- tor-project - lists.torproject.org

Anti-censorship team meeting notes, 2026-04-23
by meskio 23 Apr '26

23 Apr '26

Hi everyone, Here is our meeting log: https://meetbot.debian.net/tor-meeting/2026/tor-meeting.2026-04-23-16.00.ht… And our meeting pad: Anti-censorship -------------------------------- Next meeting: Thursday, Apr 30 16:00 UTC Facilitator: onyinyang ^^^(See Facilitator Queue at tail) Weekly meetings, every Thursday at 16:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress) This week's Facilitator:meskio == Goal of this meeting == Weekly check-in about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at the Tor Project and Tor community. == Links to Useful documents == * Our anti-censorship roadmap: * Roadmap:https://gitlab.torproject.org/groups/tpo/anti-censorship/-/boards * The anti-censorship team's wiki page: * https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/home * Past meeting notes can be found at: * https://lists.torproject.org/pipermail/tor-project/ * Tickets that need reviews: from projects, we are working on: * All needs review tickets: * https://gitlab.torproject.org/groups/tpo/anti-censorship/-/merge_requests?s… == Announcements == * == Discussion == * How to Integrate UAT with Tor * https://gitlab.torproject.org/41_un/uat * looking at what will be the next steps to get it included in TB * cohosh will review the code * Network Health is working on an anomaly detection system (P183) * https://censorbib.nymity.ch/pdf/Wright2018a.pdf * https://gitlab.torproject.org/tpo/network-health/tor_anomalies * will discuss next week (Apr 30) == Actions == * == Interesting links == * pion/webrtc with boringssl: https://github.com/zshang-oai/webrtc-boringssl * might be an alternative for proxies if snowflake gets censored by DTLS fingerprinting * boringssl is used by chrome == Reading group == * We will discuss "" on * * Questions to ask and goals to have: * What aspects of the paper are questionable? * Are there immediate actions we can take based on this work? * Are there long-term actions we can take based on this work? * * Is there future work that we want to call out in hopes that others will pick it up? * Next in the Reading Group Queue: * == Updates == Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week. Help with: - Something you need help with. cecylia (cohosh): 2026-04-23 Last week: - updated when EventOnCurrentNATTypeDetermined is dispatched (snowflake!706) - tried to deploy broker but caught a nil pointer deref bug (snowflake!708) - continued work on evaluating enumeration attacks on snowflake Next week: - keep following up with fingerprinting in Russia - make proxy-bridge reachability checks robust to bridge outages (snowflake#40504) - more work on letting broker inform proxies how often to poll - have proxies honour the NextPoll message - follow up about running shadow simulations for snowflake performance - revisit conjure integration with lyrebird - take a look at potential snowflake orbot bug - https://github.com/guardianproject/orbot-android/issues/1183 dcf: 2026-04-16 Last week: Next week: - comment on dynamic poll rate adjustment https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… Help with: meskio: 2026-04-23 Last week: - release rdsys with https language selector and scrubbed assignemnts (rdsys#300) - publish assignments log in https://rdsys-backend.torproject.org/assignments (tpa/team#42599) - remove whatasapp code from rdsys as it is not been used - explore including PTs in deb.torproject.org (tpa/team#42591) - project reports - grant planning work Next week: - Shelikhoo: 2026-04-23 Last Week: - [Testing] Unreliable+unordered WebRTC data channel transport for Snowflake rev2 (cont.)( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) testing environment setup/research - Merge request Reviews - [Research] proxy pool overload and potential blocking in Iran ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [Research] Add three NAT type buckets to the snowflake broker ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - Writing Socks5 UDP proxy for nat type simuation Next (working) Week/TODO: - Merge request reviews - [Deployment]Unreliable+unordered WebRTC data channel transport for Snowflake rev2 (cont.)( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) Building custom Tor Browser with patch applied - Vantage point maintaince - [Research] proxy pool overload and potential blocking in Iran ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [Research] Add three NAT type buckets to the snowflake broker ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - Writing Socks5 UDP proxy for nat type simuation\ - WebTunnel Censorship Research onyinyang: 2026-04-23 Last week(s): - Started implementing detection algorithm based on connecting ips in rdsys Next week: - Continue tasks for project #170 Switch back to some of these: As time allows: - Continue work on rdsys#196 - Continue Investigating rdsys#248 i.e., why dysfunctional webtunnel bridges are being distributed - Troubleshooting conjure not connecting in China - waiting for more information from conjure authors/maintainers - Lox still seems to be filling up the disk on the rdsys-test server despite changes made to delete old entries, look into what's going wrong Blog post for conjure: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/conj… - review Tor browser Lox integration https://gitlab.torproject.org/tpo/applications/tor-browser/-/merge_requests… - add TTL cache to lox MR for duplicate responses: https://gitlab.torproject.org/tpo/anti-censorship/lox/-/merge_requests/305 - Work on outstanding milestone issues: - key rotation automation Later: pending decision on abandoning lox wasm in favour of some kind of FFI? https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43096) - add pref to handle timing for pubkey checks in Tor browser - add trusted invitation logic to tor browser integration: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42974 - improve metrics collection/think about how to show Lox is working/valuable - sketch out Lox blog post/usage notes for forum (long term things were discussed at the meeting!): - brainstorming grouping strategies for Lox buckets (of bridges) and gathering context on how types of bridges are distributed/use in practice Question: What makes a bridge usable for a given user, and how can we encode that to best ensure we're getting the most appropriate resources to people? 1. Are there some obvious grouping strategies that we can already consider? e.g., by PT, by bandwidth (lower bandwidth bridges sacrificed to open-invitation buckets?), by locale (to be matched with a requesting user's geoip or something?) 2. Does it make sense to group 3 bridges/bucket, so trusted users have access to 3 bridges (and untrusted users have access to 1)? More? Less? theodorsm: 2026-04-23 Last weeks: - Report bug in collector-rs for the network health team - Researching possible DTLS block in Russia - Implementing DTLS 1.3 in pion Next weeks: - Implementing DTLS 1.3 in pion Help with: - Facilitator Queue: onyinyang cohosh shelikhoo meskio 1. First available staff in the Facilitator Queue will be the facilitator for the meeting 2. After facilitating the meeting, the facilitator will be moved to the tail of the queue -- meskio | https://meskio.net/ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- My contact info: https://meskio.net/crypto.txt -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Nos vamos a Croatan.

1 0

disrupted service: GitLab CI containers failures
by Antoine Beaupré 20 Apr '26

20 Apr '26

Hi, The GitLab Container Registry is refusing requests to GitLab CI pipelines between projects. This started on Friday, when the GitLab 18.11 upgrade was deployed. We are hoping for a quick fix from upstream, but in the meantime, we need your help! Normal GitLab operation should be unaffected. GitLab CI still works, it just fails with images from our own registry when accessed from personal projects. We've found a workaround that requires you to report the failures to us. In [tpo/tpa/team#42595], we ask that you write a new comment with the following information: - source project: failing project (e.g. `group/failing_project`) - registry project: project it is trying to pull from (e.g. `tpo/tpa/base-images`) - example failed job: URL of the failed job [tpo/tpa/team#42595]: https://gitlab.torproject.org/tpo/tpa/team/-/work_items/42595 For example, this was our first report: > - source project: Diziet/arti > - registry project: tpo/tpa/base-images > - example failed job: https://gitlab.torproject.org/Diziet/arti/-/jobs/1485144 You might be able to fix this yourself. If you have access to the "registry project" above, you can manually add the source project to the CI/CD job token allowlist of the registry project", by following: 1. Settings 1. CI/CD 1. Job token permissions 1. add the "source project" to the allowlist You MUST keep track of that exception and remove it once this incident is resolved! Thank you for your attention! -- Antoine Beaupré torproject.org system administration

1 0

gitlab 18.10 upgrade removes "issues"
by Antoine Beaupré 20 Apr '26

20 Apr '26

Hi, Today, we upgraded gitlab.torproject.org to 18.10! Among a couple of interesting new things[1], GitLab introduced a *significant* change in the way "issues" are presented and organized. It was introduced as "the work items list and saved views"[2]. It's an interesting feature! It allows you to see epics alongside issues and create saved searches of your issues, pretty neat. Except. They essentially *removed* the entire "issues" UX. You know how I keep bugging people to "file an issue"? That "new issue" button is gone. Heck, the "issues" button itself is gone. In its place, there is a "work items" button, and *there* you can find your good old issues (and, now, also epics). But, crucially, there's no "Closed" tab anymore, so you can't easily go into closed issues with one click: you need to go through the search form and a couple of clicks to find closed issues. So after consultation (well, really, it was sheer panic) with my colleagues, I found a way to revert this. So you won't yet see this view. If you really want to experiment with it, replace the "issues" string with "work_items" in URLs, that still works. I have filed a comment (like dozens of other GitLab users) objecting to the change, alongside with the instructions for other GitLab administrators to revert this change.[3] It is my hope that the feature can be improved to some maturity (at *least* keep a "closed" tab and a "new issue" button?!) and that eventually we'll be able to switch the feature back on. I can see the point of having a common view for issues and epics, even though it's not a problem I have personally struggled with in GitLab. But at this point, we can't just do that switch. Let me know if there's any other concern here! a. [1] details in https://about.gitlab.com/releases/2026/03/19/gitlab-18-10-released/ [2] https://about.gitlab.com/releases/2026/03/19/gitlab-18-10-released/#introdu… [3] https://gitlab.com/gitlab-org/gitlab/-/work_items/590689#note_3175428478 -- Antoine Beaupré torproject.org system administration

5 8

Anti-censorship team meeting notes, 2026-04-16
by Cecylia Bocovich 17 Apr '26

17 Apr '26

Hi everyone, Here is our meeting log: https://meetbot.debian.net/tor-meeting/2026/tor-meeting.2026-04-16-16.00.ht… And our meeting pad: Anti-censorship -------------------------------- Next meeting: Thursday, Apr 16 16:00 UTC Facilitator:meskio ^^^(See Facilitator Queue at tail) Weekly meetings, every Thursday at 16:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress) This week's Facilitator:shelikhoo == Goal of this meeting == Weekly check-in about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at the Tor Project and Tor community. == Links to Useful documents == Our anti-censorship roadmap: Roadmap:https://gitlab.torproject.org/groups/tpo/anti-censorship/-/boards The anti-censorship team's wiki page: https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/home Past meeting notes can be found at: https://lists.torproject.org/pipermail/tor-project/ Tickets that need reviews: from projects, we are working on: All needs review tickets: https://gitlab.torproject.org/groups/tpo/anti-censorship/-/merge_requests?s… == Announcements == == Discussion == Draft short paper about using fountain codes for rendezvous, comments welcome https://repo.or.cz/erasure-code-rendezvous.git/blob_plain/5b4b5d1cc188cdc12… https://repo.or.cz/erasure-code-rendezvous.git/tree/5b4b5d1cc188cdc12adf1f4… Recent snowflake proxy updates for DTLS fingerprinting (randomizemimic by default) https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… We haven't reached out to operators yet cohosh offers to send a tor-relays email The snowflake default bridge lines in Tor Browser were updated with a new set of STUN servers == Actions == == Interesting links == == Reading group == We will discuss "" on Questions to ask and goals to have: What aspects of the paper are questionable? Are there immediate actions we can take based on this work? Are there long-term actions we can take based on this work? Is there future work that we want to call out in hopes that others will pick it up? Next in the Reading Group Queue: == Updates == Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week. Help with: - Something you need help with. cecylia (cohosh): 2026-04-16 Last week: - added bloco to KnownProxyTypes for broker metrics (snowflake#40534) - implemented a way to manually update poll intervals without restart (snowflake!701) - responded to IPtProxy issue to expose GetCurrentNATType for the snowflake proxy (snowflake#40536) - https://github.com/tladesignz/IPtProxy/issues/86 - worked on proxy fairness proposal writeup Next week: - keep following up with fingerprinting in Russia - make proxy-bridge reachability checks robust to bridge outages (snowflake#40504) - more work on letting broker inform proxies how often to poll - have proxies honour the NextPoll message - follow up about running shadow simulations for snowflake performance - revisit conjure integration with lyrebird - take a look at potential snowflake orbot bug - https://github.com/guardianproject/orbot-android/issues/1183 dcf: 2026-04-16 Last week: Next week: - comment on dynamic poll rate adjustment https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… Help with: meskio: 2026-03-26 Last week: - split translation strings in the telegram distributor to make it easier to translate (rdsys#299) - stop sharing windows7 TB in Telegram gettor, as there is no releases anymore (onionsproutsbot#77) - assignments log scrambled on our side (rdsys!638) - grant work Next week: - give it a try to gorelease to produce debian packages Shelikhoo: 2026-04-16 Last Week: - [Testing] Unreliable+unordered WebRTC data channel transport for Snowflake rev2 (cont.)( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) testing environment setup/research - Merge request Reviews - [Research] proxy pool overload and potential blocking in Iran ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [Research] Add three NAT type buckets to the snowflake broker ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - Writing Socks5 UDP proxy for nat type simuation - [Done] Update Snowflake STUN servers at Tor browser ( https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/merge_re… ) Next (working) Week/TODO: - Merge request reviews - [Deployment]Unreliable+unordered WebRTC data channel transport for Snowflake rev2 (cont.)( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) Building custom Tor Browser with patch applied - Vantage point maintaince - [Research] proxy pool overload and potential blocking in Iran ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [Research] Add three NAT type buckets to the snowflake broker ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - Writing Socks5 UDP proxy for nat type simuation onyinyang: 2026-04-09 Last week(s): - Started background work for project #170 Next week: - Start on tasks for project #170 Switch back to some of these: As time allows: - Continue work on rdsys#196 - Continue Investigating rdsys#248 i.e., why dysfunctional webtunnel bridges are being distributed - Troubleshooting conjure not connecting in China - waiting for more information from conjure authors/maintainers - Lox still seems to be filling up the disk on the rdsys-test server despite changes made to delete old entries, look into what's going wrong Blog post for conjure: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/conj… - review Tor browser Lox integration https://gitlab.torproject.org/tpo/applications/tor-browser/-/merge_requests… - add TTL cache to lox MR for duplicate responses: https://gitlab.torproject.org/tpo/anti-censorship/lox/-/merge_requests/305 - Work on outstanding milestone issues: - key rotation automation Later: pending decision on abandoning lox wasm in favour of some kind of FFI? https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43096) - add pref to handle timing for pubkey checks in Tor browser - add trusted invitation logic to tor browser integration: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42974 - improve metrics collection/think about how to show Lox is working/valuable - sketch out Lox blog post/usage notes for forum (long term things were discussed at the meeting!): - brainstorming grouping strategies for Lox buckets (of bridges) and gathering context on how types of bridges are distributed/use in practice Question: What makes a bridge usable for a given user, and how can we encode that to best ensure we're getting the most appropriate resources to people? 1. Are there some obvious grouping strategies that we can already consider? e.g., by PT, by bandwidth (lower bandwidth bridges sacrificed to open-invitation buckets?), by locale (to be matched with a requesting user's geoip or something?) 2. Does it make sense to group 3 bridges/bucket, so trusted users have access to 3 bridges (and untrusted users have access to 1)? More? Less? theodorsm: 2026-04-16 Last weeks: - MR fixing silent errors of fingerprint parse failure in covert-dtls: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - Researching possible DTLS blocking in Russia - Implementing DTLS 1.3 in pion Next weeks: - Implementing DTLS 1.3 in pion Help with: - Facilitator Queue: meskio onyinyang cohosh shelikhoo 1. First available staff in the Facilitator Queue will be the facilitator for the meeting 2. After facilitating the meeting, the facilitator will be moved to the tail of the queue

1 0

User Support Report for March 2026
by ebanam 11 Apr '26

11 Apr '26

Hello everyone, This is the report from user support team for the month of March 2026. Note: (↑), (↓) and (-) are indicating if the number of tickets we received for these topics have been increasing, decreasing or have been the same from the previous month respectively. - Summary of updates from user support - General user support - Farsi-speaking user support - Russian-speaking user support - Frontdesk (email user support channel) - Telegram, WhatsApp and Signal user support channels - Highlights from the Tor Forum - Highlights from Google Play Store # Summary of updates from user support ## General user support * 486 tickets in total (↓110 as compared to February) * 319 tickets on Email * 118 tickets on Telegram * 24 tickets on Signal * 25 tickets on WhatsApp * With Tor Browser 15.0.7 release, a potential fix was shipped for the long-time persisting issue about the [Tor daemon failing in the background][] when using Tor Browser for Android. After a month of reviewing Google Play Store reviews and comments and monitoring our user support channels, I am happy to report the issue seems to have been fixed \o/. * With Tor VPN beta now available to download from F-Droid App Store, we updated the documentation with instructions to [download and install][], update and uninstall the app from F-Droid. * Tor Browser has dropped support for [legacy operating systems]. We updated the documentation to reflect this update. [Tor daemon failing in the background]: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42714 [download and install]: https://support.torproject.org/tor-vpn/getting-started/download-and-install/ [legacy operating system]: https://support.torproject.org/tor-browser/security/legacy-os/ ## Farsi-speaking user support * 33 tickets in total (↓75 as compared to February) * 7 tickets on Email * 26 tickets on Telegram * In March, users in Iran have been experiencing a near-total shutdown. As per reports, only a handful number of whitelisted services remain accessible and most common censorship circumvention tools are no longer working reliably. For users who managed to reach out to us on our support channels, we have been suggesting [dnstt][] (DNS tunneling) with Tor. Information about it is being shared through the [@GetDnsttBot on Telegram][], along with instructions on how to use dnstt with Orbot and Tor Browser. * As per a [survey] conducted via Telegram in Farsi for internet users in Iran, with about 13,400 responses, 12% of the respondents mentioned they were able to access the internet using dnstt. [dnstt]: https://dnstt.network/ [@GetdnsttBot on Telegram]: https://t.me/getdnsttbot [survey]: https://gitlab.torproject.org/tpo/anti-censorship/censorship-analysis/-/iss… ## Russian-speaking user support * 709 tickets in total (↓179 as compared to February) * 176 tickets on Email (↑19) * 518 tickets on Telegram (↓207) * 7 tickets on WhatsApp (↑1) * 8 tickets on Signal (↑8) * As a result of Russia blocking Telegram since the mid of March, the number of tickets we received over our user support channel on Telegram has dropped significantly. In the meantime, as a reminder for our users that we have [support channels][] reachable over email and other mediums, we posted updates reflecting that on our Telegram channels [in English][] as well as [in Russian][] respectively. We are already noticing a surge in the number tickets over email from Russian-speaking users. [support channels]: https://support.torproject.org/ru/get-in-touch/user-support/ [in English]: https://t.me/torproject/53 [in Russian]: https://t.me/torproject/55 # Frontdesk (email user support channel) * 485(-) RT tickets created * 502(↓) RT tickets resolved Tickets by topics and numbers: 1. 176(↑) tickets: circumventing censorship in Russian speaking countries. 2. 170(↓) tickets: instructions to circumvent censorship for Chinese speaking users. 3. 61(↓) tickets: help with troubleshooting existing Tor Browser install on Desktop (Windows, macOS and Linux). 4. 17(↑) tickets: help with troubleshooting Tor VPN beta. 5. 13() tickets: circumventing censorship with Tor in Farsi. 6. 9(↓) tickets: reports of fake apps on iOS AppStore masquerading as official Tor Browser 7. 5(↑) tickets: questions about which Tor app to install on iOS (i.e. Onion Browser or Orbot). 8. 5(↓) tickets: report of websites blocking Tor connections or not performing well in Tor Browser. 9. 5(↑) tickets: help with using bridges with Tor VPN Beta. 10. 4(↑) tickets: question about contributing to Tor. 11. 4(↑) tickets: help with using bridges with Tails. 12. 2(↑) tickets: can't use Tor VPN when Private DNS is configured on Android's Network settings. 13. 2(↓) tickets: help with troubleshooting Tor Browser for Android. 14. 2(↑) tickets: Accessibility issues and [Dark Mode][] in Tor Browser. 15. 2(↓) tickets: instructions on how to get Tor Browser binaries from GetTor. 16. 2(↓) tickets: help with setting up Snowflake proxy. 17. 2(-) tickets: instructions to download Tor Browser 13.5 legacy for legacy operating systems. 18. 1(↓) ticket: reports of anti-virus software blocking Tor Browser from running on Windows. 19. 1(↓) ticket: unable to save passwords on Tor Browser Desktop. 20. 1(↑) ticket: help with installing Tor VPN beta. 21. 1(↑) ticket: report of Tor VPN [bug#469][] 22. 1(↑) ticket: report of an issue with [configuring the 'exit' location][] on Tor VPN. 23. 1(↑) ticket: how to change the search engine from Tor Browser's default DuckDuckGo. 24. 1(↑) ticket: question about installing Tor Browser on a Chromebook. 25. 1(↑) ticket: [Web Authentication][] (WebAuthn) support is disabled in Tor Browser. 26. 1(↑) ticket: [German translation][] suggestion. 27. 1(↑) ticket: [Advisory][] for Tor Relay operators. 28. 1(↑) ticket: Tor Browser for Android [displays a notification] even after the browser session is closed. [Dark Mode]: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40337 [bug#469]: https://gitlab.torproject.org/tpo/applications/vpn/-/issues/469 [configuring the 'exit' location]: https://gitlab.torproject.org/tpo/applications/vpn/-/issues/428 [Web Authentication]: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/26614 [German translation]: https://gitlab.torproject.org/tpo/community/l10n/-/issues/40194 [Advisory]: https://lists.torproject.org/mailman3/hyperkitty/list/tor-relays@lists.torp… [displays a notification]: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43695 # Telegram, WhatsApp and Signal user support channels * 727(↓) tickets resolved Breakdown: * 662(↓) tickets on Telegram * 33(↑) tickets on Signal * 32(-) tickets on WhatsApp Tickets by topics and numbers: 1. 518(↓) tickets: circumventing censorship in Russian speaking countries. 2. 36(↓) tickets: help with using bridges with Tor VPN Beta. 3. 36(↑) tickets: help with troubleshooting existing Tor Browser install on Desktop (Windows, macOS and Linux). 4. 35(↑) tickets: instructions to circumvent censorship for Chinese speaking users. 5. 26(↓) tickets: circumventing censorship with Tor in Farsi. 6. 23(↓) tickets: instructions to fetch bridges from Bridge distributors on Telegram or Email and use them with Tor Browser and Tor VPN beta. 7. 22(↑) tickets: questions about which Tor app to install on iOS (i.e. Onion Browser or Orbot). 8. 17(↑) tickets: help with troubleshooting Tor VPN beta. 9. 12(↑) tickets: instructions on how to get Tor Browser binaries from GetTor. 10. 11(↓) tickets: helping users on iOS, using Onion Browser or Orbot, to use censorship circumvention methods. 11. 7(-) tickets: help with troubleshooting existing Tor Browser install on Android. 12. 4(↑) tickets: questions about onion services and how to access them. 13. 4(↑) tickets: help with using bridges with Tails. 14. 4(↑) tickets: reports of [GetTor distributor][] on Telegram not working. (Issue is resolved). 15. 2(↑) tickets: report of websites blocking Tor connections or not performing well in Tor Browser. 16. 2(↓) tickets: instructions to use WebTunnel bridges with Tor Browser. 17. 1(↓) ticket: help with installing Tor Browser on Desktop on Linux. 18. 1(↓) ticket: GetBridgesBot on Telegram freezes and stops sending bridges and users have to clear chat history. 19. 1(↓) ticket: instructions to download Tor Browser 13.5 legacy for legacy operating systems. 20. 1(↓) ticket: help with configuring bridges to use with little-t tor (the network daemon). 21. 1(↑) ticket: Misconfigured [WebTunnel bridges] exposed to the public relay extra-infos docs. 22. 1(↑) ticket: question about the letterboxing feature in Tor Browser. [GetTor distributor]: https://gitlab.torproject.org/tpo/anti-censorship/gettor-project/OnionSprou… [WebTunnel bridges]: https://gitlab.torproject.org/tpo/anti-censorship/team/-/issues/179 # Highlights from the Tor Forum * Issue with [bookmarks and saved passwords][] on Tor Browser for macOS. * [Tor Browser legacy][] has dropped support for legacy operating systems. [bookmarks and saved passwords]: https://forum.torproject.org/t/i-cant-get-the-bookmarks-and-passwords/21352 [Tor Browser legacy]: https://forum.torproject.org/t/new-release-tor-browser-13-5-29/21283/2 # Highlights from Google Play Store ## Tor Browser for Android * Tor Browser for Android (TBA) had a Google Play rating of 4.426(↑0.02) stars in March, which is higher as compared to in February. The surge in ratings is very likely due to the fix for the 'Tor daemon failing in the background' on [Android bug], that shipped with Tor Browser 15.0.7. * Tor Browser for Android (TBA) got 581(↓79) new reviews. The total count of reviews for the app stands at 68,396. * For Tor Browser, the most common issue mentioned on reviews was the censorship against Tor in the countries like Russia, China, Iran. [Android bug]: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42714 ## Tor Browser for Android Alpha * Tor Browser for Android Alpha app had a rating of 4.131(-) in March which is the same as compared to February. * In March, Tor Browser for Android Alpha got 21(↑6) new reviews. The total count of reviews for the app stands at 8,777. ## Tor VPN Beta * Tor VPN beta number of unique daily users is around 77,000 at the end of March. * The top 5 countries by the number of installations being (in descending order): Russia, Iran, India, the United States, and Turkmenistan. Thanks! -- ebanam

1 0

Anti-censorship team meeting notes, 2026-04-09
by Shelikhoo 09 Apr '26

09 Apr '26

Hey everyone! Here are our meeting logs: https://meetbot.debian.net/tor-meeting/2026/tor-meeting.2026-04-09-16.00.ht… And our meeting pad: Anti-censorship work meeting pad -------------------------------- Anti-censorship -------------------------------- Next meeting: Thursday, Apr 16 16:00 UTC Facilitator:meskio ^^^(See Facilitator Queue at tail) Weekly meetings, every Thursday at 16:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress) This week's Facilitator:shelikhoo == Goal of this meeting == Weekly check-in about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at the Tor Project and Tor community. == Links to Useful documents == * Our anti-censorship roadmap: * Roadmap:https://gitlab.torproject.org/groups/tpo/anti-censorship/-/boards * The anti-censorship team's wiki page: * https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/home * Past meeting notes can be found at: * https://lists.torproject.org/pipermail/tor-project/ * Tickets that need reviews: from projects, we are working on: * All needs review tickets: * https://gitlab.torproject.org/groups/tpo/anti-censorship/-/merge_requests?s… == Announcements == * == Discussion == * (New 04-08) Requesting feedback on broker AIMD dynamic poll interval * Description: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… * Simulation results: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… * Implementation: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - Snowflake-targeted DTLS filtering in Russia, starting 2026-03-30 https://github.com/net4people/bbs/issues/603 == Actions == * == Interesting links == * https://www.internetsociety.org/resources/doc/2025/mandated-dns-blocking/ * "Mandated DNS blocking, often presented as a straightforward policy solution, is ineffective, harmful, and impractical. It is ineffective because it is easily circumvented by users and fails to remove targeted content, which simply reappears under new domain names. It is harmful because this blunt instrument cannot distinguish between lawful and unlawful material, leading to overblocking, fragmentation of the Internet’s global naming system, and the failure of interconnected services, including critical security protocols. Finally, it is impractical because the DNS is not bound by geography, meaning national blocking orders against global resolvers create unintended and widespread extraterritorial effects. Mandated blocking is the wrong tool for a role the DNS was never designed to play." == Reading group == * We will discuss "" on * * Questions to ask and goals to have: * What aspects of the paper are questionable? * Are there immediate actions we can take based on this work? * Are there long-term actions we can take based on this work? * * Is there future work that we want to call out in hopes that others will pick it up? * Next in the Reading Group Queue: * == Updates == Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week. Help with: - Something you need help with. cecylia (cohosh): 2026-04-09 Last week: - responded to blocking of snowflake in russia - opened issue with iptproxy to enable covertdtls feature - enabled covertdtls by default for standalone proxies (snowflake!700) - caught up on anonymous report about blocking triggered by simultaneous connections (snowflake#40529) - released new version of snowflake (v2.13.1) - finished simple simulation and implementation of dynamic poll rate adjustment (snowflake#25598) - opened draft MR for dynamic poll rate adjustment (snowflake!701) Next week: - keep following up with fingerprinting in Russia - make proxy-bridge reachability checks robust to bridge outages (snowflake#40504) - more work on letting broker inform proxies how often to poll - have proxies honour the NextPoll message - follow up about running shadow simulations for snowflake performance - revisit conjure integration with lyrebird - take a look at potential snowflake orbot bug - https://github.com/guardianproject/orbot-android/issues/1183 dcf: 2026-04-09 Last week: - opened an issue for snowflake proxy -covertdtls-fingerprint silent termination https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - opened an issue to have snowflake-client log whenever KCPInErrors is nonzero https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… Next week: - comment on dynamic poll rate adjustment https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… Help with: meskio: 2026-03-26 Last week: - split translation strings in the telegram distributor to make it easier to translate (rdsys#299) - stop sharing windows7 TB in Telegram gettor, as there is no releases anymore (onionsproutsbot#77) - assignments log scrambled on our side (rdsys!638) - grant work Next week: - give it a try to gorelease to produce debian packages Shelikhoo: 2026-04-09 Last Week: - [Testing] Unreliable+unordered WebRTC data channel transport for Snowflake rev2 (cont.)( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) testing environment setup/research - Merge request Reviews - [Research] proxy pool overload and potential blocking in Iran ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [Research] Add three NAT type buckets to the snowflake broker ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - Writing Socks5 UDP proxy for nat type simuation - Update Snowflake STUN servers at Tor browser ( https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/merge_re… ) Next (working) Week/TODO: - Merge request reviews - [Deployment]Unreliable+unordered WebRTC data channel transport for Snowflake rev2 (cont.)( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) Building custom Tor Browser with patch applied - Vantage point maintaince - [Research] proxy pool overload and potential blocking in Iran ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [Research] Add three NAT type buckets to the snowflake broker ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) onyinyang: 2026-04-09 Last week(s): - Started background work for project #170 Next week: - Start on tasks for project #170 Switch back to some of these: As time allows: - Continue work on rdsys#196 - Continue Investigating rdsys#248 i.e., why dysfunctional webtunnel bridges are being distributed - Troubleshooting conjure not connecting in China - waiting for more information from conjure authors/maintainers - Lox still seems to be filling up the disk on the rdsys-test server despite changes made to delete old entries, look into what's going wrong Blog post for conjure: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/conj… - review Tor browser Lox integration https://gitlab.torproject.org/tpo/applications/tor-browser/-/merge_requests… - add TTL cache to lox MR for duplicate responses: https://gitlab.torproject.org/tpo/anti-censorship/lox/-/merge_requests/305 - Work on outstanding milestone issues: - key rotation automation Later: pending decision on abandoning lox wasm in favour of some kind of FFI? https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43096) - add pref to handle timing for pubkey checks in Tor browser - add trusted invitation logic to tor browser integration: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42974 - improve metrics collection/think about how to show Lox is working/valuable - sketch out Lox blog post/usage notes for forum (long term things were discussed at the meeting!): - brainstorming grouping strategies for Lox buckets (of bridges) and gathering context on how types of bridges are distributed/use in practice Question: What makes a bridge usable for a given user, and how can we encode that to best ensure we're getting the most appropriate resources to people? 1. Are there some obvious grouping strategies that we can already consider? e.g., by PT, by bandwidth (lower bandwidth bridges sacrificed to open-invitation buckets?), by locale (to be matched with a requesting user's geoip or something?) 2. Does it make sense to group 3 bridges/bucket, so trusted users have access to 3 bridges (and untrusted users have access to 1)? More? Less? theodorsm: 2026-04-09 Last weeks: - MR updating covert-dtls and improving public config API: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - Implementing DTLS 1.3 in pion Next weeks: - Implementing DTLS 1.3 in pion Help with: -

1 0

Anti-censorship team meeting notes, 2026-04-02
by onyinyang 02 Apr '26

02 Apr '26

Hey everyone! Here are our meeting logs: https://meetbot.debian.net/tor-meeting/2026/tor-meeting.2026-04-02-16.00.ht… And our meeting pad: Anti-censorship work meeting pad -------------------------------- Anti-censorship -------------------------------- Next meeting: Thursday, Apr 09 16:00 UTC Facilitator: shelikhoo ^^^(See Facilitator Queue at tail) Weekly meetings, every Thursday at 16:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress) This week's Facilitator:onyinyang == Goal of this meeting == Weekly check-in about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at the Tor Project and Tor community. == Links to Useful documents == * Our anti-censorship roadmap: * Roadmap:https://gitlab.torproject.org/groups/tpo/anti-censorship/-/boards * The anti-censorship team's wiki page: * https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/home * Past meeting notes can be found at: * https://lists.torproject.org/pipermail/tor-project/ * Tickets that need reviews: from projects, we are working on: * All needs review tickets: * https://gitlab.torproject.org/groups/tpo/anti-censorship/-/merge_requests?s… == Announcements == * == Discussion == * Discuss snowflake proxy mobile application * https://github.com/blocoio/snowflake * A standalone dedicated app (Android), not bundled with Orbot * Planning to release on F-Droid and Google Play as "Snowflake Volunteers" * Implementation language is Kotlin * Important priority: keep up with changes in proxy messages and other proxy implementations * The app uses IPtProxy, so it should inherit updates from there * App reports its proxy type as "bloco", we need to add that to the list of known proxy types (in the broker?) to have it included in stats as other than "unknown" * Shell suggests a type name prefixing scheme, whereby implementations could be something like "webext-suffix" and be sorted into the "webext" bucket by default, with the option of separating them out in analysis * Need to ensure no telemetry or logging of user IP addresses * Privacy policy: https://bloco-privacy-policy.web.app/snowflake.html == Actions == * == Interesting links == * https://www.techpolicy.press/what-digital-isolation-and-censorship-evasion-… * via https://mastodon.social/@torproject/116330694532247442 == Reading group == * We will discuss "" on * * Questions to ask and goals to have: * What aspects of the paper are questionable? * Are there immediate actions we can take based on this work? * Are there long-term actions we can take based on this work? * * Is there future work that we want to call out in hopes that others will pick it up? * Next in the Reading Group Queue: * == Updates == Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week. Help with: - Something you need help with. cecylia (cohosh): 2026-04-02 Last week: - wrote up plan for dynamic poll rate adjustment - https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - worked with UCSC researchers on enumeration simulations - got go1.22 support for macos only merged in tor-browser-build Next week: - follow up about running shadow simulations for snowflake performance - research snowflake enumeration attacks (snowflake#40396) - implement proxy fairness proposal - follow up on snowflake rendezvous failures (snowflake#40447) - revisit conjure integration with lyrebird - take a look at potential snowflake orbot bug - https://github.com/guardianproject/orbot-android/issues/1183 dcf: 2026-04-02 Last week: - commented on a "birthday" NAT traversal idea https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… Next week: - comment on dynamic poll rate adjustment https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - open issue to have snowflake-client log whenever KCPInErrors is nonzero https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - parent: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… Help with: meskio: 2026-03-26 Last week: - AFK - grant work Next week: - assignments log clean up in rdsys side Shelikhoo: 2026-04-02 Last Week: - [Testing] Unreliable+unordered WebRTC data channel transport for Snowflake rev2 (cont.)( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) testing environment setup/research - Merge request Reviews - [Research] proxy pool overload and potential blocking in Iran ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [Research] Add three NAT type buckets to the snowflake broker ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [MR] Done: Update webtunnel version to 0.0.4 and update bundled dockerfile dependencies ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/webt… ) Next (working) Week/TODO: - Merge request reviews - [Deployment]Unreliable+unordered WebRTC data channel transport for Snowflake rev2 (cont.)( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) Building custom Tor Browser with patch applied - Vantage point maintaince - [Research] proxy pool overload and potential blocking in Iran ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [Research] Add three NAT type buckets to the snowflake broker ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) onyinyang: 2026-04-02 Last week(s): - Finished reworking lox-extension MR and integration with Tor - Started background work for project #170 Next week: - Start on tasks for project #170 Switch back to some of these: As time allows: - Continue work on rdsys#196 - Continue Investigating rdsys#248 i.e., why dysfunctional webtunnel bridges are being distributed - Troubleshooting conjure not connecting in China - waiting for more information from conjure authors/maintainers - Lox still seems to be filling up the disk on the rdsys-test server despite changes made to delete old entries, look into what's going wrong Blog post for conjure: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/conj… - review Tor browser Lox integration https://gitlab.torproject.org/tpo/applications/tor-browser/-/merge_requests… - add TTL cache to lox MR for duplicate responses: https://gitlab.torproject.org/tpo/anti-censorship/lox/-/merge_requests/305 - Work on outstanding milestone issues: - key rotation automation Later: pending decision on abandoning lox wasm in favour of some kind of FFI? https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43096) - add pref to handle timing for pubkey checks in Tor browser - add trusted invitation logic to tor browser integration: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42974 - improve metrics collection/think about how to show Lox is working/valuable - sketch out Lox blog post/usage notes for forum (long term things were discussed at the meeting!): - brainstorming grouping strategies for Lox buckets (of bridges) and gathering context on how types of bridges are distributed/use in practice Question: What makes a bridge usable for a given user, and how can we encode that to best ensure we're getting the most appropriate resources to people? 1. Are there some obvious grouping strategies that we can already consider? e.g., by PT, by bandwidth (lower bandwidth bridges sacrificed to open-invitation buckets?), by locale (to be matched with a requesting user's geoip or something?) 2. Does it make sense to group 3 bridges/bucket, so trusted users have access to 3 bridges (and untrusted users have access to 1)? More? Less? theodorsm: 2026-02-19 Last weeks: - Bumping pion stack version with backport: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - Implementing DTLS 1.3 in pion Next weeks: - Implementing DTLS 1.3 in pion Help with: - Facilitator Queue: cohosh onyinyang shelikhoo meskio 1. First available staff in the Facilitator Queue will be the facilitator for the meeting 2. After facilitating the meeting, the facilitator will be moved to the tail of the queue -- --- onyinyang GPG Fingerprint 3CC3 F8CC E9D0 A92F A108 38EF 156A 6435 430C 2036

1 0

Anti-censorship team meeting notes, 2026-03-26
by Shelikhoo 26 Mar '26

26 Mar '26

Hey everyone! Here are our meeting logs: https://meetbot.debian.net/tor-meeting/2026/tor-meeting.2026-03-26-16.01.ht… And our meeting pad: Anti-censorship work meeting pad -------------------------------- Anti-censorship -------------------------------- Next meeting: Thursday, Apr 02 16:00 UTC Facilitator: onyinyang ^^^(See Facilitator Queue at tail) Weekly meetings, every Thursday at 16:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress) This week's Facilitator:shelikhoo == Goal of this meeting == Weekly check-in about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at the Tor Project and Tor community. == Links to Useful documents == * Our anti-censorship roadmap: * Roadmap:https://gitlab.torproject.org/groups/tpo/anti-censorship/-/boards * The anti-censorship team's wiki page: * https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/home * Past meeting notes can be found at: * https://lists.torproject.org/pipermail/tor-project/ * Tickets that need reviews: from projects, we are working on: * All needs review tickets: * https://gitlab.torproject.org/groups/tpo/anti-censorship/-/merge_requests?s… == Announcements == * == Discussion == * Release schedule planning for containers * https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/webt… * WebTunnel server has not needed an update, but the tor daemon has updated in the meantime; want to release container updates purely for the sake of getting an upgraded tor, even if there are no changes to WebTunnel * Shell will write a ticket about 3 month per maintaince release proposal * --> link is here: https://gitlab.torproject.org/tpo/anti-censorship/team/-/issues/181 (Mar 26 New) * 3 Bucket NAT Type Testing Proposal: * https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… * instead of having one single test, we run 2 webrtc connect test in parallel * one of them have a "no server reflective candidate, Endpoint+Port Dependent (Pinned) Filter, Endpoint+Port Dependent Mapping" network environment on server side's webrtc to test if the proxy is of type "open", it is open if the client can connect * one of them have a "Endpoint+Port Dependent Filter, Independent Mapping" to test if the proxy is of type "moderate", if connects then it is * the nat type test assist server get these network environment by modifying the sdp info(which we already do to remove some host candidate); connecting via socks5 proxy, the socks5 proxy simulate these network types by intentionally sabotaging the relayed connection * This design would reduce the amount of change of logic we need to make on proxy, however, would result in increase of server load. * Questions for discussion: * Is there any missing points/miscategorization that is not discussed? * Is there any unintented side effects that is not discussed? * TODO: * Shelikhoo check broker machine load * cohosh add more feedback to the ticket == Actions == * == Interesting links == == Reading group == * We will discuss "" on * * Questions to ask and goals to have: * What aspects of the paper are questionable? * Are there immediate actions we can take based on this work? * Are there long-term actions we can take based on this work? * * Is there future work that we want to call out in hopes that others will pick it up? * Next in the Reading Group Queue: * == Updates == Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week. Help with: - Something you need help with. cecylia (cohosh): 2026-03-26 Last week: - merged snowflake broker pool refactor - https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - opened MR for first part of letting broker inform proxies how often to poll - worked on proxy fairness proposal Next week: - continue snowflake and lyrebird go version support and release work - follow up about running shadow simulations for snowflake performance - research snowflake enumeration attacks (snowflake#40396) - implement proxy fairness proposal - follow up on snowflake rendezvous failures (snowflake#40447) - revisit conjure integration with lyrebird - take a look at potential snowflake orbot bug - https://github.com/guardianproject/orbot-android/issues/1183 dcf: 2026-03-26 Last week: - commented on a cypherpunks patch for snowflake webextension and OS lock / sleep https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - upgraded the snowflake bridges to 0.4.9.6 for a security release https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… Next week: - open issue to have snowflake-client log whenever KCPInErrors is nonzero https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - parent: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… Help with: meskio: 2026-03-26 Last week: - AFK - grant work Next week: - assignments log clean up in rdsys side Shelikhoo: 2026-03-26 Last Week: - [Testing] Unreliable+unordered WebRTC data channel transport for Snowflake rev2 (cont.)( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) testing environment setup/research - Merge request Reviews - Vantage point maintaince - [Research] proxy pool overload and potential blocking in Iran ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [Research] Add three NAT type buckets to the snowflake broker ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [MR] Done: Update webtunnel version to 0.0.4 and update bundled dockerfile dependencies ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/webt… ) Next (working) Week/TODO: - Merge request reviews - [Deployment]Unreliable+unordered WebRTC data channel transport for Snowflake rev2 (cont.)( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) Building custom Tor Browser with patch applied - Vantage point maintaince - [Research] proxy pool overload and potential blocking in Iran ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) - [Research] Add three NAT type buckets to the snowflake broker ( https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… ) onyinyang: 2026-03-26 Last week(s): - Finished work on https distributor language selector https://gitlab.torproject.org/tpo/anti-censorship/rdsys/-/issues/196 -Reworking lox-extension MR and integration with Tor Next week: - Start new project #170 Switch back to some of these: As time allows: - Continue work on rdsys#196 - Continue Investigating rdsys#248 i.e., why dysfunctional webtunnel bridges are being distributed - Troubleshooting conjure not connecting in China - waiting for more information from conjure authors/maintainers - Lox still seems to be filling up the disk on the rdsys-test server despite changes made to delete old entries, look into what's going wrong Blog post for conjure: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/conj… - review Tor browser Lox integration https://gitlab.torproject.org/tpo/applications/tor-browser/-/merge_requests… - add TTL cache to lox MR for duplicate responses: https://gitlab.torproject.org/tpo/anti-censorship/lox/-/merge_requests/305 - Work on outstanding milestone issues: - key rotation automation Later: pending decision on abandoning lox wasm in favour of some kind of FFI? https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43096) - add pref to handle timing for pubkey checks in Tor browser - add trusted invitation logic to tor browser integration: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42974 - improve metrics collection/think about how to show Lox is working/valuable - sketch out Lox blog post/usage notes for forum (long term things were discussed at the meeting!): - brainstorming grouping strategies for Lox buckets (of bridges) and gathering context on how types of bridges are distributed/use in practice Question: What makes a bridge usable for a given user, and how can we encode that to best ensure we're getting the most appropriate resources to people? 1. Are there some obvious grouping strategies that we can already consider? e.g., by PT, by bandwidth (lower bandwidth bridges sacrificed to open-invitation buckets?), by locale (to be matched with a requesting user's geoip or something?) 2. Does it make sense to group 3 bridges/bucket, so trusted users have access to 3 bridges (and untrusted users have access to 1)? More? Less? theodorsm: 2026-02-19 Last weeks: - Bumping pion stack version with backport: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - Implementing DTLS 1.3 in pion Next weeks: - Implementing DTLS 1.3 in pion Help with: - Facilitator Queue: cohosh onyinyang shelikhoo meskio 1. First available staff in the Facilitator Queue will be the facilitator for the meeting 2. After facilitating the meeting, the facilitator will be moved to the tail of the queue

1 0

PSA: North america changes time forward soon, Europe next
by Antoine Beaupré 23 Mar '26

23 Mar '26

Hi! This is your bi-yearly reminder that time is changing soon! # What's happening? For people not on tor-internal, you should know that I've been sending semi-regular announcements when daylight saving changes occur. Starting now, I'm making those announcements public so they can be shared with the wider community because, after all, this affects everyone (kind of). For those of you lucky enough to have no idea what I'm talking about, you should know that some places in the world implement what is called Daylight saving time or DST: https://en.wikipedia.org/wiki/Daylight_saving_time Normally, you shouldn't have to do anything: computers automatically change time following local rules, assuming they are correctly configured, provided recent updates have been applied in the case of a recent change in said rules (because yes, this happens). Appliances, of course, will likely *not* change time and will need to adjusted unless they are so-called "smart" (also known as "part of a bot net"). If your clock is flashing "0:00" or "12:00", you have no action to take, congratulations on having the right time once or twice a day. If you haven't changed those clocks in six months, congratulations, they will be accurate again! In any case, you should still consider DST because it might affect some of your meeting schedules, particularly if you set up a new meeting schedule in the last 6 months and forgot to consider this change. # If your location does not have DST Properly scheduled meetings affecting multiple time zones are set in UTC time, which does *not* change. So if your location does not observer time changes, your (local!) meeting time will *not* change. But be aware that some other folks attending your meeting *might* have the DST bug and *their* meeting times will change. They might miss entire meetings or arrive late as you frantically ping them over IRC, Matrix, Signal, SMS, Ricochet, Mattermost, SimpleX, Whatsapp, Discord, Slack, Wechat, Snapchat, Telegram, XMPP, Briar, Zulip, RocketChat, DeltaChat, talk(1), write(1), actual telegrams, Meshtastic, Meshcore, Reticulum, APRS, snail mail, and, finally, flying a remote presence drone to their house, asking what's going on. (Sorry if I forgot your preferred messaging client here, I tried my best.) Be kind; those poor folks might be more sleep deprived as DST *steals* one hour of sleep from them on the night that implements the change. # If you do observe DST If you are affected by the DST bug, your *local* meeting times *will* change access the board. Normally, you can trust that your meetings are scheduled to take this change into account and the new time should still be reasonable. Trust, but verify; make sure the new times *are* adequate and there are no scheduling conflicts. Do this *now*: take a look at your calendar in two week *and* in April. See if any meeting need to be rescheduled because of an impossible or conflicting time. # When does time change, how and where? Notice how I mentioned "North America" in the subject? That's a lie. ("The doctor lies", as they say on the BBC.) Other places, including Europe, also changes times, just not all at once (and not all North America). We'll get into "where" soon, but first let's look at the "how". As you might already know, the trick is: > Spring forward, fall backwards. This northern-centric (sorry!) proverb says that clocks will move *forward* by an hour this "spring", after moving *backwards* last "fall". This is why we lose an hour of work, sorry, sleep. It sucks, to put it bluntly. I want it to stop and will keep writing those advisories until it does. To see where and when, we, unfortunately, still need to go into politics. ## USA and Canada First, we start with "North America" which, really, is just some *parts* of USA[1] and Canada[2]. As usual, on the Second Sunday in March (the 8th) at 02:00 local (not UTC!), the clocks will move forward. This means that properly set clocks will flip from 1:59 to 3:00, coldly depriving us from an hour of sleep that was perniciously granted 6 months ago and making calendar software stupidly hard to write. Practically, set your wrist watch and alarm clocks[3] back one hour before going to bed and go to bed early. [1] except Arizona (except the Navajo nation), US territories, and Hawaii [2] except Yukon, most of Saskatchewan, and parts of British Columbia (northeast), one island in Nunavut (Southampton Island), one town in Ontario (Atikokan) and small parts of Quebec (Le Golfe-du-Saint-Laurent), a list which I keep recopying because I find it just so amazing how chaotic it is. When your clock has its own Wikipedia page, you know something is wrong: https://en.wikipedia.org/wiki/Time_in_Saskatchewan [3] hopefully not managed by a botnet, otherwise kindly ask your bot net operator to apply proper software upgrades in a timely manner ## Europe Next we look at our dear Europe, which will change time on the last Sunday in March (the 29th) at 01:00 *UTC* (not local!). I *think* it means that, Amsterdam-time, the clocks will flip from 1:59 to 3:00 AM *local* on that night. (Every time I write this, I have doubts. I would welcome independent confirmation from night owls that observe that funky behavior experimentally.) Just like your poor fellows out west, just fix your old-school clocks before going to bed, and go to sleep early, it's good for you. ## Rest of the world with DST Renewed and recurring apologies again to the people of Cuba, Mexico, Moldova, Israel, Lebanon, Palestine, Egypt, Chile (except Magallanes Region), parts of Australia, and New Zealand which *all* have their own *individual* DST rules, omitted here for brevity. In general, changes also happen in March, but either on different times or different days, except in the south hemisphere, where they happen in April. ## Rest of the world without DST All of you other folks without DST, rejoice! Thank you for reminding us how manage calendars and clocks normally. Sometimes, doing nothing is precisely the right thing to do. You're an inspiration for us all. # Changes since last time There were, again, no changes since last year on daylight savings that I'm aware of. It seems the US congress debating switching to a "half-daylight" time zone which is an half-baked idea that I should have expected from the current USA politics: https://www.usatoday.com/story/news/nation/2026/02/19/daylight-act-of-2026-… The plan is to, say, switch from "Eastern is UTC-4 in the summer" to "Eastern is UTC-4.5". The bill also proposes to do this 90 days after enactment, which is dangerously optimistic about our capacity at deploying any significant change in human society. In general, I rely on the Wikipedia time nerds for this: https://en.wikipedia.org/wiki/Daylight_saving_time_by_country ... and Paul Eggert which seems to singlehandledly be keeping everything in order for all of us: https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/latest This time, I've also looked at the normal mailing list: https://lists.iana.org/hyperkitty/list/tz@iana.org/latest ... which is where I learned about the congress bill. If your country has changed time and no one above noticed, now would be an extremely late time to do something about this, typically writing to the above list. (Incredibly, *I* need to write to the list because of this post: https://lists.iana.org/hyperkitty/list/tz@iana.org/thread/6HN5SWD2BJA7OVTPF…) One thing that *did* change since last year is that I've implemented what I hope to be a robust calendar for this, which was surprisingly tricky. If you have access to our Nextcloud, it should be visible under the heading "Daylight saving times". If you don't, you can access it using this link directly: https://gitlab.torproject.org/tpo/tpa/team/-/wikis/howto/time/dst.ics The procedures around how this calendar was created, how this email was written, and curses found along the way, are also documented in this wiki page, if someone ever needs to pick up the Time Lord duty: https://gitlab.torproject.org/tpo/tpa/team/-/wikis/howto/time A. -- Antoine Beaupré self-elected time lord in self-training torproject.org system administration

1 2

two important security vulnerabilities for Linux users
by Antoine Beaupré 19 Mar '26

19 Mar '26

Hi! We don't usually share bulletins about security issues like this here; we expect you to perform routine (and preferably automated!) upgrades of your software at home. But those two issues are critical enough to warrant a special announcement. This week, two major security issues affecting server and desktop users in the Linux community have come up. They are: - a local privilege escalation in snapd: https://lwn.net/Articles/1063453/ - a series of vulnerabilities in AppArmor: https://lwn.net/Articles/1062778/ Both issues are quite serious; they could lead to an attacker getting administrator access on your machine, bypassing normal security controls entirely. If you use Ubuntu, you are most certainly using "snapd" and should upgrade. If you don't, you might still be using it as it's also available for other operating systems. AppArmor is also used a lot on Ubuntu, but is also available for some platforms. Red Hat derivatives like Fedora are less affected by both of those, as they typically use Flatpak (instead of snapd) and SELinux (instead of AppArmor). A. -- Antoine Beaupré torproject.org system administration

1 0