----- Forwarded message from Lunar <lunar@torproject.org> ----- Date: Wed, 9 Oct 2013 17:27:02 +0200 From: Lunar <lunar@torproject.org> To: tor-news@lists.torproject.org, tor-talk@lists.torproject.org Subject: [tor-talk] Tor Weekly News — October 9th, 2013 Message-ID: <20131009152702.GA17748@loar> User-Agent: Mutt/1.5.21 (2010-09-15) Reply-To: tor-talk@lists.torproject.org ======================================================================== Tor Weekly News October 9th, 2013 ======================================================================== Welcome to the fifteenth issue of Tor Weekly News, the weekly newsletter that covers what's happening in the world of Tor — “king of high-secure, low-latency anonymity” [1]. [1] http://www.theguardian.com/world/interactive/2013/oct/04/tor-high-secure-int... New tranche of NSA/GCHQ Tor documents released ---------------------------------------------- After a cameo appearance in previous leaked intelligence documents [2], Tor found itself at the center of attention in the latest installment of the ongoing Snowden disclosures after a series of stories were published in the Guardian and the Washington Post that detailed alleged attempts by NSA, GCHQ, and their allies to defeat or circumvent the protection that Tor offers its users. A number of source materials, redacted by the newspapers, were published to accompany the articles. The documents in question [3] offer, alongside characteristically entertaining illustrations [4], an overview of the Tor network from the point of view of the intelligence agencies, as well as a summary of attacks against Tor users and the network as a whole that they have considered or carried out. Despite the understandable concern provoked among users by these disclosures, Tor developers themselves were encouraged by the often relatively basic or out-of-date nature of the attacks described. In response to one journalist's request for comment, Roger Dingledine wrote that “we still have a lot of work to do to make Tor both safe and usable, but we don't have any new work based on these slides” [5]. Have a look at the documents yourself, and feel free to raise any questions with the community on the mailing lists or IRC channels. [2] https://blog.torproject.org/blog/tor-nsa-gchq-and-quick-ant-speculation [3] http://media.encrypted.cc/files/nsa [4] https://twitter.com/EFF/status/386291345301581825 [5] https://blog.torproject.org/blog/yes-we-know-about-guardian-article#comment-... tor 0.2.5.1-alpha is out ------------------------ Roger Dingledine announced [6] the first alpha release in the tor 0.2.5.x series, which among many other improvements introduces experimental support for syscall sandboxing on Linux, as well as statistics reporting for pluggable transports usage on compatible bridges. Roger warned that “this is the first alpha release in a new series, so expect there to be bugs. Users who would rather test out a more stable branch should stay with 0.2.4.x for now.” 0.2.5.1-alpha will not immediately appear on the main download pages, in order to avoid having too many versions listed at once. Please feel free to test the new release [7], and report any bugs you find! [6] https://lists.torproject.org/pipermail/tor-talk/2013-October/030269.html [7] https://www.torproject.org/dist/ How did Tor achieve reproducible builds? ---------------------------------------- At the end of June, Mike Perry announced [8] the first release of the Tor Browser Bundle 3.0 alpha series, featuring release binaries “exactly reproducible from the source code by anyone”. In a subsequent blog post [9] published in August, he explained why it mattered. Mike has just published the promised follow-up piece [10] describing how this feat was achieved in the new Tor Browser Bundle build process. He explains how Gitian [11] is used to create a reproducible build environment, the tools used to produce cross-platform binaries for Windows and OS X from a Linux environment, and several issues that prevented the builds from being entirely deterministic. The latter range from timestamps to file ordering differences when looking up a directory, with an added 3 bytes of pure mystery. There is more work to be done to “prevent the adversary from compromising the (substantially weaker) Ubuntu build and packaging processes” currently used for the toolchain. Mike also wrote about making the build of the compiler and toolchain part of the build process, cross-compilation between multiple architectures, and the work being done by Linux distributions to produce deterministic builds from their packages. If you are interested in helping, or working on your own software project, there is a lot to be learned by reading the blog post in full. [8] https://blog.torproject.org/blog/tor-browser-bundle-30alpha2-released [9] https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and-... [10] https://blog.torproject.org/blog/deterministic-builds-part-two-technical-det... [11] http://gitian.org/howto.html Toward a new Tor Instant Messaging Bundle ----------------------------------------- A first meeting last week kicked-off the “Attentive Otter project” [12] which aims to come up with a new bundle for instant messaging. The first meeting mainly consisted in trying to enumerate the various options. In the end, people volunteered to research three different implementation ideas. Thijs Alkemade and Jurre van Bergen explored the possibilty of using Pidgin/libpurple [13] as the core component. Jurre also prepared an analysis of xmpp-client [14], together with David Goulet, Nick Mathewson, Arlo Breault, and George Kadianakis. As a third option, Mike Perry took a closer look at Instantbird/Thunderbird [15] with Sukhbir Singh. All the options have their pros and cons, and they will probably be discussed on the tor-dev mailing list and at the next “Attentive Otter” meeting. [12] https://trac.torproject.org/projects/tor/wiki/org/sponsors/Otter/Attentive [13] https://lists.torproject.org/pipermail/tor-dev/2013-October/005544.html [14] https://lists.torproject.org/pipermail/tor-dev/2013-October/005546.html [15] https://lists.torproject.org/pipermail/tor-dev/2013-October/005555.html More monthly status reports for September 2013 ---------------------------------------------- The wave of regular monthly reports from Tor project members continued this week with submissions from George Kadianakis [16], Lunar [17], Sathyanarayanan Gunasekaran [18], Ximin Luo [19], Matt Pagan [20], Pearl Crescent [21], Colin C. [22], Arlo Breault [23], Karsten Loesing [24], Jason Tsai [25], the Tor help desk [26], Sukhbir Singh [27], Nick Mathewson [28], Mike Perry [29], Andrew Lewman [30], Aaron G [31], and the Tails folks [32]. [16] https://lists.torproject.org/pipermail/tor-reports/2013-October/000346.html [17] https://lists.torproject.org/pipermail/tor-reports/2013-October/000347.html [18] https://lists.torproject.org/pipermail/tor-reports/2013-October/000348.html [19] https://lists.torproject.org/pipermail/tor-reports/2013-October/000349.html [20] https://lists.torproject.org/pipermail/tor-reports/2013-October/000350.html [21] https://lists.torproject.org/pipermail/tor-reports/2013-October/000351.html [22] https://lists.torproject.org/pipermail/tor-reports/2013-October/000352.html [23] https://lists.torproject.org/pipermail/tor-reports/2013-October/000353.html [24] https://lists.torproject.org/pipermail/tor-reports/2013-October/000354.html [25] https://lists.torproject.org/pipermail/tor-reports/2013-October/000355.html [26] https://lists.torproject.org/pipermail/tor-reports/2013-October/000356.html [27] https://lists.torproject.org/pipermail/tor-reports/2013-October/000357.html [28] https://lists.torproject.org/pipermail/tor-reports/2013-October/000358.html [29] https://lists.torproject.org/pipermail/tor-reports/2013-October/000359.html [30] https://lists.torproject.org/pipermail/tor-reports/2013-October/000360.html [31] https://lists.torproject.org/pipermail/tor-reports/2013-October/000361.html [32] https://lists.torproject.org/pipermail/tor-reports/2013-October/000362.html Tor Help Desk Roundup --------------------- A number of users wanted to know if Tor was still safe to use given the recent news that Tor users have been targeted by the NSA. We directed these users to the Tor Project's official statement on the subject [33]. One of the most popular questions the help desk receives continues to be whether or not Tor is available on iOS devices. Currently there is no officially supported solution, although more than one project has been presented [34, 35]. The United Kingdom is now one of the countries where citizens request assistance circumventing a national firewall [36]. [33] https://blog.torproject.org/blog/yes-we-know-about-guardian-article [34] https://lists.torproject.org/pipermail/tor-dev/2013-October/005542.html [35] https://trac.torproject.org/projects/tor/ticket/8933 [36] https://lists.torproject.org/pipermail/tor-talk/2013-July/029054.html Miscellaneous news ------------------ Thanks to Grozdan [37], Simon Gattner from Netzkonstrukt Berlin [38], Wollomatic [39], and Haskell [40] for setting up new mirrors of the Tor project website. [37] https://lists.torproject.org/pipermail/tor-mirrors/2013-September/000366.htm... [38] https://lists.torproject.org/pipermail/tor-mirrors/2013-September/000370.htm... [39] https://lists.torproject.org/pipermail/tor-mirrors/2013-October/000374.html [40] https://lists.torproject.org/pipermail/tor-mirrors/2013-October/000375.html Arlo Breault sent out a request for comments on a possible new version of the check.torproject.org page [41]. [41] https://lists.torproject.org/pipermail/tor-talk/2013-October/030253.html Runa Sandvik announced [42] that the Tor Stack Exchange page has moved from private beta to public beta. If you'd like to help answer Tor-related questions (or ask them), get involved now! [43] [42] https://lists.torproject.org/pipermail/tor-talk/2013-October/030269.html [43] http://tor.stackexchange.com/ Philipp Winter sent out a call for testing (and installation instructions) for the ScrambleSuit pluggable transports protocol [44]. [44] https://lists.torproject.org/pipermail/tor-talk/2013-October/030252.html Not strictly Tor-related, but Mike Perry started an interesting discussion [45] about the “web of trust” system, as found in OpenPGP. The discussion was also held on the MonkeySphere mailing list, which prompted Daniel Kahn Gilmor to reply with many clarifications regarding the various properties and processes of the current implementation. To sum it up, Ximin Luo started [46] a new documentation project [47] “to describe and explain security issues relating to identity, in (hopefully) simple and non-implementation-specific language”. [45] https://lists.torproject.org/pipermail/tor-talk/2013-September/030235.html [46] https://lists.riseup.net/www/arc/monkeysphere/2013-10/msg00000.html [47] https://github.com/infinity0/idsec/ The listmaster role has been better defined [48] and is now performed by a team consisting of Andrew Lewman, Damian Johnson, and Karsten Loesing. Thanks to them! [48] https://trac.torproject.org/projects/tor/wiki/org/operations/Infrastructure/... Roger Dingledine released an official statement on the Tor project blog [49] regarding the takedown of the Silk Road hidden service and the arrest of its alleged operator. [49] https://blog.torproject.org/blog/tor-and-silk-road-takedown Fabio Pietrosanti asked [50] for reviews of “experimental Tor performance tuning for a Tor2web node.” Feel free to have a look [51] and provide feedback. [50] https://lists.torproject.org/pipermail/tor-talk/2013-October/030405.html [51] https://github.com/globaleaks/Tor2web-3.0/wiki/Performance-tuning Claudiu-Vlad Ursache announced [52] the initial release of CPAProxy [53], “a thin Objective-C wrapper around Tor”. This is the first component of a project to “release a free open-source browser on the App Store that uses this wrapper and Tor to anonymize requests.” Claudiu-Vlad left several questions open, and solicited opinions on the larger goal. [52] https://lists.torproject.org/pipermail/tor-dev/2013-October/005545.html [53] https://github.com/ursachec/CPAProxy Upcoming events --------------- Oct 09-10 | Andrew speaking at Secure Poland 2013 | Warszawa, Poland | http://www.secure.edu.pl/ | Oct 11 | Kelley @ Journalist Training Event | Helsiniki, Finland | http://www.journalistiliitto.fi/jp13/ | Nov 04-05 | 20th ACM Conference on Computer and Communications Security | Berlin, Germany | http://www.sigsac.org/ccs/CCS2013/ This issue of Tor Weekly News has been assembled by Lunar, harmony, dope457 and Matt Pagan. Want to continue reading TWN? Please help us create this newsletter. We still need more volunteers to watch the Tor community and report important news. Please see the project page [54], write down your name and subscribe to the team mailing list [55] if you want to get involved! [54] https://trac.torproject.org/projects/tor/wiki/TorWeeklyNews [55] https://lists.torproject.org/cgi-bin/mailman/listinfo/news-team -- tor-talk mailing list - tor-talk@lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5