[tor-bugs] #30121 [Applications/Tor Browser]: Create authoritative, parseable list of Tor Browser's default bridges

[Tor Bug Tracker & Wiki]

#30121: Create authoritative, parseable list of Tor Browser's default bridges
------------------------------------------+-------------------------
     Reporter:  phw                       |      Owner:  phw
         Type:  task                      |     Status:  assigned
     Priority:  Medium                    |  Milestone:
    Component:  Applications/Tor Browser  |    Version:
     Severity:  Normal                    |   Keywords:  tbb-bridges
Actual Points:                            |  Parent ID:
       Points:  1                         |   Reviewer:
      Sponsor:                            |
------------------------------------------+-------------------------
 The ''authoritative'' list of default bridges that Tor Browser ships with
 is part of the [https://gitweb.torproject.org/builders/tor-browser-
 build.git/tree/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js
 tor-browser-build.git] repository. Other repositories however use this
 list; most importantly [https://github.com/OpenObservatory/ooni-
 resources/blob/master/bridge_reachability/tor-bridges-ip-port.csv OONI],
 as part of the "TCP Connect" scan, and possibly others. Having the
 authoritative list in tor-browser-build.git is error-prone because
 whenever it changes, we need to manually sync OONI's list. (We now have
 [https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/DefaultBridges
 a wiki page] that maps our default bridges to their respective owners but
 the page can be edited by anyone and can therefore not be authoritative.)

 To solve this problem, we could create a separate, authoritative list of
 these default bridges. We also need this list to be easy to parse, e.g.,
 in the form of a simple CSV file. irl mentioned on IRC that our CI
 infrastructure can then notify us if repositories that include default
 bridges are out-of-date. In fact, we could even automate the inclusion of
 default bridges in other repositories:
 [https://trac.torproject.org/projects/tor/ticket/30006#comment:8 boklm
 mentioned] that tor-browser-build.git could automatically generate the
 JavaScript file that includes default bridges, and OONI may be able to do
 the same.

 To get things started, here's what I propose:
 * Create a new git repository, say tor-browser-default-bridges.git, that
 contains our list of default bridges as CSV files.
 * This repository is public and can therefore be referenced and included
 by other projects.
 * This repository is maintained by the anti-censorship team, which takes
 responsibility that its content is up-to-date.

 Does this sound reasonable? Is there a simpler solution?

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/30121>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online