18:02:06 #startmeeting tor-browser 18:02:06 Meeting started Mon Jun 27 18:02:06 2016 UTC. The chair is GeKo. Information about MeetBot at http://wiki.debian.org/MeetBot. 18:02:06 Useful Commands: #action #agreed #help #info #idea #link #topic. 18:02:21 hi and welcome to another tor browser meeting 18:02:38 hello GeKo, happy monday 18:02:43 hi, i'm here 18:02:45 thanks! 18:02:46 hi 18:02:55 hi 18:02:57 hi 18:03:00 let's get started with status updates. who wants to go first? 18:03:08 * arthuredelstein can go 18:03:19 Last week I wrote a patch for #19478. 18:03:38 I then examined some of our patches for upstreaming or obsolescence. I proposed #19508, #19510, and #19511. 18:03:46 I rebased some patches got them to pass all try server tests, and submitted them to Mozilla, including 18:03:51 https://bugzilla.mozilla.org/show_bug.cgi?id=1281963 (#13313) 18:03:51 https://bugzilla.mozilla.org/show_bug.cgi?id=1121643 (#17207) 18:03:51 https://bugzilla.mozilla.org/show_bug.cgi?id=1281959 (#17502) 18:03:51 https://bugzilla.mozilla.org/show_bug.cgi?id=1281949 (#18958) 18:04:01 The last one has landed. 18:04:17 This week I want to try upstreaming some more patches, fix up my patch for #19478, and go back to trying to work on #13018. 18:04:31 That's it for me 18:07:42 i'll go 18:07:52 https://wiki.mozilla.org/Security/Tor_Uplift/Tracking 18:08:41 so there are 6 bugs active, 4 diff engineers 18:08:46 o 18:09:01 i'll be wrapping up adding the isolation pref and origin attributes isolation based on first party uri 18:09:13 good progress is being made on the patch uplift 18:09:27 i'll have more to report next week 18:09:48 still targeting firefox 52 for everything to be landed 18:09:53 but don't quote me on that 18:09:56 that's just the goal 18:09:59 huseby: how are the priorities assigned wrt the active bugs? 18:10:00 that's it for me 18:10:12 GeKo: there's a rought order to things 18:10:15 i am especially interested in 1211567 18:10:32 1) get origin attributes isolation done, land all isolation patches, land all isolation tests 18:10:40 2) then land everything else 18:10:45 because chances are high that we get our e10s deliverable replaced by one that is working on sandboxing for osx and linux 18:11:05 and help on that bug from your side would be cool then 18:11:13 ok 18:11:23 I have a question about that one (1211567) but maybe it should wait for discussion 18:11:26 1211567 is assigned to gary chen on our necko team 18:11:36 it is an active bug 18:12:01 that got picked up because it will take some time and the necko team has prioritized it as their contribution 18:12:11 yes, so work is under why there irrespecitve of progress on the isolation things? 18:12:12 there's no person saying do this, do that 18:12:16 *way 18:12:19 it's a purely volunteer effort 18:12:28 GeKo: absolutely 18:12:34 the necko team wanted to get in on the action 18:12:35 ok, neat 18:13:03 i befriended jason duell, the engineering manager of the necko team, convinced him it was worth doing 18:13:06 so they picked it up 18:13:11 :) 18:13:44 huseby: thanks for your efforts on our behalf! 18:14:05 mcs: you're welcome :) 18:14:13 it should have been done years ago 18:14:22 i'm correcting a historical transgression :) 18:14:29 ha 18:14:32 agreed. my thanks as well 18:14:37 and lots of people at mozilla are behind this 18:14:55 i've been able to get everybody to either not care, or support it. nobody is fighting it anymore 18:15:10 \o/ 18:15:56 okay, here is what i did: 18:16:43 i looked a bit at code for review (#8725 and #19478 + #19484) 18:16:57 then i was busy with the panopticlick GSoC project 18:17:09 i worked a bit on the documentation 18:17:32 and i spent some time dealing with the media stuff for the selfrando paper 18:18:12 i tried to follow bug reports wrt 6.0.2 closely but it seems we have now a stable version i can live with :) 18:19:45 this week i plan to work further on updating the design doc, #18925 and #19274. 18:19:58 that's it for me 18:21:33 * boklm can go next 18:21:53 This past week I published the 6.0.2 release, I worked on #18923, #18497, and looked at the fp-central GSoC project. 18:22:03 This week I'm planning to investigate the problems I have running our unit tests on #18923 and #15994 18:22:11 That's it for me. 18:22:31 * mcs will go next 18:22:39 Last week, Kathy and I worked some more on #19273 / #16623. 18:22:48 We decide to change course and keep the separate prompt that is currently used. 18:22:54 We are going to hook into the browser at the same points as Torbutton currently does (but in C++ instead of JS). 18:22:59 We also spent a little time on #19484, #19481, #19491, and #19432. 18:23:12 Finally, we helped with Tor Browser 6.x bug triage and reviewed the revised patch for #16998. 18:23:21 This will be a short week for us but we hope to prepare a patch for #19273 (we will be away from keyboard Wednesday June 29th - Monday July 4th). 18:23:26 That’s all for now. 18:23:51 If it works for other people, we should move next week’s meeting to Tuesday. 18:24:02 Works for me 18:24:03 (if not, we will read the minutes) 18:24:28 yes, i was going to ask about that later. 18:24:33 thx 18:24:43 fine with me (even better actually as i won't have time on monday either) 18:24:53 Next tuesday works for me too 18:25:26 good. i'll send a mail to tbb-dev tomorrow then 18:25:44 anybody else here for a status update? 18:27:21 then let's move on to the discussion part. 18:27:36 i just had the meeting for next week on my list. 18:27:42 does anybody have something else? 18:27:51 arthuredelstein: you mentioned something above? 18:28:07 Yes, I have a possibly dumb question about the domain socket stuff 18:28:38 So the main idea is to use domain sockets so we can turn off networking for the browser, correct? 18:29:16 The only connections allowed would be domain sockets to the tor process? 18:29:52 yes 18:29:55 I guess my question is, is there an alternative possibility, where we just restrict networking to localhost? 18:30:08 By whatever sandboxing mechanism we use. 18:30:21 Or better yet, localhost + the ports needed for the tor process 18:31:23 As a way of avoiding patching the browser. 18:32:51 Or perhaps I am missing an additional advantage provided by domain sockets? 18:33:24 Anyway, I was just reminded of this question, but no need to answer it now :) 18:34:52 what i find appealing is that you don't need to worry anymore about proxy bypass things with that feature 18:35:19 and you don't need to worry about your additional sandbox stuff you have behaving as expected 18:35:54 sure it is not for all platforms we support 18:36:14 but we won't get one sandbox solution there either 18:36:24 for the sandbox, I also think restricting networking to localhost is more difficult to do than blocking network completly 18:36:45 yes, i'd assume that too 18:37:42 I see. If that's the case on a given platform then domain sockets definitely seem like a better option. 18:37:51 another plus is that Mozilla has already done a great deal of the work with https://bugzilla.mozilla.org/show_bug.cgi?id=892114 and willing to support it out-of-the-box 18:38:12 s/and willing/and is willing/ 18:40:10 okay. do we have anything else? 18:41:52 thanks everybody then and see you all next week on tuesady *baf* 18:41:57 #endmeeting