17:59:55 <GeKo> #startmeeting tor-browser
17:59:55 <MeetBot> Meeting started Mon Mar 28 17:59:55 2016 UTC.  The chair is GeKo. Information about MeetBot at http://wiki.debian.org/MeetBot.
17:59:55 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic.
18:00:03 <GeKo> hi everyone
18:00:07 <boklm> hi
18:00:08 <Yawning> hi
18:00:39 <GeKo> so, we got our meeting time a little bit adjusted due to daylight savings time in europe
18:00:51 <GeKo> but we should be set up to october now )
18:00:59 <GeKo> who wants to go first?
18:01:22 * boklm can go
18:01:38 <boklm> This past week I added scramblesuit tests (#18612), fixed #18569
18:01:39 <boklm> I merged the marionette branch to master (#16009) and added a test for the User Timing API in #18597
18:01:49 <boklm> This week I'm planning to add Performance Observer tests for #18597
18:01:57 <boklm> start running the testsuite on OSX on nightlies and convert more tests to marionette
18:02:04 <GeKo> nice
18:02:05 <boklm> That's it for me.
18:03:04 <GeKo> did you run the test suite on an os x system successfully already?
18:03:32 <GeKo> and it is just a hooking up to our nightly testing infrastructure?
18:03:59 * huseby is here
18:04:05 <GeKo> hi!
18:04:06 <boklm> I ran a few tests on OSX, I didn't try to run them all yet
18:04:11 <GeKo> ok
18:04:46 <boklm> but I don't expect that there will be big problems
18:07:20 <GeKo> who is next?
18:07:40 * mcs will give a report next
18:07:48 <mcs> Last week, Kathy and I revised some of our patches for #13252 to address the Mac OS “user cannot write to /Applications” scenario.
18:07:56 <mcs> We also did a little work on #18330 but do not have a patch ready yet.
18:08:00 <mcs> And we started to work on ESR45 tickets starting with #15640.
18:08:12 <mcs> This week we plan to focus on ff45-esr tickets (#15640, #18599, #18602).
18:08:30 <mcs> Also, Kathy and I will be unavailable on Friday and Saturday of this week.
18:08:36 <mcs> That's all for us.
18:09:07 <GeKo> mcs: one thing that would be helpful is looking over arthur's rebased patches for esr45 that were written by kathy and you
18:09:28 <GeKo> to make sure nothing slipped through the cracks
18:09:55 <mcs> GeKo: OK. Also, we reviewed his revised patches and will continue to do so.
18:10:02 <GeKo> thanks
18:10:04 <arthuredelstein> thanks!
18:10:40 * arthuredelstein can go now
18:10:54 <arthuredelstein> Last week I finished up the rebase of patches for #15197.
18:11:15 <arthuredelstein> I then started working #16998.
18:11:34 <arthuredelstein> This week I will try to finish that patch and also work on #16326 and #16673.
18:12:03 <arthuredelstein> That's it for me
18:12:29 <GeKo> here is what i did:
18:13:24 <GeKo> i went through my backlog of untriaged bugs on tuesday and found we missed #18589 when preparing for esr38
18:13:46 <GeKo> i investigated that a bit and realized the query for fixed bugs was not correct
18:14:10 <GeKo> we missed the VERIFIED FIXED ones (i just looked at RESOLVED FIXED) where this one was hiding :(
18:14:32 <GeKo> i worked further on #17761 and got a mozilla engineer interested
18:14:45 <GeKo> it might help us for esr 38.8
18:15:08 <GeKo> then i spent a good time making progress on the tor browser dev doc
18:15:20 <GeKo> but work remains to be done
18:15:43 <GeKo> i wrote a patch for #14970 and plan to test that one this week
18:16:23 <GeKo> i convinced myself to fix #18331 properly and started working on a new cross-compiler
18:16:45 <GeKo> so far i got vanilla firefox cross-compiled which looks like a decent progress
18:17:10 <GeKo> this week i aim at getting everything ready for switching our nightlies to our esr45 branch
18:17:29 <GeKo> to shake out further serious bugs which we might have time to fix this way
18:17:46 <GeKo> that's it for me
18:19:20 <Yawning> oh I guess cfc should be deployable should we chose to do such a crazy thing is a browser topic
18:19:44 <GeKo> nice.
18:19:47 <Yawning> so yea, if we want to add my crazy kludge addon, we can, though I still want to figure out isolation when I have time
18:20:10 <Yawning> arthuredelstein suggested loading things in an iframe, but not sure if that's sufficient
18:20:22 <Yawning> and I could probably clean up the code more
18:21:06 <huseby> can I go?
18:21:11 <Yawning> yeah
18:21:11 <huseby> Yawning: done?
18:21:16 <Yawning> yeah
18:21:31 <huseby> well, I spent last week on-boarding two more mozilla engineers to the "upstream tor patches" effort
18:21:39 <GeKo> wow!
18:21:39 <huseby> the two engineers are in the taipei office
18:22:02 <huseby> i'll be heading to taipei the second week in april for a week long hack-a-thon
18:22:18 <huseby> the engineers were the primary authors of the origin attributes system
18:22:26 <huseby> it was originally designed for FxOS
18:22:42 <huseby> but turns out to be a really great tool for general 1st/3rd party isolation
18:23:08 <huseby> we're making headway on the origin attributes patches/fixes
18:23:44 <huseby> and we had a meeting last week to go over the TBB isolation patches, looking at how the ThirdPartyUtil dependency can be replaced with the origin attributes
18:24:01 <huseby> Our new goal is to have origin attributes in place by July
18:24:43 <huseby> then spend July, August, September porting isolation tests over from TBB to central so that we can prove that origin attributes isolation is as good, or better than the TPU isolation
18:25:05 <huseby> I'm hoping to show up to the tor dev meeting in september with at least that part landed
18:25:08 <GeKo> july would mean mozilla50, right?
18:25:21 <huseby> hrm...let me look
18:25:52 <huseby> GeKo: yes, 50 https://wiki.mozilla.org/RapidRelease/Calendar
18:26:00 <GeKo> ok
18:26:28 <huseby> the goal i set out for the new engineers was to have all of the isolation patches upstreamed/unnecessary before we fork ESR 52 in november
18:26:33 <huseby> (assuming it is 52)
18:26:41 <GeKo> yeah, that sounds nice
18:26:45 <huseby> that should make a huge dent in the 52 rebase
18:26:59 <huseby> don't hold your breath
18:27:07 <huseby> we're not committing to this in any way
18:27:16 <huseby> it's just what I am hoping we accomplish
18:27:19 <huseby> so don't quote me on it
18:27:24 <GeKo> sure sure :)
18:27:26 <huseby> having 2 new engineers will help a great deal
18:27:40 <huseby> that's it for me
18:27:42 * huseby is done
18:28:01 <arthuredelstein> I mentioned this before, but just to be a PITA...
18:28:21 <arthuredelstein> If it takes 6 months to write OriginAttribute patches to do isolation
18:28:41 <arthuredelstein> I wonder if it might be quicker to adapt TPU since it already works.
18:29:12 <mikeperry> huseby: it might be useful to also consider how identifier and state management would be reflected in a UI on a per-site basis. or at least, put consideration into making it easy for the origin attributes stuff to be exposed to UI control in some form. it probably already is amenable to that because of FxOS, but I thought I'd mention it
18:29:32 <arthuredelstein> Like maybe Mozilla management just needs a little more education on the benefits of the TPU approach?
18:29:35 <mikeperry> UI as in something functionally (but maybe not aesthetically :) like https://www.torproject.org/projects/torbrowser/design/#identifier-linkability
18:30:44 <huseby> arthuredelstein: yep, you're a PITA :)  I originally pushed for TPU but it was overruled in favor of origin attributes.  It took this long so far because I am but one engineer and I was messing with lots of sacred cows.  I had to do lots of convincing.  Now that the convincing is done, we're landing patches.
18:31:20 <arthuredelstein> huseby: I was meaning the 6 months from now until September. :)
18:31:42 <huseby> mikeperry: i'll look into that.
18:32:05 <huseby> arthuredelstein: oh, that.  well, i'm just a sandbagging mofo trying to be conservative
18:32:06 <Yawning> oh I have a question.  I use the Component object for my shitty addon.  How likely is that to go away at some point in the future
18:32:07 <huseby> :)
18:32:23 <arthuredelstein> Fair enough :)
18:32:33 <huseby> Yawning: hrm...not sure. is it in the web extension api proposal?
18:32:34 <arthuredelstein> Hugely appreciate all your work on this
18:32:37 <Yawning> (as in I do var { Ci, Cu, Cr } = require("chrome");
18:32:43 <Yawning> at the top of my thing)
18:32:50 <Yawning> idk, didn't look at that
18:33:14 <huseby> Yawning: that's a good question.  i'm not the best person to ask, but i know who is.
18:33:22 <huseby> want me to facilitate the discussion?
18:33:33 <huseby> you want to talk to baku on irc.mozilla.org
18:33:36 <Yawning> I assume the web extension thing will give me some way to get at outgoing requests before dispach and responses
18:33:46 <Yawning> not a huge rush atm
18:34:07 <mikeperry> arthuredelstein: is your rebased branch pushed?
18:34:08 <Yawning> I'll just be sad/annoyed at somepoint in the future when my stuff breaks
18:34:21 <huseby> Yawning: yes.  web extensions is basically the chrome add-on api.  and since i know adblock plus works on both browsers, i assume you can get at outgoing requests before dispatch and responses.
18:34:29 <arthuredelstein> mikeperry: Yes, #15197.
18:34:36 <mikeperry> there were a few points in my network code review where I noted that I needed to verify proper application of our previous patches
18:34:41 <GeKo> 15197+7
18:35:08 <Yawning> huseby: well, my addon has existed as a XUL, bootstrapped, and now jetpack addon
18:35:14 <mikeperry> I'm almost done with that. still going through the XPCOM stuff, but I think that is lower risk, so perhaps I will just try to go quicker through it
18:35:23 <huseby> Yawning: firefox is a harsh mistress, i know.
18:35:24 <Yawning> so moving to webextensions in the future will be catching them all
18:36:17 <Yawning> oh, one thing that annoys me massively is that there's no way to get http response details from a content script/DOMContentLoaded handler
18:36:20 <huseby> Yawning: let me know if i can help you.  i'm working on a firefox extension that needs that info as well.  it's related to anti-fingerprinting defenses and i need to get access to outgoing requests before they are dispatched.
18:36:39 <Yawning> if you need example code you can steal what I have
18:36:40 <Yawning> >.>
18:36:55 <huseby> Yawning: repo link?
18:37:09 <Yawning> https://git.schwanenlied.me/yawning/cfc
18:37:13 <GeKo> okay. anyone else for status reports?
18:37:26 <GeKo> if not, do we have something to discuss this week?
18:37:37 <Yawning> huseby: look at the observe() function
18:38:06 <Yawning> just register a "http-on-modify-request" observer basically
18:38:18 <huseby> Yawning: thanks
18:38:54 <huseby> mikeperry: just read through the linkability UI.  that's a brilliant way to looking at it.  i'm passing it on to tanvi, she's the person who works on privacy UI the most.
18:39:38 <Yawning> it would be nice if I could at least get http status codes from a content script
18:39:51 <Yawning> I can understand why the full response/request info is not available
18:40:06 <GeKo> alright, i am ending the meeting now. thanks everybody *baf*
18:40:09 <GeKo> #endmeeting