- cypherpunks - lists.cpunks.org

[tor-talk] Tor Weekly News — July, 24th 2013
by Eugen Leitl 25 Jul '13

25 Jul '13

----- Forwarded message from dope457 <dope457(a)riseup.net> ----- Date: Wed, 24 Jul 2013 14:06:09 +0200 From: dope457 <dope457(a)riseup.net> To: tor-news(a)lists.torproject.org, tor-talk(a)lists.torproject.org Subject: [tor-talk] Tor Weekly News — July, 24th 2013 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130620 Thunderbird/17.0.7 Reply-To: tor-talk(a)lists.torproject.org ======================================================================== Tor Weekly News July 24th, 2013 ======================================================================== Welcome to the 4th issue of Tor Weekly News, the weekly newsletter that covers what is happening in the great Tor community. The next newsletter is going to be posted to the resurrected tor-news mailing-list. Just subscribe! [1] [1] https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-news Summer Development Meeting 2013 ------------------------------- About 40 core Tor contributors gathered over July 22-23 at the Technische Universität München [2] in Germany for this year's Summer Development Meeting [3]. That's quite a number, and as could be expected, there are a huge number of topics up for discussion — the brainstorming session generated around 150. Gunner from Aspiration Tech [4] is once again facilitating the meeting, helping everyone focus on the most pressing issues. Rough notes from some of the break-out sessions are now up on the wiki. A list of the topics and a brief summary of the discussions are given below: * Love for volunteers: strategies for outreach and long-term support; identifying where they're most needed [5] * Censorship and pluggable transports: documenting the now-large number of pluggable transports; discussing countries' differing censorship strategies [6] * Fundraising: funding outlook seems to be positive, although diversity in funding sources is needed to reduce dependency on single institutions like the US Government [7] * Website Translation: notes from a discussion which led to the definition of a new translation review process and a list of actionables [8] * Service infrastructure: multiple fundamental services could use some more love: GetTor (TBB by email), website, Trac, check.tp.org, BridgeDB; shutting down unmaintained services [9] * Operational security: random notes on OpSec for Tor people [10] On the sidelines of the dev meeting, Roger and Jake are doing a public talk on the topic of 'Tor and the Censorship Arms Race'. [11] If you want to meet people who spend their day making Tor a reality, you can join them for a public hack day [12] on Friday, July 26, 2013. Bring your ideas, questions, projects, and technical expertise with you! [2] http://www.tum.de/ [3] https://trac.torproject.org/projects/tor/wiki/org/meetings/2013SummerDevMee… [4] http://aspirationtech.org/ [5] https://trac.torproject.org/projects/tor/wiki/org/meetings/2013SummerDevMee… [6] https://trac.torproject.org/projects/tor/wiki/org/meetings/2013SummerDevMee… [7] https://trac.torproject.org/projects/tor/wiki/org/meetings/2013SummerDevMee… [8] https://trac.torproject.org/projects/tor/wiki/org/meetings/2013SummerDevMee… [9] https://trac.torproject.org/projects/tor/wiki/org/meetings/2013SummerDevMee… [10] https://trac.torproject.org/projects/tor/wiki/org/meetings/2013SummerDevMee… [11] https://gnunet.org/tor2013tum [12] https://blog.torproject.org/blog/join-us-tor-hack-day-munich-germany Remote descriptor fetching in Stem ---------------------------------- Damian Johnson announced [13] having implemented remote descriptor fetching in Stem [14], a feature to migrate more metrics measurement tools to Python [15]. “Its usage is pleasantly simple” wrote Damian. See for yourself in the excellent documentation! [16] [13] https://lists.torproject.org/pipermail/tor-dev/2013-July/005156.html [14] https://stem.torproject.org/ [15] https://lists.torproject.org/pipermail/tor-dev/2013-May/004924.html [16] https://stem.torproject.org/api/descriptor/remote.html Orbot 12.0.1 call for beta testing ---------------------------------- After a long interval, Nathan Freitas announced the release of a new version of Orbot - a client for the Tor network on Android mobile devices [17]. For Orbot 12.0.1, the developers have “switched versioning styles to a simpler major.minor.bugfix model”, wrote Nathan. He continues with a call for testing: “Since we haven't done a release in a while, and we have some new build tools, I mostly want to make sure I have not done something terribly wrong in the build process. Please confirm back if you are able to successfully use this release.” Updates in 12.0.1: * Updated to Tor 0.2.4.15-RC * flashy screen bug fixed now shows traffic * Stats in notification area * better handling of preference settings * Changes added superuser permission for Cyanogen You can download and start testing this release here [18] or here [19]. [17] https://lists.torproject.org/pipermail/tor-talk/2013-July/029063.html [18] https://rink.hockeyapp.net/apps/92ace552aa5344d1a802decb71525897/ [19] https://guardianproject.info/releases/Orbot-release-12.0.1-beta-1.apk Miscellaneous development news ------------------------------ Lunar reported on the trip to Brussels for LSM 2013. [20] To sum it up, “people are really supportive of what we do these days”. anonym outlined [21] the release schedule for Tails 0.20. intrigeri announced [22] that Tails has switched to a more conventional task manager. It might now be easier for you to see what needs to be done. Have a look at the current list of 496 open issues [23], there might be something waiting just for you. Tor developers would love to find an easier way to debug tor when the daemon crashes. Nick Mathewson came up with an initial piece of code that could (when complete) dump stack traces on assertion, crash, or general trouble to the logs. There's more work to be done before it can be merged in Tor. Feel free to help — especially if you know how to do this on Windows or BSD. [24] Nick Mathewson along with Andrea created a wiki page for initial 0.2.5 series ticket triage [25]. If you have your own agenda for 0.2.5, you should be talking to them now! Kostas Jakeliunas reported on their GSoC project about producing a searchable metrics archive. [26] Arturo reported on his activities on Ooni probe in June. [27] Pierre Lalet announced [28] that he started working on an implementation of the Tor protocol in Python. The intent is to have an independent implementation to test Tor. As the author puts it, "the purpose is NOT to implement a secure or robust implementation that could be an alternative to Tor." Have a look at the code [29]: "Comments, fixes and questions welcome !" [20] https://lists.torproject.org/pipermail/tor-reports/2013-July/000292.html [21] https://mailman.boum.org/pipermail/tails-dev/2013-July/003292.html [22] https://mailman.boum.org/pipermail/tails-dev/2013-July/003297.html [23] https://labs.riseup.net/code/projects/tails/issues [24] https://trac.torproject.org/projects/tor/ticket/9299 [25] https://trac.torproject.org/projects/tor/wiki/org/roadmaps/Tor/025/TicketTr… [26] https://lists.torproject.org/pipermail/tor-dev/2013-July/005158.html [27] https://lists.torproject.org/pipermail/tor-reports/2013-July/000291.html [28] https://lists.torproject.org/pipermail/tor-dev/2013-July/005161.html [29] https://github.com/cea-sec/TorPylle Upcoming events --------------- Jul 26 | Tor Hack Day | München, Germany | https://blog.torproject.org/blog/join-us-tor-hack-day-munich-germany | Jul 31-05 | Tor at OHM | Geestmerambacht, Netherlands | https://ohm2013.org/ | Aug 1-4 | Runa Sandvik @ DEF-CON 21 | Rio Hotel, Las Vegas, USA | https://www.defcon.org/html/defcon-21/dc-21-index.html | Aug 13 | Roger at the 3rd USENIX Workshop on Free and Open Communications on the Internet | Washington, DC, USA | https://www.usenix.org/conference/foci13/ This issue of Tor Weekly News has been assembled by Lunar, dope457, harmony, moskvax, malaparte, whabib, and David Fifield. Want to continue reading TWN? Please help us create this newsletter. We still need more volunteers to watch the Tor community and report important news. Please see the project page [30], write down your name and subscribe to the team mailing-list [31] if you want to get involved! [30] https://trac.torproject.org/projects/tor/wiki/TorWeeklyNews [31] https://lists.torproject.org/cgi-bin/mailman/listinfo/news-team -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Reduced NSA TA History
by John Young 24 Jul '13

24 Jul '13

Th NSA Traffic Analysis history reduced from 11.5MB to 3.2MB: http://cryptome.org/2013/07/nsa-traffic-analysis.pdf

1 0

NSA History of Traffic Analysis
by John Young 24 Jul '13

24 Jul '13

NSA released on 23 July 2013 "The History of Traffic Analysis: World War I-Vietnam." http://www.nsa.gov/about/_files/cryptologic_heritage/publications/misc/traf… It notes the formation of T/A (Traffic Analysis) and C/A (Cryptanalysis) as the two elements of code-breaking, using the mail analogy of T/A for the envelope, C/A for the contents. As noted elsewhere T/A is now publicized as "metadata."

1 0

Join us for a public hack day on Friday, July 26, 2013 in Munich, Germany.
by Eugen Leitl 24 Jul '13

24 Jul '13

https://blog.torproject.org/blog/join-us-tor-hack-day-munich-germany JOIN US - Tor Hack Day, Munich, Germany Posted July 8th, 2013 by kelley in dev meeting hack day Join us for a public hack day on Friday, July 26, 2013 in Munich, Germany. Thank you to our hosts at the Technische Universität München (http://www.tum.de) The agenda and conversations will be determined by you and Tor's team of developers and researchers - so bring your ideas, questions, projects and technical expertise with you! This event is open to the public and free of charge - no RSVP necessary. Friday, July 26, 2013 Start Time: 10:00 am Location: LRZ building, Sminarraum (H.E. 008), Bolzmannstrabe 1, 85748 Garching, Germany. NOTE: the room is to the right of the main entrance. For questions please contact execdir(a)torproject.org

1 0

Re: Python Random Number Generator for OTP
by Bill Stewart 24 Jul '13

24 Jul '13

> > >Â Why not use /dev/random, instead of "ensuring you have entropy"Â > > /dev/random limits the output size to the > estimated entropy. So it has abysmal > performance unless there are high performance entropy sources available. This is for a one-time pad. Limiting the output size to the estimated entropy is a *requirement*. Abysmal performance is fine, because you're going to transfer the pad using a briefcase handcuffed to a courier's arm or some similarly high-cost high-latency physical distribution method, though if you've got a higher-performance entropy source, great. > After the initial seeding this gains very little security in practice. If "gains very little security in practice" is good enough for you, you don't need a one-time pad. Yes, the pseudo-random bits you get out of /dev/urandom will probably be much better than the bits the Russians got by mashing down the keys on typewriters, and you're probably not going to be attacked with the persistence of the Venona decrypters, but don't waste your time using one-time pads unless you're going to use them perfectly. You're much better off using a long-enough RSA key and some Diffie-Hellman session key generation. (Of course, you still want good random numbers for those, but /dev/random is plenty fast enough for that, at least on any non-virtual machine.)

3 3

Re: Gnu PG is more Safe ?
by Anthony Papillion 24 Jul '13

24 Jul '13

On Jul 23, 2013, at 9:01 PM, oxopz7(a)riseup.net wrote: > Hello everybody! > > I hope all are fine, and doing well! > > I'm good member :) I hope you will accept me! Welcome to the list! It's good to see so many new members coming on board. I'm new myself. > I like to ask about GNU PG, if is more safe than other kind of > software! > that talks about Crypto ? Because GnuPG is open source, it's been extensively peer reviewed and found safe and secure. That doesn't mean it's perfect and has no errors. But they are much less likely to exist in GnuPG than in some other solutions; particularly proprietary ones. > I like to ask also about good resources in Crypto, specially about > SSL/TLS? One of the best ways to learn about tech topics is reading RFC's. The entire way SSL/TLS operates is detailed in an RFC. Read I'd and you will be infinately more informed. Unfortunately, I can't really recommend any good crypto list because I've not found many. To learn about FnuPG and practice, you might want to look at the PGPNET list. Another of interest might be Cryptography. Regards and Welcome! Anthony

7 9

Re: [serval-project-dev] mesh networking patent application - prior art request
by Eugen Leitl 24 Jul '13

24 Jul '13

----- Forwarded message from Bryce Lynch <virtualadept(a)gmail.com> ----- Date: Tue, 23 Jul 2013 13:41:35 -0400 From: Bryce Lynch <virtualadept(a)gmail.com> To: serval-project-developers(a)googlegroups.com Subject: Re: [serval-project-dev] mesh networking patent application - prior art request Reply-To: serval-project-developers(a)googlegroups.com On Tue, Jul 23, 2013 at 7:54 AM, Dan Staples < danstaples(a)opentechinstitute.org> wrote: > That's sickening. Not paying a dime in US taxes on billions of dollars > of profit apparently isn't enough for GE, now they have to patent mesh > technology. > Mesh networking is too potentially dangerous to go unrestricted. That said, I just posted a bunch of stuff to that thread with as many links to verifiable code commits in public repos as I could. Anybody so inclined to check my work, please do, and some up-votes would be nice if they don't suck too badly. -- The Doctor [412/724/301/703] [ZS] https://drwho.virtadpt.net/ "I am everywhere." -- You received this message because you are subscribed to the Google Groups "Serval Project Developers" group. To unsubscribe from this group and stop receiving emails from it, send an email to serval-project-developers+unsubscribe(a)googlegroups.com. To post to this group, send email to serval-project-developers(a)googlegroups.com. Visit this group at http://groups.google.com/group/serval-project-developers. For more options, visit https://groups.google.com/groups/opt_out. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Crowdfunding code reviews [was: GnuPG Safe]
by grarpamp 24 Jul '13

24 Jul '13

On Tue, Jul 23, 2013 at 11:08 PM, Peter Gutmann <pgut001(a)cs.auckland.ac.nz> wrote: > Having code that's open source doesn't help at all if no-one looks at it. It is easy to write code. Harder to write it securely. Even harder to spot your own mistakes. And unless perfect written from the start, will need reviewed and fixed. Yet time to review and fix is not as free as the time writing it, is often viewed as a chore, and happens far less than open source assumes it does. Are we developed enough to begin putting together lists of most critical libraries/tools/apps and pipelining them through a crowdfunded independant peer review program? (501c3 perhaps) Or at least put bounties on the same lists.

1 0

Gnu PG is more Safe ?
by oxopz7＠riseup.net 24 Jul '13

24 Jul '13

Hello everybody! I hope all are fine, and doing well! I'm good member :) I hope you will accept me! I like to ask about GNU PG, if is more safe than other kind of software! that talks about Crypto ? I like to ask also about good resources in Crypto, specially about SSL/TLS? Have a nice day, Cheers, Ζακάρια

2 1

Python Random Number Generator for OTP
by Tom 23 Jul '13

23 Jul '13

Does anyone on the list have some Python source code for an OTP-focused random number generator they'd be willing to share? I'm interested in seeing how different people would approach it?

15 16