tor-project November 2019

tor-project@lists.torproject.org

15 participants
33 discussions

October 2019 report for the UX team
by Antonela Debiasi 22 Nov '19

22 Nov '19

Hello Tor, Tor Browser 9.0 Release ======================= We released Tor Browser 9 in October. We worked in improvements around the New Identity feature, opened a panel in about:preferences#Tor to configure the Tor Network, updated the toolbar by removing the Tor icon as part of the proposal 101, and also we started to give support to the dark theme for darkness fans. If you have any feedback, feel welcome to start a conversation on the ux team list. https://blog.torproject.org/new-release-tor-browser-90 https://gitweb.torproject.org/tor-browser-spec.git/tree/proposals/101-secur… https://lists.torproject.org/cgi-bin/mailman/listinfo/ux User Research ============= The community team has been working on having community.torproject.org in shape, and so we did with our open research methodologies. Nah updated the user research guidelines and listed our past efforts to make them available for the broad community. We also included the latest versions of the Tor Personas made by Duncan. https://community.torproject.org/user-research We worked on improving the New Identity feature in Tor Browser 9, for so we also collected feedback about it. Nah ran user research with students at the University of Sao Paulo, and we have a lot of great material to discuss for the next iteration. https://nc.riseup.net/s/CkfH4nxrkmGL58K?path=%2FUser%20Research%2F2019%2FBr… <https://nc.riseup.net/s/CkfH4nxrkmGL58K?path=%2FUser%20Research%2F2019%2FBr…> Onion Services ============== As part of the OTF grant, one of the end-users improvements is focused on client-side onion service errors. With the network team, we have been listing the different error scenarios users could experience while reaching onion services. Also, we discussed how to show them to users in a way that is 1. informative and 2. if it is available, allow them to take a recovery path. You can see some UI explorations here: https://trac.torproject.org/projects/tor/ticket/19251#comment:6 Fundraising =========== The Fundraising team launched the end of the year raising funds campaign during October. The topic this year is "Take back the internet." We worked on developing the art concept, Alon worked on the illustrations, and I delivered the different assets to support this campaign. https://marvelapp.com/7f6eha5/screen/62492102 Open Team ========= The UX Team roadmap kanban breathes here: https://dip.torproject.org/groups/torproject/ux/-/boards If you missed those, October weekly meetings notes are here: https://lists.torproject.org/pipermail/ux/2019-October/000464.html https://lists.torproject.org/pipermail/ux/2019-October/000465.html https://lists.torproject.org/pipermail/ux/2019-October/000466.html https://lists.torproject.org/pipermail/ux/2019-October/000467.html https://lists.torproject.org/pipermail/ux/2019-October/000468.html Peace and love, A -- Antonela Debiasi UX Team Lead @antonela E2330A6D1EB5A0C8 https://torproject.org

1 0

Notes from Vegas Meeting NOVEMBER 21 2019
by Erin Wyatt 21 Nov '19

21 Nov '19

Vegas Team Meeting Notes NOVEMBER 21 2019: ** NOTE: No Vegas meeting next Thursday, November 28th, in observance of U.S. Thanksgiving holiday. + OLD BUSINESS - There is a conversation about onion services in a mail thread and the possible creation of a "onion ops team”. Plan: sysrqb will move conversation to email; will put together a proposed plan and send it to vegas-team. + NEW BUSINESS - Sarah: Anyone else willing to make a thank-you video? If yes, contact Sarah ASAP at sstevenson@. - Roger: we should make a list of things that want isa's attention, to help her prioritize when she returns. (Done.) + GENERAL NOTES Philipp: 1. Collection of Snowflake proxy metrics 2. More work on (GetTor) storage limits when saving Tor Browser copies in GitHub 3. More grant writing 4. Created monthly report 5. Finished improving docker image for obfs4 bridges Gus: 1. Did a Tor talk in Roma last Saturday and in UNITO (University of Turin) last Tuesday. 2. We had a meeting with Colombia training partner. 3. Answered some RT/Frontdesk tickets. 4. Finished Community Team October report. Georg: 1. Help with OTF proposal 2. More HackerOne housekeeping 3. Trying to wrap up all my Tor Browser must-items Antonela: 1. Reducing my email backlog after vacations 2. Working on suggesting onions feature in Tor Browser with acat 3. Delivering remaining assets for the end of the year campaign 4. If you need anything urgent from me, please ping me Steph: 1. Eoy Campaign: blog post editing, thank you card, video 2. Newsletter going out today 3. Bottlepay promotion with the Giving Block 4. Pili and I will apply to OTF Learning Lab Anarcat: 1. OONI.tpo now moved out of TPO infrastructure (hosted at netlify) and closed some related accounts (https://bugs.torproject.org/31718) 2. we will need to work on onboarding/offboarding procedures (https://bugs.torproject.org/32519) and especially "what happens to email when people leave" (https://bugs.torproject.org/32558) 3. worked more on Nginx status dashboards to ensure we have good response latency and rates (we're good) 4. reconfirmed mailing list problems as related to DMARC, may hopefully be resolved by next week (https://trac.torproject.org/projects/tor/ticket/29770) 5. wrote a Postfix mail log parser (in lnav) to diagnose email issues in the mail server 6. helped with the deployment of a ZNC bouncer for IRC users (https://trac.torproject.org/projects/tor/ticket/32532) along with fixes to the "mosh" configuration 7. usual grind (email aliases, memory limits on git.tpo, old machine cleanup) 8. TPA meeting coming up on monday Gaba: 1. Reports for S31, SV 2. Helping with grants writing 3. Sponsor 30 follow up 4. talked at seagl last friday 5. scalability meeting today where Rob and Dennis showed some results of experiments. Meeting notes are public in the mailing list. Roger: 0) Most importantly: it's still Oct 31 in my mailbox. I am not even keeping up with each day's new mail now, much less making progress at the backlog. 1) Events: - finished my november burst of events: otf summit and satellite meetings, race pi meeting, 'going dark' debate, cdt keynote. tonight i do a tor lecture at nyu. - i re-contacted the fosdem booth person 2) Funding/Funders: - helped steer the upcoming nsf phantom/snowflake proposal - we now have a shared plan for the shadow dev spot - still spending much of my time thinking about race - thanks, gaba, for taking the lead on our sponsorV report bullet points - we're asking otf learning lab for help 3) Other: - do we have the start of an invite list for the dev mtg? we should get that going. - steph and i helped oliver figure out his deutsche welle text. the text came out yesterday and looks good. we should push it more. - moving forward the "dv certs for onions" pitch to ca/b forum - stalled on enterprise onion service support group - to follow up on: accounts and email policy - i introduced george/david/alex to the ricochet-refresh team - still pending: doh blog post? - pending: reviewing our 2019 draft financials - we should make a list of things that want isa's attention, to help her prioritize when she returns. Sarah: 1. Catching up after vacation. 2. EOY campaign continuing to perform well. 3. Postal appeal letter went out thanks to Al and Jon. 4. Anyone else willing to make a thank-you video? Pili: 1. Reports, reports and more reports 2. Just about keeping up with trac triage 3. Meeting with Colombia Training Partner 4. Meeting about Tor Browser measurements 5. We were not accepted for a booth at FOSDEM :( 6. Participating in a panel about Big data and violence tomorrow Alex: 1. Roadmap coming for network team coming up in December. 2. Gitlab migration test run tomorrow Friday planned! 3. Done with reading over Shadow CVs. 4. Back to coding on some s28 tasks. 5. Planning a "run a relay at home" workshop with the IT union in Denmark for Q1 2020.t Nick: 1. Trying to catch up with email and a dozen other things. Please don't assume that I remember whatever I'm supposed to be doing for you; please feel free to bug me about it. 2. 0.4.2.4-rc is out; the time to report bugs is NOW. If none are found, we might actually put 0.4.2.x-stable ahead of schedule (!). Erin: 1. Shadow dev hiring process 2. Org/corp/general HR stuff 3. Working on handbook clarifications this week Matt: 1. OTF proposal 2. Catchup from last week (was at Fastly event) 3. Tor Browser development Karsten: 1. Got new exit scanner to write properly formatted exit lists and completed an initial review of their correctness.

1 0

Anti-censorship meeting notes, 21 Nov 2019
by Philipp Winter 21 Nov '19

21 Nov '19

Here is our meeting log: http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-11-21-17.59.html And here is our meeting pad: Anti-censorship work meeting pad -------------------------------- Next meeting: Thursday November 21st 18:00 UTC Weekly meetings, every Thursday at 18:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress). == Goal of this meeting == Weekly checkin about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at Tor. == Links to Useful documents == * Our anti-censorship roadmap: https://dip.torproject.org/torproject/anti-censorship/roadmap/boards * Our roadmap consists of a subset of trac tickets. * The anti-censorship team's wiki page: https://trac.torproject.org/projects/tor/wiki/org/teams/AntiCensorshipTeam * GetTor's roadmap: https://dip.torproject.org/groups/torproject/anti-censorship/gettor-project… * Tickets that need reviews: https://trac.torproject.org/projects/tor/query?status=needs_review&componen… * Projects from sponsors we are working on: * https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor30 * https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor28 --------------------------- --- 21st November 2019 --- --------------------------- == Announcements == * == Discussion == * Gettor update * Survival guide here: https://dip.torproject.org/torproject/anti-censorship/gettor-project/gettor… * what is the main gettor repo? seems like hiro's is ahead of https://dip.torproject.org/torproject/anti-censorship/gettor-project/gettor * Since #29207, we have only about 40 proxies, down from about 400: https://snowflake-broker.bamsoftware.com/debug * Is it the case that 90% of our former proxies were not able to auto-update after the backward-incompatible change of #29207, or is there another explanation? Were those 90% all Cupcake proxies? == Actions == * == Interesting links == * https://censoredplanet.org/russia - report/paper on network censorship in Russia * https://www.cnet.com/features/in-iran-bypassing-online-censors-with-satelli… censorship circumvention system that broadcasts files over satellite tv == Updates == FORMAT! Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week (related to anti-censorship work). Help with: - Something you may need help with. Hiro: Started restoring Twitter Responder. When retrieving tweets I need to check for new tweets only otherwise Gettor will end up responding to old back log and already answered messages. <-- is this #27330 ? Next Week: - Work on gettor specs <-- Is this #3781? - More with review of strings and website content and translation phw: This week (2019-11-21): * Created and published monthly team report for October * Finished prototype for PT test tool (#31874) * Uses Yawning's bulb library to have Tor's control protocol tell us if bridge bootstrapped fine * Worked on understanding Internet shutdown in Iran * There was/is limited circumvention opportunity over VPSes in Iran, and DNS tunnels * Started process for adding new default bridge (#32547) * Attended grant writing meeting * (Almost) finished improving our obfs4 bridge docker container (#31834) * Added script "get-bridge-line" to easily get a container's bridge line * Made container permanently store tor's data directory Next week: * Help with: * Gaba: (updated October 30th) Last week (): * sponsor 30 This week (planned): * grants writing cecylia (cohosh): last updated 2019-11-21 Last week: - made #32545 for measuring snowflake network health and started investigating onionperf - wrote a script to upload tor browser releases for #32480 - have proxies report what kind they are to broker #31157 - more grant writing - reviewed #31834 and #32465 - looked into adding more STUN servers to snowflake (#30579) - ongoing help with iran internet blackout situation This week: - finish snowflake test coverage (#29259) - more grant writing - continue on #29206 and #25723 - continue on snowflake health (#32545) - investigate windows issue (#31971) - update github gettor links (#32393) - gettor reviews Help with: - review of #32480 (gettor) - review of #31157 (snowflake) - an authentication token for torproject-pusher and put it somewhere safe (outside the git repo) on gettor-01 (hiro?) - some input on the privacy implications of #30579 (snowflake stun servers) arlolra: 2019-11-14 Last week: - finished off / merged #31028 Next week: - add a build step / documentation for code reuse in cupcake #32499 - read up on turbo tunnel - Help with: - dcf: 2019-11-21 Last week: - deployed the hosted Snowflake proxy 0.1.0 (#29207) - switched to the new IPv6 broker (#29258) - prototyping QUIC in meek Next week: - decomission old broker (#32502) - prototyping QUIC in meek Help with:

1 0

Campaign Update and Request
by Sarah Stevenson 20 Nov '19

20 Nov '19

Hello Tor! As you know, our EOY campaign, Take back the internet with Tor, launched this past Monday. We are seeing great engagement and have raised over $20,000 so far. In addition to almost 500 single gifts, we have had 24 people sign up as new recurring donors. This is all without the campaign content on about:tor <about:tor> which launches next Monday. Last year we launched all the content on the same day and we received 100 fewer gifts in the first four days than we received this Monday through Thursday. Help us keep up this momentum by sharing the campaign content with your networks. Many thanks to the 'money machine’, Steph, Jon, Antonela, Alon, and the Tor Browser and Metrics teams for working on different aspects of the campaign. Now I have a specific request. The week of US Thanksgiving, we are going to post a series of ‘thank you’ videos on social media. We would love to have a variety of languages represented in these videos. Isa put together two rough examples so you can have a sense of what we are looking for. https://drive.google.com/file/d/1YshJnLIhxgTS-62XAFhjYKV_M7W3jbJe/view?usp=… <https://drive.google.com/file/d/1YshJnLIhxgTS-62XAFhjYKV_M7W3jbJe/view?usp=…> https://drive.google.com/file/d/1nq3QXr9uxGyyC7uMCl1Nk1-9j6P1JgQf/view?usp=… <https://drive.google.com/file/d/1nq3QXr9uxGyyC7uMCl1Nk1-9j6P1JgQf/view?usp=…> If you would like to participate, please let me know. Have a wonderful weekend! Sarah Sarah Stevenson (she/her) Fundraising Director The Tor Project sstevenson(a)torproject.org Take back the internet with Tor. https://donate.torproject.org/ Public Key: 93B3 AC08 4257 FA3D D4BB 8E95 CC08 5DBA C015 612A

1 1

Community Team report for October 2019
by gus 20 Nov '19

20 Nov '19

Hi, Here's Community Team report for October 2019. Weekly meetings, every Monday at 16:00 UTC, in #tor-meeting at OFTC. Outreachy and Documentation =========================== In October the Tor Project applied to participate in the Outreachy round that runs December to March 2020. At least 30 applicants contacted the Community Team to introduce themselves and start contributing to the project "Help Tor Project support our users". We wrote a newcomer guide <https://trac.torproject.org/projects/tor/wiki/Outreachy#Newcomerguide> and explained our documentation and support workflow. Applicants answered users in informal support channels (i.e, Reddit), joined us on IRC and our weekly meetings. :D It was a very busy month and we had many documentation tickets fixed. The new Outreachy intern will be announced by the end of November and will be mentored by Gus. Sponsor work ============ This month we continued to work to get partners to sign the partnership contract. We're helping them to organize the first round of Tor trainings in their cities, and sharing our training materials. At the moment we have at least one partner for each country that we visited in the last year. We also updated the training material after Tor Browser 9 release. Antonela, Gaba and Gus met to discuss Sponsor30 and Community+UX teams activities. Besides running bridges and talking with more volunteers, we would like to have some activities with other digital security trainers and users in general to understand how they learn and get bridges. Relevant ticket: <https://trac.torproject.org/projects/tor/ticket/31870> User feedback and support ========================= After Tor Browser 9 release, users contacted us and asked about: - Letterboxing: <https://support.torproject.org/tbb/maximized-torbrowser-window/> Ticket: <https://trac.torproject.org/projects/tor/ticket/32324> - Windows: api-ms-win-crt-convert-l1-1-0.dll is missing - <https://trac.torproject.org/projects/tor/ticket/32327> - Black screen in some Linux distros: <https://trac.torproject.org/projects/tor/ticket/32215> - Translation issues in Tor Browser for Android. Outreach ======== - Pili and Brabo are organizing Tor Project and more privacy activities in FOSDEM, wiki page: <https://trac.torproject.org/projects/tor/wiki/org/meetings/2020Brussels>. [CFP] Decentralized Internet & Privacy devroom @ FOSDEM 2020, deadline for talks - 1 Dec 2019: <https://lists.fosdem.org/pipermail/fosdem/2019q4/002903.html>. - (Mexico City) Carlos held a workshop about Tails and Tor at UAM university: <http://multimedia.xoc.uam.mx/index.php/13a-semana-de-la-cultura-digital-en-…> good news is that 25 computers in the library now have Tor Browser installed, which used to have only adobe and apple software. - (Naples) Gus talked about Tor "Aromi e lacrime del routing cipolla", at MSAck.org hacklab: <https://blog.torproject.org/events/tor-aromi-e-lacrime-del-routing-cipolla-…> - (London) Mozfest: Pili, Gaba, Hiro, Nah and many Tor friends went to Mozfest: <https://blog.torproject.org/events/mozfest-london> - (Bern) Ahf talked at Swiss Web Security Day: <https://blog.torproject.org/events/swiss-web-security-day-bern> - (Taipei) Roger talked at Tor Sharing: <https://blog.torproject.org/events/tor-sharing-taipei> - Global South monthly IRC meeting happened Oct 30th: <https://lists.torproject.org/pipermail/global-south/2019-October/000266.html> Next Global South meeting scheduled @ 29 November, 1600 UTC, #tor-south Meta ==== Meeting notes * Community Team Meeting Notes - 07 Oct 2019 - <https://lists.torproject.org/pipermail/tor-community-team/2019-October/0003…> * Community Team Meeting Notes - 14 Oct 2019 - <https://lists.torproject.org/pipermail/tor-community-team/2019-October/0003…> * Community Team Meeting Notes - 21 Oct 2019 - <https://lists.torproject.org/pipermail/tor-community-team/2019-October/0003…> * Community Team Meeting Notes - 28 Oct 2019 - <https://lists.torproject.org/pipermail/tor-community-team/2019-November/000…>

1 0

FOSDEM 2020: Decentralized Internet & Privacy devroom CFP
by Pili Guerra 19 Nov '19

19 Nov '19

Hi everyone, Just wanted to share the CFP[1] for the Decentralized Internet & Privacy devroom at FOSDEM 2020. We look forward to reading your proposals. Thanks! Pili [1] https://lists.fosdem.org/pipermail/fosdem/2019q4/002903.html — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

1 0

Network Team Meeting Notes, 12 November 2019
by Alexander Færøy 17 Nov '19

17 Nov '19

Hello, Here is a short summary of the network team meeting from Wednesday: 1) We started out by looking at the 0.4.2 status page on Trac to see how we are doing there. #31653 and #31002 was moved to 0.4.3. 2) We went over our Kanban board. 3) We went over our review queue. 4) We talked about proposing the use of 'network-team' as highlight on IRC to other teams. Nick will bring it to the vegas meeting. 5) Alex requested help with getting someone else to take over the PR policy work since he keeps pushing it down his todo list. We decided to bring this up again next week and ideally that Nick and Alex might work on this together. 6) We talked about moving all our doc/HACKING documents into being Doxygen format. People seemed positive about this. 7) Catalyst requested for more feedback on their proposal for C style. 8) We talked about splitting the tor man page into two manpages: one for tor and one for torrc. 9) Nobody had anything else to discuss. --- end of summary --- You can read today's network team meeting log at: http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-11-12-17.59.html Below are the contents of our meeting pad: gaba: (updated on october 30th) Last week (actual): nc migration sponsors grant proposals This week (planned): report on sponsor 31 Help with: teor: (online first week of the month, offline at the usual meeting time) Week of 4 November (actual): Take Time for: - team policies: - commit bit - backports Roadmap: - Sponsor 31 modularisation: - Merged Disable major relay and dirauth options, when those modules are disabled #32213 - Merged associated bug fixes #32368 #32370 #32371 - Fixed more bugs #32410 - Add NSS (and lzma and zstd) support to test_parseconf.sh #32397 - Associated bug fixes - Code reviews and merges Other: - Helping with Android issues - Bug fixes, ticket triage, and quick reviews - Helped out at a local Aaron Swartz Day CryptoBar - gave away some Tor stickers Week of 11 November (planned): Take Time for: - catching up on emails - Fix #30901 - we missed some config bugs last week, because stem always fails in CI Roadmap: - Sponsor 31 modularisation: - Fix bugs - Do more modularisation (#31851 / #29211) Other: - Helping with Android issues - Bug fixes, ticket triage, and quick reviews - Helped out at a local Aaron Swartz Day CryptoBar - gave away some Tor stickers Week of 11 November (actual): Urgent: - Fix Appveyor CI failure #32449 Take Time for: - Roadmap: - Sponsor 31 modularisation: - Fix the obsolete option message in 0.4.2 #32295 - Add extra config tests #32451 - Disable "Phase 0" code in the relay module #32163 #32244 #32245 - Start on "Phase 1" - Code and design reviews Other: - Code reviews & ticket triage Nick: Week of 4 November (planned): - S31 meeting - Doxygen work, tor-guts work. (#29214) - Write a lot of documentation for #29215 - More #30866 work; try to get it merged - Start revisions on paper with Ian & Chelsea? - Plan for upcoming stable releases. Week of 4 November (actual): - Doxygen work, and lots of it. - Documentation on subsystems and initialization (32211) - Finish 30866: most subsystems can now be configured with new API. - Suggestions for research on revision of walking onions paper. Week of 11 November (planned): - Short week because of holiday. - Catch up with reviews. - Catch up with documentation: 32209 (config), 32207 (pubsub), 29214 (continued subsuming of tor-guts). - Finish 32427 (refactor options_act_reversible). - Regression analysis on 041-regression,042-regression tickets. - 0.4.2.4-rc release. - Time permitting (haha): 32139 (configuration isolation for directory authority options) - Time permitting (haha): 32408 (refactor new options_act_reversible into new system.) Mike: Week of 11/06 (planned): - Finish cleaning up circpad simulator - Read asn's research feedback - Get DNS recommendations for exit operators for fingerprinting blog post - Update + triage circpad bugs Week of 11/06 (actual): - Refactored circpad simulator; fixed some simulator bugs+issues; a few more remain - See: https://github.com/pylls/circpad-sim (and https://github.com/mikeperry-tor/tor/tree/circpad-sim-v2) Week of 11/11 (planned): - Finish cleaning up circpad simulator - Read asn's research feedback - Get DNS recommendations for exit operators for fingerprinting blog post - Update + triage circpad bugs Need help with/at risk of dropping this month: - Deep-thought-required research project followup - (Google masque, BGP, ECN, Rob's bw experiments, Dennis's Mozilla video, etc etc...) catalyst: week of 11/04 (2019-W45) (planned): - reviews - more sponsor31 architecture doc stuff (#29215) - maybe finish up #30984 - GSoD stuff as needed week of 11/04 (2019-W45) (actual): - reviews - checked in on GSoD stuff -- proposed some ways forward - wrote some sponsor31 architecture doc stuff - got early review of #30984 (thanks, teor!) week of 11/11 (2019-W46) (planned): - Monday is a public holiday - reviews - sponsor31 architecture doc stuff - work on splitting out torrc(5) manpage for swati to work on - other GSoD stuff as needed - monitor C style thread and respond as needed help with: - would like to hear feedback about whether to split torrc options out of the tor(1) manpage (non-torrc command line options would remain in tor(1)). i think teor might have opionions on this? asn: Week of 04/11 (planned): Week of 04/11 (actual): - Attended OTF meeting. Started a few email threads as the result of that. - Encoding v3 descriptors in stem is currently at the hands of atagar. I'm waiting for him to drop a branch soon. - Started initial work on actual OBv3 using the OBv2 codebase after discussion with Donncha. - Catching up with some S27 stuff. Week of 12/11 (planned): - Look into S27 typo deliverable (#30022) - Review atagar's descriptor encoding branch and make it work with OBv3. - If possible, write test vectors for descriptor encoding/decoding when stem support stabilizes. - Move forward with core OBv3 work. - Reviews as usual. ahf: Week of 4 November (planned): - Travel with Gus to Freedom Not Fear in Brussels. - Hack on #28930 and #32320. - Continue to see if we can get the asciidoc situation solved for Swati. Week of 4 November (actually): - Went to Freedom not Fear with Gus in Brussels: we did a Tor meetup with ~20-30 people, a session on onion services, and a session on anti-censorship technology. - Continued to try to figure out what is going on for #32320. - Shadow Simulation Developer work. Week of 11 November (planned): - Shadow Simulation Developer things - Get back to #28930. - Figure out with Swati how things are going there. - Retrospective. dgoulet: Week of 04/11 (actual): - Worked on #29698 unit tests. Turned out to be not enough. Worked for couple hours on recreating the bug through unit tests. I failed but at least found: #32388 - s27: Ticket work several tickets: #32376, #32356, #31371. - s27: Discussed work on #32030 with asn on the PR. - Reviews and merges. I still have a review backlog unfortunately. - Network Health team world needed my attention (bad relays). Week of 12/11 (planned): - Continue in the s27 world of -must ticket. - Hopefully make progress on the intro point retry period (tor-dev@ thread): #31561 - Can't promess any progress on #29698 (cmux/ewma). Unit tests is hella complicated to pull off. - Hope to get to a fix for #32388. All the best, Alex. -- Alexander Færøy

1 0

Anti-censorship team monthly report: October 2019
by Philipp Winter 15 Nov '19

15 Nov '19

Hi everyone, Here's what the anti-censorship team has been up to in October: Snowflake ========= * Continued work on a sequencing and reliability layer for snowflake: <https://bugs.torproject.org/29206> * Localised the snowflake.torproject.org website and implemented a language switcher: <https://bugs.torproject.org/31384> * Added an automatic packaging script for the snowflake web extension: <https://bugs.torproject.org/31253> * Fixed a bug in the web extension hat was keeping open UDP sockets: <https://bugs.torproject.org/31285> * Continued to investigate and monitor snowflake network health. * Snowflake web extension localisation updates. * Refactored the web extension code to allow for multiplexing of multiple clients through a single browser proxy: <https://bugs.torproject.org/31310> * Reduced unnecessary error messages in snowflake logs. BridgeDB ======== * Finished updating BridgeDB's requirements and created a process for keeping requirements up-to-date in the future: <https://bugs.torproject.org/29484> <https://gitweb.torproject.org/bridgedb.git/tree/doc/HACKING.md#n36> * Finished BridgeDB's language switcher: <https://bugs.torproject.org/26543> You can find it in the top right corner over at <https://bridges.torproject.org> * Accidentally fixed another UI issue while implementing the language switcher: <https://bugs.torproject.org/19839> * Debugged and fixed BridgeDB's email autoresponder. It broke after the underlying operating system was updated to the latest Debian stable: <https://bugs.torproject.org/32105> * Finished specification of BridgeDB's metrics format: <https://bugs.torproject.org/31780> * Started ripping out PGP support in BridgeDB's email autoresponder: <https://bugs.torproject.org/17548> BridgeDB's PGP keys have expired many years ago and the feature does not seem popular enough to warrant the (likely non-trivial) effort of resurrecting it. * Implemented a parser for BridgeDB metrics and used it to create a bunch of visualisations: <https://bugs.torproject.org/32135> * Fixed a bug that resulted in BridgeDB not logging vanilla bridges in its metrics: <https://bugs.torproject.org/32203> * Took a look at BridgeDB's broken email localisation: <https://bugs.torproject.org/15404> This is another broken feature that may not be worth the effort it takes to fix it. * Requested and installed new translations. Thanks to all volunteers who helped translate BridgeDB! GetTor ====== * Moved to a new VM. * More work towards bringing the Twitter responder back to life. Miscellaneous ============= * Implemented a prototype of bridgestrap, a service that takes as input a bridge line and tells you if it can bootstrap a tor connection over the given bridge: <https://bugs.torproject.org/31874> * Filed a ticket to discuss the future of website mirrors: <https://bugs.torproject.org/31990> * Wrapped up our "set up new obfs4 bridges" campaign: <https://bugs.torproject.org/30777> Our volunteers helped set up approximately 100 new bridges! * Started distributing some of our new high-capacity private obfs4 bridges. Also created a YAML file to coordinate who got what bridges. Obfs4 ===== * Made good progress on improving our obfs4 bridge Docker image: <https://bugs.torproject.org/31834> * Finished a prototype of sharknado, a backwards-compatible obfs4 improvement: <https://bugs.torproject.org/30716#comment:16> * Created a wiki page that documents the process for supplying an NGO with private obfs4 bridges: <https://trac.torproject.org/projects/tor/wiki/org/teams/AntiCensorshipTeam/…> * Conducted a probe test of a subset of our newly created obfs4 bridges from the bridge campaign in September. Found that all of the new bridges we tested seem to be blocked already in China: <https://trac.torproject.org/projects/tor/attachment/ticket/31701/obfs4-reac…> Tor Browser =========== * Upgraded goptlib to v1.1.0, fixing an error condition that would arise when using a pluggable transport with a non-working proxy: <https://bugs.torproject.org/32076> <https://bugs.torproject.org/32056>

1 0

Sept & Oct Communications Report
by Stephanie A. Whited 15 Nov '19

15 Nov '19

1 0

OONI Monthly Report: October 2019
by Maria Xynou 15 Nov '19

15 Nov '19

Hello, In October 2019, the OONI team completed its 1-year contract with the OTF (which started on 1st November 2018). We thank the OTF for its generous support, which has helped the OONI-verse grow and allowed us to build new and exciting tools for the internet freedom community! ## Stable release of OONI Probe Desktop App for Windows and macOS We released the stable version of the OONI Probe desktop app for Windows and macOS: https://github.com/ooni/probe-desktop/releases/tag/v3.0.0-rc.3 From version 3.0.0-rc.2 onwards, auto-update support is enabled and working on macOS and Windows. Users of the older beta versions may have to do a hard reset of OONI Probe from the About screen page. The new OONI Probe desktop app supports running the Websites, Instant Messaging, Performance, and Middlebox tests, as well as configuring the maximum number of tested URLs for the Websites test (which defaults to the full test list). We aim to publicly launch the new OONI Probe desktop app over the next weeks, once we have received more feedback from community members and have done more extensive testing of the app on more platforms. ## Stable release of OONI Probe Command Line Interface (CLI) We released the stable version of the OONI Probe Command Line Interface (CLI): https://github.com/ooni/probe-cli/releases/tag/v3.0.0-rc.3 Prior to this, we also made other releases during October 2019: https://github.com/ooni/probe-cli/releases/ ## Stable release of OONI Probe engine To enable the integration of tests and to otherwise improve OONI Probe sustainability, we have been re-writing the OONI Probe measurement engine (the software that implements OONI Probe nettests) from C++ to golang. The new OONI Probe measurement engine is available via the following repository: https://github.com/ooni/probe-engine During October 2019, we made several releases: https://github.com/ooni/probe-engine/releases The latest release of the OONI Probe engine is stable: https://github.com/ooni/probe-engine/releases/tag/v0.2.0 ## Release of OONI Probe Mobile 2.2.0 We released the 2.2.0 version of the OONI Probe mobile app. Android: https://github.com/ooni/probe-android/releases/tag/v2.2.0 iOS: https://github.com/ooni/probe-ios/releases/tag/v2.2.0 The latest 2.2.0 version: * Uses less storage by automatically deleting old measurements and fetching them from OONI Explorer * Enables users to copy and share OONI Explorer links based on their testing results ## Seamless integration between mobile and desktop apps To have a more seemless integration between the OONI Probe mobile and desktop apps, we integrated react-native (https://facebook.github.io/react-native/) into the probe-android and probe-ios apps. This allows us to maximize code sharing between the OONI Probe desktop and the mobile apps, as well as making it possible for us to use our in-house React expertise for OONI Probe Mobile development as well -- hence reducing the ongoing maintenance effort. We used the About screen as an example to understand the possible limitations to this approach and implemented it as a react-native screen: https://github.com/ooni/probe-react-native/blob/master/views/About.js Some research was done into converting all of the ooni-components part of our design system (https://github.com/ooni/design-system) to react-native and we have understood that we will have to make some changes to how we use the styled-components module. Specifically, we have understood that we will have to refactor our code to use the react-native specific styled-components wrapped when importing modules into the react-native views. We also spent some time researching the performance impact and application size overhead associated with using react-native. See: https://github.com/ooni/probe/issues/868#issuecomment-547720048 Based on all of this research, we have decided to postpone shipping the react-native integration until we have more views implemented and we have assessed the impact that the increased app size will have on our user-base. We do still think this is something we should be doing, as it opens up opportunities for us to start sharing code between desktop and mobile apps for specific components, such as charts and tables. This will also help ensure that the UX and design is more similar and familiar across platforms. Relevant code: https://github.com/ooni/probe-react-native https://github.com/ooni/probe-ios/pull/313 https://github.com/ooni/probe-android/pull/266 https://github.com/ooni/probe/issues/868 ## Made OONI Probe testing more resilient to network outages To make OONI Probe testing more resilient to network outages, we: * used jafar to stress test netx and implemented retransmission of DNS to improve DNS robustness * made the “nervous resolver” fallback to DoH using Cloudflare, which is also a way to increase robustness The automatic fallback to DNS over HTTPS / DNS over TLS has been designed in such a way that it will be triggered (without touching the scoreboard) also in the event that the master DNS fails. This will be useful to improve reliability when the master DNS used by the device is either down or overloaded. We experienced this kind of transient outage both in Cuba and in Italy, during a six-hour incident where Vodafone Italy DNS infrastructure was down. We also ensured that the new Go code has timeout settings in line with the Go standard library and browsers like Firefox, thus further increasing OONI Probe reliability. A detailed explanation of what this work entailed (including relevant code repositories) is available here: https://github.com/ooni/probe-engine/issues/88#issuecomment-548895700 ## Implemented new OONI Probe nettests To improve and expand upon OONI Probe measurement methodologies, we implemented the following new nettests: * Update to the latest ndt7: https://github.com/ooni/probe-engine/issues/70 * DASH rewrite that uses HTTPS: https://github.com/ooni/probe-engine/issues/51 * Telegram re-write using github.com/ooni/netx: https://github.com/ooni/probe-engine/issues/54 We have also integrated automatic follow-up measurements for: * DNS over TLS / DNS over HTTPS fallbacks: https://github.com/ooni/netx/pull/108 * SNI blocking detection: https://github.com/ooni/netx/pull/109 The DNS over TLS / DNS over HTTPS fallback is performed anytime we resolve a domain name and we get a bogon IP (i.e. an IP that should not be public, such as, for example 10.0.0.1 or 127.0.0.1). In such cases, we record into a scoreboard structure that we were served a bogon IP and fallback to DNS over TLS or DNS over HTTPS. SNI blocking detection is performed after a URL measurement; whenever we see a TLS handshake failure that leads us to think that there may be SNI injection, we run an additional follow-up test with a test helper (example.com:443 in the current experimental code) with the SNI we suspect being blocked and we also record the result into the scoreboard. This design for follow-up experiments is also based on conversations with Vinicius Fortuna (Jigsaw) regarding how to improve the OONI testing methodology. This work intersects with the "Improve basic on device data analysis" work. We chose a design where these new nettests are follow-ups, because this enables us to collect richer measurements without the need to prompt users to manually run follow-ups. The above work was tracked through this master ticket: https://github.com/ooni/probe-engine/issues/86 We implemented these new nettests in probe-engine and we plan to ship them as part of the OONI Probe apps over the next months. ## Ingested new metadata produced by new set of tests Previously, the OONI data processing pipeline only ingested metadata from OONI's Web Connectivity test. We have now added support for ingesting and analyzing the metadata produced by most OONI Probe tests: * Facebook Messenger test * Telegram test * WhatsApp test * HTTP header field manipulation test (for middlebox detection) * Vanilla Tor connectivity test * TCP connect test * DASH test * Meek test We have also implemented basic handling (without scoring) of the following OONI Probe tests: * Psiphon test * NDT test This work was implemented as part of the fast-path pipeline in the following pull request: https://github.com/ooni/pipeline/pull/242 ## Improved basic on-device data analysis To improve basic on-device data analysis (as mentioned above in "Implementing new OONI probe nettests") we added support for the following: * OONI Probe can detect bogus DNS replies and fallback to DNS over HTTPS / DNS over TLS * OONI Probe flags the event where the TLS handshake failed with connection reset and runs follow-up tests to determine whether it's a case of SNI-based filtering This work was tracked through the following ticket: https://github.com/ooni/probe-engine/issues/87 We also built Jafar (https://github.com/ooni/jafar ) -- a tool that simulates a censored environment -- to ensure that our methods work as expected. ## Reduced the latency of publication of uploaded measurements to less than daily To analyze and publish OONI measurements from around the world faster, we built a fast-path pipeline: https://github.com/ooni/pipeline/pull/213 To reduce the latency of publication of uploaded measurements to less than daily, we implemented fast-path support in the OONI API. This work is available through the following pull request: https://github.com/ooni/api/pull/115 The database tables for the fast-path (which publish measurements daily) are already getting populated and published. The OONI API related changes (which will expose the most recent measurements in OONI Explorer) are going to be shipped in production sometime next week, as we are trying to avoid deploying too many services at once. ## Added data processing pipeline heuristics for flagging relevant blocking events for the RSS feed To flag relevant blocking events and expose them via the RSS feed, we added data processing pipeline heuristics to the fast-path pipeline and ingested the metadata of most OONI Probe tests. Our work on adding an event detector and RSS feed generation to the fast-path pipeline is available via the following pull request: https://github.com/ooni/pipeline/pull/228 Based on this, we have an internal web app that generates charts based on blocking events. The event detector is currently running. ## Exposed blocking events in RSS feed hosted on OONI Explorer Based on the event detector that we added to the fast-path pipeline (https://github.com/ooni/pipeline/pull/228), we created an RSS feed for exposing blocking events on OONI Explorer. OONI Explorer now provides links to RSS feeds on events detected by the fast-path pipeline event detector. The following feeds are to be made available on OONI Explorer: * Global feed (added to all pages) * Country-specific feed (added to relevant country pages) So far, we have deployed the global RSS feed which shows events on a global scale and is available here: https://explorer.ooni.org/rss/global.xml Soon thereafter, we are going to be adding the country-specific feed on the OONI Explorer country pages. This work was implemented through the following pull request: https://github.com/ooni/explorer/pull/342 For the time being, we are not going to be promoting the RSS feed feature of OONI Explorer extensively as we need to use it more ourselves and get feedback from trusted community members to avoid mis-interpretation of the data. ## Ensured all our infrastructure is re-deployable We worked on ensuring that all our infrastructure is re-deployable, making it possible for us to recover from a disaster (a machine being terminated) with minimal amount of downtime and be able to migrate to up-to-date versions of Operating Systems to keep our infrastructure secure. All of our work on ensuring that our infrastructure is re-deployable was completed in October 2019 and tracked via this ticket: https://github.com/ooni/sysadmin/issues/356 As part of this work, we also coordinated with Greenhost to ensure the redeployed hosts are using the eclips.is platform in the most resource-conscious way possible. For example, several unnecessary hosts have been terminated and some that did not require to be located in Hong Kong or Amsterdam have been migrated to the Miami location which has more availability of resources. ## Improved the availability of our infrastructure We improved the availability of our infrastructure via the "oonification of probe services". The oonified bouncer, collector and orchestra backend are deployed and serving clients. The pipeline is using the new collector and we rolled-over all the collectors to the new probe-services oonified host. Our work on oonifying the probe services is available via this pull request: https://github.com/ooni/sysadmin/pull/361 All of our work on improving the availability of our infrastructure was tracked through the following ticket: https://github.com/ooni/sysadmin/issues/359 ## Published report on the blocking of abortion rights websites In collaboration with Coding Rights (Brazilian partner) and Women on Waves / Women on Web, we published a report that examines the blocking of abortion rights websites womenonwaves.org and womenonweb.org around the world. The report is available on the following sites: * OONI: https://ooni.org/post/2019-blocking-abortion-rights-websites-women-on-waves… * Coding Rights: https://medium.com/codingrights/on-the-blocking-of-pro-choice-websites-wome… VPNCompare wrote an article about our report: https://www.vpncompare.co.uk/block-abortion-websites/ In this report, we share OONI data confirming the blocking of womenonwaves.org in Brazil, as well as in Iran and Turkey. We also share OONI data on the blocking of womeononweb.org in South Korea, Turkey, and Saudi Arabia. We corroborated OONI findings by looking at Censored Planet data (https://censoredplanet.org/) as well, shared in the report. ## Created community resources To strengthen existing partnerships and better support OONI community engagement efforts, we created several new resources, listed below. ### Created OONI Frequently Asked Questions (FAQ) section To better support the OONI community, we created a Frequently Asked Questions (FAQ) section: https://github.com/TheTorProject/ooni-web/pull/301 The OONI FAQ can also be viewed here: https://deploy-preview-301--ooni.netlify.com/about/faq/ The new OONI FAQ includes answers to 67 questions that fall under the following themes: * About OONI * OONI Probe * Testing websites * OONI data * OONI Explorer We included the questions that we have most frequently been asked over the last years, as well as questions that have been raised by community members during meetings, hackathons, workshops, usability studies, and during other community interactions. The new FAQ (along with all other content on the OONI website) is published on github, and we welcome feedback and community contributions. We aim to publish the FAQ on the OONI website and promote it over the next few weeks. As OONI tools and methodologies evolve, we will continue to update the FAQ on an ongoing basis. ### Created OONI Glossary To empower broader community participation in censorship measurement research, we created a glossary which explains the terms used in the OONI apps, methodologies, and research reports. The new OONI Glossary is available on github (and we encourage review, feedback, and community contributions): https://github.com/TheTorProject/ooni-web/pull/298 The glossary can also be viewed here: https://deploy-preview-298--ooni.netlify.com/about/glossary/ We aim to publish the glossary on the OONI website over the next few weeks and we will promote it through our partner networks. ### Published OONI workshop slides To enable our partners and the broader community to teach OONI Probe and engage their local communities with censorship measurement research and advocacy, we created and published OONI workshop slides: https://docs.google.com/presentation/d/1UAxGeF1NhCXc8pT7cfWTp0NPdkWB5LInBkG… These workshop slides cover the basics with regards to: * OONI Probe test methodologies * Running OONI Probe * Potential risks associated with running OONI Probe * How to reduce potential risk associated with running OONI Probe * Contributing to test lists * Customized website testing * OONI Run: Coordinating custom OONI Probe testing * Using OONI Explorer * OONI API * Interpreting OONI data * Using OONI data * How to get involved with the OONI community We have published these OONI workshop slides on Google Slides so that community members can: * download the slides in the format of their choice * edit and customize the slides (so that they're more relevant to their local context and to the needs of the communities they teach) Our edits to the OONI website to accommodate the publication of the OONI workshop slides are available here: https://github.com/TheTorProject/ooni-web/pull/302 The OONI workshop slides can be found through the Get Involved section of the OONI website: https://ooni.org/get-involved/ ### Published document for OONI Probe community engagement Our partners have expressed the need for a document that they can share to introduce new people to the use of OONI Probe. To this end, we created a PDF document that summarizes key information for getting started with running OONI Probe and engaging your community with censorship measurement research: https://ooni.org/documents/Getting%20started%20with%20OONI%20Probe.pdf Specifically, this document covers: * About OONI Probe * Running OONI Probe * Testing websites * Testing specific websites of your choice * Testing a custom list of websites The above information is shared through instructions, synthesized information, and links for further reading. Our edits to the OONI website to accommodate the publication of this document are available here: https://github.com/TheTorProject/ooni-web/pull/302/commits/6f61b9e9b672443e… This document can be found through the Get Involved section of the OONI website: https://ooni.org/get-involved/ ### Updated OONI Run button page Often when censorship events emerge (leading up to or during political events, such as protests or elections), social media, news media, and VPN sites are commonly blocked. To enable the testing of specific types of websites and to support rapid response to emergent censorship events, we set up a page which includes OONI testing buttons: https://ooni.org/get-involved/run/ These buttons enable the OONI Probe testing of: * Social media websites * News media websites * VPN sites * Wikipedia sites * Human rights sites * Environmental sites * LGBTQI sites Rather than having to identify which social media websites (for example) to test during an urgent censorship event, the OONI community can refer to the buttons on this page for targeted testing. Apart from supporting efforts related to rapid response, these OONI Run buttons can also support research and advocacy efforts related to the customized testing of the above categories of sites over time. ## Community use of OONI data ### Investigating the blocking of sci-hub and libgen in France Community members hosted an OONI workshop in France to engage locals with the use of OONI Probe in order to test the blocking of sci-hub and libgen across different networks. They shared their OONI Probe methodologies and findings through a series of tweets: https://twitter.com/tenacioustek/status/1183715300283502592 They also shared the script they wrote to query results directly from the OONI API: https://github.com/Te-k/analyst-scripts/blob/master/ooni/get_ooni_website_s… ## Community activities ### HacktoberFest 2019 OONI participated in HacktoberFest (https://hacktoberfest.digitalocean.com/): https://twitter.com/OpenObservatory/status/1179033711557263361 The OONI github issues that were part of HacktoberFest are available here: https://github.com/search?q=org%3Aooni+label%3Ahacktoberfest We received valuable contributions from HacktoberFest participants! Across projects, we received 6 pull requests. Notably, the newly launched OONI Explorer received 4 pull requests, one of which was a major refactoring exercise: https://github.com/ooni/explorer/pull/336 ### OONI workshop in Taiwan Our Taiwanese partners, the Open Culture Foundation (OCF), hosted an OONI workshop in Taipei on 17th October 2019. Information about their workshop is available here: https://ocftw.kktix.cc/events/iffcc201910 ### Manual for OONI Probe rapid response in Chile Our Chilean partners, Derechos Digitales, created and published a manual (in Spanish) which explains how to use OONI Probe: https://www.derechosdigitales.org/13931/manual-rapido-de-ooni-probe-para-mo… The use of OONI Probe was heavily promoted by Derechos Digitales during the protests in Chile: https://twitter.com/derechosdigital/status/1187101399001260032 ### Blog post about OONI Probe The Civilsphere Project (dedicated to supporting NGOs, journalists, and human rights defenders) published a blog post (also in Spanish) where they explain OONI and how to use OONI Probe (likely in response to the protests in Chile): https://www.civilsphereproject.org/blog/2019/10/22/que-es-ooni-y-como-usarlo In their blog post, Civilsphere discuss why it's important to measure internet censorship, what OONI Probe can measure, how to run OONI Probe (and associated potential risks), how to configure OONI Probe settings, and how to find OONI data. ## Press coverage CNET published an article about OONI (titled: "These watchdogs track secret online censorship across the globe"): https://www.cnet.com/features/the-watchdogs-tracking-secret-online-censorsh… OONI Probe was also listed as a tool to fight authoritarianism in the following article: https://toolsandnotions.comprehensophy.org/technologies-that-counter-author… ## Userbase In October 2019, OONI Probe was run 485,623 times from 5,561 different vantage points in 214 countries around the world. This information can also be found through our stats: https://api.ooni.io/stats ~ The OONI team. -- Maria Xynou Research & Partnerships Director Open Observatory of Network Interference (OONI) https://ooni.torproject.org/ PGP Key Fingerprint: 2DC8 AFB6 CA11 B552 1081 FBDE 2131 B3BE 70CA 417E

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

tor-project November 2019