18:01:16 <GeKo> #startmeeting tor browse 18:01:16 <MeetBot> Meeting started Mon Oct 3 18:01:16 2016 UTC. The chair is GeKo. Information about MeetBot at http://wiki.debian.org/MeetBot. 18:01:16 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic. 18:01:21 <GeKo> ha! 18:01:25 <GeKo> *browser 18:01:35 <boklm> hi! 18:01:39 <Yawning> herro 18:01:44 <mcs> hi 18:01:49 <GeKo> hi everybody and welcome to the first meeting after the seattle one 18:02:01 <GeKo> i hope you had a good time and are now fully recovered 18:02:23 <GeKo> to sprint through october for sponsorU :) 18:02:41 <Yawning> >.< 18:02:43 <arthuredelstein> hi! 18:03:26 <GeKo> okay, let's get started with some status updates before we move on to the discussion phase 18:04:41 <GeKo> the past two weeks i worked on a bunch of things. 18:05:14 <GeKo> highlights were #13893 and #20184 18:05:30 <femme> hi 18:05:51 <GeKo> i investigated #20195 because it made me nervous 18:06:10 <Yawning> it's weird, sorry bout that, no idea what's going on 18:06:14 <GeKo> that one is fun too; i am about to update the ticket 18:06:22 <GeKo> (no spoilers before) 18:06:29 <GeKo> thanks for finding it :) 18:06:52 <GeKo> then i reviewed quite some tickets, e.g. #20111 18:07:15 <GeKo> where we found that something is still missing wrt unix domain socket usage 18:07:51 <Yawning> yeah I need to sit down and fix some of that stuff 18:08:02 <GeKo> i got involved in the cloudflare thing where i started pondering their blinding specification over the weekend 18:08:35 <GeKo> Yawning: do you think we could get #18753 done too in that wake? 18:08:55 <GeKo> that broke a lot of OS X users 18:09:22 <GeKo> that might be it from the last couple of days for me 18:09:42 <GeKo> this week i'll focus on getting the planning done for the remaining SponsorU stuff 18:09:53 <Yawning> not sure about that one, think nickwas making noises in that direction 18:10:04 <GeKo> i want to work on #20184 18:10:15 <GeKo> and we'll see what else comes up 18:10:29 <GeKo> Yawning: okay, i'll poke him later about it 18:10:34 <nickm> I'll take a patch for #18753 if somebody writes one this week. Or if nobody is planning to, I can write one today. 18:10:51 <GeKo> woah, thanks 18:11:12 <GeKo> currently nobody is planning to write one afaict... 18:11:22 <mcs> nickm: that would be awesome (writing a patch) 18:12:24 * mcs can give a status report next 18:12:35 <GeKo> yeah, i think i am done 18:12:42 <mcs> Since our last team meeting, Kathy and I created a revised patch for #20111 and investigated #20261 (a related ticket). 18:12:49 <mcs> We investigated #20210. 18:12:55 <mcs> We backported some Mozilla patches to fix #20204. 18:13:00 <mcs> We spent some time learning about the MacOS sandbox for #20121. 18:13:06 <mcs> We made a plan to fix #20185 (which we will work on this week). 18:13:12 <mcs> We also reviewed several patches and helped with bug triage. 18:13:22 <mcs> Also, Mark was in Seattle last week for the Tor meeting. 18:13:28 <mcs> We had a lot of good discussions related to Tor Browser, Mozilla, and other topics. 18:13:34 <mcs> This week we plan to work on #20185 and MacOS sandboxing (#20121). 18:13:38 <mcs> That’s all for now. 18:14:48 * arthuredelstein can go 18:14:50 <GeKo> mcs: fwiw: i just read the plan in comment 18:14:52 <GeKo> 3 18:14:59 <GeKo> (i forgot to look at it) 18:15:10 <GeKo> and i had a similar idea. 18:15:22 <GeKo> so, if that is the thing you want to do: +1 18:16:09 <mcs> The proposal is to do all of 1 - 4. Is taht what you are agreeing to or just 3? 18:16:28 <GeKo> the "3" belonged to "comment" :) 18:16:40 <mcs> ah, got it. thanks. 18:16:41 <GeKo> so, yes, 1 - 4 18:16:53 <mcs> that is what we will do then. 18:16:58 <GeKo> cool 18:19:33 <mcs> who is next? 18:19:43 <arthuredelstein> I can go 18:19:47 <arthuredelstein> Since last time, 18:19:51 <arthuredelstein> I wrote patches for #17904, #17546, #20123, #18093, #20043. 18:20:01 <arthuredelstein> The last two need revisions, which I hope to complete this week. 18:20:08 <arthuredelstein> I also started working on #20244 and I opened #20264 (maybe a good discussion topic today). 18:20:17 <arthuredelstein> I posted some notes from the meeting at 18:20:23 <arthuredelstein> https://trac.torproject.org/projects/tor/wiki/org/meetings/2016SummerDevMeeting/Notes/AntiFingerprinting?version=2 18:20:26 <arthuredelstein> https://trac.torproject.org/projects/tor/wiki/org/meetings/2016SummerDevMeeting/Notes/GrowingTor?version=1 18:20:33 <arthuredelstein> and there are some more on our meetings with Mozilla that I will post later. 18:20:53 <arthuredelstein> On the Mozilla side, I reviewed bugzil.la/277803 (favicon isolation), and posted a patch for bugzil.la/1305144 (.onion referrer hiding). 18:21:05 <arthuredelstein> This week I plan to work on more SponsorU tickets. 18:21:09 <arthuredelstein> That's it for me. 18:21:49 <isabela> (just a quick note that I will update the wiki with the suggested roadmap we created in Seattle) 18:21:52 <isabela> o/ 18:22:03 <GeKo> thanks 18:22:19 * boklm can go next 18:22:32 <boklm> Since last meeting I helped publish the alpha release, worked on #19067, and last week was at the Seattle meeting 18:22:35 <boklm> This week I'm planning to work on fixes related to the dmg2mar script (#20210, #20182, #20186, #20217, #20183), and #19067 18:22:48 <boklm> That's it for me. 18:24:29 <GeKo> arthuredelstein: re your anti-fingerprinting notes: 18:24:44 <GeKo> yes, updating the design document is still very high on my priority list 18:25:06 <GeKo> but i can't guarantee that it will get done in oct due to the sponsorU stuff 18:25:28 <GeKo> i am almost done up to and inlcuding the cross-origin linkability section 18:25:44 <GeKo> so there is already a fair amount of stuff covered at least ;) 18:25:54 <arthuredelstein> GeKo: No worries! That wasn't intended as pressure. :) 18:26:28 <GeKo> nah, the pressure is there with or without the wiki entry 18:26:43 <GeKo> because not getting this updated timely sucks quite a lot 18:27:02 <arthuredelstein> We were discussing with EFF how to make a full list of possible fingerprinting vectors, so the design document is a good source for that. 18:27:18 <GeKo> good idea. 18:27:34 <GeKo> re that our GSoC project could play an important role here as well 18:28:24 <arthuredelstein> Yes, I think so. 18:28:25 <GeKo> which could be tailored to the questions we have without having the issue of all the legacy data panopticlick brings along 18:28:58 <GeKo> anyway, before we start discussing stuff: is there anybody else for a status update? 18:29:06 <Yawning> I can go though I didn't do much 18:29:07 <GeKo> *else here 18:29:08 <Yawning> >.> 18:29:23 <GeKo> welcome back, fwiw! 18:29:29 <Yawning> went to the dev meetihng, talked about sandboxing stuff 18:29:31 <GeKo> nice to have you around again 18:29:48 <Yawning> hey, even when I wasn't on irc much I posted bugs and replied to some e-mail >.> 18:30:05 <mcs> I have some sandboxing notes to post (from the dev meeting) 18:30:27 <GeKo> Yawning: sure, sure :) 18:30:28 <mcs> (mostly Yawning talked about what he has done) 18:31:06 <GeKo> so you all have the big plan we just need to execute, right? 18:31:14 <Yawning> p much 18:31:25 <Yawning> assuming I made the right design decisions 18:31:32 <GeKo> neat 18:31:51 <arthuredelstein> Yawning: What help do you need from the rest of us at this stage? 18:32:00 <Yawning> "does my design suck" 18:32:09 <Yawning> "ability to hide updater related ui elements" 18:32:22 <Yawning> "figure out how to make firefox work without a /proc filesystem, (SIGSEGV)" 18:32:43 <Yawning> "Do I need to care about D-Bus/IBus (hard)?" 18:33:08 <Yawning> "Is 'you must install bubblewrap from your distribution's pacage manager' acceptable" 18:33:20 <Yawning> prolly other things I'll think about it some 18:33:37 <arthuredelstein> These seem like good things for tickets. Shall I file them? 18:33:44 <Yawning> I've been filing issues on my bug tracker 18:33:45 <Yawning> sec 18:34:07 <Yawning> https://git.schwanenlied.me/yawning/sandboxed-tor-browser/issues?state=open&milestone=3 18:34:13 <Yawning> that's my task list 18:34:17 <mcs> Are we at the discussion stage of the meeting now? 18:34:21 <Yawning> it's a huge amount of work, but I think I can do most of them 18:34:40 <Yawning> also we need to figure out packaging and stuff 18:34:57 <Yawning> the good news is, my prototype works, now with audio >.> 18:35:10 <arthuredelstein> Awesome. 18:35:14 <GeKo> mcs: yes 18:35:20 <Yawning> (I have a separate list of things that we should investigate when moving from early adopter alpha to production) 18:35:59 <arthuredelstein> Yawning: So if there are things we can help with (investigate or patch), probably the best thing is if you can file a ticket on trac. 18:36:12 <Yawning> mmk 18:36:19 <Yawning> I think the UI element one already has a ticket 18:36:24 <Yawning> though not sure if't scomplete or not 18:36:44 <Yawning> the "firefox crashes without /proc" thing is technically a upstream bug 18:36:51 <mcs> It seems like sandboxing is the biggest / riskiest Sponsor U task that remains on our list. I want to propose that maybe Kathy and I should do what we can for OSX and Arthur should work with Yawning to finish the Linux work. 18:37:00 <Yawning> (and certain functionality, eg: about:memory will break) 18:37:09 <mcs> A lot of the work may be deciding how to ship something. 18:37:14 <mcs> (what to cut etc.) 18:37:22 <Yawning> yeah 18:37:53 <Yawning> is there a trac keyword I should use? 18:38:01 <arthuredelstein> mcs: I second that proposal. 18:38:03 <GeKo> mcs: in general this sounds not bad 18:38:19 <GeKo> i can work on linux sanboxing, too, now that the emet stuff seems to be fixed 18:38:22 <mcs> It does not seem like we will have time to ship the sandbox enabled with our regular alpha. So we may need to make it ioptional of have a separate release like hardened. 18:38:23 <GeKo> *sandboxing 18:38:38 <mcs> GeKo: that is good news! 18:38:39 <Yawning> #20083 and #20219 are the tickets I did file arleady 18:38:55 <Yawning> well, the dist.top/aus1 situation in general 18:38:57 <GeKo> there are still torbutton conversion things we need to fix 18:39:15 <GeKo> like #19459 and #16622 18:39:22 <Yawning> mcs: well, my approach lets you sandbox alpha/release/hardened 18:39:35 <Yawning> since it downloads the bundle, and supports (in theory) specifying the channel 18:39:43 <GeKo> but apart from that we are not in bad shape 18:39:46 <Yawning> OSX model prolly different 18:39:52 <mcs> Yawning: True. So maybe in that case the sandbox is a separate thing. 18:39:58 <Yawning> yeah 18:40:00 <mcs> (that we ship separately) 18:40:03 <GeKo> oh, i have to think about what to do with #10281 18:40:05 <GeKo> :( 18:40:25 <mcs> I am less clear what we will end up with on OSX but hope to have a plan soon. 18:41:01 <Yawning> the general vibe I got from the meeting is that some but not everyone thought my approach was reasonable, with the "not everyone" just not being there >.> 18:41:11 <GeKo> arthuredelstein: i guess if you could focus on the remaining conversion tickets. i could start with the sandboxing stuff 18:41:16 <arthuredelstein> Yawning: I think we don't have a keyword. Maybe start using tbb-sandboxing? 18:41:18 <Yawning> so unless someone tells me otherwise I will proceed with "make what I have usable" 18:41:21 <Yawning> k 18:41:26 <GeKo> and you could just join the club later on :) 18:41:39 <arthuredelstein> GeKo: Yes, that's fine with me as well. 18:42:06 <Yawning> The proc thing is a nice to have but can probably slip fwiw 18:42:23 <Yawning> perfect is the enemy of good etc 18:42:32 <GeKo> arthuredelstein: we alredy have tbb-sandboxing 18:42:38 <GeKo> #19750 has it 18:42:57 <GeKo> which is the parent ticket for All The Stuff 18:43:26 <Yawning> Also I know that whatever UI I bolt onto the sandbox launcher of doom won't be localized with the time constraints we have 18:43:29 <Yawning> :/ 18:43:45 <Yawning> because I'm only bilingual, and I'm a crap UI programmer 18:43:55 <mcs> I am not sure it is worthwhile to spend a lot of time on UI at this point. 18:43:58 <arthuredelstein> GeKo: Aha! I should have remembered that. 18:44:03 <mcs> (as in, we don’t have a lot of time) 18:44:12 <GeKo> Yawning: i think that falls under alpha quality and is okay 18:44:16 <Yawning> yah 18:44:22 <Yawning> I'll do something basic 18:44:27 <GeKo> yes. 18:44:37 <Yawning> most of the rest of the stuff I need to think about except international input is like... fairly easy I think 18:44:56 <Yawning> I mean, the foundation is solid enough that I've been using it for a bit over a week 18:45:58 <arthuredelstein> Very exciting. 18:46:14 <GeKo> indeed. and thanks, yawning, for getting this going 18:46:57 <GeKo> okay, it seems we have kind of a plan for that one 18:47:10 <GeKo> do we have something else to discuss? 18:47:17 <dcf1> me 18:47:29 <Yawning> "yawning dissapears into the cat cave, and code comes out" 18:47:35 <dcf1> I would like to have some Tor Browser dev help on #20250 18:47:46 <dcf1> I don't have a macOS Sierra machine to test 18:48:32 <dcf1> I thought for sure the cause was the version of Go used to compile: https://trac.torproject.org/projects/tor/ticket/20250#comment:11 18:48:40 <dcf1> But that didn't help this user. 18:49:17 <dcf1> In any case, we are going to have to start compiling Go programs even in the stable release with Go 1.6.3+, or there are likely to be problems with Sierra. 18:49:38 <GeKo> who of us has a 10.12 OS X machine to look at that? 18:49:40 <dcf1> The upgrade to 1.6.3 is currently blocked on #20030, which is a small patch I have to merge. 18:49:51 <dcf1> I'll file a ticket for the Go upgrade, but I'm stumped on #20250. 18:49:57 <dcf1> That's all from me. 18:50:18 <mcs> Kathy and I now have a 10.12 system. But I am not sure how to debug the problem. 18:50:20 <arthuredelstein> dcf1: Maybe test on a MacOS VPS? 18:50:27 <mcs> We will try to reproduce to start though. 18:50:34 <GeKo> thanks 18:50:39 <dcf1> thanks 18:51:14 <dcf1> According to the Go release notes, our alpha release built with Go 1.6.3 should be new enough to avoid the Sierra issues. 18:51:43 <mcs> The claim is that one of the meek processes is crashing? I guess I need to read the ticket more carefully. 18:52:15 <mcs> Kathy and I will see what we can learn and we will comment in the ticket. 18:52:32 <Yawning> (I have no idea what to do about sandboxed meek/fte btw) 18:52:40 <dcf1> The reporter says the pluggable transport dies, sometimes after a few minutes of operation (which is the weird part) 18:52:51 <GeKo> that's probably a thing for the follow-up funding :) 18:52:57 <Yawning> (My current plan is "too bad so sad, I might unbreak meek at a later date, it's an alpha") 18:53:05 <GeKo> yes 18:53:21 <Yawning> GeKo: another thing for followup would be "Tor Browser should support Wayland" 18:53:34 <Yawning> but not an aplha thing by any reasonable strech of the imagination 18:54:02 <GeKo> indeed 18:54:13 <Yawning> (even with all the stuff that'll prolly get cut, it will be a good alpha assuming I can execute I think) 18:54:40 <Yawning> I guess meek_lite is an option. We ship it but don't use it 18:55:03 <mcs> meek_lite is meek without a browser, right? 18:55:09 <Yawning> correct 18:55:09 <dcf1> Yes meek_lite or just meek-client without meek-client-torbrowser 18:55:43 <mcs> What is the difference btw those two options? Two different implementations or the same thing or ? 18:55:46 <Yawning> it's integrated into obfs4 as a space saving measure for android 18:55:55 <Yawning> apart from that they're identical for the most part 18:55:59 <mcs> Yawning: thanks 18:56:31 <GeKo> okay, anything else for today? 18:57:07 <Yawning> neg, I shall codecave/file tickets, but mostly codecave 18:57:38 <arthuredelstein> I filed #20264 -- does anyone have opinions on this? 18:58:08 <GeKo> i think this is a worthwhile thing to do 18:58:18 <mcs> agreed 18:58:18 <GeKo> but probably not for october 18:58:25 <Yawning> is that the "medium high is the new medium" thing? 18:58:29 <GeKo> we might want to think a bit more about it 18:58:29 <arthuredelstein> Oh, I just saw the new comments. 18:58:30 <GeKo> yes 18:58:57 <GeKo> but generally, it always felt to me a bit weird to have a medium-low setting 18:59:20 <GeKo> and i think just having low - medium - hight is a good solution 18:59:24 <GeKo> *high 19:00:14 <GeKo> alright, 19:00 UTC 19:00:36 <GeKo> thanks for the meeting and a productive week everybody *baf* 19:00:39 <GeKo> #endmeeting