hopefully), we'll have implemented, reviewed, merged, and deployed the missing features in Atlas, and we'll shut down Globe. We should probably add a static web page pointing to Atlas. If it takes longer than this, it takes longer, but let's use this date for now. Maybe nobody will be missing anything from Globe. We'll see. Suggestions welcome, not only if you strongly object! All the best, Karsten -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXG5afAAoJEC3ESO/4X7XBj/8H/25hssQXL5QuqVbzngTSJ8AF BchTx9l9lAclddyeaug74obAW01+ljO4PZhEZGr12FrTKtlot3PWlQTykkeqCuKh kbVDHgO4U90qSSsVX2aOB9UVlAfvNpk93c5RqdQVwa/1jx6MaMdUM3OFopm9m8ji ceJqizYBrKfL8sI4ksdz84f9u+fwClI2+2H1RMs5PhFG4gIZ/F/ZzVMbkh2ruITC gNl3tWwj46I1CicPQQfYEtaKsA2VckRNo+8N1pfpSKsHBAP6hdGbKQvTkTxRSsrO MFu+kMaF0wkaT58o2IF2FhrQdnq7rns/zAoG+L2ym+7qqEbuaqb/m3wq1jnNp1I= =NDEg -----END PGP SIGNATURE-----

8 17