- tor-project - lists.torproject.org

Setup Worksheet
by Damian Johnson 12 Jan '16

12 Jan '16

Hi, couple people were curious on irc about the setup instructions I gave Shari so here they are. Might be interesting to have a 'getting started' doc available for non-developers. On the other hand though we don't bring new people on too often. Cheers! -Damian ============================================================ --------------------------------------------------------------------------- 1. Connect to IRC on Adium --------------------------------------------------------------------------- Most important thing is getting you on irc! We want to make sure you're using SSL to prevent trivial wire-tapping and registered with the Nick server. To get started connect to OFTC's SSL endpoint... ircs://irc.oftc.net:6697 Pick a nickname you like, then run... /msg nickserv register [password] [email] To claim your nick when you first connect you'll run... /msg nickserv identify [password] Adium (and later Irssi) can do this for you automatically if configured to do so. At this point you should be on irc so lets get ya on the channels important to you. There's only two... #tor-project - public organizational discussions #tor-internal - private internal channel, ask Damian for the password Other tor channels are... #nottor - off-topic banter #tor - general tor user channel #tor-dev - tor development discussions --------------------------------------------------------------------------- 2. Set up OTR --------------------------------------------------------------------------- Since we've got Adium up anyway lets look into setting up OTR. This provides an encrypted method of chatting with others. https://adium.im/help/pgs/AdvancedFeatures-OTREncryption.html The only real trick to OTR is communicating fingerprints with the people you want to talk to. Usually this is done in person, via a shared secret ('what did we talk about in person last week?'), or some other mechanism to ensure the person on the other end is who you think it is. Once a fingerprint is established it's remembered for next time. --------------------------------------------------------------------------- 3. Set up PGP --------------------------------------------------------------------------- We'll step through the commandline instructions, but there's also GUIs you'll likely find much easier to use... https://ssd.eff.org/en/module/how-use-pgp-mac-os-x Making your key with a revocation certificate just in case it gets compromised... % gpg --gen-key % gpg --output revoke.asc --gen-revoke [key] % gpg --keyserver pgp.mit.edu --send-key [key] Sending an email to someone... % gpg -r 'atagar1(a)gmail.com' -a --encrypt my_reply.txt % cat my_reply.txt.asc The thing you now see on your screen is an encrypted email only that recipient can decrypt. Receiving an email... % gpg --decrypt my_message.txt.asc Signing a document to prove it's from you... % gpg --clearsign my_reply.txt Getting someone's key... Say you get a business card with a pgp fingerprint on it. You can add their key using the following, so you can send them encrypted messages... % gpg --recv-keys 68278CC5DD2D1E85C4E45AD90445B7AB9ABBEEC6 To give this a whirl lets request a tor ldap account. This will give you a @torproject.org email address and, more importantly, access to some of our infrastructure. This is needed so we can set up Irssi another day to get ya a persistent irc connection. Look at the following ticket and do what I did... https://trac.torproject.org/projects/tor/ticket/17353 --------------------------------------------------------------------------- 4. Request access to corporate SVN --------------------------------------------------------------------------- We use an access restricted Subversion server for sensitive documents you'll need access to. To get it run the following... % htdigest -c passwd.corp "Tor Project Corporate SVN" [username you want] % htdigest -c passwd.internal "Tor Project Internal SVN" [username you want] ... and send the content of those two files to Nick in a pgp signed email. --------------------------------------------------------------------------- Follow-up tasks... --------------------------------------------------------------------------- 1a. Swap email to Riseup. 1b. Send me and Roger a notice saying what your new address is. We'll update your email list subscriptions. 2. When you have an ldap account lets meet again to get Irssi going. That'll give you a much better irc setup. 3. Nick suggests the following: confirm you have disk encryption enabled, find a password manager you like, and make sure you have backups (such as OSX's Time Machine).

2 1

Shari on Marketplace
by Kate Krauss 07 Jan '16

07 Jan '16

Hi, Shari has been doing a lot of interviews and getting a lot of positive press for Tor, but I want to point out this piece especially, which is just a great frame for our organization. Marketplace is an influential US public radio show focused on business. <http://www.marketplace.org/shows/marketplace-tech/marketplace-tech-tuesday-…>http://www.marketplace.org/shows/marketplace-tech/marketplace-tech-tuesday-… (starts at 4:00 mark) Onward and upward, Katie -- DONATE TO THE TOR PROJECT Join our first-ever crowdfunding campaign! https://torproject.org/donate Kate Krauss Director of Communications and Public Policy kate(a)torproject.org @TorProject 1-718-864-6647 (works for Signal also) PGP: CC0D 9B42 DE89 D4D0 619B A606 DDEB 3937 7D18 973B

2 1

Distributed teams
by Kate Krauss 05 Jan '16

05 Jan '16

Hi, Here are a few articles I've collected about the special situation of distributed teams--I'm forwarding them in case they are useful to any of us (most of us are on such teams). They are worth a read, though each organization is different; some of these ideas would be great for Tor, while others would be terrible. 1. Work to do in person vs work to do remotely (some of these things we do already): https://modelviewculture.com/pieces/software-in-person by Sumana Harihareswara 2. From 18F, on best practices for distributed teams: https://18f.gsa.gov/2015/10/15/best-practices-for-distributed-teams/ The person I've found who has really thought through the stresses and pressures on remote workers, and what to do about this organizationally is Oktavia Jonsdottir (https://www.irex.org/person/oktavia-jonsdottir) She manages a very large, international, distributed team of people who train human rights activists to use online privacy tools under high risk, pressure, and time zones that span 14 hours (none of this is documented on the web). Her management decisions are based on peer-reviewed research as well as her direct experience as a manager. 3. Finally, this classic--The Tyranny of Structurelessness: http://www.jofreeman.com/joreen/tyranny.htm Sincerely, Kate -- DONATE TO THE TOR PROJECT Join our first-ever crowdfunding campaign! https://torproject.org/donate Kate Krauss Director of Communications and Public Policy kate(a)torproject.org @TorProject 1-718-864-6647 (works for Signal also) PGP: CC0D 9B42 DE89 D4D0 619B A606 DDEB 3937 7D18 973B

1 0

maatuska starts voting BadExit
by Linus Nordberg 31 Dec '15

31 Dec '15

Hi, There are three directory authorities voting BadExit (tor26, gabelmoo and moria1). As announced at the dev meeting in Berlin earlier this year, another dirauth (maatuska) will start voting BadExit. This will happen today or tomorrow. maatuska will start out by voting BadExit exactly like the other three are doing now, including AuthDirBadExitCC sy,ir (see ticket #4923). One effect of this is that three out of four voting dirauths will have to vote BadExit in order for an exit to lose its exit flag. I have high hopes in longclaw will start voting too soon, improving the balance some.

3 2

Fwd: [OTF-Talk] Now Open: Request for Information Security Proposals
by isis 17 Dec '15

17 Dec '15

----- Forwarded message from Dan McDevitt <dan(a)opentechfund.org> ----- > From: Dan McDevitt <dan(a)opentechfund.org> > Subject: [OTF-Talk] Now Open: Request for Information Security Proposals > Date: Mon, 14 Dec 2015 12:53:46 -0500 > Message-ID: <CAOGASDf_aSAaVxLfj-ORUNUfqutxBwqXPxWQmAbnY4DN=Pea3g(a)mail.gmail.com> > To: OTF-Talk <OTF-Talk(a)opentechfund.org> > Delivered-To: <isis+torproject(a)patternsinthevoid.net> > > Hello OTFers, > > OTF is now soliciting Information Security proposals to provide services > and add depth to OTF's Red Team Lab > <https://www.opentech.fund/lab/red-team-lab> and our Rapid Response > <https://www.opentech.fund/requests/rapid-response-fund> and Digital > Integrity <https://www.opentech.fund/fellowships/difp> initiatives. > > The scope of contract is to provide OTF's supported projects, as well as > in-kind projects, with security assessments based on code review, pen > testing and end-point security. > > Anyone, including all security, crypto and/or infrastructure and > organizational security experts, is welcome to submit a bid. > > *For more info and instructions on how to submit a bid, please check out > our announcement here:* > https://www.opentech.fund/article/request-information-security-proposals > > The full RFP can be viewed here > <https://drive.google.com/a/opentechfund.org/file/d/0B6IGLb5RJPkSTzNlVmNRejF…> > . > > Any questions or comments can be sent to Chad Hurley at > chad(a)opentechfund.org. *NOTE*: Do not email your bid or bid ideas to anyone > at OTF or your bid may be disqualified. > > Best, > Dan > > -- > > Dan McDevitt > Communications and Outreach Coordinator > Open Technology Fund > > office: (202) 587-2059 > cell: (610) 955-4778 > www.opentechfund.org > > > Radio Free Asia > 2025 M.Street NW Ste. 300 > Washington, DC 20036 > > -- > This is now the OTF-Talk mailing list (formally OTF-Projects), where past and current OTF supported projects can share information, ask questions, and more. > > You can continue to post monthly reports here or to OTF-Active (the list for currently supported projects) > --- > You received this message because you are subscribed to the Google Groups "OTF-Talk" group. > To unsubscribe from this group and stop receiving emails from it, send an email to OTF-Talk+unsubscribe(a)opentechfund.org. > To post to this group, send email to OTF-Talk(a)opentechfund.org. > To view this discussion on the web visit https://groups.google.com/a/opentechfund.org/d/msgid/OTF-Talk/CAOGASDf_aSAa…. > For more options, visit https://groups.google.com/a/opentechfund.org/d/optout. ----- End forwarded message ----- -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://blog.patternsinthevoid.net/isis.txt

1 0

Fwd: RightsCon Silicon Valley: submission deadline 12/14
by Nima Fatemi 15 Dec '15

15 Dec '15

Are we submitting anything for Rightscon? Now is the time, if we want to :) The deadline is 11:59pm Pacific Time on December 14, 2015. -- Nima -------- Forwarded Message -------- Subject: RightsCon Silicon Valley: Extended submission deadline fast approaching Date: Tue, 8 Dec 2015 18:48:44 +0000 From: Nick Dagostino, Access Now <nickd(a)accessnow.org> Reply-To: Nick Dagostino, Access Now <nickd(a)accessnow.org> To: Nima <nima(a)riseup.net> https://www.rightscon.org/ Dear friends, As someone who has participated in RightsCon (https://rightscon.org/) in the past, we wanted to provide you with the opportunity to help shape (https://rightscon.org/submission) the agenda of the world's leading conference on the future of the internet. Due to popular demand, we've extended our program session submission deadline to Monday, December 14th. That means now is your time to act quickly and help shape the agenda at RightsCon Silicon Valley 2016. You can submit your program session or Demo Room proposal (https://rightscon.org/submission) , and find our special ticket discount policy (https://rightscon.org/tickets) for session organizers and speakers, on our website. Who you're joining: RightsCon speakers to date RightsCon 2016 is shaping up to be better than ever, with some of the world's leading experts on technology and human rights confirmed to speak - including Bruce Schneier (renowned security expert), Nicole Wong (former US Deputy CTO), Salil Shetty (Secretary General of Amnesty International), Mathew Prince (Co-Founder and CEO of CloudFlare), and many more. See here for our complete confirmed speakers list to date! (https://rightscon.org/speakers) For more information on tickets, registration, and more Visit our ticket and event info page (https://rightscon.org/tickets) to find more information about our official venue, or contact me at nickd(a)accessnow.org (mailto:nickd@accessnow.org) with any questions you may have. Looking forward to seeing how your submissions will help shape the RightsCon program! Best wishes, Nick Dagostino, RightsCon Coordinator P.S. The event will take place again in San Francisco (Wednesday, March 30 - Friday, April 1). Be sure to meet Monday’s deadline and don’t forget to grab your early bird tickets here (https://rightscon.org/tickets) ! 2016 Sponsors to date below: https://rightscon.org/sponsors ============================================================ Copyright © 2015 Access, All rights reserved. You are receiving this email because you attended or registered for RightsCon. Our mailing address is: Access PO Box 115 New York, NY 10001 USA

1 1

Money raised at Hackadon in Paris
by Lunar 12 Dec '15

12 Dec '15

Hi! I have been invited to present Tor at the “Hackadon” [1] organized by Without Model [2] this evening. Sarah Gold [3] did an introduction talk were she addressed topics like privacy and control over computers and data, developping free software tools by working closer with users, cooperation between designers and developpers, funding and sustainability. She very recently started a new company called IF to work on these topics. We most likely will have the chance to meet in Valencia. Six different projects working on open culture and tools then had five minutes to pitch what they were up to. After rounds of questions, the audience was invited to distribute money that the organizers had collected between the projects. 620€ were gathered for The Tor Project and several attendees came to me to say how much the appreciate our work. :) [1]: It's a word play as “don” in French means donation, and as the whole sounds close to “hackathon”. [2]: https://hackadon.org/hackadons2015/paris-withoutmodel.html [3]: https://project-if.com/ -- Lunar .''`. lunar(a)debian.org : :Ⓐ : # apt-get install anarchism `. `'` `-

4 3

Kazahstan will setup MITM goverment SSL CA root from 01.01.2016
by Matthew Finkel 03 Dec '15

03 Dec '15

This caught my eye... Looks like there are ~8000 direct users, and 100-200 bridge users now. There aren't many details, and the English version of the press release is a direct Google Translate from the original. I couldn't find the step-by-step guide mentioned, I'm thinking it's accessible after you log in but maybe it's not published yet.

6 6

UX Mailing List Announcement
by Nima Fatemi 28 Nov '15

28 Nov '15

Hello friends, I'm writing this email to let you know we've just created a new mailing list at Tor Project, for discussions about the user experience of various products at Tor. This mailing list was one of the outcomes of our initial UX team meeting on Nov 16th, which took place on #tor-project IRC channel. This list is going to be a place for UX researchers, designers, developers and whoever else who cares about the usability of security software. Please feel free to subscribe and/or invite whoever you think might be interested. https://lists.torproject.org/cgi-bin/mailman/listinfo/ux Sometime next week I will send an email about upcoming meetings and we can work together to see how we can move this team forward, together. Your involvement is strongly encouraged. Best, -- Nima 0XC009DB191C92A77B | @mrphs "I disapprove of what you say, but I will defend to the death your right to say it" --Evelyn Beatrice Hall

1 0

Fwd: Fwd: Tor messenger logo
by Wendy Seltzer 03 Nov '15

03 Nov '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cool: - -------- Forwarded Message -------- Subject: Fwd: Tor messenger logo Date: Sat, 31 Oct 2015 12:28:47 -0700 From: Cory Doctorow <doctorow(a)craphound.com> To: Wendy Seltzer <wendy(a)seltzer.org> FYI - -------- Forwarded Message -------- Subject: Tor messenger logo Date: Sat, 31 Oct 2015 11:47:42 -0700 From: Hugh at EFF <hugh(a)eff.org> To: Cory Doctorow <doctorow(a)craphound.com> Hi, I noticed you had only a low-res version of that lovely logo, so I went ahead and re-did it. Here it is in .png and .svg! Cheers! H. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlY1N2MACgkQuuui10VsrVEfxACfYT1vUtspyDhRqrt2DN8ztrjc pvUAoISyrvwU44BTz9uGQw9MosI4n2CA =Z1ow -----END PGP SIGNATURE-----

6 5