Hello!

Status updates and news from Tor Browser land after the Mozilla All Hands meeting got discussed yesterday at our weekly meeting. The chat log can be found at:

http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-06-18-18.01.log....

The notes from our pad are:

Tor Browser Meeting Notes Monday, June 18, 2018

Discussion: -"status:" update -Quo vadis sandboxing? [GeKo: sysrqb is updating the sandbox plans he had and we get together on IRC to hammer out details] -Tracking issues in Trac -release preparations (blocker 1) and 2) from last week got solved, no new ones showed up, only 3) is left for the alpha) -which UX features need to get into the first alpha

- .onion padlock indicator

- circuit display

- Tor Browser icon update

- about:tor without onboarding?

-next meeting - sysrqb: Confirming, we should base TBA on 60ESR, yes? [GeKo: yes] - igt0: Thinking about TBA, are we going to release a new orbot version as well? [GeKo: No, that's still the GuardianProject's job] - igt0: Service workers added lot of new APIs, I was not able to find out tickets about it (a master ticket), Is someone taking a look? [GeKo: We don't need that for now as service worksers are still disabled in the ESR60, we have #15563 for general service workers related work]

sukhe: Last Week: - Finalized #26203, #26326, #26204, #25837 (Windows build issues; merged) and prepared #23561 (NSIS 64bit) for review - Attended Summer Institute This Week: - Work on #26319 (Don't package up the whole Tor Browser in the `mach package` step), #26251 (Adapt macOS snowflake compilation to new toolchain) - I am offline on Wed June 20

mcs and brade: Last week: - Triage some new/incoming tickets: - #26346 (Update prompt from 7.5.5 to the same version) - #26350 (MacOS Tor Browser cannot bind to port) - #26375 (On Mac, cannot have Tor Browser and Tor Browser Alpha side by side) - #26381 (about:tor page does not load on first start in localized Windows bundle) - Helped with #26045 (Create a new MAR signing key for ESR60) - Helped with #26355 (Make sure only Windows users on Windows7+ are trying to use Tor Browser based on ESR60 - Completed review for #23247 (Communicating security expectations for .onion). - Continued with #22074 (Review Firefox Developer Docs and Undocumented bugs since FF52esr). This week: - Continue with #22074 (Review Firefox Developer Docs and Undocumented bugs since FF52esr). - This is going slowly, so we are trying to find a way to speed up the review. - #26381 (about:tor page does not load on first start in localized Windows bundle) GeKo: Do you want us to work on this ticket? [Please go ahead, I probably won't get to it, GeKo]

sysrqb: Last week: - At Mozilla All-Hands - Participated in conversations about Firefox sandboxing - Learned about Mozilla's plans for Firefox/Gecko on Android - Many more things This week: - Push Tor Browser 60ESR branch with TBA patches for review - Work on cross-platform Tor Browser sandboxing plan - Begin auditing code for proxy-safety (#21863)

GeKo: Last week: -made progress on the network audit (#22176) -help with the Windows nightly builds (we seem to be good here now as well) -went over the UX tickets relevant for tor browser 8 -fixed up my rustc ticket (#26329) and some other small stuff (#23231, #26304) -reviews (#26329, #25837, #26203, #23247, #26396) This week: -fix for #26362 (create old-style MAR files) -test Mozilla fixes for bug 1413868 and 1421081, possible backport of a crash bug fix -continuing network audit (#22176) -reviews -release preparations and building/signing releases

igt0: Last week: - Tested torbutton with FF60 - started investigating strategies to detect APK tampering. (Since we are going to allow the user to install from different places #26242). This week: - Define and implement update strategy(ies) for TBA (#26242) - Consider different installation methods (#26318)

boklm: Last week: - reviewed some patches: - #26329: Fix Rust cross-compilation for 32bit Windows - #26203: Adapt tor-browser-build firefox and tor-browser project for ESR 60 Windows build - #26304: Update zlib to latest version - #23231: Error in STL wrappers when building Firefox 64-bit for Windows - #26250: Bump Rust version to 1.26.1 - #23561: Fix nsis builds for Windows 64 - made patches for: - #26354: Make sure only Linux users with SSE2 support are trying to use Tor Browser based on ESR60 - #26370: Don't copy msvcr100.dll and libssp-0.dll twice - #26206: Ship pthread related dll with tor - #26396: libwinpthread we ship in Windows builds is not built reproducible This week: - help building the new releases - doing some reviews - plan travel for mexico meeting - continue investigating build issue with #12968 (HEASLR) - fill upstream binutils ticket for #26148 - continue work on some ansible roles for testsuite VMs setup (#26149)

pospeselr: Last week: - Mozilla All-Hands - patch for #26039 (extension-overrides.js no long being a thing in ESR60) This week: - fix up #23247 (onion lock icons) with final bits of feedback - verify #26039 fix works - go through the outreachy intern's issues spreadsheet - #26355

arthuredelstein: Last week: - Mozilla all hands meeting - Worked on reviewing HTTP/2 code including origin frames and AltSvc This week (as described last time): - Help with build as needed - Finish a patch for https://trac.torproject.org/25555 (reimplement optimistic socks) - HTTP/2, https://trac.torproject.org/14952 - Other needed alpha/ff60-esr tickets: https://trac.torproject.org/21785, https://trac.torproject.org/26321, https://trac.torproject.org/26322

Georg