- tor-project - lists.torproject.org

Rhatto's Monthly Status Report, February 2023
by rhatto 03 Mar '23

03 Mar '23

Hi all :) This is my monthly status report for February 2023 with the main activities I have done during the period. ## 0. Research * Joined Network Team's Onion Service Working Group, which is aimed at improving the current technology. I'm joining as someone who's more at the operational side of things and that's interested in a range of usability topics, from enhanced deployment/monitoring tools to certificates and service discovery. ## 1. Development * Internal security policy work for the Onion Support Group and the Community Team. Such work might in the future be another step towards the broader security policies work at Tor, which is detailed at https://gitlab.torproject.org/tpo/team/-/issues/41 ## 2. Support * Ongoing Sponsor 123 deployments, monitoring and maintenance. * Custom support for Onion Service deployment. This is being an interesting experiment about setting up an Onion Service for an organization without dedicated IT staff, requiring a setup with minimum maintenance effort. ## 3. Organization * Detailed planning on my workload allocation and activity scenarios, split between research, development and support. This is helping me to figure out how my time can be split between different teams, initiatives, sponsors etc and also reduce the number of daily/weekly/monthly context changes. -- Silvio Rhatto pronouns he/him

1 0

Anti-censorship team meeting notes, 2023-03-02
by Shelikhoo 02 Mar '23

02 Mar '23

Hey everyone! Here are our meeting logs: http://meetbot.debian.net/tor-meeting/2023/tor-meeting.2023-03-02-15.58.html And our meeting pad: Anti-censorship work meeting pad -------------------------------- ------------------------------------------------------------------------------------ THIS IS A PUBLIC PAD ------------------------------------------------------------------------------------ Anti-censorship -------------------------------- Next meeting: Thursday, March 9 16:00 UTC Weekly meetings, every Thursday at 16:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress) == Goal of this meeting == Weekly check-in about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at the Tor Project and Tor community. == Links to Useful documents == * Our anti-censorship roadmap: * Roadmap: https://gitlab.torproject.org/groups/tpo/anti-censorship/-/boards * The anti-censorship team's wiki page: * https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/home * Past meeting notes can be found at: * https://lists.torproject.org/pipermail/tor-project/ * Tickets that need reviews: from sponsors, we are working on: * All needs review tickets: * https://gitlab.torproject.org/groups/tpo/anti-censorship/-/merge_requests?s… * Sponsor 28 * must-do tickets: https://gitlab.torproject.org/groups/tpo/-/milestones/10 * possible-do tickets: https://gitlab.torproject.org/groups/tpo/-/issues?scope=all&utf8=%E2%9C%93&… * Sponsor 96 * https://gitlab.torproject.org/groups/tpo/-/milestones/24 * Sponsor 139 <-- hackerncoder, irl, joydeep, meskio, emmapeel working on it * https://pad.riseup.net/p/sponsor139-meeting-pad == Announcements == == Discussion == * Should we improve anti-censorship measures against Tor without bridges? Should we fix the fingerprints and randomize them? (ValdikSS) * Currently, proposals to make any change in C-tor are being closed in favor of Arti, which is not available in any relays yet. * Is Arti going to be implemented the same as C-tor with respect to anti-censorship of its Tor-protocol connections, or will it try better to resist blocking in its native state? * Team has not yet reviewed Anti's anti-censorship design and stance. * Old history (circa May 2012, tor 0.2.3.15) of plain tor's attempts to enhance blocking resistance (by imitating Firefox ciphersuites, etc.), before pluggable transports: https://gitlab.torproject.org/tpo/team/-/wikis/projects/Tor/TLSHistory * In Turkmenistan, huge ranges of foreign addresses are blocked, perhaps 40% of the space. Tor relays are a good resource for testing and reachability because they are all listed; unlike obfs4 for example which are only attainable in small quantities are are usually 100% blocked anyway. * But will it remain that way if the reachable Tor relays start being used on a large scale? * In Iran, there is an SNI regexp filter for the Tor client's default fake SNI of www.[a-z].com; changing .com to .net evades the filter. * valdikss will make an issue to collect all this information. == Actions == * meskio will write a survival guide on onbasca * move the ampcache snowflake fallback forward == Interesting links == * https://www.fortinet.com/blog/threat-research/dissecting-tor-bridges-plugga… * In which the intrepid FortiNet analyst busts out OllyDbg rather than read the source code. * Workaround for server-side Tor block: https://web.archive.org/web/20221205135630/https://www.fortinet.com/blog/th… * Part 2: https://www.fortinet.com/blog/threat-research/dissecting-tor-bridges-plugga… * https://www.youtube.com/watch?v=kL7YCRer3To&list=PLfUWWM-POgQvGOVAk1HjP3uFK… * Video for reading group paper. * https://www.youtube.com/watch?v=dbOf8U2GDZ8 Q&A video, 0:00–3:36 and 10:14–11:11 are about this paper. == Reading group == * We will discuss "Detecting Tor Bridge from Sampled Traffic in Backbone Networks" on March 9 * https://www.ndss-symposium.org/wp-content/uploads/madweb2021_23011_paper.pdf * https://www.youtube.com/watch?v=kL7YCRer3To&list=PLfUWWM-POgQvGOVAk1HjP3uFK… * Questions to ask and goals to have: * What aspects of the paper are questionable? * Are there immediate actions we can take based on this work? * Are there long-term actions we can take based on this work? * Is there future work that we want to call out in hopes that others will pick it up? == Updates == Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week. Help with: - Something you need help with. cecylia (cohosh): last updated 2023-03-02 Last week: - Lox tor browser integration work in progress - https://gitlab.torproject.org/tpo/anti-censorship/team/-/issues/116 - Finished getting the wasm client integrated as a Tor Browser module This week: - continue Lox tor browser integration - find a better way to generate and call wasm client in tor-browser-build - make team repos for Lox pieces - expand client-side support for more Lox features - continue work on conjure client-side recovery Needs help with: dcf: 2023-03-02 Last week: - restarted snowflake bridges for haproxy CVE-2023-0056, CVE-2023-25725 https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - increased tor instances from 4 to 12 on snowflake-02 https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… Next week: - migrate goptlib to gitlab https://gitlab.torproject.org/tpo/anti-censorship/team/-/issues/86#note_282… (for real) Help with: meskio: 2023-02-23 Last week: - integrate onbasca into rdsys to test bridge speed (rdsys#150) - deploy onbasca in polyanthum - patch onbasca API to be easier to parse (onbasca!60) - investigate bridgestrap issue, is reporting 30% of functional bridges Next week: - Vacation!!! Shelikhoo: 2023-03-02 Last Week: - [Merge Request Awaiting] Add SOCKS5 forward proxy support to snowflake (snowflake!64) - [Research] HTTPT Planning https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/http… - WebTunnel @ TorBrowser mobile(https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/i…, https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/merge_re…, https://gitlab.torproject.org/tpo/applications/tor-android-service/-/merge_…) - Upstreaming Remove HelloVerify countermeasure (https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow…) Next Week: - [Research] WebTunnel planning (Continue) - Try to find a place to host another vantage point - WebTunnel @ TorBrowser mobile(https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/m… onyinyang: 2023-03-02 Last week: - Finished up Lox wasm bindings for Tor integration: - issue invitation - check blockage - blockage migration This week: - Working on distributor backend for Lox server (integration with rdsys) Itchy Onion: 2023-03-02 Last week: - Holiday - Contine working on issue #40252 (NAT probetest for standalone proxy) This week: - Finished most issue #40252 (!136) - Started looking at #40231 (Client sometimes send offer with no ICE candidates) hackerncoder: 2023-03-02 last week: - work on monitoring bridges health Next week: - getting ooni-exporter to work with torsf (snowflake) - work on "bridgetester"? cece: 2022-12-22 This week: - working on creating a dummy WhatsApp bot Next week: - My bot is not yet working as expected s? still trying to figure that out Help with: - resources

1 0

onyinyang's monthly status report, January 2023
by onyinyang 01 Mar '23

01 Mar '23

Hello everyone, This is my status report for the contract work done in January 2023. Apologies for the delay! # Lox Implementation * Updated Lox library to implement serialization/de-serialization as required for wasm bindings https://gitlab.torproject.org/onyinyang/lox <https://gitlab.torproject.org/onyinyang/lox>note: these changes could likely be merged into the main library (https://git-crysp.uwaterloo.ca/iang/lox) once this effort is complete. * Implemented wasm bindings for the first (open-invitation) Lox protocol in the Lox client https://gitlab.torproject.org/onyinyang/lox-wasm <https://gitlab.torproject.org/onyinyang/lox-wasm> * Implemented test server in rust to handle the requests made by the client https://gitlab.torproject.org/onyinyang/lox-server So far it's been interesting and exciting to help out with this effort :) onyinyang

1 1

PieroV's Monthly Status Report, February 2023
by Pier Angelo Vendrame 01 Mar '23

01 Mar '23

Hi everyone! Here is my status report for February 2023. At the beginning of the month, I continued improving the profile directory patch of Tor Browser [0]. Then, for the rest of the month, I kept polishing tiny details in the browser and in our build system. I am very satisfied with some changes, such as the one to display the commit hash Tor Browser has been built from in about:buildconfig [1]. I also sent a patch to Mozilla to generalize the browser name on that page [2]. I also sent a patch to prevent the network ID computed by Firefox from being persistent [3]. Another couple of tasks I worked on were fixes and improvements on the system font normalization patch [4], and I tried to fix the reproducibility problems with RLBox [5]. Best, Pier [0] https://gitlab.torproject.org/tpo/applications/tor-browser/-/merge_requests… [1] https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4… [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1814416 [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1817756 [4] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41646 [5] https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…

1 0

TPA-RFC-50: private GitLab pages
by Antoine Beaupré 27 Feb '23

27 Feb '23

Summary: allow GitLab users to publish private GitLab pages # Background In our GitLab instance, all GitLab pages are public, that is sites published by GitLab CI outside of the static-component system have no access control whatsoever. GitLab pages does support enabling authentication to hide pages under GitLab authentication. This was not enabled in our instance. # Proposal Enable the GitLab access control mechanisms under the `read_api` scope. Note that this might make your GitLab pages inaccessible if your project was configured to hide them. If that's not something you want, head to `Settings` -> `General` -> `Visibility` -> `Pages` and make them public. # Deadline This was implemented on 2023-02-16, and this proposal was written to retroactively inform people of the change. # Status This proposal is currently in the `standard` state. # References Discussion in [tpo/tpa/team#41079][]. [tpo/tpa/team#41079]: https://gitlab.torproject.org/tpo/tpa/team/-/issues/41079 -- Antoine Beaupré torproject.org system administration

1 0

Anti-censorship team meeting notes, 2023-02-23
by Itchy Onion 23 Feb '23

23 Feb '23

Hey everyone! Here are our meeting logs: http://meetbot.debian.net/tor-meeting/2023/tor-meeting.2023-02-23-15.58.log… And our meeting pad: ------------------------------------------------------------------------------------ THIS IS A PUBLIC PAD ------------------------------------------------------------------------------------ Anti-censorship -------------------------------- Next meeting: Thursday, March 02 16:00 UTC Weekly meetings, every Thursday at 16:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress) == Goal of this meeting == Weekly check-in about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at the Tor Project and Tor community. == Links to Useful documents == Our anti-censorship roadmap: Roadmap: https://gitlab.torproject.org/groups/tpo/anti-censorship/-/boards The anti-censorship team's wiki page: https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/home Past meeting notes can be found at: https://lists.torproject.org/pipermail/tor-project/ Tickets that need reviews: from sponsors, we are working on: All needs review tickets: https://gitlab.torproject.org/groups/tpo/anti-censorship/-/merge_requests?s… Sponsor 28 must-do tickets: https://gitlab.torproject.org/groups/tpo/-/milestones/10 possible-do tickets: https://gitlab.torproject.org/groups/tpo/-/issues?scope=all&utf8=%E2%9C%93&… Sponsor 96 https://gitlab.torproject.org/groups/tpo/-/milestones/24 Sponsor 139 <-- hackerncoder, irl, joydeep, meskio, emmapeel working on it https://pad.riseup.net/p/sponsor139-meeting-pad == Announcements == == Discussion == What is the status of activating the snowflake-02 bridge in Orbot? snowflake-01 is still pretty much saturated, and snowflake-02 relatively almost unused no news yet from Orbot on status of deployment latest Orbot release was 2023-01-13 will add to S96 agenda and discuss in 2 weeks (On March 2rd) if they are not around forking obfs4proxy, a new name? https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/obfs… rdsys is using onbasca to measure bridge bandwidth https://gitlab.torproject.org/tpo/anti-censorship/rdsys/-/merge_requests/76 bridgestrap is reporing most bridges as non-functional looks similar to an old issue: https://gitlab.torproject.org/tpo/anti-censorship/bridgestrap/-/issues/7 rdsys can handle the situation and will not be a big problem if is not fixed fast == Actions == meskio will write a survival guide on onbasca move the ampcache snowflake fallback forward == Interesting links == https://explorer.ooni.org/chart/mat?probe_cc=IR&since=2023-01-20&until=2023… continued sporadic blocking of cdn.sstatic.net in Iran https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… == Reading group == We will discuss "Detecting Tor Bridge from Sampled Traffic in Backbone Networks" on March 9 https://www.ndss-symposium.org/wp-content/uploads/madweb2021_23011_paper.pdf Questions to ask and goals to have: What aspects of the paper are questionable? Are there immediate actions we can take based on this work? Are there long-term actions we can take based on this work? Is there future work that we want to call out in hopes that others will pick it up? == Updates == Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week. Help with: - Something you need help with. cecylia (cohosh): last updated 2023-02-16 Last week: - FOCI workshop prep - Lox tor browser integration work in progress - https://gitlab.torproject.org/cohosh/tor-browser/-/tree/lox-integration This week: - Lox tor browser integration - continue work on conjure client-side recovery Needs help with: dcf: 2023-02-16 Last week: - opened issue to restart snowflake bridges for haproxy CVE-2023-0056, CVE-2023-25725 https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… Next week: - restart snowflake bridges https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - migrate goptlib to gitlab https://gitlab.torproject.org/tpo/anti-censorship/team/-/issues/86#note_282… (for real) Help with: meskio: 2023-02-23 Last week: - integrate onbasca into rdsys to test bridge speed (rdsys#150) - deploy onbasca in polyanthum - patch onbasca API to be easier to parse (onbasca!60) - investigate bridgestrap issue, is reporting 30% of functional bridges Next week: - Vacation!!! Shelikhoo: 2023-02-16 Last Week: - [Merge Request Awaiting] Add SOCKS5 forward proxy support to snowflake (snowflake!64) - [Research] HTTPT Planning https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/http… - Try to find a place to host another vantage point (not working so far) - WebTunnel @ TorBrowser mobile Next Week: - [Research] WebTunnel planning (Continue) - Try to find a place to host another vantage point - WebTunnel @ TorBrowser mobile onyinyang: 2023-02-23 Last week: - Lox wasm bindings for Tor integration: - encrypted bridge table (this took longer than expected due to confusion about needing to implement deserialize) - level up This week: - continuing with bindings for the rest of the Lox protocols: - issue invitation - check blockage - blockage migration Help with: - questions about best way to handle timing for freshness credentials (fresh for x time period or fresh until x time each day)<this is not especially urgent> Itchy Onion: 2023-02-23 Last week: - Continue working on issue #40108 (standalone proxy bind specific IP) - Created issue #40252 (NAT probetest for standalone proxy) - Foci - Work on updating snowflake plugin for the latest race version (code freeze on Friday) This week: - Holiday - Contine working on issue #40252 (NAT probetest for standalone proxy) hackerncoder: 2023-02-23 last week: - work on monitoring bridges health Next week: - getting ooni-exporter to work with torsf (snowflake) - work on "bridgetester"? cece: 2022-12-22 This week: - working on creating a dummy WhatsApp bot Next week: - My bot is not yet working as expected s? still trying to figure that out Help with: - resources

1 0

TPA-RFC-48: Enable new GitLab Web IDE
by Jérôme Charaoui 21 Feb '23

21 Feb '23

Summary: enable the new VSCode-based GitLab Web IDE, currently in beta, as the default in our GitLab instance # Background The current Web IDE has been the cause of some of the woes when working with the blog. The main problem was that is was slow to load some of the content of the in the project repository, and in some cases even crashing the browser. The [new Web IDE][] announced a few months ago is now available in the version of GitLab we're running, and initial tests with it seem very promising. The hope is that it will be much faster than its predecessor, and using it will eliminate one of the pain points identified by Tor people who regularly work on the blog. [new Web IDE]: https://about.gitlab.com/blog/2022/05/23/the-future-of-the-gitlab-web-ide/ # Proposal Make the new Web IDE the default by enabling the `vscode_web_ide` feature flag in GitLab. ## Affected users All GitLab users. ## Alternatives Users who wish to continue using the old version of the Web IDE may continue to do so, by [adjusting their preferences][]. The removal of the old Web IDE is currently planned for the 16.0 release, which is due in May 2023. [adjusting their preferences]: https://docs.gitlab.com/ee/user/project/web_ide_beta/index.html#stop-using-… # Approval Needs approval from TPA. # Deadline The setting is currently enabled. Feedback on this RFC is welcome until Tuesday, February 28, at which point this RFC will transition to the `adopted` state unless decided otherwise. # Status This proposal is currently in the `proposed` state. # References * [GitLab documentation about the new Web IDE][] * discussion ticket: [tpo/web/lego#51][] [GitLab documentation about the new Web IDE]: https://docs.gitlab.com/ee/user/project/web_ide_beta/index.html#use-the-web… [tpo/web/lego#51]: https://gitlab.torproject.org/tpo/web/lego/-/issues/51

1 0

Job Opening - Product Designer
by Erin Wyatt 17 Feb '23

17 Feb '23

Hi everyone, We have a new opening for a Product Designer! Please help us spread the word. If you are or know someone who would be a good fit and wants to join our awesome UX team, please apply/share. https://www.torproject.org/about/jobs/product-designer/ Have a nice weekend! Erin Wyatt Director of People Operations (she/her) ewyatt(a)torproject.org PGP: 35E7 2A9F 6655 45F9 2CB6 6624 BA0C 9400 F80F 91CE https://www.torproject.org <https://www.torproject.org/> http://2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion/

1 0

A go-ahead to share my blog post
by Cecilia Orji 17 Feb '23

17 Feb '23

Hi Isabela, Kindly go ahead to share the blog post. ~Cecilia

2 2

Moving Tor Browser Weekly to Tuesday (2023-02-21)
by Richard Pospesel 16 Feb '23

16 Feb '23

Next Monday is a TPO holiday, so we will be moving the weekly meeting to Tuesday at 1500 UTC in #tor-meeting on OFTC IRC. best, -Richard

1 0