- tor-project - lists.torproject.org

Notes from May 19 2016 Vegas team meeting
by Karsten Loesing 23 May '16

23 May '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for May 19 2016 meeting: Kate: 1) Update on Rule 41 2) Negotiated with CNN lawyers to remove random, bad video that originally accompanied Isis interview (not a different weird but ok video dominates the page, and they have created a hilarious piece of art of Isis jumping from a US flag to a German flag) 3) Have attempted to talk down a CNBC reporter from Dark Web article; sent statement and referred her to Matt Blaze, Chris Soghoian and EFF 4) Fast.ly meeting 5) Scheduling the next CloudFlare meeting 6) Meeting with volunteer to work on Press Kit 7) Put out Asn’s blog post to reporters 8) We need headshots - photographer at dev meeting? 9) Crazy idea: Tor Security Day! Pick 5 security goals for the group (everyone can PGP easily, everyone has an encrypted hard drive, everyone is on Signal or knows how to use Tails) and then we choose a day where collectively up our infosec as an organization. Remember, the weakest link can affect the strongest links! Georg: 1) We are finalizing Tor Browser 6.0. Planned release date is next Friday (May 27). 2) I worked on our search engine situation (Disconnect is falling back to Bing see: https://trac.torproject.org/projects/tor/ticket/19115) We decided to make sure the fallback in Tor Browser 6.0 is not Bing but DuckDuckGo and that I am writing an email to Disconnect coordinating with them and asking about the search volume of Tor users per day and whether that dropped due to Google results being not available anymore. 3) I read and commented on a draft of the membership document 4) I spent some time thinking about the replacement for our e10s Y2 deliverable. We are planning to do browser independent sandboxing work instead and are currently defining its scope. Nick: 1) Isabela repeatedly saves my team from confusion. Go Isabela! 2) I don't have any banking set up on BoA yet. Should I ping them, or delegate it? 3) Has Shari now got the ability to read svn, decrypt passwords, and share them with Seattleites as appropriate? This is pretty important. I'm not policy-boss, so I shouldn't be password dispenser. Alison: 1) thanks for all your edits on the membership doc! I will incorporate them and send back another draft before it goes to tor-internal@. let's talk about it! 2) the rest of the community docs will follow -- that is, the social contract and the community council guidelines. it may make sense to send these all to tor-internal at the same time, since they refer to each other. 3) community team participation still continues to be an issue. I've been pinging a lot of folks to see if they might want to get involved. most people are pretty busy! 4) LFP has a bunch of cool events coming up -- international librarians conference, some UK dates, ALA, Toronto. thinking of how/if this might be valuable to share with tor-project@. this is why we really need TWN. 5) eager to get on Rule 41 advocacy and training. Shari: 1) DRL coming to visit the Seattle office on June 27-28. This is a standard visit they do to all of their grantees. 2) Meeting with EFF last week - They're going to organize a meeting between us and CloudFlare and may be willing to do an activism campaign if that is unsuccessful. 3) Talked with Giant Rabbit about creating our donation infrastructure. They've sent me a contract. Roger: 1) Still excited about the new Tor blog. Any news? Answer: Mike moved the thread with Kevin forward a bit. 2) FYI: My next 4 months are going to be even messier, logistics-wise and schedule-wise, than the last few months. :( Karsten: 1) Wrote documentation for metrics-lib (Java library to parse Tor descriptors used by Metrics, Onionoo, etc.) and discussed many improvements to developing/building/releasing/running CollecTor (Tor descriptor archive). The medium-term goal is that Metrics doesn't depend as much on a single person anymore. 2) Thought more about funding proposal and started a list of research papers citing Tor Metrics, which already became quite a list (50+ entries). Didn't start with the Metrics calendar or video of calendar just yet. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXQwO4AAoJEC3ESO/4X7XBjykH/Ax48ihz5dlKl+LKXJ6a/blE Q36tP9CjJgoveNpJ10fxoQaKYSLpIJknlk6LQRnNzgw3AOK1nR4jRWxcpcL/tEdB pf4qEdS91FIXRaNdcxVopBy1Kib4m0bXHN08/BALO5jfzaUtSl/hsWnUS1kyNAhK EzzG//B1MQGkG4/krJAqAnfAlh3MUGOF+7qYcdysCfY/Wd60vk4z57aiDUYNZO+Q sMwE1Q13hzKHwApcP1c4uTE+XYfR4leFxily/joSwVUjB53R7xcTnb/c7nwO4sjj a+yjOs5lY1Wy3inDxBPXb++mSpCxGDjKyMczwexEtuI99Wgj/UbrVBHsNhMzfgA= =xio0 -----END PGP SIGNATURE-----

2 1

Support meeting pt2
by Colin Childs 22 May '16

22 May '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi all, It is time for another support meeting! Below is a Doodle[1] link, please indicate which times you are available. If none of the times work for you and you really wanted to attend, please send me an email and I will see about adding a different time slot to the Doodle or look into other ways to include you in the meeting . Thanks! [1]: http://doodle.com/poll/48wzda3yn54nxam9 - -- Colin Childs Tor Project https://www.torproject.org Twitter: @Phoul -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJXO4H8AAoJEJWQHABkmqq5CGUP+wQWxUNY5QqVJksIa/pKPCsC bstBukBOm5TdtfnJ0t/RnEbF3mexBrjipr1ya/z41dKsfEsH5n3/Kq/nzRETMsbM +vzWEgeYWyXNcvRIfbXV1UosU7jGIrmyDoDJWfmMQ9oExEBnXCY+QBpWTxoj0vEZ W6ClPFR0ID9i5+ZRI8SpKhegJDit5mrYwIsampT3VWjIAeJat/onv32VkAlVzxC1 W7dSSioP4n3xZuRfmoOgC/vkepqoBrX1HWZnEer+one9BQchBgQ0lKg0/783Jf6h Mq9A2M112etam/sN+Bna9J6fBLtiRNS9UOXn5+mwOuf/A0q8D6TuFFhaICSecP9Z bBONDr3Ai0FJLsxDO2Li30t1O2sh9syQSDPHeGyyXqEwwKfIx+l132H7ZhI+Xy9p 5/+WIN/jMS9NGzJcszM8Bs3U30C7egsh/JOmwYnaFv3eojdmCjkzQboHxHw6rI6O GbvFKT4O8/0c34Cv8kVMNYhHiWssfna++azPO9mwjmuFaeY0TXPRmLGG48GUs5HF n5STs0aliEUIknXH8KY/a6miO7SS9BboPQ7Cy5wQGx5NTQ/09lv88GphQNMJLoFl GOrpPly43b/2lzNsYS+HfK+H8O8BZjnW5CEMpe/hUNdivvZyFPzPwAAQ5kkEY7b1 vFNzIR8Rii74AEjv7Zw+ =388e -----END PGP SIGNATURE-----

3 3

Summary of meek's costs, April 2016
by David Fifield 20 May '16

20 May '16

Here's the summary of meek's CDN fees for April 2016. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 January 2015 $464.37 + $669.02 + $0.00 = $1133.39 February 2015 $650.53 + $604.83 + $0.00 = $1255.36 March 2015 $690.29 + $815.68 + $0.00 = $1505.97 April 2015 $886.43 + $785.37 + $0.00 = $1671.80 May 2015 $871.64 + $896.39 + $0.00 = $1768.03 June 2015 $601.83 + $820.00 + $0.00 = $1421.83 July 2015 $732.01 + $837.08 + $0.00 = $1569.09 August 2015 $656.76 + $819.59 + $154.89 = $1631.24 September 2015 $617.08 + $710.75 + $490.58 = $1818.41 October 2015 $672.01 + $110.72 + $300.64 = $1083.37 November 2015 $602.35 + $474.13 + $174.18 = $1250.66 December 2015 $561.29 + $603.27 + $172.60 = $1337.16 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 February 2016 $986.39 + $977.85 + $445.83 = $2410.07 March 2016 $1079.49 + $865.06 + $534.71 = $2479.26 April 2016 $1169.23 + $1074.25 + $508.93 = $2752.41 -- total by CDN $12613.50 + $13563.76 + $3111.46 = $29288.72 grand total https://metrics.torproject.org/userstats-bridge-transport.html?graph=userst… The number of users again stayed pretty flat during April 2016 at 10,000. Reminder that if you configure your own CDN or App Engine account and point it at https://meek.bamsoftware.com/, you will be using a completely unlimited bridge, which will go faster and help save money. == App Engine a.k.a. meek-google == Here is how the Google costs broke down: 6942 GB $833.06 6723 instance hours $336.17 https://atlas.torproject.org/#details/88F745840F47CE0C6A4FE61D827950B06F9E4… == Amazon a.k.a. meek-amazon == Asia Pacific (Singapore) 231M requests $278.22 594 GB $84.85 Asia Pacific (Sydney) 3M requests $4.06 17 GB $2.36 Asia Pacific (Tokyo) 881K requests $1.06 5 GB $0.70 EU (Ireland) 256M requests $307.32 2040 GB $161.79 South America (Sao Paulo) 9M requests $20.08 71 GB $16.90 US East (Northern Virginia) 120M requests $120.72 953 GB $75.70 -- total 621M requests $731.46 3683 GB $342.30 charge for alarms $0.50 https://atlas.torproject.org/#details/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == Zone 1 5183 GB $450.88 Zone 2 421 GB $ 58.05 -- total 5603 GB $508.93 https://atlas.torproject.org/#details/AA033EEB61601B2B7312D89B62AAA23DC3ED8… Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

1 0

The Akamai slide Alec posted
by Ian Goldberg 20 May '16

20 May '16

Does anyone know where we can get more information about the stats behind this slide: https://twitter.com/AlecMuffett/status/730773970383982592 The slide says: 1:11,500 non-Tor IPs contained malicious requests 1:380 Tor exit nodes contained malicious requests The way it's worded, it sounds like they're saying "1/11500 of the non-Tor IP addresses we saw sent malicious requests, and 1/380 of the Tor exit node IP addresses we saw sent malicious requests", but I'm finding that hard to believe, since 1/380 of the Tor exit node IP addresses is ~3 IP addresses. It's unlikely that all malicious Tor traffic was confined to 3 exit nodes. (But interesting if true.) Were they perhaps being a little loose and really meant "1/11500 TCP connections coming from non-Tor IP addresses, and 1/380 TCP connections coming from Tor exit nodes, contained malicious requests"? Thanks, - Ian

2 2

dates for Seattle TorDev
by Shari Steele 20 May '16

20 May '16

Hey all. We’ve settled on dates for the next TorDev meeting. It will be in Seattle from September 26-30. We’re working on securing a block of rooms and will send more information soon. Shari

1 0

brief downtime of some services, including mail
by Peter Palfrader 19 May '16

19 May '16

Hey, just a quick heads-up. The friendly people who host some of our hardware have to shuffle things around in their racks. As a result, two of our machines that host a couple of VMs will be down for a few hours starting around 1600Z. Services that will be down include mail, lists, rt, torperf, gettor, translation, compass, jenkins. If all goes well, things should be back a few hours later. Cheers, -- | .''`. ** Debian ** Peter Palfrader | : :' : The universal https://www.palfrader.org/ | `. `' Operating System | `- https://www.debian.org/

1 1

Notes from May 12 2016 Vegas team meeting
by Karsten Loesing 17 May '16

17 May '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 See this posting for context: https://lists.torproject.org/pipermail/tor-project/2016-April/000223.html Notes for May 12 2016 meeting: Mike: 1) I reviewed a bunch of sandboxing tech for Tor Browser. I think I have the outlines of what a sandbox would look like that blocks some/most/all of the information obtained by the FBI exploit (we'll likely do best on Linux and Mac, but can still block proxy bypass on windows). I will be sending that to the Tor Browser team shortly. 2) Got an email from Disconnect. They are working to restore Google searches.. Georg: 1) We worked on getting the ESR45 based Tor Browser into stable shape (there are still things left to do) 2) I worked on our search engine situation (Disconnect does not have Google results anymore) Nick: 1) Doing code review and encouraging others by formal pressures: Till the needs-review tickets of May 10 are reviewed, I'm not reviewing other (non-critical) stuff. [Talking with Isabela about this, and applying structural pressure. It's going fine.] 2) Need to get SVN access to Seattle folks. I need to hear from Shari about whether it's internal or corp+internal. (Is Shari on?). [Outcome: Shari says Jon should have access. So I added him.] 3) Resolved UDRP with help from Peter and Wendy. Put my Google voice # as the contact. Now I am getting 4-5 no-message calls there per day. (I have ringing disabled.) [Outcome: waiting for decision on which phone number should get all the phonespam.] Isabela: 1) Pick up SIDA proposal 2) tomorrow is DRL call I sent an email about it 3) sent a blog post for fact check to Roger and Nick Katie: 1) CloudFlare meeting and next steps 2) FBI exploit hearing happening today in Washington State. Mozilla has requested that it see the exploit first. 3) Isis media and training going well so far :) 4) Rule 41 5) Fastly opportunity Shari: 1) Talking with Duck Duck Go to see if their search engine might be a good way to go for Tor Browser. 2) Talking with Laura Cunningham from DRL to see if I can get a good read on whether they really want TorDev in Valencia in 2017. 3) Jake's back. How can he best engage? Karsten: 1) Reviewed CollecTor patches and discussed design changes with iwakeh. 2) Spent some time writing a possible funding proposal for metrics work. 3) Please read responses to notes posted to tor-project@ and respond if people ask questions about your notes. Alison 1) Still collecting user feedback around CloudFlare stuff. Contacted all of the allies that were on my list, heard from only one, and that one hasn't told me yet if I can share their comments with the group. 2) Reaching out to allied people (journalists, activists, attorneys, etc) to see about getting more varied involvement in the community team 3) Continuing to work on the membership doc, social contract, and support manual here and there in the midst of hectic travel and speaking schedule. -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXOueAAAoJEC3ESO/4X7XBVgcH/09pGr0Pq6zAxPbqPiXML+Su f+ZxDQpftO+QRmWHOR2mzakpudIZIjUBgJkp41zSxfqsbQ2luwG+/bfZZGAdqm0F hDHFNZPJG0pQ0k2fhHNVl3ngsnYrGoMxLukRahgpzEl4hwpFJQUWiWvv0hNhHcIW +zbSSIbVbJJbhH3N4726TmxAzQxQFKCcTaSPtQzwxWcVlgexz2vFVcfEM+TPWfGy AA+ZC+1Pcr4qBB/v25ryK4OM5LWRpXVbkA6wZjuALXWfy+npQEokgHF4E/gRwZj9 SO2gvAFnSbUgTmez0GWVs+sCUgrTz8PihvQnKAkzRwdRqL+0wjDjZllqgE3xK6M= =Jfvw -----END PGP SIGNATURE-----

1 0

Re: [tor-project] Google lifted sanctions on Iran
by Nathan Freitas 16 May '16

16 May '16

On Sat, May 14, 2016, at 04:07 PM, Nima Fatemi wrote: > Good news! Google finally lifted sanctions on Iran. This means Iranians > are no more censored from both ends and can now take advantage of > censorship circumvention techniques like meek-google. Any practical impact on Google Play downloads? I've been seeing those as tracked from Iran for quite awhile now, but perhaps people were still using VPNs? > Heck, I think we can even accept GSoC students from Iran, now. Oh yes, put me down for mentoring that, for sure! +n

1 0

Re: [tor-project] Launching Ethics Guidelines
by isis 16 May '16

16 May '16

Virgil Griffith transcribed 10K bytes: > I accidentally put tor-project@ on the To: field. Sorry about that. A *likely* story. I put tor-project@ back in the To: field. > Although I personally don't consider this content to be dangerous, at > least one person will consider it so, and I'd rather not antagonize > that person. Heh. > I renamed the URL to: [snipped the URL] > Share as you see fit. I'll refrain from stooping to your level, thanks. > -V The above URL to dropbox which Virgil gave me contains extremely detailed logs of user behaviour, including: - timestamp accurate to the second - IP addresses (where only the final octet is scrubbed, reducing the set of possible IPs in question to ~253) - onion service requested - full URI requested - onion service response code > On Thu, May 12, 2016 at 5:43 PM, Virgil Griffith <i(a)virgil.gr> wrote: > > Apparently tor-assistants@ no longer exists? Well, here's the logs. > > Share with whomever you think is appropriate. > > > > ============================================================ > > The earlier dates were on a different hard drive. Here's the oldest > > date I have on hand: Jan 25, 2016. > > > > https://dl.dropboxusercontent.com/u/3308162/2016-01-25.log.gz This file was replaced with a new one, which says the following: > Oops! Didn't mean to post this URL to a public mailing list. My goof. > > I renamed the file and sent the new URL to isis and Matt Finkel. If you > want the data, talk to either of them. I trust each of them to distribute > the data however they see fit. > > In releasing this day's worth of data, my goal is concretize the discussion > of how much de-anonymizing power this data provides. > > I claim two things: > (a) Forbidding any Tor community member from using Google Ads on a > Tor-related website is overbroad. > (b) The de-anonymizing power of onion.link's minimized logs is > substantially less than Google Ads (or equivalent). > > If (a) is not true, reasonable next candidates for banishment include, and > are not limited to: > > * Grams http://grams7enufi7jmdl.onion [onionsite] > * DailyDot http://www.dailydot.com/tags/tor [clearnet] > * DeepDotWeb http://deepdot35Wvmeyd5.onion [double whammy! DeepDotWeb > tracks users on its onionsite *AND* clearnet > https://www.deepdotweb.com/] > > And last I checked these were popular upstanding onionsites. > > Obviously some people will dislike (a). And thus some people will dislike > (b). And that's okay. The community (obviously) doesn't wish to > unanimously approve of every Tor onion-site. The question is whether using > an ad-network is a bannable offense. > > Given (a) is not a bannable offense, and additionally badness(b) < > badness(a). Ergo (b) not a bannable offense. To my knowledge, The Daily Dot has never attempted to sell Tor user data to INTERPOL. > > SHA1: f5eaab44c04e483ffe24c58ec558fdfaefb610b2 > > > > I forthrightly attest that: > > > > (1) these logs are socially very interesting, but not actively dangerous. > > > > (2) these logs are substantially less dangerous than running Google > > ads, which was the alternative. > > > > Rebuttals are welcome on tor-project@ . > > > > If you want to see the minimized logs for a specific day I can do that too. Hmm… I think I've heard the word "minimised" in reference to bulk metadata collection before… -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://fyb.patternsinthevoid.net/isis.txt

2 1

Google lifted sanctions on Iran
by Nima Fatemi 15 May '16

15 May '16

Hey all, Good news! Google finally lifted sanctions on Iran. This means Iranians are no more censored from both ends and can now take advantage of censorship circumvention techniques like meek-google. Heck, I think we can even accept GSoC students from Iran, now. Big kudos to those who worked hard to make this happen. Thought I'd share this news with you. Best, -- Nima 0XC009DB191C92A77B | @mrphs "I disapprove of what you say, but I will defend to the death your right to say it" --Evelyn Beatrice Hall

2 1