tor-project May 2020

tor-project@lists.torproject.org

15 participants
24 discussions

Planet Testing
by Alexander Færøy 05 Jun '20

05 Jun '20

Hello Core Tor Members, (This email was also sent to tor-internal@ some days ago, but it is not secret, so we can share it here as well. Feel free to ignore if you have already read it) Antonela made progress on a theme for a "Planet Tor" blog aggregator over the weekend. We still need to tune a few things, but we can do that over the next weeks or so. We are looking for some core Tor members who occasionally write about Tor stuff on their blogs. Right now, all articles should be in English, but we can later add an aggregator for posts in other languages, too, if there is an interest in that. Please reply directly to me (not a list reply) with the following information if you are interested: 1. Your name formatted in the way you want it listed. 2. Your nickname (if any) formatted in the way you want it listed. 3. A link to your blog's "front page." 4. A link to your blog's RSS and/or Atom feed. If you have a Tor specific "category" or "tag" and your blog engine supports it, you can give us a direct link to that feed such that "only" things you tag explicitly with Tor will show up here. Up to you. 5. (optionally) A link to your Twitter handle. 6. (optionally) A link to your Mastodon handle. Thanks! Antonela and I will continue to experiment a bit with this over the next period of time. The repository for the work can be found at https://gitlab.torproject.org/ahf/planet and is tracked in https://bugs.torproject.org/9721 Have a nice weekend! All the best, Alex. -- Alexander Færøy

1 1

Tor Community Portal: Feedback from the Digital Security Helpline
by Beatrice Martini 02 Jun '20

02 Jun '20

Dear Tor Project Team, My name is Beatrice Martini, and I am the Education Coordinator of the Access Now Digital Security Helpline. Nice to e-connect! I am writing you to share my most positive feedback on your new Tor Community Portal. Congratulations on the launch and thank you for your great work! It is truly a brilliant resource, and I was glad to share it with the rest of the Helpline Team. In particular, I very much appreciated the Training section, and the detailed information regarding the training (and its follow-up!), best practices, code of conduct and tips on risk assessment. I think that both experienced and newer information security trainers will find these resources extremely helpful. Thanks again! I am looking forward to learning more about upcoming developments of the Community Portal. Best, Beatrice -- Beatrice Martini Education Coordinator Digital Security Helpline Access Now | <https://www.accessnow.org/help> PGP fingerprint: F94F 205E A3E4 6979 E719 8D16 0C5F 23FF 7D5B 5AEC <https://pronoun.is/she> * Subscribe to the Access Now Express <https://www.accessnow.org/express>, our weekly newsletter on digital rights * RightsCon Costa Rica has been postponed <https://www.rightscon.org/covid-19-update-rightscon-costa-rica-postponed-un…> until 2021 – stay up to date via the RightsCon Rundown <https://www.rightscon.org/rundown/>

2 1

Anti-censorship meeting notes, 28 May 2020
by Philipp Winter 28 May '20

28 May '20

Hi all, Here are our meeting minutes: http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-05-28-16.00.html And here is our meeting pad: Anti-censorship work meeting pad -------------------------------- Next meeting: Thursday May 28th 16:00 UTC Weekly meetings, every Thursday at 16:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress). == Goal of this meeting == Weekly checkin about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at Tor. == Links to Useful documents == * Our anti-censorship roadmap: * Our roadmap consists of a subset of trac tickets on keyword #anti-censorship-roadmap-2020 * The anti-censorship team's wiki page: https://trac.torproject.org/projects/tor/wiki/org/teams/AntiCensorshipTeam * Past meeting notes can be found at: https://lists.torproject.org/pipermail/tor-project/ * GetTor's roadmap: https://gitlab.torproject.org/groups/torproject/anti-censorship/gettor-proj… * Tickets that need reviews: from sponsors we are working on: * https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor30 * https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor28 * Anti-censorship related tickets that we want other teams to fix: * https://pad.riseup.net/p/tor-anti-censorship-tickets-keep == Announcements == * == Discussion == * S30 UX work - https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor30 * O3.1 (Research different scenarios of how human rights defenders experience censorship) * A1 - Develop Tor user personas as a tool to understand users’ contexts and mental models. - ticket #32811- in progress, Duncan is back and we are collaborating on this. I'm planning to involve Maria from OONI for reviewing it as well. * A2 - Define which censorship scenarios we are going to address.- first approach in the link * A3 - Use Tor user personas to define user flows that will empower human rights defenders to effectively circumvent censorship based on the scenarios identified above.- TBD * O3.2 (Design the flow of how our users can bypass the scenarios of O3.1) * A1 / A2 * User flow part 1: User learns they are under censorship. Create mockups with different solutions on how to notify Tor Browser users about detected censorship. * User flow part 2: Once censorship is acknowledged by the user, we then guide them on how to bypass the detected censorship. Create mockups with different solutions on how to better guide our users to bypass censorship. * I'm not sure what is the best ticket to drop this. I've been working on this, and I want to share it with you so we can start thinking about what we want to do in Tor Browser for this sponsor and with this scope. You can make comments! I can move this to any other place if it is useful/better! <--- Can you create a ticket for it? I was waiting for you to start looking at this to create a ticket. It should be a children of #31283. * https://www.notion.so/antonela/S30-UX-0dd8ffd7a46a44f4ae4660d89f95eb51 * Improvements to snowflake quality of life (by prioritizing less restrictive proxies) also opens us up to DoS attacks. Are we okay with this? Ideas on how to mitigate it? (https://bugs.torproject.org/34129 for context) == Actions == * == Interesting links == == Reading group == * We will discuss "Conjure: Summoning Proxies from Unused Address Space" on May 28 * https://censorbib.nymity.ch/#Frolov2019b * Questions to ask and goals to have: * What aspects of the paper are questionable? * Are there immediate actions we can take based on this work? * Are there long-term actions we can take based on this work? * Is there future work that we want to call out, in hopes that others will pick it up? == Updates == Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week. Help with: - Something you need help with. phw: This week (2020-05-28): * Good progress on #34259; mostly done with fetching OONI data. * Also thought about how one could generalise wolpertinger (after all, it's basically BridgeDB for for censorship measurement clients rather than users). * OONI's backend now has support for wolpertinger's API. * Updated onionperf patch set for #30586 with new requirements. * Filed #34298 for onionperf and wrote a fix. * Reviewed #33434 for onionperf. * Reviewed #34286 for GetTor. * Merged #34154 and #33945 for BridgeDB; released version 0.10.1. * Wrote blog post about new BridgeDB release (may come out today). * Reviewed OTF applications. * Finally got access to our Azure account. * Filed #34318 for BridgeDB. * Helped bridge op figure out why bridge didn't have Running flag -- apparently because IPv6 port was unreachable. * Helped agix get a blog account. * Wrote exitmap module to find exits that resolve non-existing domains. Next week: * Make wolpertinger fetch OONI's test results from S3 bucket. Help with: * cecylia (cohosh): last updated 2020-05-28 Last week: - reviews - worked with Hashik on snowflake proxy for android - did more learning about debain packaging and catching up on #33736 - Wrote some code to demonstrate NAT behaviour discovery (#34129) - started integrating NAT behaviour discovery into snowflake - file an upstream pion/stun PR for support for RFC 5780 - wrote a fix for gettor mailer-daemon loop (#34286) - wrote up a summary for the conjure reading group meeting This week: - finish implementations of NAT behaviour discovery (#34129) - Design a way to use NAT behaviour discovery at the broker - implement NAT behaviour discovery in client and proxies - look at viatsk's work on NAT test suite (#25595) - look at BridgeDB's email responder code and see if there's an uninvasive way to integrate GetTor (#3780) - investigate #33669 - Follow up on discussions of debian obfs4proxy package - translations? - testing snowflake client on android (#30318) Needs help with: - review of #34286 - feedback on #34129 juggy : This week: - Dig into the algorithm for how BridgeDB distributes bridges Next week: - Implement audio captchas in moat, figure out how to reduce audio captcha request size - Keep studying BridgeDB to write architectural overview Help with: arlolra: 2020-05-07 Last week: - webext repo versioning / publishing #34140, #34126, #34132, #34127 Next week: - follow ups to #33365 - start on #31201 Help with: - dcf: 2020-05-28 Last week: Next week: - check with Kyle about snowflake fingerprinting results - share access to the snowflake broker CDN configuration (#30510) Help with: agix:2020-05-28 Last week: - Worked on patch for #27984 - Read this weeks paper - Get familiar with blog policies Next week: - Further test #27984 & submit patch Help with: - thymbahutymba: 2020-04-02 Last week: - CI/CD pipeline for multiarch docker images, which has a problem with the apt tor version even though the apt repository have been changed into the Dockerfile. Next week: Help with: HashikD: 2020-04-28 Last week: - Established the WebRTC connection. (in Test project) - Fixed the issue with connectoin termination. (in Test project) - Sending some temporary data to test the connection. (in Test project) - Finished #34308 (closed) creating new project - Finished and commented on #34264, #34307 (merge_ready) Next week: - Getting my merge requests accepted and acting up on feedback of code. Help with:

1 0

Metrics meeting notes, 28th May 2020
by Gaba 28 May '20

28 May '20

Hi! Metrics Meetings are happening every Thursday at 15UTC in #tor-meeting in irc.oftc.net Here are the minutes for the meeting of May 28th: http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-05-28-14.58.html And here is the pad notes: ----------------------------------------------------- Agenda Thursday, May 28th, 15 UTC ----------------------------------------------------- OnionPerf project: https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor59 Find out why onion service measurements have gotten slower (#34303) How do we catch future '#34303's? Define lower/upper bounds for TTFB/TTLB/circuit build times/etc. in whichever monitoring tool we're going to use. Automatically run OnionPerf instances with newly changed OnionPerf/Tor code. Analyze unusual distribution of time to extend to first hop in circuit (#34257) karsten updates the HK instance to run a #34303-patched tor version to see if #34303 also affects circuit build times. karsten adds measurements to the ticket by Friday evening for dennis_jackson to look over the weekend. Harmonize TTFB/TTLB definitions with Tor Metrics plots (#34215) We agree that it's a good change. karsten merges after the meeting. Split visualizations into public server vs. v2 onion server vs. v3 onion server measurements (#34216) acute reviews this patch. Update metrics-web to only plot "official" data (#33397) We should have guidelines for archiving experimental measurements; like keeping a tarball of the onionperf-data/ directory, a description of the experiment, versions used, etc. In the future we might want to have long-running measurements that shouldn't be plotted on the Metrics website; like different Tor versions or configurations. Having these in CollecTor would be convenient. We should reconsider this when we have these use cases and see what we need. Fix message logging and filtering (#29369) phw picks this ticket. Any review pending to be assigned? Anybody need any help with anything? Log: http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-05-28-14.58.log… -- she/her are my pronouns GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

1 0

Privacy-Friendly web- GSoC 2020
by Aya Hany 26 May '20

26 May '20

Hi there :) I'm Aya, I'm studying Computer science at Mansoura University. I will be working on the "Privacy-Friendly web" project as a part of the GSoC with my mentors Hiro and Antonela. The goal of the project is to make websites work better with tor browser, providing a CSS template based on bootstrap.

2 1

Stem Type Hints
by Damian Johnson 21 May '20

21 May '20

Hi all, I'm delighted to announce that Stem now incorporates type information! For a brief description please see... https://blog.atagar.com/may2020/ Cheers! -Damian

1 0

Outreachy Intern Introduction
by Nicolei Ocaña 21 May '20

21 May '20

Hi Tor Project Team, I'm Nicolei Ocana (IRC: nicoleiocana__), one of the 2020 Outreachy Interns. I will be contributing in Project 1: Help Tor Project support our users along with my mentor Gus (ggus) & the Community Team. I am thrilled to be participating with everybody in helping millions of users protect their privacy, safety, and freedom of expression on the the Internet. Thank you Pili Guerra (pili); I am beyond appreciative for the opportunity to aid in circumventing censorship with you guys!

1 0

Anti-censorship meeting notes, 21 May 2020
by Philipp Winter 21 May '20

21 May '20

Hi all, Here are our meeting minutes: http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-05-21-15.59.html And here is our meeting pad: Anti-censorship work meeting pad -------------------------------- Next meeting: Thursday May 21st 16:00 UTC Weekly meetings, every Thursday at 16:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress). == Goal of this meeting == Weekly checkin about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship at Tor. == Links to Useful documents == * Our anti-censorship roadmap: https://gitlab.torproject.org/torproject/anti-censorship/roadmap/boards * Our roadmap consists of a subset of trac tickets. For 2020 Q1, the trac keyword is anti-censorship-roadmap-2020Q1 * The anti-censorship team's wiki page: https://trac.torproject.org/projects/tor/wiki/org/teams/AntiCensorshipTeam * Past meeting notes can be found at: https://lists.torproject.org/pipermail/tor-project/ * GetTor's roadmap: https://gitlab.torproject.org/groups/torproject/anti-censorship/gettor-proj… * Tickets that need reviews: from sponsors we are working on: * https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor30 * https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor28 * Anti-censorship related tickets that we want other teams to fix: * https://pad.riseup.net/p/tor-anti-censorship-tickets-keep == Announcements == * == Discussion == * Shall we post our monthly report on the blog instead of (or in addition to) the mailing list? == Actions == * == Interesting links == == Reading group == * We will discuss "Conjure: Summoning Proxies from Unused Address Space" on May 28 * https://censorbib.nymity.ch/#Frolov2019b * Questions to ask and goals to have: * What aspects of the paper are questionable? * Are there immediate actions we can take based on this work? * Are there long-term actions we can take based on this work? * Is there future work that we want to call out, in hopes that others will pick it up? == Updates == Name: This week: - What you worked on this week. Next week: - What you are planning to work on next week. Help with: - Something you need help with. phw: This week (2020-05-21): * Reviewed #27330. * Reviewed and merged #31528. BridgeDB isn't silly anymore. * Wrote a patch for #30586 (onionperf). * Lots of work on wolpertinger. * OONI started using our public endpoint. * Made some API improvements. * Created API endpoint to POST measurements. * Improved authentication thanks to OONI's feedback. * Started working on shim that relays between wolpertinger and bridgestrap. * Filed #34253 and several S30-related tickets. * Set up GetTor email autoresponder test on our monit instance. * Wrote a fix for #34154. * Made some progress on #34260. * Updated BridgeDB translations (not deployed yet though). * Checked in on #33945; looks like BridgeDB's email autoresponder is healthy again. Next week: * Make wolpertinger fetch OONI's test results from S3 bucket. Help with: * #34154 (extend bridgedb's blockedbridges table) * #33945 (fix bridgedb's failed assertion) cecylia (cohosh): last updated 2020-05-21 Last week: - off Monday (public holiday) - worked with HashikD on GSoC tasks - more work on sponsor 28 evaluation - ran a check for STUN servers that support RFC 5780 - started implementing RFC 5780 support for pion/stun (#34129) - some grant writing tasks This week: - Continue work on STUN servers (#34129 and #25591) - More work on reviving the twitter responder in GetTor (#33036, #27330) - look at old GetTor mirrors (#33893) - investigate #33669 - Follow up on discussions of debian obfs4proxy package - translations? Needs help with: - creation of snowflake repo (#34222) from git-admin juggy : This week: - Dig into the algorithm for how BridgeDB distributes bridges Next week: - Implement audio captchas in moat, figure out how to reduce audio captcha request size - Keep studying BridgeDB to write architectural overview Help with: arlolra: 2020-05-07 Last week: - webext repo versioning / publishing #34140, #34126, #34132, #34127 Next week: - follow ups to #33365 - start on #31201 Help with: - dcf: 2020-05-21 Last week: - helped debug Moat in Tails https://lists.torproject.org/pipermail/tbb-dev/2020-May/001093.html - tried NAT discovery STUN server (#34129) Next week: - check with Kyle about snowflake fingerprinting results - share access to the snowflake broker CDN configuration (#30510) Help with: agix:2020-05-21 Last week: - was held up with university stuff Next week: - Continue work on #27984 & submit/test first patch Help with: - thymbahutymba: 2020-04-02 Last week: - CI/CD pipeline for multiarch docker images, which has a problem with the apt tor version even though the apt repository have been changed into the Dockerfile. Next week: Help with: HashikD: 2020-04-18 Last week: - Learning how to compile the WebRTC library from Google source. - Learning the broker API. - Implementing to test the WebRTC API into a test project. - Getting ICE candidates and forming the SDP on the client-side. (Answer) Next week: -Learning how to format the SDP (Serialize) to send it to the broker and Deserialize the SDP offer from the broker to assign it to the local descriptor of peer connection. - Setting up the project. Help with: - SDP serialization .

1 0

Metrics meeting notes, 21st May 2020
by Gaba 21 May '20

21 May '20

Hi! Metrics Meetings are happening every Thursday at 15UTC in #tor-meeting in irc.oftc.net Here are the minutes for the meeting of May 21st: http://meetbot.debian.net/tor-meeting/2020/tor-meeting.2020-05-21-15.01.html And here is the pad notes: ----------------------------------------------------- Agenda Thursday, May 21st, 15 UTC ----------------------------------------------------- OnionPerf project: https://trac.torproject.org/projects/tor/wiki/org/sponsors/Sponsor59 Update OnionPerf to TGen 1.0.0 (#33974) karsten emails jnewsome about getting access to a testing VM. requirements are not included in setup.py (#30586) acute writes an update on the ticket. Analyze unusual distribution of time to extend to first hop in circuit (#34257) dennis started looking at the analysis and will look more. karsten tries to get two new hosts in Florida and Amsterdam for comparison. Reduce the number of 50 KiB downloads (#34023) karsten comments on the ticket to say that there were no major concerns at the weekly meeting and that we're doing it. Reduce timeout and stallout values (#34024) karsten updates the ticket to say that we agree that this is an improvement, and we're going to do it. Allow users to select Onion Service version to measure (#33434) asn replied on the ticket. Update metrics-web to only plot "official" data (#33397) Remove existing Tor control log visualizations (#34214) Harmonize TTFB/TTLB definitions with Tor Metrics plots (#34215) Fix message logging and filtering (#29369) leaving this here as something to pick up for writing code. Combine multiple analysis files into single data set (#34191) leaving this here as something to pick up for writing code. Python style anarcat suggested pyflakes3 and black acute suggested pylint and yapf phw and jnewsome suggested flake8 as being used in bridgedb and shadow karsten tries out these tools, and we'll discuss them again next week. Reviews (tag with metrics-team if needs review) karsten adds metrics-team to auto-cc for (new) Metrics/OnionPerf tickets. there are 4 tickets that needs reviewer: https://trac.torproject.org/projects/tor/query?status=needs_review&sponsor=… -- she/her are my pronouns GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

1 0

NYC HOPE to nine days
by George 19 May '20

19 May '20

FYI: > > > Greetings, > > While we all want things to go back to normal, the science just doesn't > make that possible. July and August may still seem far away, but there > simply is no way the COVID-19 crisis will be over by then, even in the > best-case scenario. We had planned on waiting until June to make a final > decision, but it's become clear that planning an in-person conference > simply wouldn't be the responsible thing to do. Nothing matters more than > the health and safety of our attendees. Yes, this will be a financial > kick in the teeth for us. But it's one we'll willingly take as the mere > possibility of putting any of you at risk is unconscionable. > > We want to be clear on one important point. Apart from the obvious > disappointment of not being able to host this historic event at a new > venue we were so looking forward to, we want everyone to come out of this > not feeling dissatisfaction beyond that. More on that later. > > This is what we're now looking at: > > We are NOT canceling HOPE. Instead, we are changing what this year's HOPE > will be. > > HOPE 2020 will now be a NINE DAY EVENT, beginning on Saturday, July 25th > and running until Sunday, August 2nd, 2020. Why did we add an entire week? > Because we want some good to come out of this and we believe our community > is in a position to do just that. We all know what we WON'T have without a > physical conference, but let's now focus on what we CAN have with some > imagination and collaboration. That's what the hacker community is all about. > > We intend to have around the same number of talks as we normally do, but > spread out over a much longer period and available for viewing on a high > capacity stream. Those of you who bought tickets will have exclusive access > to the presenters so you can ask questions, participate in workshops, and > interact with other conference attendees. In addition, you will also > receive a conference t-shirt and badge that won't ever be made available to > anyone else. > > We plan on having NINE keynote speakers, again with exclusive Q&A access > for our attendees. > > Participation in HOPE will no longer be bound by visas and worries of arrest > by certain controversial types. So expect a dynamic and varied cast of > characters. It wouldn't be HOPE without that, but now we can REALLY remove > some barriers. > > In addition to ongoing talks and panels, we'll also have workshops for the > duration of the nine day event. Expect everything from lockpicking to > soldering instruction to our infamous ham radio exams. > > For the overnight hours, we're planning on having concerts, DJs, and other > fun stuff. HOPE will remain a 24 hour event, but for nine days! > > All of this has been - and will continue to be - a daunting task. The > COVID-19 pandemic has affected all of us in varying ways. The continued > survival of 2600 was quickly put into doubt as our distributors stopped > paying us, bookstores with our issues in them shut down, and new issues > were left in loading zones. We've lost more than half a year's income at > last count and have had to stop getting paid in order to continue to > survive. Making this year's HOPE a success is really the only way we can > come through this. > > As mentioned above, we don't want anyone to feel extra unhappy because of > this. If you want a refund, we will give you one. But with all of the > losses we've already suffered, we won't be able to continue existing if we > have to issue very many of those. That's why we're hoping we can put > together the best event possible and make this the highlight of our summer > despite all that's happened. > > We are in the process of accepting talk and workshop proposals that have > already been submitted. We will be providing technical support so that > presenters will be able to participate smoothly in a virtual environment. > We are now opening up the submission process to include many more > participants from all around the globe, something we never really had the > ability to do before. We hope to have talks, workshops, and musical > presentations from a truly international community, no longer bound by a > physical presence. > > While we have a dedicated team of volunteers already working on making this > happen, we can definitely use many more, especially as the event draws > closer and becomes bigger. Email volunteers(a)hope.net and let us know how > you think you can help. We're looking for people with experience setting up > and producing live online broadcasts. We are also looking for emcees, > moderators for online forums, and people to fulfill other behind-the-scenes > roles. > > If we get through all of this, we fully intend to hold a physical HOPE in > 2021 (the first odd-year HOPE since 1997). This will also enable us to > continue publishing once bookstores start opening again. All of this depends > on our hacker spirit getting us through the toughest times we ever could > have imagined. And if you share our enthusiasm over what this new incarnation > of HOPE will mean, this summer will indeed be one to look forward to. > > Stay safe. > > The HOPE Staff > _______________________________________________ > hope-announce mailing list -- hope-announce(a)lists.2600.com > To unsubscribe send an email to hope-announce-leave(a)lists.2600.com >

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

tor-project May 2020