15:59:03 #startmeeting anti-censorship team meeting 15:59:03 Meeting started Thu Jul 9 15:59:03 2020 UTC. The chair is phw. Information about MeetBot at http://wiki.debian.org/MeetBot. 15:59:03 Useful Commands: #action #agreed #help #info #idea #link #topic. 15:59:06 good morning, everybody 15:59:18 here is our meeting pad: https://pad.riseup.net/p/tor-anti-censorship-keep 15:59:34 hey 15:59:36 hi 16:00:40 hi 16:00:43 hi 16:01:00 hi 16:01:01 gaba: did the tuesday gitlab meeting result in a way forward regarding our problem with anonymous issue submissions? 16:01:44 yes 16:01:54 we are creating all users that people are asking 16:01:58 and then ahf is working on a lobby 16:02:13 on submission form 16:03:06 https://gitlab.torproject.org/ahf/lobby 16:03:13 a submission form to apply for accounts? 16:03:22 "This Django application contains the lobby website for Tor's Gitlab instance. 16:03:25 The Gitlab Lobby allows users to: 16:03:28 Request accounts on our Gitlab server, if they are interested in working 16:03:31 with Tor's development teams. 16:03:33 Anonymously submit and comment on issues on Tor's Gitlab instance." 16:03:49 phw: first step is for users to sign up, second step is for users to submit anonymously 16:04:00 hope to have a demo ready next week for the first step 16:04:38 what do people sign up with? so it's not a shared account? 16:05:40 so if I understand correctly, at the moment to submit a bug report, you email gitlab-admin@tpo and get an account, then use the account to file the report 16:05:51 right 16:06:02 that is how is working right now 16:06:06 when the lobby website is ready, it will be possible to use it to 1) request an account without emailing gitlab-admin, or 2) submit a bug report without an account 16:06:14 phw: people wont have to sign-up. people will be able to submit (with moderation) to the issue tracker 16:06:15 ok 16:06:20 for projects who are willing to do moderations 8) 16:06:52 phw: the discource discussion yesterday might change the plans those, but i'm not tracking that super much right now 16:07:43 the discourse wil help with where discussion is happening before tickets 16:07:53 but i do not think it will change how we submit tickets 16:08:05 discourse will help with blogpost (if we do discourse) 16:08:16 and to redirect people from multiple Tor forums around the Internet 16:08:25 * ahf nods 16:09:03 should we create a cypherpunks-like gitlab account until the lobby website is ready? 16:09:33 why? 16:09:55 how many weeks until people are able to submit tickets? 16:10:00 there is some debate on the cypherpunk account. Some people do not like that option and is harder to do in gitlab because the possible changes people can do on the account 16:10:03 it might be nice to have something to bridge the gap until then 16:10:13 as a temporary solution, so people can interact with gitlab until the lobby is done 16:11:30 you think that people asking for accounts is not something that can work for now? 16:11:46 I guess we as a team could do this, by requesting a new account with the proper permissions. 16:12:19 I think that requiring an account, and especially requiring emailing someone to make an account, is a high barrier for many of the people who want to reach us. 16:12:24 gaba: we're talking about anonymous submissions, specifically. i don't think that asking for an account is a good solution for this 16:13:02 i wouldn't mind managing an account that's only allowed to report issues in the anti-censorship group 16:13:08 ...so it wouldn't bother anyone else 16:13:18 the permission systems are not setup correctly yet, which makes it hard to maintain such a user. the user would have access to everything practically and we haven't audited all group access yet 16:13:37 and first time someone logs in and changes the pw, you will need someone to reset it :-/ 16:13:37 i see 16:13:39 hmm 16:13:56 i do agree the barrier to entry is higher than anybody wants it 16:14:10 an easy alternative is we designate a bug-reporting etherpad and remember to check it every week 16:14:24 like that alternative 16:14:41 sounds good to me 16:14:44 or take issues by mail? the first suggestion we had when we moved was for people to write to tor-dev@, but a mailing list also have higher barriers than somebody wants 16:14:45 we could even setup a form somewhere where people send tickets... 16:15:13 We just need something concrete to write at https://snowflake.torproject.org/#bugs 16:15:25 yeah an etherpad is a good call 16:15:36 is then when the lobby is ready we can write that information on the pad 16:15:42 from what i can tell, the lobby stuff is the only thing i have on my plate for gitlab stuff next week, and it's not a big project for the account sign-up. i think i could spend half a day more on it and do some very basic ticket submission stuff (but probably not comments) if you are willing to beta-test something like that 16:16:06 * cohosh is willing to beta test 16:16:12 ahf: thanks for doing all this 16:16:31 I am available for testing aswell. 16:16:32 trying with the anti-censorship teams' project would be nice before we try opening it up. i've been hoping to find a test team this week or next 16:16:38 cool 16:17:31 thanks ahf 16:17:44 np! let me try to poke you all sometime next week when i have something we can try 16:18:28 dcf1: do you mind updating https://snowflake.torproject.org/#bugs ? 16:18:41 Yes I'll do it. 16:18:52 thanks 16:19:36 dcf1: i just remembered that i haven't updated the badge yet for #34129 >.< 16:19:57 oh, there are a bunch of censorship-related pets'20 papers. take a look at the 'interesting links' section 16:21:04 I found a badge in the wild in Sergey's site: https://sfrolov.io/ 16:21:25 dcf1: woah heh 16:21:41 looks like it's populating the strings right though 16:21:44 it's not* 16:23:25 any other topics to discuss before we move on to our 'needs review' section? 16:23:48 I'm the author of GoodbyeDPI, it's listed on the pad. Feel free to ask me anything. 16:24:04 valdikss: hi! 16:24:23 valdikss: welcome! 16:24:51 hey valdikss, we're scheduled to talk about it right after the normal meeting business 16:25:13 I'll be here, mention me and I'll check the chat. 16:26:18 * phw takes a look at today's reviews 16:26:45 #30579 for cohosh, and i think that's it? 16:26:53 oh, is that still relevant? 16:28:36 sorry I'm behind on the last week of tickets 16:28:37 yeah it's a small change to add a new default stun server to the proxy-go isntances 16:29:02 so that they'll do nat discovery by default 16:29:15 i'm almost done rolling out all the nat discovery changes 16:29:33 gotcha 16:29:40 does anyone else need help with anything? 16:30:30 *crickets* means no 16:30:36 let's move on to the reading group 16:30:45 I'll at least leave a ticket on merge request !5 16:30:51 *a comment 16:31:01 dcf1: thanks 16:32:06 i didn't get around to this week's reading, so i would appreciate it if anyone else can moderate today's session :/ 16:32:52 i took a look but don't have a summary pre-prepared 16:32:59 I believe cohosh suggested the topic; also I am prepared to talk about it 16:33:22 And of course valdikss can correct any errors 16:34:12 okay i can do a brief summary of what i learned 16:34:41 i have some questions too 16:34:57 16:35:53 GoodbyeDPI is a service for bypassing censorship by either ignoring redirects sent by DPI boxes or tricking the DPI into ignoring the session 16:36:19 a lot of the techniques used are somewhat similar to the ones we've discussed in some of the recent reading groups on symTCP and geneva 16:36:42 e.g., fragmenting the first TCP data packet 16:36:58 and some HTTP-level tricks like playing with the capitalization of the Host: header 16:37:13 E.g. https://github.com/ValdikSS/GoodbyeDPI#how-does-it-work 16:37:43 but it will also just ignore packets that it thinks are sent by the DPI 16:38:15 these are packets that have an IP id of 0x0000 or 0x0001 that contain tcp rst 16:38:50 my understanding is that these techniques are specifically catered to the DPI boxes used by censors in Russia 16:39:25 Yes, the tuning for local conditions is interesting to me. 16:39:25 and that it is meant to be installed as a windows service so that the tricks can be used by any browser or other program that is making TCP/HTTP requests 16:39:51 they have also included with the tool some scripts that users can run to test whether goodbyeDPI will work for them 16:39:59 That is correct. GoodbyeDPI either prevents OS and software from receiving injected packets by DPI or 'breaks' the packets to make them undetectable by the DPI. 16:40:19 16:40:24 I guess, most of the related works and GoodbyeDPI is geared towards bypassing a Russing ISP 16:40:49 There's a similar software for Linux, https://github.com/bol-van/zapret 16:41:08 From my notes: 16:41:29 GoodbyeDPI is for WIndows only. For packet manipulation it relies on WinDivert (https://github.com/basil00/Divert) 16:41:33 GoodbyeDPI works in Indonesia (they recently got Netflix blocked and the software unblocks it), Turkey. I've also tested it in Saudi Arabia. 16:41:45 valdikss: thanks, i was curious about that 16:41:55 WinDivert itself has its origin in ReQrypt (https://reqrypt.org/reqrypt.html), about which I wrote a summary: https://groups.google.com/d/msg/traffic-obf/iwDomyMF--Q/N87y8mAPAgAJ 16:42:17 Here's an example in the source code for Host header manipulation: https://github.com/ValdikSS/GoodbyeDPI/blob/505b8bf516b74f2f1c0aff2b10768d6e9a0adeab/src/goodbyedpi.c#L783 16:42:46 Here's an example of changing the window size on receiving a SYN/ACK (I suppose this is something like brdgrd): https://github.com/ValdikSS/GoodbyeDPI/blob/505b8bf516b74f2f1c0aff2b10768d6e9a0adeab/src/goodbyedpi.c#L938 16:43:18 I unpacked the release the found a file blacklist.txt with a list of domains in it; I suppose that by default, GoodbyeDPI only affects those domains? 16:43:27 Additionally, One of the related works suggests to use DNS-Over-Https to bypass DNS. I guess most censors rely on DOT for blocking. 23:42:40 #endmeeting 16:57:41 doot de doot 16:58:56 o/ 16:58:57 hi! 16:59:00 hi 16:59:01 just in time with pad update :o 16:59:09 gaba: Error: Can't start another meeting, one is in progress. 16:59:14 what! 16:59:30 #endmeeting ? 16:59:33 oh no 16:59:45 another thing we need to fix in an upcoming irc bot 16:59:51 well, anybody know what happened? 16:59:55 yeah 17:00:01 090720 19:20:01 + phw: wait, my #endmeeting does not seem to have ended the meeting...? │············································································ 17:00:06 uh 17:00:07 looks like phw's endmeeting didn't work 17:00:17 ok, let's add a ticket to tpa 17:00:38 #endmeeting