15:58:37 #startmeeting tor anticensorship meeting 15:58:37 Meeting started Thu Jan 7 15:58:37 2021 UTC. The chair is cohosh. Information about MeetBot at http://wiki.debian.org/MeetBot. 15:58:37 Useful Commands: #action #agreed #help #info #idea #link #topic. 15:58:43 happy new year 15:58:49 first meeting of 2021! 15:59:08 hey, happy new year! 15:59:20 :D 15:59:50 here is our meeting pad: https://pad.riseup.net/p/tor-anti-censorship-keep 15:59:58 dcf1: i think you have the first announcement 16:00:34 The Counter-Power Lab, who contracted with me for the Turbo Tunnel work, is required to get a security audit of work they fund 16:01:10 This includes the parts that affect Snowflake I believe, and I've invited them to interact with the anti-censorship team and not me exclusively on the Snowflake parts 16:01:35 Current status is I sent them a summary of the work and links to all the source code, and they are coming up with a plan and scope of work. 16:01:58 oh nice 16:02:37 next discussion point is mine too 16:03:00 I found a link where a user was worried about their snowflake extension connecting to bamsoftware.com 16:03:23 I looked at it a little bit and thought that we had cahnged the doamin (in the extension) quite a long time ago 16:03:50 my question is, am I wrong about the domain being changed; and if not, how did this user get an extension that still connects to this old domain? 16:04:01 huh 16:04:34 you're right, it should have been changed 16:04:41 They link the right addons page, https://addons.mozilla.org/en-US/firefox/addon/torproject-snowflake/ in the reddit post 16:05:02 Possibly they deliberately installed a very old version? Maybe there is something wrong with the packaging? 16:05:13 snowflake-broker.bamsoftware.com is a cname for snowflake-broker.freehaven.net. maybe that's the issue? 16:05:15 there is one edge case i've been worried about, which is that a long time ago we checked a box to make the extension available on android 16:05:38 we stopped checking the box because it wasn't at all useful 16:05:54 mhmm 16:06:04 but maybe there were some users who added the extension that way who still ahve a super old version? 16:06:26 checking just now: `unzip -p snowflake-0.5.2-fx.xpi | grep bamsoft` (no output). `unzip -p snowflake-0.5.2-fx.xpi | grep freehav` (Config.prototype.brokerUrl = 'snowflake-broker.freehaven.net';) 16:06:46 Or maybe a super old version is all that's available to install for android? 16:07:40 right, yeah 16:08:00 i hoped that failing to check the box would somehow make it not installable that way 16:08:14 or discontinue extensions that were installed 16:09:11 is malwarebytes a windows thing though? 16:09:15 malwarebytes may be looking at dns reqs without considering the semantics of a cname, in which case it always sees the bamsoftware domain 16:09:32 Okay is there something actionable we can do here? Open a ticket to at least see what the add-ons page offers on Android? 16:09:51 that makes sense 16:09:51 phw: that's a good thought. 16:10:05 that seems more likely 16:10:14 dig snowflake.freehaven.net 16:10:17 ;; ANSWER SECTION: 16:10:17 snowflake.freehaven.net. 3600 IN CNAME snowflake.bamsoftware.com. 16:10:17 snowflake.bamsoftware.com. 86400 IN A 37.218.242.151 16:10:49 i just tested with wireshark: i see bamsoftware.com in my dns responses when i turn snowflake on 16:11:30 great, sounds like the mystery is solved 16:11:42 now is it a good course of action to make *.freehaven.net plain A records? 16:11:51 yeah, or the torproject.net domains 16:12:01 and then make freehaven and CNAME for torproject.net 16:12:23 seems that *.torproject.net are already not CNAMES 16:12:44 aha okay so maybe just change the CNAME for freehaven 16:12:51 ok, I'll make a ticket to that effect 16:12:57 thanks dcf1 16:12:58 thanks for the laser debugging 16:14:06 okay the next discussion item is to pick a reading 16:14:28 are we interested in starting this up again? 16:14:59 On BBS I have a list of reading I'm behind on https://github.com/net4people/bbs/wiki/Reading-list 16:15:21 i'm neutral on this because i often failed to read the papers 16:17:04 i would prefer to keep it up, but I leave it up to you guys 16:17:05 i've really liked the chance to have discussions with people outside of tor 16:17:05 (i'm not going to pick a paper because it's a bit rude to suggest reading that i may not read myself) 16:17:32 the psiphon paper looks like it might be directly relevant to us 16:17:39 https://tics.site/proceedings/2019a/icn_2019_7_10_38005.pdf 16:18:32 i'd be up for reading that 16:18:44 +1 16:19:22 cool, so two weeks from now.. on january 21st? 16:19:32 it's also a shorter paper (5 pages) 16:19:34 sounds good! 16:19:43 yes, a light read to ease into 2021 16:20:46 okay and then one last action item to update the monthly report for december: https://pad.riseup.net/p/mh4PvdOzncZlcxwHGROn 16:22:04 let's look at our needs help with 16:22:32 phw: i can do bridgestrap!5 16:22:41 cohosh: thanks! 16:22:47 I'll do snowflake!25 16:22:54 thanks dcf1 16:23:36 anything else for today? 16:23:43 not from me 16:24:26 nope 16:24:39 i also had a report from a family member whose AV was triggering on their snowflake firefox extension 16:24:53 every time their snowflake connected to the broker, it popped up an "omg malware" window on their windows system 16:25:08 oof this is a good thing to get fixed 16:25:10 arma2: I'll assign the ticket I make to you, as you are probably the one who can change freehaven.net DNS records? 16:25:12 sounds like it might be the same issue as the backlog 16:25:24 yes, i can change dns records for freehaven 16:25:31 ok 16:25:36 at least, i think. we'll see if i have the skillz. but if not me, nobody 16:26:06 cohosh: yeah, they saw the defcon talk from years ago and were like "finally i will help roger with something" and now they run cupcake and snowflake 16:26:20 i'm not sure if running cupcake is even wise at this point 16:26:30 we kicked out cupcake users 16:26:38 but also, cupcake wasn't the extension causing the problem, so i left that one alone :) 16:26:41 just by checking what version they are running 16:26:45 ok 16:27:11 if it gets updated it'll work again 16:28:00 alright i'll close the meeting for today 16:28:04 have a great week everyone! 16:28:08 #endmeeting