15:00:03 #startmeeting S27 09/17 15:00:03 Meeting started Tue Sep 17 15:00:03 2019 UTC. The chair is pili. Information about MeetBot at http://wiki.debian.org/MeetBot. 15:00:03 Useful Commands: #action #agreed #help #info #idea #link #topic. 15:00:14 hi everyone, who's here for the S27 meeting? 15:00:14 hello! 15:00:51 here's the pad: https://storm.torproject.org/shared/LCiRm4Fzu2J8Z7_3lkteia5LfAlpUmvJWbBnXTructQ 15:01:03 dgoulet is off the grid 15:01:17 hola! 15:01:24 * mcs is here but has not been doing S27 work (as per plan :)) 15:01:49 * arma2 looks at pad 15:01:50 please add your updates :) 15:01:51 o/ 15:02:23 done 15:02:26 I'll give people a few minutes more 15:04:43 Ok i think we're pretty much there 15:05:10 so... we're almost halfway through the project!!! :) 15:05:21 in terms of time at least... ;) 15:05:56 so I wanted to review our roadmap and estimations for the next few months to check we're on track 15:05:56 yeah, there is a lot to do yet :) 15:06:03 and on the same page 15:06:19 aha 15:06:23 great 15:06:32 So I just wanted to go through the objectives and activities to see where we are and if there are any changes, etc 15:06:35 does that sound like a plan? 15:06:42 yep 15:06:43 ok 15:07:53 ok, so O1A1.1 Make v3 default on core tor stable 15:08:01 aha 15:08:07 this is mostly dgoulet fwiw 15:08:13 with some help from teor 15:08:16 we had 72 points assigned for this and I calculate 41 points left in this 15:08:21 ok 15:08:28 i think they have done great work on this 15:08:37 there's a lot in it... :) 15:08:42 and some of the big things that are still open, are halfway done or so 15:09:05 like #30200 and #28841, dgoulet has done lots of work there 15:09:38 One thing I don't have is when this work is planned for, as in, it seems to be in progress but I'm not sure of the timelines for it 15:09:55 hm 15:10:11 dgoulet is gonna be pretty much full time on O1A1.1 until november or so 15:10:47 ok, sounds good :) 15:10:49 and teor will be working on #22893 15:10:54 (which surprise! i just added to the parent ticket) 15:11:05 aha! ;) 15:11:17 pili: btw, it might be counter-intuitive but we don't need to do all the -must tickets on O1A1 15:11:22 that's good to know 15:11:24 because it's mainly a bugfixes ticket 15:11:33 and more bugfixes appear all the time and take priority over the old ones 15:11:44 so we are continuously prioritizing the most important ones 15:11:51 and at some point we are gonna drop the rest to -can 15:12:02 but all in all, we've done great work there already. 15:12:30 great :) 15:12:31 thanks 15:12:32 ok, maybe we can move on to O1A1.2 then... if there's nothing else on this 15:12:39 i'd say that by end-of-october we can call it 50% done, but i'd wait for dgoulet to have a say here 15:13:04 so O1A1.2 is onionbalance 15:13:25 i've been on this full-time since the end of august 15:13:32 there is still lots to be done 15:13:39 I had 23 points for this 15:13:41 i think i will be 100% done here in mid/end-november 15:13:48 ok 15:13:54 which means that at some point early october we can call it 50% 15:14:09 (i'm also going for vacations in mid-october so i wont be doing much then) 15:14:13 that helps with billing 15:14:14 ok 15:14:36 but yes this is under control 15:16:04 O1A2: DoS defense 15:16:10 I have a few questions here... ;) 15:16:14 yes shoot 15:16:35 so, it's 36 points, but actually the children add up to more points 15:16:41 36 points remaining? 15:16:44 and there's some PoW stuff that I'm not sure is in scope and we're still doing 15:16:49 I think it was 36 points total 15:16:51 ok 15:16:56 that makes more sense 15:17:40 so for the PoW I can see #29607 and #31223 ? 15:17:58 and they both add up to 25 points as it is 15:18:21 i think #29607 is pretty much done 15:18:25 the investigation has been completed there 15:18:30 i would close it and move things over to #31223 15:18:33 then there's #24973 that I'm not sure we're still working on 15:18:39 but i'm afraid that people will start spamming #31223 with random stuff 15:18:48 so i'm just leaving it open to soak up the crazies 15:18:57 :) 15:19:23 pili: yes i'm also not sure about #24973 15:19:36 i need to check our roadmap. i kinda recall that perhaps tim is gonna do that, but im not sure. 15:19:48 aaah, ok ;) 15:19:58 sure, it seems like it was planned for 2019Q1Q2 and then things went quiet :) 15:19:58 #24973 can be dropped 15:20:20 ok 15:20:25 lots of things were added after the fact, and could potentially be dropped in the future 15:20:30 just saying 15:21:09 that's fine, just want to make sure I know what we're still planning to work on and how much work that entails... 15:21:17 like i just added #31754 yesterday. i put it as -must because it's more important than the -cans, but if we dont do it, it's fine 15:21:27 i know this makes no sense from a project management PoV 15:21:48 /o\ ;) 15:21:50 ok... 15:22:11 but i can assure you that me and dgoulet have O1 in control 15:22:15 so where would you say we are with O1A2 in terms of completion? 15:22:23 I have no doubts about it ;) 15:22:24 we are perhaps adding more stuff than we can handle, because we get overexcited 15:22:39 but at some point we will drop the overoptimistic stuff 15:22:53 and there will still be tons of stuff done for each deliverable 15:23:02 pili: O1A2 i'd say 75% 15:23:03 ok 15:23:17 but we are planning to finish it off after O1A1 and O1A1.2 15:23:19 *O1A1.1 15:23:32 because it's largely under control, and the rest of the stuff are good-to-haves 15:23:49 sounds good 15:23:50 maybe we can move on to O2A1: Client Auth? 15:23:51 I have some questions for brade and mcs here also 15:24:04 I have it on my plans to start this work again in October, but I'm not sure if that's still realistic 15:24:19 and I also want to try to understand how much work is left from the network and browser sides 15:24:28 and maybe UX, antonela ? 15:25:07 On the first question (re-start date), we don’t know but I can say there are a lot of loose ends for Tor Browser 9 (as you know). 15:25:20 So November seems more likely than October. 15:25:41 there is 4 points of network team work on #30382, which is gonna be done by dgoulet in october 15:25:47 i think that's all from network team 15:25:50 ok, that's what I was thinking 15:26:09 will there need to be any browser team help needed while that's happening? 15:26:21 or any coordination necessary? 15:26:42 i imagine that browser team will find more bugs in #30381/#30382 and that we will need to fix them 15:26:55 but i dont think that's gonna be huge things 15:27:10 So far we have not used REMOVE or VIEW 15:27:25 currently #30381/#30382 are not production ready, but they are enough to do the basic tb/ux integration IMO 15:27:28 for O2A1 - the work mostly happened on #30237, we need to coordinate with gus for ##31069 and i'd like to have it in some alpha after TB 9.0 launches 15:28:20 ok 15:28:28 Probably the big remaining item on the browser side is to provide UI for viewing and removing client auth info 15:28:42 (which would use REMOVE and VIEW) 15:28:55 ok, how many points/days would that be more or less? 15:28:56 mcs do we want to expose it in about:preferences? 15:29:32 Probably yes. Maybe we can find someone with experience in that area on the dev side :) 15:29:44 mcs i mean, do we want to persistently save those credentials in TB? 15:29:57 mcs, yes we can :) 15:30:36 I assume people will want that option but you are right — we need to decide whether to save to disk 15:31:11 yes, that is what i remember we have been discussing so far 15:32:18 OK. Assuming we want the option to save to disk (and I think we do), we will need a management UI in about:preferences. It might be fairly simple. 15:33:02 perfect, i can file that ticket and parent it with #30237 15:33:09 agreed about simple 15:33:50 ok 15:34:01 any estimates though? ;) 15:34:28 No estimate at this time from me :) 15:34:44 im quite behind with this question, but for all people here 1point = 1 day = 8 hs? 15:35:22 yup :) 15:35:35 ok, I think it may be time to move on to O2A2 then 15:36:02 O2A2 and O2A4 are related and i should work on them this month 15:36:03 that's the typos activity 15:36:06 great :) 15:36:18 I have the browser team working on them end Oct - November 15:36:23 but I'm guessing that will change again? 15:36:39 we also need to decide who's going to work on this, if it's still going to be mcs and brade or someone else 15:36:56 we had some dev work done there which is the socks connection between tor and the client, so is basically me connecting the pieces of the puzzle 15:37:30 ok 15:37:51 and coming up with a list of all the possible errors 15:38:03 It might actually make sense for brade and I to work on the O2A2 and O2A4 and handoff the management part of O2A1 to Richard (I don’t want to ping him right now tho) 15:38:20 ok 15:38:25 that's fine :) 15:38:43 I guess we need to talk about assignments on the browser team side while anto finalizes the design 15:38:43 that could work quite nicely 15:38:46 yup 15:38:51 mcs, sounds good! 15:39:00 and we're probably looking at start of November for this work on the browser side 15:39:06 yup 15:39:09 ok, anything else on typos and errors? 15:39:29 there is some network team work there too 15:39:41 i'm working on the typos, and i'm supposed to do it in october 15:39:58 so that tor exposes "there was a typo" to firefox through the SOCKS port 15:40:22 it's not much work 15:40:39 ok, that will fit in nicely with browser starting on it in november then 15:40:40 we have some work done, tho > https://github.com/torproject/torspec/blob/master/proposals/304-socks5-extending-hs-error-codes.txt 15:40:49 yep 15:41:00 that is the spec side of #30382 15:41:01 which makes maybe the 30% of progress? not sure how to measure it 15:41:12 not sure if all these errors are implemented in tor 15:41:15 i dont recall right now 15:41:18 if they are implemented def 30% 15:41:21 ah 15:41:22 ok 15:41:39 that's good if we want to bill for some of that item 15:42:00 ok, shall we move on to O2A3: alt-svc? 15:42:08 yep, O2A3 is #30024 15:42:29 and my side of work is almost there and done - im not sure how to move forward with it 15:42:32 I see the network team will work on this in november? Is this still accurate? 15:42:41 do we need a formal proposal for alt-onion? 15:42:48 i dont think there is anything for us to do 15:42:57 let me find the ticket 15:42:58 this is purely browser side 15:43:06 #21952 15:43:29 hmm, that doesn't seem right 15:43:35 im not sure what's the action item in that ticket 15:43:38 oh yeah 15:43:44 we were originally supposed to handle the onion-location proposal 15:43:48 gaba had added some points and tags 15:43:57 but we passed that to the tb team, after discussion with geko 15:44:08 so if any changes need to happen to the onion-location proposal, the tb team should do them 15:44:27 yeah, sounds like it's just ux and browser 15:44:30 yes, and we parented #21952 with #30024 because that discussion has been made 15:44:48 im not even sure if there is any value in having #21952 around 15:44:51 perhaps we can close it? 15:44:56 maybe? 15:45:04 is a good thread tho 15:45:11 perhaps it represents work on onion-location 15:45:15 since there is no ticket for onion-location 15:45:18 yes 15:45:23 but it's not clear that this is the case 15:45:25 is the onion-location proposal written? 15:45:32 did you make it asn? 15:45:37 yes 15:45:40 let me find it 15:45:47 can we add a section with the UI? :) 15:45:54 [tor-dev] UX improvement proposal: Onion auto-redirects using Alt-Svc HTTP header 15:46:07 https://gitweb.torproject.org/user/asn/torspec.git/commit/?h=onion-location&id=14fc750e3afcd759f4235ab955535a07eed24286 15:46:55 shall we update it based on #30024 discussion? 15:46:57 i think geko also merged it to some TB spec tree 15:47:44 but i cant find it right now 15:48:12 maybe https://gitweb.torproject.org/tor-browser-spec.git/tree/proposals/100-onion-location-header.txt 15:48:17 antonela: i changed the ticket title and added a comment to enforce the onion-location side 15:48:21 of #21952 15:48:24 mcs: yep thanks 15:48:25 nice, thanks 15:48:32 I have the browser work on O2A3 planned for February and March, so the end of the project. 15:48:44 does that still work for people? 15:48:50 I guess it's just UX that needs to be involved 15:49:19 if we can work on it earlier, then we can run some usability test on them 15:49:20 I think that timeframe should be fine… although I would like to have someone on the browser team thinking about it sooner. 15:49:34 good point r.e. testing 15:49:52 re: testing, i know is out-of-scope for this sponsor, but anyways i prefer to have some feedback 15:50:16 it all depends on who will work on it and therefore how many of these items can be worked on in parallel 15:50:22 testing would be great 15:50:30 if we are planning release this features on TB9.5, then we can estimate it better 15:50:51 the last one is O2A5: HTTPSE which I had planned for before O2A3 15:51:03 O2A5 exciting! 15:51:06 indeed 15:51:12 November - Jan 2019 15:51:13 i wrote our stockholm discussion summary in the ticket yesterday 15:51:19 I saw! :) 15:51:37 so, if we can work on O2A3 and O2A5 in parallel, great 15:51:45 otherwise we need to decide which goes first 15:51:53 i worked with O2A5 during O2A3 as well 15:51:54 yes 15:52:00 but I feel O2A5 has more unknowns so it would be good to get it started earlier 15:52:20 but maybe it will be quick and straightforward after all?!? thoughts? :) 15:52:30 (also I have a hard stop in 8 minutes...) 15:52:50 #30029 needs a sync between multiple teams, if we can start earlier would be great 15:53:34 +1 on starting earlier if possible 15:53:45 (but we only have so many people) 15:54:10 yeah 15:54:13 hmmm 15:54:14 ok 15:54:33 we'll have to discuss end of October once ESR68 has "stabilized" 15:54:47 we'll hopefully have a better idea then 15:54:50 ok! 15:54:57 any last comments from anyone today? 15:55:25 im good! 15:55:29 we are making the OTF summit next month and i'd like to discuss together any objectives we have for it 15:55:36 good point 15:55:39 probably during the next meeting :) 15:55:46 next meeting we will also have dgoulet 15:55:57 when is the summit? end of October or ? 15:56:02 start of nov 15:56:05 my plan for the otf summit is to re-meet as many people as possible, 15:56:15 im fine sharing all our work, i have mockups and prototypes but im sure we want to be in the same page about what we are sharing with the community and with the sponsor 15:56:19 but if there is something specifically onion service related i should help with, in terms of advocacy or whatever, do let me know :) 15:56:37 oooh, exciting, I'd forgotten about the summit 15:56:38 last time i went to an otf meeting it was not about us displaying what we have done 15:56:45 not sure if this one is gonna be different 15:56:52 I think we should start with weekly meetings again after our next meeting (15th October) 15:56:53 asn: yes but it *could* be if we try hard to make it into that 15:57:02 so that will give us 1 or 2 meetings before summit to discuss 15:57:10 like, antonela carries a laptop around and is like "hey let me show you what i mean" 15:57:11 ok 15:57:18 right 15:57:22 pili: sounds good 15:57:23 arma2 that is what im usually do 15:57:34 :D 15:57:41 i think we have exciting stuff to show 15:57:46 yes, we have! 15:57:58 especially if we frame them nicely 15:58:06 not sure how much time we should invest here 15:58:13 because perhaps all the folks will be busy living their personal dream 15:58:22 i already have slides and mocks, is just about to coordinate together our mission there asn 15:58:24 and we will just be chasing them around with laptops about onio nservices 15:58:42 antonela: sounds good! 15:58:52 hehe 15:58:58 ok, I'm going to wrap this up now 15:59:16 #endmeeting