- tor-project - lists.torproject.org

OONI Monthly Report: June 2020
by Maria Xynou 22 Jul '20

22 Jul '20

Hello, Throughout June 2020, the OONI team worked on the following sprints: * Sprint 14 - Ponyo (1st June 2020 - 7th June 2020) * Sprint 15 - Globster (8th June 2020 - 21st June 2020) * Sprint 16 - Neon (22nd June 2020 - 30th June 2020) Our work can be tracked through the various OONI GitHub repositories: https://github.com/ooni Highlights are shared in this report below. ## Released OONI Probe Mobile 2.5 We released OONI Probe Mobile 2.5! Android: https://github.com/ooni/probe-android/releases/tag/v2.5.0 iOS: https://github.com/ooni/probe-ios/releases/tag/v2.5.0 Highlights from the latest release include: 1) Circumvention tool testing: The latest release includes OONI Probe tests for measuring the blocking of Tor & Psiphon! 2) 5 new languages: Thanks to the Localization Lab community, the OONI Probe mobile app is now also available in Indonesian, Thai, Romanian, Slovak, and Icelandic (in total, the OONI Probe mobile app is now available in 20 languages!) As part of the iOS release, we also rewrote NDT to increase its reliability and measurement accuracy, and wrote the Telegram, NDT, and DASH tests in golang. ## OONI Probe desktop app In June 2020, we made two OONI Probe desktop app releases: * OONI Probe Desktop 3.0.2: https://github.com/ooni/probe-desktop/releases/tag/v3.0.2 * OONI Probe Desktop 3.0.3: https://github.com/ooni/probe-desktop/releases/tag/v3.0.3 These releases feature bug fixes and other improvements based on community feedback. ## Making the OONI Probe apps rely entirely on the golang engine As part of our ongoing efforts to make the OONI Probe apps rely entirely on the golang engine, we: * Used JCenter to fetch probe-engine on Android: https://github.com/ooni/probe/issues/1191 * Updated to the latest version of probe-cli/probe-engine: https://github.com/ooni/probe/issues/1178 * Made a series of updates: https://github.com/ooni/probe-engine/issues/689 ## Adding support for configuring push notifications Our goal is to be able to send push notifications to OONI Probe mobile app users through the use of Countly, which enables us to include links (such as OONI Run links for coordinated OONI Probe testing) in push notifications. To this end, we evaluated how to manage the collection of app usage metrics, crash reports, and privacy settings, as documented through the following ticket: https://github.com/ooni/probe/issues/1182 We also made progress on implementing countly on Android: https://github.com/ooni/probe-android/pull/341 ## Adding support in OONI Probe for availability testing of the circumvention tools Tor, obfs4proxy, and Psiphon We have completed our work related to adding support in OONI Probe for availability testing of Tor, obfs4proxy, and Psiphon. The new Tor and Psiphon tests are available through the recently launched OONI Probe desktop app (https://ooni.org/install/desktop) In June 2020, we also implemented the STUN server reachability experiment: https://github.com/ooni/probe-engine/issues/243 ## Improving censorship circumvention tool methodologies by including performance metrics We completed our (short-term) work on improving our methodologies for measuring censorship circumvention tools by measuring the performance of those tools as well. As part of our final relevant activities, we: * Recorded website accessibility performance metrics when using Psiphon: https://github.com/ooni/probe-engine/issues/404 * Improved the data format versioning: https://github.com/ooni/probe-engine/issues/423 * Allowed using an external tor binary to run ndt7, DASH, and urlgetter over it: https://github.com/ooni/probe-engine/issues/587 ## Developing OONI Probe orchestration logic that is specific to circumvention tool testing We completed our work related to developing OONI Probe orchestration logic that is specific to circumvention tool testing. As part of our final relevant activities, we: * Wrote an integration test for private Tor bridges: https://github.com/ooni/probe-engine/issues/721 * Stripped private bridge addresses: https://github.com/ooni/probe-engine/issues/643 * Included the country code in the Tor query string: https://github.com/ooni/probe-engine/issues/629 ## Making OONI Probe’s reporting logic more resilient to censorship We completed our (short-term) efforts related to making OONI Probe’s reporting logic more resilient to censorship. As part of our final relevant activities, we: * Discussed requirements for detecting the blocking of OONI services in the pipeline: https://github.com/ooni/backend/issues/417 * Created new domain names: https://github.com/ooni/backend/issues/424 * Implemented a prototype of Probe Services blocking detection: https://github.com/ooni/backend/issues/428 * Implemented failover between available OONI data centers: https://github.com/ooni/probe-engine/issues/621 * Used best available OONI data center for orchestration and other services: https://github.com/ooni/probe-engine/issues/651 We did an analysis (https://github.com/ooni/probe/issues/886) using the fact that we added support for probes to failover to cloudfront collectors, and we did not notice any probes failing over using this method. We have not identified any cases of blocking of OONI infrastructure. That said, we will continue to do more investigations and eventually automate the process. ## Improving URL testing ### Implementing beta quality backend logic for prioritising URLs As part of our work on implementing beta quality backend logic for the prioritization of URLs, we worked on refactoring and improving our URL prioritization backend (and on creating an internal Grafana dashboard). See: https://github.com/ooni/pipeline/pull/321 Moreover, we started adding an haproxy server in front of the URL prioritisation backend so that we are able to start using it in production for a percentage of the probes out there. See: https://github.com/ooni/sysadmin/pull/446. ### Implementing beta quality frontend to support management of the URL priorities In order to implement a beta quality frontend to support the management of URL priorities, we started off by reviewing the relevant priorities. As part of this process, we documented the next steps in the following tickets: https://github.com/ooni/backend/issues/429 https://github.com/ooni/ooni.org/issues/524 ## Analyzing data to extract website metrics As part of our ongoing data analysis work to extract website metrics, we published an aggregation API endpoint and started working on creating a page to try out the new aggregation API. The goal of this page is to query the API for different kinds of data and to render charts based on that data. Eventually, these charts will be integrated in the country pages of OONI Explorer. See: https://github.com/ooni/explorer/issues/463 Our initial experiment for trying out the new aggregation API is available here: https://codesandbox.io/s/nivobar-extra-layers-pbgg4?file=/src/index.js ## Presenting website measurements to account users We are working towards enabling community members to have access to advanced and database-heavy views of website-centric measurements (through accounts that we will create). To this end, we started off by discussing and deciding what it means to have an account within the context of the various OONI platforms: https://github.com/ooni/ooni.org/issues/434 As part of this research, we wrote an internal document outlining our plans for implementing accounts and authentication to OONI services. We also documented the use cases (user stories) for these accounts, feedback and community requests pertaining to accounts (as communicated to us through a pull in a previous community meeting, as well as through other long-term interactions with community members), as well as implementation details and requirements. We also worked on creating mock-ups for website-centric views: https://github.com/ooni/explorer/issues/472 ## Improving our server infrastructure As part of our ongoing work to improve our server infrastructure, we improved the performance of the counters table (https://github.com/ooni/backend/issues/411) and we made improvements to the monitoring of our infrastructure (https://github.com/ooni/backend/issues/427) ## Testing and quality assurance We made progress on improving the quality of our software through better testing and quality assurance procedures. We performed data analysis based on specific measurements (https://github.com/ooni/probe-engine/issues/662) and implemented changes (described below in detail) to simplify subsequent data analysis attempts. We also further evaluated the code for selecting the closest OONI probe service API among the available data centers (HK, MIA, AMS), and extended this functionality to OONI orchestration. Specifically, we: * Performed experiments and data analysis based on measurements performed in India (which resulted in a blog post): https://github.com/ooni/probe-engine/issues/662 * Simplified OONI data analysis by ensuring that the resolver is added to the measurement: https://github.com/ooni/probe-engine/issues/642 * Simplified OONI data analysis by setting the DNS cache to null when empty: https://github.com/ooni/probe-engine/issues/658 * Improved urlgetter measurements: https://github.com/ooni/probe-engine/issues/656 * Used best data center providing the probe service API for orchestration and other services: https://github.com/ooni/probe-engine/issues/651 * Wrote an integration test for private Tor bridges: https://github.com/ooni/probe-engine/issues/721 Throughout June 2020, we focused quite a bit on improving the data quality of OONI measurements. ## Published report on the blocking of DNS over TLS in Iran In June 2020, we published a research report, titled "DNS over TLS blocked in Iran", which is available here: https://ooni.org/post/2020-iran-dot/ We investigated whether DoT works in Iran by gathering a list of 31 well-known DoT endpoints and running experiments from four distinct Iranian mobile and fixed-line Internet Service Providers (ISPs): MCI, TCI, Irancell, and Shatel. We discovered that: * 57% of the endpoints are blocked on a least one ISP; * the blocking is not implemented uniformly across ISPs; * most blocking happens by interfering with the TLS handshake; * in some cases TLS handshake blocking seems to depend on the SNI, while in other cases it seems to depend strictly on the TCP endpoint being used; * forcing TLSv1.3 does not change the rate of successful TLS handshakes compared to letting the server choose a TLS version between v1.0 and v1.3. In our report, we share details from our experiments and findings. This research is part of our ongoing efforts to expand and improve upon our measurement methodologies. ## Published report on TLS blocking in India In collaboration with India’s Centre for Internet and Society (CIS), we co-published a research report investigating TLS blocking in India. This report is available here: https://ooni.org/post/2020-tls-blocking-india/ This investigation sought to understand whether there were cases of TLS blocking that were not only caused by the value of the Server Name Indication (SNI) field in the ClientHello TLS message, but also by the destination IP address. This was part of our efforts to expand our SNI blocking methodology (discussed here: https://ooni.org/post/2020-iran-sni-blocking/) To this end, we wrote and ran a series of experiments (that will eventually be integrated into the OONI Probe measurement engine) to measure the blocking of four domains (facebook.com, google.com, collegehumor.com, and pornhub.com) on three popular Indian ISPs: ACT Fibernet (fixed line), Bharti Airtel, and Reliance Jio (mobile). We recorded SNI-based blocking on both Bharti Airtel and Reliance Jio. We also discovered that Reliance Jio blocks TLS traffic not just based on the SNI value, but also on the web server involved with the TLS handshake. We also noticed that ACT Fibernet’s DNS resolver directs users towards servers owned by ACT Fibernet itself. Such servers caused the TLS handshake to fail, but the root cause of censorship was the DNS. We also found that one of the tested endpoints (for collegehumor.com:443) does not allow establishing a TCP connection from several vantage points and control measurements. Yet, in Reliance Jio, we saw cases where the connections to such endpoints completed successfully and a timeout occurred during the TLS handshake. This is likely caused by some kind of proxy that terminates the TCP connection and performs the TLS handshake. ## Expanding OONI Probe measurement methodologies Our aforementioned research reports on DNS over TLS blocking in Iran (https://ooni.org/post/2020-iran-dot/) and TLS blocking in India (https://ooni.org/post/2020-tls-blocking-india/) document our ongoing efforts to expand our measurement methodologies. The experiments that we design and run as part of these research efforts will eventually be integrated into OONI Probe and shipped as part of our apps. Some of our efforts on expanding our measurement methodologies are also documented through the following tickets: https://github.com/ooni/probe-engine/issues/624 https://github.com/ooni/probe-engine/issues/576 https://github.com/ooni/probe-engine/issues/659 ## Published report of OTF Information Controls Fellow Over the last year, OONI has had the opportunity to serve as the host organization of OTF Information Controls Fellow, Chinmayi S K (https://www.opentech.fund/about/people/chinmayi-sk/) In June 2020, we published Chinmayi's research report, titled "Those Unspoken Thoughts: A study of censorship and media freedom in Manipur, India". Summary of report: https://ooni.org/post/2020-those-unspoken-thoughts-otf-fellow-report/ Full length report: https://ooni.org/documents/those-unspoken-thoughts-otf-fellow.pdf As part of her fellowship, Chinmayi researched internet censorship in Manipur, India, and its effect on the womxn in the region. To investigate internet censorship, Chinmayi ran OONI Probe in various regions of India and analyzed relevant OONI measurements. To explore the impact of internet censorship on womxn in the region and to investigate restrictions to media freedom, she circulated a survey and carried out interviews. Throughout her fellowship, OONI provided research, editing, and data analysis support. When we published Chinmayi’s report in June 2020, we also assisted with relevant outreach activities. ## Published statement in support of the OTF Following the firing of OTF’s leadership, we published a statement in support of the OTF, explaining why the OTF is essential for internet freedom. Our statement is available here: https://ooni.org/post/2020-06-19-save-internet-freedom-support-the-open-tec… ## Collaboration with Azerbaijan Internet Watch ### Published guest blog post to encourage more OONI Probe testing in Azerbaijan To encourage more OONI Probe testing in Azerbaijan, we published a guest blog post (in Azerbaijani) written by Arzu Geybullayeva of Azerbaijan Internet Watch (with whom we partner). This blog post is available here: https://ooni.org/post/2020-azerbaijan-ooni-probe-testing/ The post provides step-by-step instructions for OONI Probe testing, particularly with regards to the testing of media websites and circumvention tools, which present signs of blocking based on OONI data analysis. ### Data analysis As part of our partnership with Azerbaijan Internet Watch, we analyzed all OONI measurements collected from Azerbaijan between 1st January 2020 to 30th June 2020 (https://github.com/ooni/ooni.org/issues/543) based on which we produced relevant charts and wrote a report. ## Collaboration with Netalitica Netalitica researchers continued to do great work in reviewing and updating the Citizen Lab test lists (https://github.com/citizenlab/test-lists) In June 2020, we reviewed URLs shared by Netalitica researchers and added them to the Turkish test list: https://github.com/citizenlab/test-lists/pull/642 We also made updates to the Azerbaijan (https://github.com/citizenlab/test-lists/pull/640) and Hong Kong (https://github.com/citizenlab/test-lists/pull/641) test lists, based on URLs shared by community members. ## Press coverage RESET interviewed the OONI team and published an article about OONI. This article was published in: * German: https://reset.org/blog/ooni-software-spuert-menschenrechtsverletzungen-im-i… * English: https://en.reset.org/blog/ooni-free-software-designed-detect-human-rights-v… DARK Reading also published an article that mentions OONI Probe, following an interview with OONI’s Arturo. This article is published here: https://www.darkreading.com/cloud/no-internet-access-amid-protests-heres-ho… ## Community use of OONI data ### Psiphon Data Engine (PDE) Over the last year, we have collaborated with Psiphon on integrating OONI measurements into a new platform, called Psiphon Data Engine (PDE). This platform displays OONI and M-Lab measurements, along with Psiphon metrics, through an interactive dashboard. In June 2020, Psiphon launched the PDE, which is available here: https://psix.ca/ ### Report on the blocking of Blogger in Lebanon Through the use of OONI Probe and OONI data, SMEX examined the blocking of Blogger in Lebanon. They published a report based on their findings, which is available here: https://smex.org/ar/%d8%ad%d8%ac%d8%a8-%d8%a8%d9%84%d9%88%d8%ba%d8%b1-%d9%8… ### Report on potentially blocked media in Belarus In June 2020, Human Constanta published a report examining several cases of network interference in Belarus. As part of their study, they also used OONI Probe to examine the blocking of several media websites. Their report (which includes OONI findings) is available here: https://humanconstanta.by/chto-proisxodilo-s-internetom-v-belarusi-19-iyuny… ### 2019 Annual Report on Digital Rights in Venezuela Our Venezuelan partners, IPYS Venezuela, published their 2019 annual report on digital rights in Venezuela, which is available here: https://ipysvenezuela.org/2020/05/17/desconexion-y-censura-reporte-anual-de… This report discusses censorship findings that they discovered through the use of OONI Probe and OONI data. ### Blocking of YouTube in Venezuela Through the use of OONI Probe and OONI data, our local partners in Venezuela reported the blocking of YouTube: https://twitter.com/ipysvenezuela/status/1271196383463247872 ## Community activities ### Internet Measurement Village 2020 Throughout June 2020, we organized and hosted the first Internet Measurement Village (IMV) 2020. Information about the event is available through our relevant blog post: https://ooni.org/post/2020-internet-measurement-village/ The IMV is an online community event -- dedicated to discussions around internet measurement -- that took place throughout June 2020, starting on 10th June 2020 and ending on 3rd July 2020. During this 4-week period, we hosted one session almost every day (on weekdays), all of which were live-streamed on the OONI YouTube channel: https://www.youtube.com/c/OONIorg In total, we hosted 18 live-streamed sessions, covering a wide range of internet measurement projects, as well as local censorship measurement projects, advocacy efforts against internet shutdowns, and censorship circumvention tool projects. To encourage participation, we hosted a live chat on several platforms (YouTube chat, Slack, IRC) and, on average, each presenter received around 10 questions from the viewers. All questions discussed during each session are available through this pad: https://pad.riseup.net/p/imv2020-keep Apart from hosting 18 live-streamed sessions, we also worked on promoting each session through the creation of relevant social media assets, as well as through outreach on multiple mailing lists and on all our social media platforms (Twitter, Mastodon, Facebook, Instagram). The Internet Measurement Village 2020 also featured an online social event, the IMV2020 Distance Disco, hosted by Sandy Ordonez on the following platform: https://distancedisco.nl/ At the end of the Internet Measurement Village 2020, we shared a survey to collect community feedback and learn how we can host better events in the future. Our survey is available here: https://ooni.typeform.com/to/cPVT4ILB As all the live-streamed sessions of the IMV will continue to live on the OONI YouTube channel, we hope that these recordings will serve as a valuable resource on internet measurement for the internet freedom community. ### OONI presentation at the Internet Measurement Village 2020 On 10th June 2020, as part of the Internet Measurement Village 2020 (that we organized and hosted throughout June 2020), we live-streamed a presentation about OONI. The video recording of our presentation is available here: https://www.youtube.com/watch?v=SES8PAeQvvs ### Online discussion of findings of OTF Information Controls Fellow research report Over the last year, OONI has served as the host organization for OTF Information Controls Fellow, Chinmayi SK, whose research report was published on the OONI website in mid-June 2020 (see: https://ooni.org/post/2020-those-unspoken-thoughts-otf-fellow-report/) On 25th June 2020, we hosted a session on the OONI Slack channel (https://slack.ooni.org/) -- bridged with IRC -- to provide Chinmayi an opportunity to present and discuss her findings with the community. As part of this session, Chinmayi discussed her research findings in depth, and received several questions from participants. ## Userbase In June 2020, 7,657,872 OONI Probe measurements were collected from 5,942 networks in 208 countries around the world. This information can also be found through our measurement stats on OONI Explorer (see chart on “monthly coverage worldwide”): https://explorer.ooni.org/ ~ The OONI team. -- Maria Xynou Research & Partnerships Director Open Observatory of Network Interference (OONI) https://ooni.org/ PGP Key Fingerprint: 2DC8 AFB6 CA11 B552 1081 FBDE 2131 B3BE 70CA 417E

1 0

[INFORMATION REQUEST] Onion Service Web Site Deployments
by Matthew Finkel 21 Jul '20

21 Jul '20

(tl;dr: We'd like more information about how onion services are deployed, and whether we should re-think about the current assumption that connections with all onion services are secure. Do you send HTTP (unencrypted/unauthenticated) traffic between the onion service and a remote web server?) Hello everyone, Recently we received a question and concern regarding how Tor Browser interacts with web sites over HTTP. Over the last few years, Tor Browser has increasingly trusted HTTP connections with a .onion address (HTTP+.onion) due to the inherent security properties of onion services. The security assumptions Tor Browser makes about these connections is based on another critical assumption: connections between the onion service and the destination web server are "secure" [0]. This assumption is correct when an onion service is run beside the web server and connections between the two components are over localhost/loopback/etc. However, onion services can connect to a remote web server instead, and when the connection between those hosts/components is not secure then Tor Browser's security assumption about the overall connection is wrong. Let's call this latter configuration an "onion tunnel" (for lack of a better term right now). We are now aware some web sites are deploying onion tunnels where the connection between the onion service and the web server is not secure. As a result, we are considering reverting [1] a change of behavior in Tor Browser where "secure cookies" may leak in plaintext under some circumstances in an onion tunnel deployment. Tor Browser treats connections with onion services as secure in other ways, as well. We'd like more information about how onion services are deployed, and whether we should re-think about the current assumption that all .onion connections are secure. Do you know of deployments where HTTP (unencrypted/unauthenticated) traffic is sent between the onion service and a remote web server? (Please email me privately if you feel more confortable with that.) Thanks, Matt [0] In this context, let's say "secure" means a connection that provides unidirectional authenticity, and bidirectional integrity and confidentiality. TLS is the typical example, but onion services provide these properties, too. [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40033

4 6

Tor Browser meeting notes, July 20th 2020
by Gaba 20 Jul '20

20 Jul '20

Hi! Tor Browser meetings are happening every Monday at 1800UTC on #tor-meeting in irc.oftc.net For the last meeting: Log: http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-07-20-18.00.log… Pad: http://kfahv6wfkbezjyg4r6mlhpmieydbebr5vkok5r34ya464gqz6c44bnyd.onion/p/tor… *************************************************************************************** This pad is shared publicly. *************************************************************************************** == Tor Browser meeting pad! == Next meeting is at Monday 27th July 1800 UTC on #tor-meeting on OFTC. July Schedule: * Monday 20 July 18:00 UTC * Monday 27 July 18:00 UTC Release meetings: https://pad.riseup.net/p/tor-browser-release-meeting-keep Tuesday July 21st 18:00 UTC Wiki page for the team: https://gitlab.torproject.org/tpo/applications/team/-/wikis/home (This channel is logged while meetings are in progress.) (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) Upcoming Releases and other important dates: Latest Releases: 2020.06.30: 10.0a2 - ESR68.10 https://blog.torproject.org/new-release-tor-browser-100a2 2020.06.30: 9.5.1 https://blog.torproject.org/new-release-tor-browser-951 Previous notes: https://lists.torproject.org/pipermail/tor-project/ (Search the tor-project mailing list archive for older notes.) == What project we are working on? == SPONSOR 58 - Tor Browser Security, Performance, & Usability Improvements Milestone: https://gitlab.torproject.org/groups/tpo/-/milestones/11 Parent ticket: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/33664 Timeline: https://nc.torproject.net/s/ow2r6cLgL7Cd9BA == Stuff to do every week == Board https://gitlab.torproject.org/groups/tpo/applications/-/boards - any change? Check reviews not taken! How reviews from last week worked? Any blocker? Tickets on needs review: https://gitlab.torproject.org/groups/tpo/applications/-/issues?scope=all&ut… Merge Requests https://gitlab.torproject.org/groups/tpo/applications/-/merge_requests ------------------------------- ---- 20 July 2020 ------------- ------------------------------- == Announcements [please date] == == Discussion [please date] == [mcs 13 July 2020] How are we tracking desktop esr78 tasks? Are we using the “Sponsor 58” keyword? Or a milestone? For example, tor-browser#33855 does not have any interesting labels; in Trac, it was a child of #33534. https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/33855 for 10.0 release MUST DO we use milestone https://gitlab.torproject.org/groups/tpo/applications/-/milestones/1 for anything 10.0 release related to sponsor 58 and MUST DO we use milestone https://gitlab.torproject.org/groups/tpo/-/milestones/11 for anything that may be able to go into sponsor 58 we use label 'Sponsor 58' 10.0 but not s58 we use label 'TB-10.0-could' Assumptions Tor Browser should make about an active connection with an onion service Fenix hosting on Gitlab (ahf) - Should we get some content into https://gitlab.torproject.org/tpo/applications/fenix/ ? the repository is empty right now and i wonder if we should sync (manually) what there is on mozilla's github? The DoH DNS resolver is blocked by the patch from https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/33962. This means that people who want to test DoH with Tor must risk DNS leaks (DoH itself is proxied, but DoH/TRR has modes that issue native DNS queries in parallel for perf tests) Gitlab CI == Status Updates == Please update the status in the same place every week under your name Name: Week of XYZ (planned): - What you planned for last week. Week of XYZ (actual): - What you did last week. Week of ABC (planned): - What you're planning to do this week. Help with: - Something you may need help with. ahf: Week of 13/6 (planned) - Fenix - Land \r\n issues. - Help with merges/reviews on sbws Week of 13/6 (actually) - SBWS reviews. - Got test instance up and running for first version of our Gitlab Lobby. - Landed \r\n patches. - Got Gitlab-CI to run for MR's and merges. - Updated my Fenix checkout and continued the fight with the build-system. Week of 20/6 (planned): - Fenix - Help with merges boklm: Week of 2020-06-15 (actual): - Made patches to use rootless containers and was able to do builds of Tor Browser for windows-x86_64 and osx-x86_64 (tor-browser-build#23631 and rbm#40001). For some unknown reason the builds based on wheezy are not working. Week of 2020-06-22 (planned): - Add some documentation for rbm#40001 and set the patch as Needs Review - Improve patch for rbm#32272 to handle Ctrl+C Mike: Week of 07/06 (planned): - gecko-dev proxy audit (#40017) Weeks of 07/06-07/20 (actual): - gecko-dev proxy audit, DNS portion (#40017 and #33962) - Hong Kong Happy Path UX discussions - PETS - SANS Tor Talk Week of 07/20 (planned): - gecko-dev proxy audit, Socket portion - Minor congestion control proposal tweaks, from Toke's latest review - Metrics meeting for extra onionperf instances mcs and brade: Week of July 13th (actual): - Commented in tor-browser#33533 (Rebase esr68 patches on top of esr78). - Closed tor-browser#33867 (Disable password manager and password generation). - For tor-browser#33534, reviewed pref changes made in recent Firefox releases. - Created patches for: - tor-browser#33852 (Clean up about:logins (LockWise) to avoid mentioning sync, etc.) - tor-browser#33855 (Don't use site's icon as window icon in Windows) - tor-browser#30682 (Adapt Intermediate Preloading for Tor Browser) Week of July 20th (planned): - Do some testing of the ESR78-based updater (desktop). - Open more issues for things found in tor-browser#33534 (Review FF release notes from FF69 to latest). - Work on some of these “child” issues. sysrqb: Week of 13 July (planned): #33939 Review and land tpo/applications/tor-browser-build!13 (updated toolchains) Update tor browser signing key Week of 13 July (actual): #33939 Had some conversations with Mozilla about providing additional support Discussion about security expectations/assumptions Tor Browser makes about onion services (resulting in #40033) Updated tor browser signing keys Landed !13 Week of 20 July (planned): #33939 #34407 review dev.tpo? Release prep GeKo: Week of July 13 (planned): Vacation Week of July 13 (actual): Vacation Week of July 20: Finish build of application services Help with release Reviews (#27105, #30832, #33954) Go over "Merge Ready" things and actually merge them :) Fix up remaining desktop toolchain issues for alpha toolchain (#34227 + child tickets contain all the things we are aware of currently) Antonela: Week of July 13 (planned): Work on S58 tickets TBA UI Review HTTPS-E Names https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40010 Review Onion Location https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40020 Week of July 13 (actual): Work on S58 tickets TBA UI https://gitlab.torproject.org/tpo/applications/fenix/-/issues/34407 https://gitlab.torproject.org/tpo/applications/fenix/-/issues/34405 https://gitlab.torproject.org/tpo/applications/fenix/-/issues/34406 Reviewed Onion Location https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40020 Week of July 20: Continue working on S58 TBA UI 👀 https://marvelapp.com/prototype/783fhfb Back to S30 - Connect to Tor ft bridges Back to S9 - dev.tpo.org acat: Week of 6th July (planned): - Revise & Rebase #33533 to 79beta and test tor-browser-spec#40001 process - 40010: Improve/Simplify HTTPS-Everywhere Onion Name Implementation - torbutton#40001: Generate tor-browser-brand.ftl from brand.properties and brand.dtd - Iterate on tor-browser#33791: Evaluate Firefox tests - I was thinking of finding the subset of FF tests that pass and putting it in some list/script, so that we can run/keep track of it. +1 (+1, yes, please) Week of 13th July (planned): - Vacations (including today). Week of 6th June (actual): - 40010: Improve/Simplify HTTPS-Everywhere Onion Name Implementation - torbutton#40001: Generate tor-browser-brand.ftl from brand.properties and brand.dtd Week of 20th July: - Iterate on tor-browser#33791: Evaluate Firefox tests - Revise & Rebase #33533 to 79beta and test tor-browser-spec#40001 process - 40024: Go over rebased patches again and reorder pieces where needed Jeremy Rand: Week of 6 July (planned): File some GitLab issues about Namecoin support in macOS/Windows. Work on getting Electrum-NMC 4.0.1 ready. Work on upstreaming Electrum-NMC patches. More NLnet coordination. Publish OTF statement on Namecoin.org. Maybe figure out why email notifications aren't working for me from GitLab. <-- notifications were disabled before, they do not work for a specific project for you? --gaba (Hmm, maybe something was fixed without me noticing, will try again. -Jeremy) Week of 6 July / 13 July (actual): File some GitLab issues about Namecoin support in macOS/Windows. More NLnet coordination. Publish OTF statement on Namecoin.org. Managed to get email notifications from GitLab working by switching mail servers. Seems my previous mail server has a STARTTLS issue that might have been the issue. Week of 20 July (planned): Work on getting Electrum-NMC 4.0.1 ready. Work on upstreaming Electrum-NMC patches. Start coding patches for porting Tor Browser Namecoin support to Windows. -- she/her are my pronouns GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

1 0

Tor Browser Release meeting on July 21st
by Gaba 20 Jul '20

20 Jul '20

Hi! We will be having a Tor Browser release meeting on Tuesday July 21st. Meeting pad: http://kfahv6wfkbezjyg4r6mlhpmieydbebr5vkok5r34ya464gqz6c44bnyd.onion/p/tor… cheers, gaba -- she/her are my pronouns GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

1 0

Network meeting, July 20th
by Gaba 20 Jul '20

20 Jul '20

Hi! Network meetings are happening every Monday at 1700UTC on #tor-meeting in irc.oftc.net. Everyone is welcome to participate in them! Meeting Log: http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-07-20-16.58.log… Contents of the meeting pad: == Network meeting pad! == Next meeting is at Monday 27th July 1700 UTC on #tor-meeting on OFTC. June Schedule: * Monday 20 July 17:00 UTC * Monday 27 July 17:00 UTC Welcome to our meeting! We meet each month at: Mondays at 1700 UTC On #tor-meeting on OFTC. (This channel is logged while meetings are in progress.) (See https://lists.torproject.org/pipermail/tor-project/2017-September/001459.ht… for background.) Want to participate? Awesome! Here's what to do: 1. If you have updates, enter them below, under your name. 2. If you see anything you want to talk about in your updates, put them in boldface! 3. Show up to the IRC meeting and say hi! After each week's meetings, the contents of this pad will be sent to tor-project @ lists.torproject.org. After that is done, the pad can be used for the next week. == Previous notes == (Search the tor-project mailing list archive for older notes.) 15 June: https://lists.torproject.org/pipermail/tor-project/2020-June/002877.html 22 June: https://lists.torproject.org/pipermail/tor-project/2020-June/002890.html == Stuff to do every week == Let's check and update our roadmap: What's done, and what's coming up? Any change? Board: https://gitlab.torproject.org/groups/tpo/core/-/boards S28 & S30 - Continue after October - Ahf - maybe dgoulet can do some of this after August? S55 - Nickm & dgoulet, ends 15 August Non sponsor stuff DoS defenses = Dgoulet + Asn Library Size reduction = Ahf + Dgoulet sbws = Ahf + Juga Check reviewer assignments! How reviews from last week worked? Any blocker? Here are the outstanding reviews, oldest first, including sbws: Merge requests in Core: https://gitlab.torproject.org/groups/tpo/core/-/merge_requests Let's check out 0.4.4 release status and open tickets! Tickets in 0.4.4.x with no owner. https://gitlab.torproject.org/dashboard/issues?scope=all&utf8=%E2%9C%93&sta… nickm: https://gitlab.torproject.org/dashboard/issues?scope=all&utf8=%E2%9C%93&sta… dgoulet: https://gitlab.torproject.org/dashboard/issues?scope=all&utf8=%E2%9C%93&sta… ahf: https://gitlab.torproject.org/dashboard/issues?scope=all&utf8=%E2%9C%93&sta… asn: https://gitlab.torproject.org/dashboard/issues?scope=all&utf8=%E2%9C%93&sta… Core Tor Releases: https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/CoreTorRele… == Reminders == * Remember to "/me status: foo" at least once daily. * Remember that our current code reviews should be done by end-of-week. * Make sure you are in touch with everybody with whom you are doing work for the next releases. * Check other's people call for help in their entries. Volunteers need help. Please help them when you are around. Maybe we should have times of day when different people are responders, and expectations of who helps. ------------------------------- ---- 20 July 2020 ------------------------------- == Announcements [please date] == == Discussion [please date] == issues in https://gitlab.torproject.org/tpo/core/team/-/issues anybody interested in the gitlab/appveyor/gitlab script unification? (nickm + ahf will chat; ahf can't start this week) when are we supposed to figure out 045 scope? 046 scope? Let's plan to talk about 045 on next Thursday (30 July) === Active Proposed Policies === * Pull Request Guidelines (stalled) === Design proposals under discussion === 315: require more fields in directory documents (still waiting [6/1]) 316: flashflow (asn and nickm are reviewing, should schedule discussion with pastly. [5/18]) 317: dns (under discussion on ML [5/18]) 318: limit protovers (waiting for more commment; needs discussion [6/1]) 319: wide everything (nick replied on ml; waiting for more discussion [6/1]) 320: tap out again - Do we have a consensus to replace this with a "deprecate v2 onion services" proposal? If so, who writes it? [6/1] protover rethinking (teor's email to tor-dev) (nick needs to reply [5/18]) 321: happy families (need feedback [6/1]) 322: dirport linkspec (need feedback [6/1]) == Recommended links == == Updates == Name: Week of XYZ (planned): - What you planned for last week. Week of XYZ (actual): - What you did last week. Week of ABC (planned): - What you're planning to do this week. Help with: - Something you may need help with. PLEASE DO NOT BULK-DELETE THE OLD ENTRIES! Leave the "Planned" parts! Leave the parts for last week and this week! (feel free to delete your own stuff that's more than 1-2 weeks old) Nick: Week of 13 July (planned): - Revise my working checklists, and distribute them? - Keep an eye on blog comments for release posts - Review and merge stuff, with prioirity for 044 fixes. - Help with 044 fixes. - S55 hacking - Misc tool and technical debt hacking - Keep an eye on OpenSSL bug status (https://github.com/openssl/openssl/issues/12377) Week of 13 July (actual): - Discussed issues with API and exit-blocking - S55 hacking and review - General hacking and review - Misc tool and technical-debt hacking Week of 20 July (planned): - Catch up on emails - Still keep an eye on openssl bug status - Chutney attack! - Try to wrap up all s55 work with dgoulet - Try to make 044 progress as needed/possible - Work on checklists more. - ahf: Week of 13/6 (planned) - Fenix - Land \r\n issues. - Help with merges/reviews on sbws Week of 13/6 (actually) - SBWS reviews. - Got test instance up and running for first version of our Gitlab Lobby. - Landed \r\n patches. - Got Gitlab-CI to run for MR's and merges. - Updated my Fenix checkout and continued the fight with the build-system. Week of 20/6 (planned): - Fenix - Help with merges asn: Week of 29/06 (planned): - More PoW work - A look at v3 metrics. - More OBv3 hackathon. Someone is hacking on distinct descriptor support. - Need to adapt the gitlab process to using MRs as discussed on Thurdsay. - A bunch more reviews & merges. Week of 29/06 (actual): - Lots of network team reviews/merges/bugfixes work. - Some v3 metrics work. - More OBv3 reviews. - Triaging gitlab tickets. Week of 06/07 (planned); - Going AFK on Friday so biggest priority is to finish all reviews/merges/044 tickets by then. jnewsome: Week of July 6 (planned): - Get code-coverage PR cleaned up and merged - Implement phantom memory-marshalling optimization "for real" and merge Week of July 6 (actual): - Got code-coverage tracking merged into shadow - Reworked CI to move logic from GH proprietary config to shell scripts, and added scripts to run it locally via Docker - More work on memory-marshalling mmap optimization: wrote an IntervalMap in Rust to track mmap state Week of July 13 (planned): - Memory-marshalling mmap optimization Week of July 13 (actual): - Finished up and merged IntervalMap https://github.com/shadow/shadow/pull/886 - Started making Shadow C code callable from Shadow Rust code (bindgen + wrappers) https://github.com/shadow/shadow/pull/887 - Prototyped some different approaches of modelling Shadow's object graph in Rust https://github.com/sporksmith/dev-journal/blob/master/rust-ownership/Shadow… Week of July 20 (planned): - Write MemoryManger in Rust to implement mmap-based memory access in Shadow/Phantom - OoO next week - have fun! pastly: Week of 18 May (planned): - Finish bones of external FlashFlow repo (python?) to control tor clients that perform FF measurements - Finish bones of little-t tor changes s.t. measurement can be performed - Discuss FlashFlow with network team devs as they have questions c: Week of July 6 (actual): - fix up chutney #40002 Week of July 13 (actual): - #40002 merged in Week of July 20 (planned): - tor #21524 and other IPv6-tagged issues dgoulet: Week of 13/07 (actual): - s55, s55 and s55 (IPv6). :) Week of 20/07 (planned); - s55 - New list of fallback dirs -- she/her are my pronouns GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

1 0

Package wiki discontinuation
by Damian Johnson 18 Jul '20

18 Jul '20

Hi all. Just a quick friendly head's up that now that Trac is read-only the packages wiki I've maintained these last three years will be discontinued... https://trac.torproject.org/projects/tor/wiki/doc/packages I suspect hardly anyone used it, but if anyone would care to create a GitLab replacement the script to keep such a page up to date is located at... https://gitweb.torproject.org/doctor.git/tree/package_versions.py Cheers! -Damian

1 0

Anti-censorship meeting notes,16 July 2020
by Cecylia Bocovich 17 Jul '20

17 Jul '20

Hi! Here are our meeting minutes: http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-07-16-15.58.html And here is our meeting pad: Anti-censorship work meeting pad -------------------------------- Next meeting: Thursday July 16th 16:00 UTC Weekly meetings, every Thursday at 16:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress). == Goal of this meeting == Weekly checkin about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at Tor. == Links to Useful documents == Our anti-censorship roadmap: Roadmap: https://gitlab.torproject.org/groups/tpo/anti-censorship/-/boards The anti-censorship team's wiki page: https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/home Past meeting notes can be found at: https://lists.torproject.org/pipermail/tor-project/ Tickets that need reviews: from sponsors we are working on: All needs review tickets: https://gitlab.torproject.org/groups/tpo/anti-censorship/-/merge_requests?s… Sponsor 30 https://gitlab.torproject.org/groups/tpo/-/milestones/4 https://gitlab.torproject.org/groups/tpo/-/milestones/7 https://gitlab.torproject.org/groups/tpo/-/milestones/5 https://gitlab.torproject.org/groups/tpo/-/milestones/6 Sponsor 28 must-do tickets: https://gitlab.torproject.org/groups/tpo/-/milestones/10 possible tickets: https://gitlab.torproject.org/groups/tpo/-/issues?scope=all&utf8=%E2%9C%93&… Anti-censorship related tickets that we want other teams to fix: https://pad.riseup.net/p/tor-anti-censorship-tickets-keep <-- it will be moved into gitlab with TPO labels == Announcements == The censorship track at PETS starts at 16:40 UTC today at https://www.youtube.com/watch?v=JdDgAuuilZk and a recording of the VPN talk we're going to discuss next week is available at https://www.youtube.com/watch?v=3aSO4ZMKjmY == Discussion == Any naming suggestions for our experimental BridgeDB successor? https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/Baby-Name-Bo… == Actions == == Interesting links == Privacy Enhancing Technologies Symposium 2020 is this week. The censorship session is 16:40–17:55 UTC on Thursday. https://petsymposium.org/2020/program_UTC.php I skimmed the program for papers that look relevant to us. There's one on VPN usage, two on decoy routing, and one on rendezvous using cryptocurrency. Emotional and Practical Considerations towards the Adoption and Abandonment of VPNs as a Privacy-Enhancing Technology https://petsymposium.org/2020/files/papers/issue1/popets-2020-0006.pdf Running Refraction Networking for Real https://petsymposium.org/2020/files/papers/issue4/popets-2020-0073.pdf SiegeBreaker: An SDN Based Practical Decoy Routing System https://petsymposium.org/2020/files/papers/issue3/popets-2020-0051.pdf MoneyMorph: Censorship Resistant Rendezvous using Permissionless Cryptocurrencies https://petsymposium.org/2020/files/papers/issue3/popets-2020-0058.pdf == Reading group == We will discuss "Emotional and Practical Considerations Towards the Adoption and Abandonment of VPNs as a Privacy-Enhancing Technology" on July 23rd https://petsymposium.org/2020/files/papers/issue1/popets-2020-0006.pdf https://www.youtube.com/watch?v=jksejehBQII Questions to ask and goals to have: What aspects of the paper are questionable? Are there immediate actions we can take based on this work? Are there long-term actions we can take based on this work? Is there future work that we want to call out, in hopes that others will pick it up? == Updates == Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week. Help with: - Something you need help with. phw: This week (2020-07-16): Experimented with a generalisation of BridgeDB. ...based on "Clean Architecture": https://blog.cleancoder.com/uncle-bob/2012/08/13/the-clean-architecture.html Added a handful of new papers to CensorBib. Merged obfs4 bridge setup guide for Windows. Reviewed tpo/anti-censorship/bridgedb#40003. Merged tpo/anti-censorship/bridgedb#33647. Merged tpo/anti-censorship/bridgedb#33835. Next week: Wrap up tpo/anti-censorship/wolpertinger#34259. Help with: cecylia (cohosh): last updated 2020-07-16 Last week: - PETS 2020 conference participation and artifact committee stuff - Getting really bogged down with sponsor 28 evaluation work - some snowflake mobile UI discussion and reviews - opened a ticket to implement more NAT discovery at browser proxies (snowflake-webext#13) - ran some performance tests on a symmetric NAT to check for improvements from #34129 (#33666) This week: - take a look at #25595 - NAT discovery at proxies (snowflake-webext#13) - snowflake sponsor 28 evaluation work - maybe take a look at snowflake#21314 or some other blockers on #19001 - continue with GetTor + BridgeDB refactor Needs help with: - review of tor-browser-build#40016 (i'll ping the applications team) juggy : This week: - Dig into the algorithm for how BridgeDB distributes bridges Next week: - Implement audio captchas in moat, figure out how to reduce audio captcha request size - Keep studying BridgeDB to write architectural overview Help with: arlolra: 2020-06-11 Last week: - Next week: - follow ups to #33365 - start on #31201 Help with: - dcf: 2020-07-16 Last week: - reviewed RFC 5780–compatible STUN server for Snowflake broker. - https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - commented on STUN server selection for Tor Browser - https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - archived Snowflake WebExtension 0.4.0 Next week: - find out what went wrong with trying to give cohosh CDN access (snowflake#30510) - set up an etherpad for public bug reporting and link it from https://snowflake.torproject.org/#bugs (snowflake#34435) Help with: Antonela: 2020-07-16 - (S28) Snowflake Android App UI https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - (S30) Making bridges.tpo looks like tpo.org https://gitlab.torproject.org/tpo/anti-censorship/bridgedb/-/issues/34322 - (S30) Planning activities for the user group in HK (happening next week): - Run emma https://gitlab.torproject.org/tpo/ux/research/-/blob/master/scripts%20and%2… - Discovery issues with Bridges flow - working on the script https://gitlab.torproject.org/tpo/ux/research/-/issues/4 agix:2020-07-02 Last week: -Worked on #27984 Next week: -Work on #34318 Help with: -Review of #27984 (It's just a feedback implementation) hanneloresx: 2020-06-25 Last week: - Read existing documentation for BridgeDB. Get acclimated to GitLab. - Started investigating #32117 - Filed and fixed #40003 Next week: - Work on #32117 - Work on #33727 Help with: - thymbahutymba: 2020-04-02 Last week: - CI/CD pipeline for multiarch docker images, which has a problem with the apt tor version even though the apt repository have been changed into the Dockerfile. Next week: Help with: HashikD: 2020-07-16 Last week: - Made designs for Snowflake mobile: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… - #6 Showing users stat about how many clients they served in the past 24 Next week: - Turn Designs in to code - Contemplating Help with: -

1 0

Metrics meeting notes, July 16th
by Gaba 16 Jul '20

16 Jul '20

Hi! Metrics Meetings are happening every Thursday at 15UTC in #tor-meeting in irc.oftc.net Next meeting will be on July 21st and you are all welcome to come! Today we had a very short meeting but woswos presented the project they are working one. Check it out: https://dashboard.captcha.wtf/ Here are the minutes for the meeting of July 16th: Log: http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-07-16-14.59.log… Public pad URL is: https://pad.riseup.net/p/tor-metricsteam-2020.1-keep And here is the pad notes: Links: Metrics Team wiki page: https://gitlab.torproject.org/tpo/metrics/team OnionPerf board: https://gitlab.torproject.org/tpo/metrics/onionperf/-/boards OnionPerf milestone: https://gitlab.torproject.org/groups/tpo/metrics/-/milestones/1 All Metrics Roadmap: https://gitlab.torproject.org/groups/tpo/metrics/-/boards Next meeting: Thursday, July 21st, 15 UTC ----------------------------------------------------- Agenda Thursday, July 16th, 15 UTC ----------------------------------------------------- Data portal UX research Woswos project: https://dashboard.captcha.wtf/ -- she/her are my pronouns GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

1 0

Tor Wiki
by Gaba 15 Jul '20

15 Jul '20

Hey! I have been migrating and updating the wiki from trac into Gitlab. I want to give a brief update on where we are at. Main wiki for The Tor Project is at https://gitlab.torproject.org/tpo/team . It has links to all the other wikis from groups and projects as well as official resources mantained by The Tor Project. Inside each group there is a wiki for that group: Anti-censorship - https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/home Applications - https://gitlab.torproject.org/tpo/applications/team/-/wikis/home Community - https://gitlab.torproject.org/tpo/community/team/-/wikis/home Metrics - https://gitlab.torproject.org/tpo/metrics/team/-/wikis/home Network - https://gitlab.torproject.org/tpo/core/team Network Health - https://gitlab.torproject.org/tpo/network-health/team Sysadmin - https://gitlab.torproject.org/tpo/tpa/team/-/wikis/home UX - https://gitlab.torproject.org/tpo/ux/team/-/wikis/home Operations - https://gitlab.torproject.org/tpo/operations/team/-/wikis/home And inside each project we should have a wiki for specifics of that project. for example: https://gitlab.torproject.org/tpo/metrics/onionperf/-/wikis/home The projects we are working on this year are at: https://gitlab.torproject.org/tpo/team/-/wikis/Sponsors-2020 And past Tor meeting notes and info are at https://gitlab.torproject.org/tpo/team/-/wikis/Meetings There may be missing info or not updated (and I may still be working on it when I have time). If you spot anything please update it or send me a message. thanks! gaba -- she/her are my pronouns GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

1 0

User feedback program: past, present and future (2018-2021)
by gus 14 Jul '20

14 Jul '20

Hi, In the last three years, Community and UX teams have been working together to collect user feedback and integrate it into our products while preserving Tor users' privacy. In this email, we're going to explain the present, how it works, and our next phase. ## 1. User Advocate Since 2018, the Community team works with an intern from Outreachy[0] as a User Advocate. You can read more about this project here: "Help us support our users"[1]. Every month, the User Advocate submits to the tor-project mailing list an User Feedback Report with questions and comments from our Frontdesk system and other sources (Reddit, Tor stack exchange, Google Play, blog comments, IRC #tor, etc.). If you were around at that time, maybe you remember Pari presented an user feedback research[2] at the Tor Dev Meeting in Rome, in 2018. You can read our previous user feedback reports here: Cybelle (2018)[3], Wayward (2019)[4], and Cleopatra (2020)[5]. As Nicolei started last month, on May 19th, he sent his first user feedback report[6]. Nicolei's internship will end in August this year. And Outreachy will open a new selection process in September/October. After the report is sent, we discuss the issues and comments at UX and/or Community team meetings on IRC (#tor-meeting). For some of these issues, we open new tickets in Gitlab, our new bug tracker, and the user advocate adds comments to open issues. For example, we have some tickets to improve the website, Tor Browser and other products. We have plans to introduce a global label [user-feedback] to make explicit which issue came directly from users. There's also a proposal to use Discourse, but so far, we only discussed it a few times during the Gitlab process and at the last all hands, and mostly to improve our blog moderation and user feedback. ## 2. User Research: UX feedback and Tor training in the Global South As part of sponsor work, the Community and UX teams have met users face to face during our digital security training in the Global South. We wrote about it and also added some metrics of this project in a blog post[7], "Reaching people where they are." The user research reports are publicly available here[8], and the users we've met during this project informed the work we did to outline User Personas. Personas were made not to frame our work to any target, but instead to reach a common understanding across teams of "Who are Tor users?" and who we are designing for. We also did a session about Users Personas[9] in Stockholm Dev Meeting (2019). We sent a more detailed narrative report regarding the activities to all Tor core contributors in January (2020), where outlines each activity we ran carefully in all the countries we visited. The new Community portal reflects the first step in understanding the different roles we host in our community. The intent is to serve as a home for non-savvy technical people but also technical people as relay operators or onion sites admins to collaborate with Tor. Furthermore, we made public and gave open access to the material at the training section in the Community portal, where we collected and organized the materials that we have used during our travels and meetings with groups. All this content was co-designed with our community based on their needs. The most significant difference from Frontdesk, where users come to us to report issues, this program works with our team members to reach out and go to communities to run usability tests and interviews with users. Both ways of collecting user feedback complement each other. We not just collect feedback but also teach about digital security holistically, to encourage critical users to make decisions by themselves. Threat modelling exercises to understand digital security assets have been run with communities in the Global South. The point about the whole program it's not just a way to collect software feedback. Part of our non-profit work is to educate users about privacy, anonymity and technology as a way to promote and advance human rights. We developed a program focused on building a network of human rights defenders, journalists, whistleblower platforms, digital security trainers, hackerspaces, activists, marginalized communities, and having a stable relationship with them, the people who trust and most need our software. In the last year, we built partnerships in our first Training Program, where NGOs and other organizations in the Global South were running Tor training and UX tests by themselves. We had training in Brazil, Colombia, Mexico, Uganda, Indonesia, and Tanzania. We developed a process of continuous improvement for these organizations to collect feedback from their assistants about our products and the decision they just ran[10]. ## 3. Next steps The next phase of this sponsor will happen from July 2019 - 2020, where we will focus on supporting our partner organizations during this Covid-19 pandemic, the migration to secure spaces for running their activities online and also the spread of remote user research made by them and for us on our recently released improvements in Tor Browser for desktop and Android, and the entire Tor Project new portals. In July, Narrira Lemos will be back to work with us as a fellow from Bertha Institute. The work Nah will be running will be focused on mobiles and per se Tor Browser for Android. She also will give support (as she did in 2019) on coordinating user research with communities. Antonela and Gus UX and Community Team ## Notes [0] Outreachy https://www.outreachy.org/ [1] https://trac.torproject.org/projects/tor/wiki/Outreachy#TheProjects [2] https://gitlab.torproject.org/legacy/trac/-/wikis/org/meetings/2018Rome/Not… [3] Jun 2018 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2018-June/001829.html Jul 2018 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2018-July/001871.html Aug 2018 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2018-August/001940.html [4] Oct 2018 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2018-November/002058.html Nov 2018 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2018-December/002125.html Dec 2018 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2019-January/002176.html Jan 2019 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2019-February/002230.html Feb 2019 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2019-March/002259.html Mar 2019 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2019-May/002311.html Apr 2019 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2019-May/002333.html [5] Dec 2019 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2020-January/002645.html Jan 2020 User Feedback Report - https://lists.torproject.org/pipermail/tor-project/2020-February/002688.html [6] https://lists.torproject.org/pipermail/tor-project/2020-June/002887.html [7] https://blog.torproject.org/reaching-people-where-they-are [8] https://community.torproject.org/user-research/ [9] https://gitlab.torproject.org/legacy/trac/-/wikis/org/meetings/2019Stockhol… [10] https://gitlab.torproject.org/tpo/ux/research/-/tree/master/community https://lists.torproject.org/pipermail/tor-project/2020-May/002850.html -- The Tor Project Community Team Lead http://expyuzz4wqqyqhjn.onion/

1 0