18:01:59 <sysrqb> #startmeeting Tor Browser Meeeting 3 August 2020 18:01:59 <MeetBot> Meeting started Mon Aug 3 18:01:59 2020 UTC. The chair is sysrqb. Information about MeetBot at http://wiki.debian.org/MeetBot. 18:01:59 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic. 18:02:07 <sysrqb> Welcome to August 2020, everyone 18:02:20 <antonela> 2020 what a joke 18:02:29 <antonela> can we reset? :) 18:02:53 <mcs> do over? 18:02:57 <GeKo> i am here 18:02:59 <GeKo> sorry 18:03:00 <mikeperry> not until the next simulation checkpoint is stored 18:03:10 <antonela> lol 18:04:00 <sysrqb> mikeperry: when's that scheduled? 18:04:02 <antonela> https://pad.riseup.net/p/tor-tbb-2020-keep 18:04:04 <GeKo> i think you put more weight on the simulation argument than it actually holds but that's for a different discussion .) 18:04:07 <GeKo> :) 18:04:15 <sysrqb> heheh 18:04:39 <sysrqb> GeKo: you're not convinced yet? you've heard his argument 18:04:51 <sysrqb> :) 18:04:52 <mikeperry> sysrqb: it is continuous, but movement means a lot of copy-on-write updates.. so staying still at home definitely makes it faster 18:04:55 <GeKo> i've read the original paper :) 18:04:58 <sysrqb> anyway 18:05:11 <sysrqb> mikeperry: oh, good. 18:05:15 <sysrqb> :) 18:05:22 <sysrqb> so. Tor Browser. 18:06:52 <mcs> mikeperry: you have a second “Week of 07/27 (planned):” 18:07:07 <antonela> multiples dimensions perry 18:07:34 <mikeperry> mcs: CoW glitch. fixed : 18:07:34 <mikeperry> 0 18:08:49 <mikeperry> time keeps on slipping... 18:09:01 <sysrqb> into the past 18:09:26 <sysrqb> mikeperry: what's the situation with QUIC/HTTP3? 18:09:45 <sysrqb> did you already brain dump onto a ticket? 18:10:45 <mikeperry> no I found a couple of pieces of support code that were using UDP.. I need to dig more to make sure they can't be reached 18:11:05 <mikeperry> it's disabled via pref anyway right? I noted it down and plan to come back after I finish XPCOM/android 18:12:28 <mikeperry> similar story for FastOpen. it looks disabled, and we probably don't care about re-enabling it with proposal#309 I assume? I noted that one on the ticket 18:13:20 <sysrqb> okay, that's good 18:13:51 <sysrqb> GeKo, acat, and I chatted earlier today 18:14:10 <sysrqb> and we'd like to get our 78esr-based alpha within the next two weeks 18:14:24 <sysrqb> but, one blocker for that is the proxy-safety audit 18:14:33 <sysrqb> so this work is definitely a high priority righ tnow 18:15:51 <sysrqb> moving on to XPCOM is fine, if necko looks okay 18:16:18 <sysrqb> what else do you have on your list after XPCOM and fenix (other than looking at QUIC/HTTP3/FastOpen again)? 18:16:28 <mikeperry> yes, I have not noticed anything definite yet 18:16:53 <mikeperry> XPCOM is ther last piece of desktop-specific audit. after that is android. hence my discussion point on that 18:17:30 <sysrqb> ah ha. okay 18:17:48 <sysrqb> the item dated "27 July" :) 18:18:34 <sysrqb> we can come back to that discussion item in a little bit 18:20:17 <sysrqb> acat: did you already talk with mcs/brade about reviewing the rebase? 18:20:55 <acat> not yet, i mentioned them in #40023 18:21:10 <sysrqb> ah, okay 18:21:18 <acat> to ask for updater patches reviews (which they already probably do) 18:21:19 <mcs> let us know what we need to do :) 18:21:38 <mcs> ah, I see a comment now 18:21:41 <acat> but this time i'm a bit less sure of some of the patches i rebased 18:22:57 <mcs> we will definitely look at the updater patches. does it make sense for GeKo to tell us which other patches need a second look? 18:23:24 <GeKo> i can ping you for those 18:23:38 <mcs> great; thanks 18:26:06 <sysrqb> acat: i see you created some MRs 18:26:09 <sysrqb> https://gitlab.torproject.org/groups/tpo/applications/-/merge_requests 18:26:14 <sysrqb> should those be assigned to someone? 18:26:28 <sysrqb> ah, is that part of #40023? 18:26:49 <acat> yes, but maybe they could be reviewed independently 18:26:58 <sysrqb> okay 18:27:20 <sysrqb> we have four torbutton patches 18:27:28 <acat> i was not sure whom to assign them to, maybe mcs/brade? 18:27:54 <sysrqb> i think mcs/brade hav a lot on their plate already 18:28:14 <GeKo> i can try doing that during my #40023 review 18:28:18 <sysrqb> i can take MR 2: https://gitlab.torproject.org/tpo/applications/torbutton/-/merge_requests/2 18:28:29 <GeKo> but we all have a lot on our plate :/ 18:28:55 <sysrqb> #40002 #40003 #40004 18:29:05 <sysrqb> oh, right. 18:29:32 <sysrqb> tpo/applications/torbutton#40002 tpo/applications/torbutton#40003 tpo/applications/torbutton#40004 18:29:52 <GeKo> we should probably be careful about merging those changes, tooo 18:29:55 <GeKo> *too 18:29:55 <sysrqb> should we leave these as unassigned for now? 18:30:09 <GeKo> because they might conflict with what we need for esr78 18:30:28 <acat> in principle my intention was to make them compatible with esr78 18:30:36 <GeKo> yeah :) 18:30:40 <acat> :) 18:31:01 <GeKo> sysrqb: wfm 18:31:14 <sysrqb> okay 18:31:42 <sysrqb> okay, anything else we should talk about regarding weekly updates, before we move on to the discussion 18:32:41 <sysrqb> okay, discussion topics 18:33:05 <sysrqb> we only have mike's 18:33:54 <sysrqb> so, pon Friday I pushed a branch onto the fenix repo 18:34:25 <sysrqb> it's the Firefox 79 tag plus a signed commit that includes a gitlab CI file for running the full test suite 18:34:33 <sysrqb> (fenix test suite) 18:34:57 <sysrqb> it was an easy base from which we can modify, but we may want something different 18:35:36 <sysrqb> for the proxy audit, yes, that's probably the correct place to start for auditing fenix 18:36:03 <sysrqb> the dependencies go deep, but i've been auditing some of them as I work through #33939 18:36:15 <sysrqb> just for sanity 18:37:54 <sysrqb> i haven't thought enough about how we should track firefox beta development 18:38:23 <sysrqb> so the current audits are using out-dated code 18:38:23 <mikeperry> does that CI commit clone all the sub-repos we want? 18:38:38 <GeKo> well, just jumping on the latest beta and starting would be a good thing 18:38:40 <mikeperry> or is there another way to get a full checkout of whatever we decide to build with, all at once? 18:38:47 <sysrqb> but i'm working under the assumption that the delta between 79 and the next versions will be easier to audit 18:38:49 <GeKo> it's already 2 cycles past esr78 18:39:03 <GeKo> mikeperry: i don't think so 18:39:16 <sysrqb> nope 18:39:22 <sysrqb> we have our own fenix repo 18:39:28 <GeKo> right now we want at least application-services and android-components in addition to fenix 18:39:40 <sysrqb> but the other repos are still using mozilla's tree 18:40:25 <GeKo> mikeperry: i think it's a safe assumption to use the current tip of those and look for proxy issues 18:40:41 <GeKo> and we'll finally reach that code when we release in september 18:41:00 <mikeperry> just those two? 18:41:15 <mikeperry> I am a little lost because I have no idea how this fits together or how to tell if it changes 18:41:21 <GeKo> application-services, andrdoi-components, fenix 18:41:39 <GeKo> the first one needs nss as deps and sqlcipher 18:41:58 <GeKo> for the former i applied the patches we already have in our tor-browser repo 18:42:14 <GeKo> (when preparing the branch for tor-browser-build) 18:42:20 <GeKo> i am not sure about the latter 18:42:38 <GeKo> i guess we would find out when doing the proxy audit in application-services 18:42:41 <sysrqb> tpo/applications/tor-browser-build#3410 18:42:55 <sysrqb> whoops. #34101 18:43:07 <GeKo> thanks 18:44:32 <sysrqb> starting at fenix and then auditing down into android-components/applications-services/etc is probably a good path 18:44:44 <sysrqb> a lot of the proxy audit from 68esr is applicable 18:44:57 <GeKo> yep 18:45:15 <sysrqb> but the implementations are in the libraries instead of the browser (fenix) now 18:46:01 <GeKo> fenix mentions the androic-components version at https://gitlab.torproject.org/tpo/applications/fenix/-/blob/tor-browser-79.0-10.0-1/buildSrc/src/main/java/AndroidComponents.kt 18:46:01 <sysrqb> i've stared at a lot of this code, and have a general working understanding of how the pieces fit together 18:46:13 <sysrqb> so if you need some help, let me know 18:46:18 <GeKo> you could look at the respective tag in the android-components repo 18:46:23 <GeKo> to have that link 18:47:58 <mikeperry> ok. I might not have questions until next week, but this will be useful if I have time to get to android before next meeting 18:48:37 <sysrqb> mikeperry: this may be relevant, too https://gitlab.torproject.org/tpo/applications/fenix/-/issues/40008 18:49:07 <sysrqb> that ticket is the parent for auditing various components within android-components 18:49:55 <sysrqb> mikeperry: thanks 18:49:58 <sysrqb> okay, anything else we should discuss now? 18:50:42 <sysrqb> okay, i think we're done. 18:50:46 <sysrqb> thanks everyone! 18:50:52 <antonela> thanks! 18:50:52 <sysrqb> have a good week, and happy hacking 18:50:53 <Jeremy_Rand_Talos> thanks! 18:50:57 <sysrqb> #endmeeting