- tor-project - lists.torproject.org

Notes from July 7 2016 Vegas team meeting
by Karsten Loesing 11 Jul '16

11 Jul '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for June 30 2016 meeting: Kate: 1) Helping with board-related stuff 2) Responding to media queries 3) Re-writing nontechnical blog posts to be actually nontechnical (with love and affection; they are awesome) 4) Is Congress targeting our funding via the State Department? Wondering if this is a response to the failed Feinstein-Burr bill. https://www.techdirt.com/articles/20160701/18073734878/senate-funding-bill-… (will learn more soon and post something on Tor Internal) - From Politico: ENCRYPTION CONCERNS MOVE TO A NEW BILL — The “going dark” debate has crept into the State Department’s global internet freedom agenda. The fiscal 2017 State-Foreign Ops spending bill approved by the Senate Appropriations panel this week requires State to detail safeguards to keep any spending under the program on “circumvention technology” (which includes encryption) from being used “for illicit purposes, such as coordinating terrorist activities or online sexual exploitation of children.” The bill language mirrors provisions in the House version of the legislation, which that chamber’s Appropriations Committee hasn’t yet approved. Both bills also continue a ban that began in fiscal 2016 on using State or USAID money to establish outside email servers, a swipe at former Secretary of State Hillary Clinton, now the presumptive Democratic presidential nominee. Read more: http://www.politico.com/tipsheets/morning-cybersecurity/2016/07/still-more-… Isabela: 1) Submitted last week the grant we worked with Cass for orfox / tor browser for android 17.7k/6months 2) lots of DRL work (Q2 reports, M&E.. F-indicators organizing... collecting docs for audit) Karsten: 1) Busy coding and reviewing on various metrics-related codebases together with iwakeh. Putting out metrics-lib 1.3.0 this week. Nick: 1) busy as heck with tor stuff 2) at PETS the week after next (17July through 24July). 3) let's make sure we get Seattle meeting right. 4) here comes a new tor release Shari: 1) Seattle TorDev meeting invitees 2) community and corp working together 3) employee stuff 4) board update -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXg3TXAAoJEC3ESO/4X7XBqiAH/1x+htZhspeQ7I+wVep9TkdK 9b26mc9zCB2ErKYMi+5L5TIVFS7PoGka6curEK2BzVN6aFA7gwVicOQnTUti+0T8 1Gzp05pRS6tXUsePqqNG//IbL2OcbM3LNZ3408ReJ4a+s/+/8RzsEzIXaOZO4WNm qfS28k54X4JP9RktU7/g81l6Ao/xqH3m3Lk62FB+07F1y0Z1knr5qf69ArNPGKEf FdrUCTJ/tDVQ9jYgmpFdlVFXyjnyBQzaHjhiQGCwJX+RVtaSvAjcKRZHcrkYjiBo 0TzzGU92ScKJKJeUSueFdYUUfRAwk6gHgat5hCywYw4F1JXS+5+sBuWU8xWWeMY= =rezc -----END PGP SIGNATURE-----

1 0

Notes from June 30 2016 Vegas team meeting
by Karsten Loesing 04 Jul '16

04 Jul '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for June 30 2016 meeting: Georg: 1) How to route money from Mozilla's bug bounty program to Tor? As a donation? As "normal" wire transfer? 2) Moved forward with the Berlin meetup idea 3) Helped a bit with the ISC proposal Kate: 1) Posting blog post about Serene; answering media inquiries about our tech; planning newsletter. 2) CRS has published a report on Rule 41 Nick: 1) Trying to deal with software stuff. That seems to be going well. 2) Not much happening. No need to check in much. Karsten: 1a) MOSS award: does it start on July 1? Isabela and Shari say yes. 1b) do we know when the paperwork will get signed? Isabela expects paper work to start soon. 1c) and most importantly can we have sponsor letter X? Yes, already assigned X. Alison: 1) Community team continues to work on the support manual and have just started work on an attached glossary. We want to get in touch with the folks who made the amazing Twitter support desk and get all their secrets, because Twitter support is amazing. 2) social contract is really nearly done! getting feedback on the preamble/blog text now. soon we'll have to talk about ratifying the thing, and where it will live. 3) membership guidelines are next... 4) a few of us came up with some text for the folks speaking at HOPE to say before their talk, gently acknowledging the elephant in the room, and directing folks to talk about said elephant in a moderated space at another part of the conference. 5) Alison is speaking all over the UK in the next two weeks (London, Brighton, Glasgow) including a Tor talk at the British Library!!!! Isabela: 1) Worked on mobile tor browser proposal to ISC - will submit today after this meeting 2) We have a designer! who simply secure hired and is paying to do our brand guideline - he did mozilla's and has a good track record doing design work. Phil (from ux team) will be reviewing his work. I will send a letter introducing him to tor-project. I was wondering if I could extend the europe pre dev meeting gathering to Elio, Ame and Phil -- they are all in europe and are working with UX team and I hope they will do more projects with us beyond the guidelines. Would be great for them to mingle and meet more tor ppl and for tor ppl to tell them what needs we have. 3) Worked on organizing tasks with the core tor team 4) Hoping to get DRL reports done 5) SIDA is moving and we have a deadline (August 1st) yay! Shari: 1) board meeting today 2) dealing with some personnel issues 3) good news: we received the promise of a grant of $250k from the Media Democracy Fund for general operating expenses -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXemqFAAoJEC3ESO/4X7XBqYgH/0qx10XyPLD7PNfDz6H1iPu2 3Nh9twpIbw200HFmAPmYdIIkrPPm4yOmbSrH1SijEmO6U2w1VN0hVjoqZ8bzIPgO FshyNqNJFAD5T1UeMZ6W/rbaHRZVJ4srkD32oyTr0SIYoFad/adewdFKicEJfvPM NxiCaTTva7zpY3bXXid00B3FquV/LkYaZGwdSZjeIK1o3wiNHnZSSkxECUa+cI5S EZ5378HMropMOYjZ6b3nUAs5XY9X54UIfd3TUrPuWOhAJMHdBV0NIq7IGsnaAPLv acd1wfS6IDS8hkUAQI4tQBDPsKmQZ9V8YoOYDJYSVOQSFJx8FH0ohNQvuShdS2s= =Iqk4 -----END PGP SIGNATURE-----

1 0

(FWD) Plan for dropping urras: starts with dizum, Faravahar, dannenberg
by Roger Dingledine 03 Jul '16

03 Jul '16

Fyi for those wondering about the logistics of rotating directory authorities (and why it is more complicated and more fragile than you may have expected :). --Roger ----- Forwarded message from Roger Dingledine <arma(a)mit.edu> ----- Date: Fri, 1 Jul 2016 13:31:46 -0400 From: Roger Dingledine <arma(a)mit.edu> To: dir-auth(a)lists.torproject.org Subject: Plan for dropping urras: starts with dizum, Faravahar, dannenberg -------------------------------------------------------------------------- We're going to do this in three phases. PHASE ONE: a) dizum, Faravahar, and dannenberg all drop urras from their DirServers lines. There's no need to synchronize here -- just do it as soon as you get around to it, and let us know that you did. PHASE TWO: once all of phase one is done, then moria1, gabelmoo, and longclaw will do a coordinated switch in the same hour. PHASE THREE: maatuska and tor26 will switch whenever they like after that. -------------------------------------------------------------------------- Here are all the details so you can follow along with why I think this will work, and how it can go wrong. Constraint 1: We have nine dir auths currently, and we need five of them to agree in order to get a consensus. Constraint 2: Five of the nine have attached bandwidth authorities, and we need three bwauths to be part of the consensus at all times. Constraint 3: Five of them vote on BadExit, and we need at least one of them in the consensus or we unassign all the BadExit flags. An odd number of voters (one or three) is better than an even number (two). Constraint 4: Three of them vote about recommended versions, and we need at least one of them in the consensus. Constraint 5: Each authority supports a range of consensus methods depending on what Tor version it runs. When constructing a consensus, the authorities choose the largest consensus method supported by more than 2/3 of the voting authorities for that hour. Now that dizum has upgraded to Tor 0.2.8.x, we'll have 9 authorities that can do method 20 and 4 authorities that can do method 22, which means we'll pick method 20 so long as there are at least 6 authorities voting. We should make sure that nobody else upgrades to Tor 0.2.8.x until we've finished, else we could fall into an edge case where we have enough that we pick method 22, but not enough to get five signatures on the resulting consensus. Constraint 6: Tor versions before 0.2.8.1-alpha don't believe in dannenberg's current v3 identity key, and Tor versions before 0.2.4.26 or 0.2.5.11 don't believe in longclaw at all. The dannenberg issue can be solved by having dannenberg resume voting with its legacy v3 identity key (I don't know why it stopped -- maybe it never started?), and the longclaw issue can be solved by declaring that versions that old don't matter to us. With that in mind, here are our nine dir auths, with their properties, grouped into the three phases: dizum no-bwauth method22 faravahar BWauth method20 dannenberg no-bwauth method20 only-believed-by-0.2.8 moria1 BWauth BadExit recommends-versions method22 gabelmoo BWauth BadExit recommends-versions method22 longclaw BWauth BadExit method20 maatuska BWauth BadExit method20 tor26 no-bwauth BadExit recommends-versions method22 urras no-bwauth method21 So once phase one is complete, we should still have six dir auths voting, including four bwauths and five badexit voters and two recommends-versions, and using consensus method 20. Once phase two is complete, we should have six dir auths voting, including four bwauths and three badexit voters and two recommends-versions, and using consensus method 20. The end of phase two will be the most delicate point, since most deployed Tors don't believe in dannenberg's new key, so while we will have six dir auths voting, most clients will consider the resulting consensus to have only five signatures -- so if anybody drops out we will not have enough signatures. Once phase three is complete, we should have eight dir auths voting, including five bwauths and five badexit voters and three recommends-versions, and still using consensus method 20. Whew. Let me know if any of my logic is bad. --Roger ----- End forwarded message -----

1 1

meek-google suspension
by David Fifield 03 Jul '16

03 Jul '16

I managed to get some information on why meek-google got suspended on App Engine. There was a botnet that used Tor and the public meek instance for command communication. They shut it down for that reason. I still haven't gotten any kind of official communication from Google Cloud Platform. I wrote a guide on how people can set up their own personal instance. https://lists.torproject.org/pipermail/tor-talk/2016-June/041699.html I figure the botnet risk is far less this way, without a single central service to freeload off of. Though of course far fewer people will be able to follow these steps than were able to use a default configuration. Because I can't see just setting up a new account under the circumstances, I'm planning to ask the Tor Browser devs to remove the non-functional meek-google option.

4 3

Welcome Elio Qoshi - designer who will help us at the UX team!
by isabela 02 Jul '16

02 Jul '16

Hello there! I would like to send this introduction because you will might see Elio on emails, face to face meetings and on irc. As you might know, last year we start building our UX team by inviting individuals and organizations to join and help us - we had our first f2f meeting in Valencia Dev meeting this year! The first project that came out of it was to work on a style guideline for Tor that will help us define the foundation of new designs we produce. Simply Secure (you might remember Amee at our dev meeting as well) will help us with this project and have done a lot of work preparing for it already, like hiring a designer! They actually hired two because just like when you are coding, is good to have a reviewer, anything done with a second pair of eyes will be done better :) Elio will be the designer working on the Style guidelines and Philip Lammert, from our community and who has also being involved on building up our UX team, will be working with Elio as a design reviewer. A little bit about Elio on his own words: "I have been involved with Design at Mozilla, Fedora, FSFE, I2P and many other projects, so I'm excited to help out with branding at Tor. Really, it's a privilege to work for Tor so I look forward to our time together! You can find more about me on my personal blog https://elioqoshi.me " Say hi to Elio if you see him around on irc o/ Cheers, isabela -- PM at TorProject.org gpg fingerprint = 8F2A F9B6 D4A1 4D03 FDF1 B298 3224 4994 1506 4C7B @isa

2 1

Fwd: New Module Owners for Mobile
by Nathan Freitas 01 Jul '16

01 Jul '16

Changes at Mozilla on the mobile front. ----- Original message ----- From: Mark Finkle <mfinkle(a)mozilla.com> To: "mobile-firefox-dev(a)mozilla.org" <mobile-firefox-dev(a)mozilla.org>, "firefox-dev" <firefox-dev(a)mozilla.org> Subject: New Module Owners for Mobile Date: Fri, 1 Jul 2016 10:27:53 -0400 Today, I am transitioning module ownership of Firefox for Android and Firefox for iOS to Margaret Leibovic and Stefan Arentz, respectively. Margaret and Stefan have been leading the engineering teams on their respective projects for some time. That alone is enough to transition the module ownership, but today is also my last day at Mozilla [1], so I want to make sure nothing is left in limbo for the Mobile teams. Please join me in congratulating and supporting Margaret and Stefan. Finkle [1] http://starkravingfinkle.org/blog/2016/07/leaving-mozilla/ _______________________________________________ mobile-firefox-dev mailing list mobile-firefox-dev(a)mozilla.org https://mail.mozilla.org/listinfo/mobile-firefox-dev

1 0

Re: [tor-project] State of tshirts for volunteers running Tor relays
by Jon Selon 30 Jun '16

30 Jun '16

Hey all! Shari forwarded me the string of emails concerning the tor relay shirts. I would love to take this project on. We do have a small surplus of the relay shirts here at the Seattle office, so if someone could just point me in the right direction I will knock all this out. Where is this list of requests? Is this something I need to subscribe to? Let me know and I'll get this done. Any other information you could provide would also be greatly appreciated. Thanks, Jon

2 2

Monthly summary of various teams
by Nima Fatemi 30 Jun '16

30 Jun '16

With teams expanding in all different directions, it's getting harder and harder to catch up with what each team has been up to. Right now you'd have to sign up for all different mailing lists and show up for all different meetings to catch up with the work each team is doing... and then you wouldn't have any time to do any actual work. Would it make sense to have each team to send a summary of what they've been up to every month, to this list? or tor-reports? whichever that's more appropriate. Cheers, -- Nima 0X58C4B928A3E218F6 | @mrphs "I disapprove of what you say, but I will defend to the death your right to say it" --Evelyn Beatrice Hall

3 2

Summary of meek's costs, May 2016
by David Fifield 30 Jun '16

30 Jun '16

Here's the summary of meek's CDN fees for May 2016. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 January 2015 $464.37 + $669.02 + $0.00 = $1133.39 February 2015 $650.53 + $604.83 + $0.00 = $1255.36 March 2015 $690.29 + $815.68 + $0.00 = $1505.97 April 2015 $886.43 + $785.37 + $0.00 = $1671.80 May 2015 $871.64 + $896.39 + $0.00 = $1768.03 June 2015 $601.83 + $820.00 + $0.00 = $1421.83 July 2015 $732.01 + $837.08 + $0.00 = $1569.09 August 2015 $656.76 + $819.59 + $154.89 = $1631.24 September 2015 $617.08 + $710.75 + $490.58 = $1818.41 October 2015 $672.01 + $110.72 + $300.64 = $1083.37 November 2015 $602.35 + $474.13 + $174.18 = $1250.66 December 2015 $561.29 + $603.27 + $172.60 = $1337.16 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 February 2016 $986.39 + $977.85 + $445.83 = $2410.07 March 2016 $1079.49 + $865.06 + $534.71 = $2479.26 April 2016 $1169.23 + $1074.25 + $508.93 = $2752.41 May 2016 $525.46 + $1097.46 + $513.56 = $2136.48 -- total by CDN $13138.96 + $14661.22 + $3625.02 = $31425.20 grand total https://metrics.torproject.org/userstats-bridge-transport.html?graph=userst… As you can see, the number of users took a hit around May 13, dropping from ≈10,000 to ≈6,000. This was caused by the suspension of meek-google. You can read more about that here: https://lists.torproject.org/pipermail/tor-talk/2016-June/041699.html Reminder that if you configure your own CDN or App Engine account and point it at https://meek.bamsoftware.com/, you will be using a completely unlimited bridge, which will go faster and help save money. == App Engine a.k.a. meek-google == 3068 GB $368.17 3146 instance hours $157.29 https://atlas.torproject.org/#details/88F745840F47CE0C6A4FE61D827950B06F9E4… == Amazon a.k.a. meek-amazon == Asia Pacific (Singapore) 215M requests $258.16 651 GB $90.42 Asia Pacific (Sydney) 7M requests $9.66 54 GB $7.46 Asia Pacific (Tokyo) 1M requests $2.05 17 GB $2.28 EU (Ireland) 249M requests $299.58 1617 GB $127.67 South America (Sao Paulo) 15M requests $34.23 174 GB $40.95 US East (Northern Virginia) 126M requests $126.43 1249 GB $98.10 -- total 616M requests $730.11 3765 GB $366.88 charge for alarms $0.48 https://atlas.torproject.org/#details/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == Zone 1 5262 GB $457.76 Zone 2 404 GB $ 55.80 -- total 5666 GB $513.56 https://atlas.torproject.org/#details/AA033EEB61601B2B7312D89B62AAA23DC3ED8… Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

1 0

Unrecommended old 0.2.4.x and 0.2.5.x versions
by Roger Dingledine 30 Jun '16

30 Jun '16

Hi Peter, Sebastian, I just removed "0.2.4.23,0.2.4.24,0.2.4.25,0.2.5.8-rc,0.2.5.9-rc,0.2.5.10" from the set of Tor versions that moria1 recommends as acceptable. That's mainly because these are versions from before we added longclaw as a directory authority, so especially with dannenberg's rotated key (as of 0.2.8.1-alpha), those versions will have a tougher time believing today's consensus. According to https://packages.debian.org/search?keywords=tor there aren't any supported Debian packages that want to use those versions. I did not check Ubuntu or others. You should consider making this change too. :) Thanks, --Roger

2 1