Hi everyone!

We had another weekly Tor Browser meeting yesterday. The IRC meeting log can be found at:

http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-01-14-18.59.log....

The meeting notes are copied below, for your convenience:

Monday January 14, 2019 Discussion: - Google Summer of Code (GSoC) Application (pili - apologies I will likely be afk for the meeting)

- Projects? Volunteer mentors? Could be both Tor Browser or "Applications Team" projects. (GeKo: tjr can imagine to mention the crash report project further) - Plan for Tor Launcher/Torbutton compat with ESR 68 (GeKo: tentative schedule for landing that is 9.0a1; we don't get enough testing for 8.5) - Replacement for donation banner (#29035) (GeKo: I put that on my plate and anto provides the remaining UX items) - Can we move this meeting 30 minutes or 1 hour earlier? (sysrqb now has a partial conflict, but can adjust if changing the meeting is too difficult) (GeKo: tentively moving to 1830UTC, I need to get back to igt0 whether that works for him, too) - next meeting? (GeKo: on Monday is US holiday, so let's meet on 1/22 instead)

pospeselr: Last Week: - updated icons for #25702 (rebranding) and #28546 (windows installer branding) to fix clipping/squashing issue

- reviewed #28711 (arraybuffer metadata in its own arena) and #28329 (TBA+Orbot design)

- backported 1446472 (and than discovered tjr beat me to it lol)

- squashed/rebased #25702

- began work on #25658 (security settings)

boklm - ran into a couple of build issues this past week (just in case you weren't aware):

- https-everywhere explicitly requiring python 3.6 in it's make.sh script (container installs python 3.7 now when just installing the python package)

- issues building servo in the latest alpha branch in tor-browser, didn't delve too deeply into this on Friday since I was on my laptop

[boklm: can you open tickets with some details about those issues?] richard : can do!

This Week: - file tickets for above-mentioned issues - #25658 work (security settings)

pili: likely afk for meeting

Last week:

- Sponsor 8 report

- Tor Browser release meeting

- OTF Onion service SMART objectives

- Starting to look at team budgets

This week:

- Review 2019 needs and priorities

- looking into orbot and trac discussion on mailing lists

GeKo: Last week: - refined patch for #28716 (mingw-w64/clang toolchain) and mapped out remaining things to be done for #28238 - begin-of-the-month admin dance - finally commented on the ideas in doc for #3600 - I reviewed #28705 and started with #25702 and #26858 - wrote patches for #29028 (activate canvas warning improvements), #28874 (WebGL crashes), #28814, and #29081 (hardening of libwinpthread) - helped with bug investigations (#28823, #tra) - looked over #28329 and tor-launcher redesign - looked over sponsor proposals This week: - help with mobile stuff where needed - backport fix for bug 1469916 - work on various issues related to #28238 - work on the donation banner replacement (#29035) - looking closer at https://bugzilla.mozilla.org/show_bug.cgi?id=1376621#c12 - reviews, review, reviews

sysrqb: Last week: Real World Crypto Wrote/sent email about Google Play reviews Worked a little on TBA bootstrap process (#28329) This week: More work on UI for #28329 Finish fastlane patch Review TOPL/Orbotservice ticket (#29080) Update branch for app crash during download (#28705)

mcs and brade: Last week: - Worked on #28044 (Integrate Tor Launcher into tor-browser). - Did some experiments. - Commented in the ticket. - Opened #29045 for dormant mode follow up work (Tor Launcher). - Completed end of quarter/end of year administrative tasks. This week: - #28836 (Links on about:tor are not clickable anymore). - #28885 (notify users that update is downloading). - Work on a proposal for #28044 (Integrate Tor Launcher into tor-browser). - Out of the office on Friday, January 18th.

boklm: Last week: - investigated binutils reproducibility issue and made patch to update binutils to 2.31.1 (#26148) - started a patch for #27531 (Tor Browser 8 crashes trying to print on Linux) - fixed some testsuite issues (#27136, #27114) This week: - continue work on testsuite - test patch for #27531 (Tor Browser 8 crashes trying to print on Linux) - some reviews: #29081, #28716, #28803, #28874 - will be afk on Friday

tjr: Leave is coming, but unsure of dates. Lots of mingw work. "gk: where to track the remaining work for enabling accessibility support on windows, because it's still not functioning properly it seems with the patches we have" tjr: Can you elaborate? And/or show me a not-scary (trustworthy/open source) accessibility tool to test with? [GeKo: accessibility is not working in e10s, see: https://trac.torproject.org/projects/tor/ticket/27503#comment:13 ff. I noted that on the moz bug, see comments 11 and Jacek's reply in comment 19. I have not looked whether there are non-scary tools yet] "gk: --enable-accessibility on mingw-gcc" tjr: Yes, I did not test this (on TaskCluster or otherwise). If switching to mingw-clang is on the horizon, I am not inclined to try and get support for this working on TaskCluster [GeKo: works for me, just so you are aware of that this breaks the mingw-w64/gcc builds once this gets enabled on esr60][tjr: they use different mozconfigs; so it the mingw-gcc builds will stay --disable-accessibility][GeKo, yeah, fine with me] I have an --enable-accessibility, --enable-sandbox, pdbs esr60 build working in TaskCluster. Have requested uplift of a bunch of patches On central; I am personally being plagued by https://bugzilla.mozilla.org/show_bug.cgi?id=1519608 but others don't seem affected TODO: - Uplift the aforementioned esr60 patches - Land small -central patches (--enable-accessibility, Bump MinGW, _WIN32_WINNT) - Investigate ASLR - Investigate if we can ditch binutils We have a next step forward on the rust stuff: https://bugzilla.mozilla.org/show_bug.cgi?id=1376621#c12 It's not significant; but we'll see where to go from here. Am I correct in thinking that this is basically the same thing you did (look for connect/socket/etc calls) except you did it in the source, and this is on the object file? [GeKo: have not looked yet, but can do this week, hopefully; sysrqb thinks the answer is "yes"] Uplifted https://bugzilla.mozilla.org/show_bug.cgi?id=1446472 which will show the Canvas icon if canvas is auto-blocked because it has no user input. Landed https://bugzilla.mozilla.org/show_bug.cgi?id=1509829 which uplifts Tor's "Only reveal the OS in the JS navigator object and not the User-Agent header" I should backport this to esr60.

anto: - working on #28329 - TBA + Orbot - working on #29035 - Newsletter Subscription links - reviewing TBA - added UX improvements ideas for TB on DRL doc for the UX team - reviewing sysrqb's list of GPlay TBA reviews

sisbell: Last week: - #29080 Merge OrbotService and TOPL - did initial prototype and outlined details of changes needed in trac issue - #28803 - Integrate building PT - finished android-pluggable-transport project (ready for review) This Week: - #29080 - Cleanup work and create patches for OrbotService - #27609 - Evaluate Tor Onion Proxy - I’ll setup project in tor-browser-build and create patch as specified in #29080

Georg