17:59:55 <GeKo> #startmeeting tor-browser 17:59:55 <MeetBot> Meeting started Mon Mar 28 17:59:55 2016 UTC. The chair is GeKo. Information about MeetBot at http://wiki.debian.org/MeetBot. 17:59:55 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic. 18:00:03 <GeKo> hi everyone 18:00:07 <boklm> hi 18:00:08 <Yawning> hi 18:00:39 <GeKo> so, we got our meeting time a little bit adjusted due to daylight savings time in europe 18:00:51 <GeKo> but we should be set up to october now ) 18:00:59 <GeKo> who wants to go first? 18:01:22 * boklm can go 18:01:38 <boklm> This past week I added scramblesuit tests (#18612), fixed #18569 18:01:39 <boklm> I merged the marionette branch to master (#16009) and added a test for the User Timing API in #18597 18:01:49 <boklm> This week I'm planning to add Performance Observer tests for #18597 18:01:57 <boklm> start running the testsuite on OSX on nightlies and convert more tests to marionette 18:02:04 <GeKo> nice 18:02:05 <boklm> That's it for me. 18:03:04 <GeKo> did you run the test suite on an os x system successfully already? 18:03:32 <GeKo> and it is just a hooking up to our nightly testing infrastructure? 18:03:59 * huseby is here 18:04:05 <GeKo> hi! 18:04:06 <boklm> I ran a few tests on OSX, I didn't try to run them all yet 18:04:11 <GeKo> ok 18:04:46 <boklm> but I don't expect that there will be big problems 18:07:20 <GeKo> who is next? 18:07:40 * mcs will give a report next 18:07:48 <mcs> Last week, Kathy and I revised some of our patches for #13252 to address the Mac OS “user cannot write to /Applications” scenario. 18:07:56 <mcs> We also did a little work on #18330 but do not have a patch ready yet. 18:08:00 <mcs> And we started to work on ESR45 tickets starting with #15640. 18:08:12 <mcs> This week we plan to focus on ff45-esr tickets (#15640, #18599, #18602). 18:08:30 <mcs> Also, Kathy and I will be unavailable on Friday and Saturday of this week. 18:08:36 <mcs> That's all for us. 18:09:07 <GeKo> mcs: one thing that would be helpful is looking over arthur's rebased patches for esr45 that were written by kathy and you 18:09:28 <GeKo> to make sure nothing slipped through the cracks 18:09:55 <mcs> GeKo: OK. Also, we reviewed his revised patches and will continue to do so. 18:10:02 <GeKo> thanks 18:10:04 <arthuredelstein> thanks! 18:10:40 * arthuredelstein can go now 18:10:54 <arthuredelstein> Last week I finished up the rebase of patches for #15197. 18:11:15 <arthuredelstein> I then started working #16998. 18:11:34 <arthuredelstein> This week I will try to finish that patch and also work on #16326 and #16673. 18:12:03 <arthuredelstein> That's it for me 18:12:29 <GeKo> here is what i did: 18:13:24 <GeKo> i went through my backlog of untriaged bugs on tuesday and found we missed #18589 when preparing for esr38 18:13:46 <GeKo> i investigated that a bit and realized the query for fixed bugs was not correct 18:14:10 <GeKo> we missed the VERIFIED FIXED ones (i just looked at RESOLVED FIXED) where this one was hiding :( 18:14:32 <GeKo> i worked further on #17761 and got a mozilla engineer interested 18:14:45 <GeKo> it might help us for esr 38.8 18:15:08 <GeKo> then i spent a good time making progress on the tor browser dev doc 18:15:20 <GeKo> but work remains to be done 18:15:43 <GeKo> i wrote a patch for #14970 and plan to test that one this week 18:16:23 <GeKo> i convinced myself to fix #18331 properly and started working on a new cross-compiler 18:16:45 <GeKo> so far i got vanilla firefox cross-compiled which looks like a decent progress 18:17:10 <GeKo> this week i aim at getting everything ready for switching our nightlies to our esr45 branch 18:17:29 <GeKo> to shake out further serious bugs which we might have time to fix this way 18:17:46 <GeKo> that's it for me 18:19:20 <Yawning> oh I guess cfc should be deployable should we chose to do such a crazy thing is a browser topic 18:19:44 <GeKo> nice. 18:19:47 <Yawning> so yea, if we want to add my crazy kludge addon, we can, though I still want to figure out isolation when I have time 18:20:10 <Yawning> arthuredelstein suggested loading things in an iframe, but not sure if that's sufficient 18:20:22 <Yawning> and I could probably clean up the code more 18:21:06 <huseby> can I go? 18:21:11 <Yawning> yeah 18:21:11 <huseby> Yawning: done? 18:21:16 <Yawning> yeah 18:21:31 <huseby> well, I spent last week on-boarding two more mozilla engineers to the "upstream tor patches" effort 18:21:39 <GeKo> wow! 18:21:39 <huseby> the two engineers are in the taipei office 18:22:02 <huseby> i'll be heading to taipei the second week in april for a week long hack-a-thon 18:22:18 <huseby> the engineers were the primary authors of the origin attributes system 18:22:26 <huseby> it was originally designed for FxOS 18:22:42 <huseby> but turns out to be a really great tool for general 1st/3rd party isolation 18:23:08 <huseby> we're making headway on the origin attributes patches/fixes 18:23:44 <huseby> and we had a meeting last week to go over the TBB isolation patches, looking at how the ThirdPartyUtil dependency can be replaced with the origin attributes 18:24:01 <huseby> Our new goal is to have origin attributes in place by July 18:24:43 <huseby> then spend July, August, September porting isolation tests over from TBB to central so that we can prove that origin attributes isolation is as good, or better than the TPU isolation 18:25:05 <huseby> I'm hoping to show up to the tor dev meeting in september with at least that part landed 18:25:08 <GeKo> july would mean mozilla50, right? 18:25:21 <huseby> hrm...let me look 18:25:52 <huseby> GeKo: yes, 50 https://wiki.mozilla.org/RapidRelease/Calendar 18:26:00 <GeKo> ok 18:26:28 <huseby> the goal i set out for the new engineers was to have all of the isolation patches upstreamed/unnecessary before we fork ESR 52 in november 18:26:33 <huseby> (assuming it is 52) 18:26:41 <GeKo> yeah, that sounds nice 18:26:45 <huseby> that should make a huge dent in the 52 rebase 18:26:59 <huseby> don't hold your breath 18:27:07 <huseby> we're not committing to this in any way 18:27:16 <huseby> it's just what I am hoping we accomplish 18:27:19 <huseby> so don't quote me on it 18:27:24 <GeKo> sure sure :) 18:27:26 <huseby> having 2 new engineers will help a great deal 18:27:40 <huseby> that's it for me 18:27:42 * huseby is done 18:28:01 <arthuredelstein> I mentioned this before, but just to be a PITA... 18:28:21 <arthuredelstein> If it takes 6 months to write OriginAttribute patches to do isolation 18:28:41 <arthuredelstein> I wonder if it might be quicker to adapt TPU since it already works. 18:29:12 <mikeperry> huseby: it might be useful to also consider how identifier and state management would be reflected in a UI on a per-site basis. or at least, put consideration into making it easy for the origin attributes stuff to be exposed to UI control in some form. it probably already is amenable to that because of FxOS, but I thought I'd mention it 18:29:32 <arthuredelstein> Like maybe Mozilla management just needs a little more education on the benefits of the TPU approach? 18:29:35 <mikeperry> UI as in something functionally (but maybe not aesthetically :) like https://www.torproject.org/projects/torbrowser/design/#identifier-linkability 18:30:44 <huseby> arthuredelstein: yep, you're a PITA :) I originally pushed for TPU but it was overruled in favor of origin attributes. It took this long so far because I am but one engineer and I was messing with lots of sacred cows. I had to do lots of convincing. Now that the convincing is done, we're landing patches. 18:31:20 <arthuredelstein> huseby: I was meaning the 6 months from now until September. :) 18:31:42 <huseby> mikeperry: i'll look into that. 18:32:05 <huseby> arthuredelstein: oh, that. well, i'm just a sandbagging mofo trying to be conservative 18:32:06 <Yawning> oh I have a question. I use the Component object for my shitty addon. How likely is that to go away at some point in the future 18:32:07 <huseby> :) 18:32:23 <arthuredelstein> Fair enough :) 18:32:33 <huseby> Yawning: hrm...not sure. is it in the web extension api proposal? 18:32:34 <arthuredelstein> Hugely appreciate all your work on this 18:32:37 <Yawning> (as in I do var { Ci, Cu, Cr } = require("chrome"); 18:32:43 <Yawning> at the top of my thing) 18:32:50 <Yawning> idk, didn't look at that 18:33:14 <huseby> Yawning: that's a good question. i'm not the best person to ask, but i know who is. 18:33:22 <huseby> want me to facilitate the discussion? 18:33:33 <huseby> you want to talk to baku on irc.mozilla.org 18:33:36 <Yawning> I assume the web extension thing will give me some way to get at outgoing requests before dispach and responses 18:33:46 <Yawning> not a huge rush atm 18:34:07 <mikeperry> arthuredelstein: is your rebased branch pushed? 18:34:08 <Yawning> I'll just be sad/annoyed at somepoint in the future when my stuff breaks 18:34:21 <huseby> Yawning: yes. web extensions is basically the chrome add-on api. and since i know adblock plus works on both browsers, i assume you can get at outgoing requests before dispatch and responses. 18:34:29 <arthuredelstein> mikeperry: Yes, #15197. 18:34:36 <mikeperry> there were a few points in my network code review where I noted that I needed to verify proper application of our previous patches 18:34:41 <GeKo> 15197+7 18:35:08 <Yawning> huseby: well, my addon has existed as a XUL, bootstrapped, and now jetpack addon 18:35:14 <mikeperry> I'm almost done with that. still going through the XPCOM stuff, but I think that is lower risk, so perhaps I will just try to go quicker through it 18:35:23 <huseby> Yawning: firefox is a harsh mistress, i know. 18:35:24 <Yawning> so moving to webextensions in the future will be catching them all 18:36:17 <Yawning> oh, one thing that annoys me massively is that there's no way to get http response details from a content script/DOMContentLoaded handler 18:36:20 <huseby> Yawning: let me know if i can help you. i'm working on a firefox extension that needs that info as well. it's related to anti-fingerprinting defenses and i need to get access to outgoing requests before they are dispatched. 18:36:39 <Yawning> if you need example code you can steal what I have 18:36:40 <Yawning> >.> 18:36:55 <huseby> Yawning: repo link? 18:37:09 <Yawning> https://git.schwanenlied.me/yawning/cfc 18:37:13 <GeKo> okay. anyone else for status reports? 18:37:26 <GeKo> if not, do we have something to discuss this week? 18:37:37 <Yawning> huseby: look at the observe() function 18:38:06 <Yawning> just register a "http-on-modify-request" observer basically 18:38:18 <huseby> Yawning: thanks 18:38:54 <huseby> mikeperry: just read through the linkability UI. that's a brilliant way to looking at it. i'm passing it on to tanvi, she's the person who works on privacy UI the most. 18:39:38 <Yawning> it would be nice if I could at least get http status codes from a content script 18:39:51 <Yawning> I can understand why the full response/request info is not available 18:40:06 <GeKo> alright, i am ending the meeting now. thanks everybody *baf* 18:40:09 <GeKo> #endmeeting