- tor-project - lists.torproject.org

Ricochet is audited! What next?
by Roger Dingledine 17 Feb '16

17 Feb '16

Hi Special, Tom brought the new pdf to my attention: https://ricochet.im/files/ricochet-ncc-audit-2016-01.pdf First, congrats! Second, I think Tom has a journalist or two that wants to talk to you. I'll let him contact you about that. Third, should we think about things we can do on our side? Like, I could tweet an encouraging thing about how great it is that Tor community projects are getting traction and taking security seriously. We could even imagine something more thorough, like we did for https://blog.torproject.org/blog/isec-partners-conducts-tor-browser-hardeni… with explanations of the future roadmap, mentions that we added Ricochet to the Tor projects list, etc. Let us know how we can best help. --Roger

1 0

Barry Eisler recommending Tor to evade network surveillance
by Griffin Boyce 17 Feb '16

17 Feb '16

Novelist and ex-CIA spy Barry Eisler gave Tor a shout-out in an interview about hacking, surveillance, etc as a promo for his new book. Pretty great =) http://www.amazon.com/dp/B01ACOITJM/ref=pd_va_rv_2 ~Griffin -- “We have to create; it is the only thing louder than destruction.” ~ Andrea Gibson

1 0

HOPE XI - January 11th, CFP opens
by David Goulet 17 Feb '16

17 Feb '16

Hi everyone! On monday, the HOPE conference in NY happening on July 22-24 will open its CFP. I will attend this event for which I think it's a great place to reach hackers, activist, journalist and so on in North America. I know some of you are planning also which is great. But I feel like we should also try to submit a talk there. In the last two (4 years time), there were no Tor talk at all. There are plenty of subject we can talk about but I would also like not to repeat the 32c3 talks (at least not word for word). So, here it is, a thread so we can think about it. Something that could be cool is: "I'm a Tor directory authority and here how that works." or <insert idea>. I'm happy to "coordinate" this CFP effort if we think it's a good idea and we want to do it. So knowing who is going and who is willing to speak would be good :). I offer my service for that but it DOES NOT have to be me necessarly (also the more the merrier). Cheers! David

11 12

Tor Dev Meeting in the Baltic States
by Juris - torservers.net 17 Feb '16

17 Feb '16

Hey all, Jens was lately suggesting Jena (Germany) for the next dev meeting. I think it's a good idea to put another place up for discussion. As some of you know, I'm Latvian, so I'm familiar with the Baltic States. First of all, Latvia has a really fast internet (Top10 worldwide (Akamai)) and reasonable prices for food and living. The Latvian capitol Riga has an international airport, but afaik no direct flights to/from the US (one-stop flights only). Riga has a nice old city and it's not so far to a wonderful beach. It's safe to travel and the people are mostly friendly. Half of my family is living there, so I can offer helping hands, if needed. Another idea is to go to Tallinn (Estonia) which is incredible technologically advanced. Let me know your thoughts. Thanks! Juris

2 2

Tor Weekly News -- February 15th, 2016
by TWN 16 Feb '16

16 Feb '16

======================================================================== Tor Weekly News February 15th, 2016 ======================================================================== After a few-months-long hiatus, we're back with Tor Weekly News, the weekly newsletter that covers what's happening in the Tor community. Contents -------- 1. Tails 2.0 released 2. Tor Browser 5.5.1, 6.0a1, and 6.0a1-hardened released 3. Monthly status reports for January 2016 4. Miscellaneous news 5. Upcoming events Tails 2.0 released ------------------ This is a major version bump (from 1.8.2) covered previously on the Tor Blog [1] and on the Tails site [2]. Here's a quick recap of the new features: it's now based on Debian 8 (from Debian 7), it uses GNOME 3 in "Classic Mode" (previously GNOME 2) [3], it's got the just-released Tor Browser 5.5, they've replaced Claws Mail with Icedove, and there's a fancy new set of installation instructions [4]. Several security issues [5] were found and fixed, so it's important for existing users to upgrade [6] as soon as possible. (As of Feb. 15th, the latest patch version is 2.0.1.) [1]: https://blog.torproject.org/blog/tails-20-out [2]: https://tails.boum.org/news/version_2.0/index.en.html [3]: https://tails.boum.org/doc/first_steps/introduction_to_gnome_and_the_tails_… [4]: https://tails.boum.org/install/ [5]: https://tails.boum.org/security/Numerous_security_holes_in_1.8.2/ [6]: https://tails.boum.org/upgrade/index.en.html Tor Browser 5.5.1, 6.0a1, and 6.0a1-hardened released ----------------------------------------------------- Most users should be following the stable series of Tor Browser, which recently changed from 5.0.x to 5.5.x. 5.5 replaced 5.0.7 on January 27th [7], and the latest patch version as of Feb 15th is 5.5.2 [8]. The biggest new feature is a set of bundled fonts that prevent an adversary from fingerprinting you based on your system fonts. Developers and bug-tolerant users might want to try one of the alpha versions: 6.0a1 [9] or 6.0a1-hardened [10]. (In case you missed it, the Tor Browser Team started releasing the hardened series in November [11]. Firefox is compiled with AddressSanitizer (ASan) [12], and Tor is compiled with both ASan and Undefined Behaviour Sanitizer (UBSan) [13]. These insert a lot of run-time safety checks to make memory corruption bugs harder to exploit, at the cost of increased memory usage, larger binary distributions, and slower performance.) All of these new releases are based on Firefox 38.6.0esr, which includes a few important security fixes [14] to the previous version, so users should update as soon as possible. [7]: https://blog.torproject.org/blog/tor-browser-55-released [8]: https://blog.torproject.org/blog/tor-browser-552-released [9]: https://blog.torproject.org/blog/tor-browser-60a1-released [10]: https://blog.torproject.org/blog/tor-browser-60a1-hardened-released [11]: https://blog.torproject.org/blog/tor-browser-55a4-hardened-released [12]: https://en.wikipedia.org/wiki/AddressSanitizer [13]: http://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer… [14]: https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/#f… Monthly status reports for December 2015 ---------------------------------------- Tor Project members submitted their monthly reports for December. Karsten [15] worked on metrics-lib; Leiah [16] worked on the fundraising campaign graphics; the Tor Browser team [17] worked on six releases; Isabela [18] worked on organizing the Network team, on contracts, and on the fundraising campaign; Georg [19] worked on Tor Browser and wrote a blog post on the reproducible builds workshop in Athens, which he attended; Damian [20] worked on Nyx; Isis [21] gave a cryptography lecture in the Netherlands and worked on BridgeDB; George's SponsorR report [22] and his own report [23] included work on hidden services and a 32c3 talk about them; David [24] also did hidden services work and gave the same 32c3 talk; Arturo [25] reports that the OONI team worked on the Lantern tests and the new API/web-frontend for the collected reports; and Isabela's SponsorU report [26] includes work on ed25519 keys, DoS resilience, and developer documentation. [15]: https://lists.torproject.org/pipermail/tor-reports/2016-January/000964.html [16]: https://lists.torproject.org/pipermail/tor-reports/2016-January/000965.html [17]: https://lists.torproject.org/pipermail/tor-reports/2016-January/000966.html [18]: https://lists.torproject.org/pipermail/tor-reports/2016-January/000967.html [19]: https://lists.torproject.org/pipermail/tor-reports/2016-January/000968.html [20]: https://lists.torproject.org/pipermail/tor-reports/2016-January/000969.html [21]: https://lists.torproject.org/pipermail/tor-reports/2016-January/000970.html [22]: https://lists.torproject.org/pipermail/tor-reports/2016-January/000971.html [23]: https://lists.torproject.org/pipermail/tor-reports/2016-January/000973.html [24]: https://lists.torproject.org/pipermail/tor-reports/2016-January/000972.html [25]: https://lists.torproject.org/pipermail/tor-reports/2016-January/000974.html [26]: https://lists.torproject.org/pipermail/tor-reports/2016-January/000975.html Miscellaneous news ------------------ Mike Perry added [27] a new proposal to the torspec repository [28]. "In order to properly load balance in the presence of padding and non-negligible amounts of directory and hidden service traffic, the load balancing equations in Section 3.8.3 of dir-spec.txt are in need of some modifications." [27]: https://lists.torproject.org/pipermail/tor-dev/2016-January/010181.html [28]: https://gitweb.torproject.org/torspec.git/tree/proposals/265-load-balancing… George asked [29] for code review on proposal 250's shared randomness [30] implementation [31], which will be used in the next-generation hidden services. [29]: https://lists.torproject.org/pipermail/tor-dev/2016-January/010182.html [30]: https://gitweb.torproject.org/torspec.git/tree/proposals/250-commit-reveal-… [31]: https://gitweb.torproject.org/user/dgoulet/tor.git/log/?h=prop250_final_v1 There was a mailing list discussion [32] about the hidden service changes in proposal 246. [32]: https://lists.torproject.org/pipermail/tor-dev/2016-January/010203.html Nick started a discussion [33] about the proposal review system. There followed a few meetings about proposals 241, 247, 250, 251 and 259, and George and Mike posted their notes to the mailing list [34][35][36][37]. [33]: https://lists.torproject.org/pipermail/tor-dev/2016-January/010219.html [34]: https://lists.torproject.org/pipermail/tor-dev/2016-January/010265.html [35]: https://lists.torproject.org/pipermail/tor-dev/2016-January/010279.html [36]: https://lists.torproject.org/pipermail/tor-dev/2016-January/010290.html [37]: https://lists.torproject.org/pipermail/tor-dev/2016-January/010328.html Yawning released [38] obfs4proxy-0.0.6. "There aren't many significant changes, and the internal changes primarily affect the client side initialization, so those of you that are perfectly content with obfs4proxy-0.0.5 can continue to use the existing version without issue." [38]: https://lists.torproject.org/pipermail/tor-dev/2016-January/010308.html Serence, Arlo, and David released [39] Snowflake [40], a webrtc pluggable transport inspired by flashproxy. [39]: https://lists.torproject.org/pipermail/tor-dev/2016-January/010310.html [40]: https://gitweb.torproject.org/pluggable-transports/snowflake.git Nathan announced [41] v15.1.0-RC-4 of Orbot and posted a roadmap [42] for 2016. [41]: https://lists.torproject.org/pipermail/tor-dev/2016-January/010318.html [42]: https://lists.torproject.org/pipermail/tor-dev/2016-January/010185.html ProPublica set up a hidden service version [43] of their website, and Mike Tigas has an article [44] on their motivation and technical details. [43]: http://www.propub3r6espa33w.onion/nerds/item/a-more-secure-and-anonymous-pr… [44]: https://www.propublica.org/nerds/item/a-more-secure-and-anonymous-propublic… George announced [45] the tor-onions(a)lists.torproject.org mailing list [46], for technical discussion about running Tor onion (hidden) services. [45]: https://lists.torproject.org/pipermail/tor-talk/2016-January/040060.html [46]: https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-onions Upcoming events --------------- Feb 17 13:30 UTC | Network Team Meeting | #tor-dev, irc.oftc.net | https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/Meeting… | Feb 18 14:00 UTC | Metrics Team Meeting | #tor-dev, irc.oftc.net | https://trac.torproject.org/projects/tor/wiki/org/teams/MetricsTeam | Feb 26 - Mar 01 | Tor winter dev meeting 2016 | Valencia, Spain | https://trac.torproject.org/projects/tor/wiki/org/meetings/2016WinterDevMee… | Mar 01 - Mar 07 | Internet Freedom Festival | Valencia, Spain | https://internetfreedomfestival.org/ | This issue of Tor Weekly News has been assembled by jl and teor. Want to continue reading TWN? Please help us create this newsletter. We still need more volunteers to watch the Tor community and report important news. Please see the project page [47], write down your name and subscribe to the team mailing list [48] if you want to get involved! [47]: https://trac.torproject.org/projects/tor/wiki/TorWeeklyNews [48]: https://lists.torproject.org/cgi-bin/mailman/listinfo/news-team

3 3

status of bwauths
by Sebastian Hahn 16 Feb '16

16 Feb '16

Hi Tom, I hear you may run a bwauth on Debian jessie, is that correct? If so, which version of the code are you using, and are there tricks to make it work? Cheers Sebastian

2 3

IFF Registration Deadline is Today
by Griffin Boyce 05 Feb '16

05 Feb '16

Hello! For those who would like to attend the Internet Freedom Festival in Valencia, the registration deadline is today. Registering is free, but IFF will stop taking registrations at midnight EST tonight. https://internetfreedomfestival.org/register/ best, Griffin -- “We have to create; it is the only thing louder than destruction.” ~ Andrea Gibson

1 0

GSoC Application
by Damian Johnson 01 Feb '16

01 Feb '16

Bah, seems Google pushed the org application window out a week. Could've sworn it started today, but instead it's 2/8-19. I'll be on vacation 2/5-15 so I might be able to take care of it when I get back but that's cutting it a little close. As mentioned on irc it might be good to have fresh blood take this over. Would anyone care to take over the org admin hat? If not then I'll take care of it when I get back. Cheers! -Damian

1 0

Visiting and speaking at Raboud Universiteit in Nijmegen this week
by isis 01 Feb '16

01 Feb '16

Hello, I'm at Raboud Universiteit in Nijmegen this week, visiting Peter Schwabe and the ICIS cryptography students. Tomorrow I'll be giving a talk to the students to explain what I work on, mostly to introduce myself so that the students can feel more comfortable talking to "the scary gothy hacker girl" about potential research/projects which they might work on on/for Tor. On Friday, I'm very excited to have the opportunity to meet and have dinner with Joan Daemen (one of the creators of the Rijndael alorithm, which is now AES). :D If there's anything I can pass along to folks here, such as project ideas which might be useful to pitch to interested students, or cryptography questions, please let me know! ----- Forwarded message from Peter Schwabe <peter(a)cryptojedi.org> ----- > From: Peter Schwabe <peter(a)cryptojedi.org> > Subject: Visit and talk by Isis Lovecruft (The Tor project) > Date: Sat, 30 Jan 2016 09:02:23 +0100 > To: icis-all(a)cs.ru.nl, kerckhoffs-students(a)science.ru.nl, students(a)true-security.nl > Cc: Isis Lovecruft <isis(a)patternsinthevoid.net> > Delivered-To: <isis(a)patternsinthevoid.net> > > Dear all, > > Next week Isis Lovecruft will be visiting our group. I know Isis from > her work for the Tor project; for those of you who don't know her, her > website is https://www.patternsinthevoid.net/. > > Isis will be around the whole week and will be giving a talk on > > Tuesday, February 2, 15:30, in room HG00.068. > > > Title: "Tor Bridges: Hiding Public Resources from Nation-State > Adversaries" > > Abstract: "After a brief overview of Tor and Tor bridges, I'll talk > about how Tor's circuit-level cryptography allows for loose-source > routing and how that can be used to protect Tor bridges from nation > state adversaries seeking to discover their location. Finally, I'll > briefly cover the design for the new Tor bridge distribution system I'm > currently working on which uses anonymous credentials to monitor Tor > bridge users' behaviour, facilitating allowing well-behaved users to > invite people in their social circle into the bridge distribution > system, as well as causing bad actors to be locked out of the system." > > > Looking forward to seeing many of you there. > > > Cheers and have a nice weekend, > > Peter ----- End forwarded message ----- -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://blog.patternsinthevoid.net/isis.txt

1 0

Meanwhile, at library conferences for coders--
by Kate 28 Jan '16

28 Jan '16

FYI- -------- Forwarded Message -------- Subject: c4l Child Care Options - Register Today Date: Tue, 26 Jan 2016 19:19:16 UT From: code4lib(a)concentra-cms.com Reply-To: code4lib(a)concentra-cms.com To: ailanthus(a)riseup.net Hello Kate Krauss, If you are planning to use the on site childcare during the 2016 Code4lib conference, you will need to sign up by January 31st. The childcare provider we are working with has asked for ample advanced notice to ensure that we secure the right number of childcare staff for each day of the conference. CHILD CARE REGISTRATION: To register please log on at Child Care Registration. For more information about the child care offered at the confernce please visit Childcare at code4lib 2016. Sincerely, Jenn Cummings & Kathy Azevedo 2016 Code4Lib Conference Planners | CONCENTRA – CMS | code4lib(a)concentra-cms.com | www.code4lib.org

5 6