15:00:54 <richard> #startmeeting Tor Browser Weekly Meeting 2022-01-24
15:00:54 <MeetBot> Meeting started Mon Jan 24 15:00:54 2022 UTC.  The chair is richard. Information about MeetBot at http://wiki.debian.org/MeetBot.
15:00:54 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic.
15:01:00 <sysrqb> \o/
15:01:00 <richard> bam nailed it
15:01:08 <sysrqb> first time
15:02:20 <donuts> o/
15:02:34 <donuts> I have to look up those commands every time, even a year in
15:02:47 <richard> I stored it in the pad vOv
15:02:52 <boklm> hi
15:03:48 <donuts> ahh clever
15:05:27 <donuts> pad: https://pad.riseup.net/p/tor-tbb-keep
15:05:36 <richard> ah yes^
15:05:50 <richard> what's the status of the 11.5a2 alpha?
15:06:31 <sysrqb> boklm included an update in their status
15:06:34 <boklm> I had some issue while doing the signing, which should be solved now, so will be ready soon
15:07:03 <donuts> great! :)
15:07:08 <richard> ah great!
15:08:30 <GeKo> sysrqb: what is blocking the mobile alpha release?
15:09:12 <sysrqb> GeKo: creating the blog post, I've gotten distracted, but should be published today
15:09:24 <sysrqb> i already uploaded on google play
15:09:41 <GeKo> okay, i was wondering as i can do signing and releasing, too, and thought helping you
15:09:48 <GeKo> but did not know what the problem was
15:10:03 <sysrqb> actually, on that topic, i lost the link you send me last year for testing your signed apk
15:10:14 <sysrqb> and i wanted to ping you about that again
15:10:23 <sysrqb> can you give me the link again, somewhere?
15:10:30 <richard> sysrqb: speaking of signing, do you think you can walk me through the signing process this week?
15:10:57 <sysrqb> richard: definitely. let's pick a day after
15:11:04 <richard> ok
15:11:44 <richard> i took a look at our release schedule this morning, and have discovered it's a bit optimistic, so I'll see about getting that updated this week
15:12:04 <sysrqb> optimistic in terms of Android releases?
15:12:18 <sysrqb> (desktop is relatively fixed in stone)
15:12:34 <richard> mostly optimistic in the number desktop of alphas we'd have by now :p
15:12:43 <sysrqb> ah
15:12:53 <sysrqb> yes
15:13:16 <sysrqb> updating the schedule so it reflects where we are now is a good idea
15:13:17 <GeKo> sysrqb: https://people.torproject.org/~gk/misc/26536_fix/tor-browser-10.5.10-android-armv7-multi_26536.apk.asc
15:13:19 <GeKo> sysrqb: https://people.torproject.org/~gk/misc/26536_fix/tor-browser-10.5.10-android-armv7-multi_26536.apk
15:13:29 <sysrqb> GeKo: thanks
15:13:32 <GeKo> (now it's baked into the meeting log :))
15:13:39 <richard> :)
15:13:47 * donuts is catching up, was busy writing in the pad
15:13:52 <GeKo> but you have to remember which meeting it was ;)
15:14:16 <richard> aguestuser: I suspect the answers to your questions in the discussion is some combination of boklm and sysrqb
15:14:16 <sysrqb> indeed
15:14:54 <sysrqb> yeah
15:14:59 <PieroV> I am also working on that
15:15:09 <sysrqb> i see three dividsions divisions of labor here
15:15:14 <sysrqb> PieroV: I agree
15:15:27 <PieroV> Last time I stopped at fenix, but geckoview and android components should be buildable now
15:15:46 <PieroV> The MR for geckoview is still valid, but I haven't created one for android-components, yet
15:16:02 <PieroV> I was hoping to test everything before creating the MR
15:16:39 <sysrqb> boklm usually works on the toolchain (tor-browser-build updates), PieroV works on geckoview rebase, and aguestuser will work on fenix
15:16:47 <PieroV> But I can open the MR for android-components, and somehow integrate my changes in tor-browser-build, so also aguestuser can build my changes
15:16:49 <richard> mmhm
15:17:15 <sysrqb> and then whoever finishs their work first can work on rebasing android-components (but I suspect that will usually be aguestuser )
15:17:31 <boklm> I have started a branch for tor-browser-build changes: https://gitlab.torproject.org/boklm/tor-browser-build/-/tree/mozilla96
15:18:09 <PieroV> boklm: should I open an MR to your repo, for the updated gradle-dependencies.txt?
15:18:19 <aguestuser> PieroV curious: (1) do you have a link to a working branch i could look at? (2) how do you plan to "test everything?" (in general trying to learn how we test)
15:18:46 <aguestuser> ((1) is for learning but also to test a dev flow i'm working on...))
15:19:30 <PieroV> (1): I only have a MR for geckoview, but you would need to change some files in tor-browser-build to test it
15:20:11 <aguestuser> PieroV working on a "fast iterations" workflow that bypasses tbb (to see changes in the fenix layer more quickly. this might be an interesting test case. might not!)
15:20:12 <boklm> PieroV: I think you can push a branch on your repo, and I can cherry-pick your commit
15:20:37 <sysrqb> (s/tbb/tor-browser-build/)
15:20:47 <aguestuser> ^-- yes!
15:21:01 <GeKo> sysrqb: it's worth thinking about a slight deviation in that division plan given that boklm is only part time working and has other stuff on his plate
15:21:07 <GeKo> maybe that is cool
15:21:07 <PieroV> aguestuser: (2): I'm not sure, just seeing that TBA opens, can browser a bit and in the tor network would be enough to start for me :)
15:21:30 <sysrqb> aguestuser: i only clarified because Tor Browser was previously called Tor Browser Bundle (or TBB)
15:21:30 <aguestuser> PieroV cool! :)
15:21:33 <GeKo> but maybe it's worth figuring something out so that no one is blocked on toolchain updates they wait on
15:21:37 <PieroV> For the real tests you should ask the others :)
15:21:46 <richard> PieroV: if possible I'd like you to finish any remaining patch shuffling required for tor-browser#40562, perhaps optimistic but I'd like to see the next the next alpha (eg 11.5a3 or whatever) based off the re-orderded patch-set
15:21:48 <PieroV> boklm: okay, will do
15:21:51 <aguestuser> sysrqb good clarification!
15:22:16 <PieroV> richard: I tried building at every commit, and it worked for me
15:22:32 <aguestuser> sysrqb richard (sorry for crossing streams w/ patch disco): do we have a target date for landing all 3 android rebases?
15:22:35 <sysrqb> GeKo: yes, that may be true, richard can re-distribute tasks as needed
15:22:39 <richard> interesting
15:22:48 <PieroV> richard: so I am waiting for you to tell me any other problems you find...
15:22:58 <sysrqb> aguestuser: asap? :)
15:23:06 <GeKo> richard: so, now you are aware of that :)
15:23:21 <GeKo> i recall when acat, sysrqb, and i jumped on that faster mobile train
15:23:24 <PieroV> the only thing that is missing for tor-browser#40562 is moving the prefs before the tor group
15:23:26 <richard> ok i'll ping you after the meeting once I verify
15:23:36 <GeKo> i worked full time on toolchain updates and that work okay-ish
15:23:56 <GeKo> but just with part time working only on toolchain updates that might have been way harder
15:24:15 <GeKo> *worked
15:24:34 <GeKo> and boklm is working on other stuff, too...
15:25:40 <boklm> PieroV: you can also include commits to use for testing non-merged branches, similar to this: https://gitlab.torproject.org/boklm/tor-browser-build/-/commit/ae691a2f9311f77c30d780aefb07c3184212a555
15:25:50 <boklm> (and we drop those commits before merging)
15:26:32 <PieroV> ack
15:26:50 <richard> aguestuser, PieroV: not sure it y'all are aware of it yet, but for git_url you can also point to a local .git directory (eg /home/aguestuser/tor-browser/.git )
15:27:06 <PieroV> yep, that's the first thing you told me :)
15:27:49 <richard> okey then
15:28:21 <boklm> I can help PieroV or aguestuser do the toolchain updates (for moz96, or for the next one)
15:29:16 <PieroV> When you say updating the toolchain, what are you referring to, in particular? Android SDK, compiler version, etc...?
15:29:30 <boklm> yes
15:29:59 <boklm> the updates listed in `make list_toolchain_updates-*`
15:30:00 <richard> do we have that documented anywhere (eg things that we want to update for android builds?)
15:30:19 <richard> i have my list for things we generally care about for desktop (openssl, go, etc)
15:31:29 <sysrqb> i think PieroV should look at the geckoview branch and update it with the fixes and patchset reorganization from the desktop branch, as well
15:31:31 <boklm> the process is to run `make list_toolchain_updates-$component` for each component, to get the list of updates we need
15:31:49 <sysrqb> (but that shouldn't prevent working on the toolchain updates)
15:32:16 <richard> boklm: oh neat
15:32:21 <PieroV> sysrqb: okay
15:32:46 <boklm> (after updating the commit in steps/list_toolchain_updates in projects/$component/config)
15:33:15 <sysrqb> PieroV: but richard can help prioritize work
15:33:33 <sysrqb> i don't know if they feel one of these is more important than the other
15:34:06 <richard> indeed i have no intuition on these matters
15:34:34 <PieroV> right now I'm working on tor-browser#40774, which is sponsor 33 work
15:34:46 <sysrqb> 33? :)
15:34:53 <sysrqb> is that 96?
15:34:57 <richard> I'm inclined to say aguestuser should take the toolchain stuffs while PieroV works on the s96 stuff
15:35:00 <richard> yeah 40774
15:35:07 <PieroV> Is it the issue with top priority for me? Or should I prioritize TBA?
15:35:08 <sysrqb> sounds good to me
15:35:24 <PieroV> s/33/30
15:35:35 <sysrqb> ah! yes :)
15:35:42 <richard> 30/96 whichever vOv
15:35:49 <aguestuser> richard happy to. i could use guidance on what is entailed in "toolchain stuffs"
15:36:15 <richard> yeah let 40774 be your top priority for this week outside any feedback on the patch re-ordering MR
15:36:24 <aguestuser> (honestly could use guidance on most parts through this first flow, but really no idea what is entailed in updating toolchain other than setting new dependencies as discussed above)
15:36:40 <sysrqb> aguestuser: yeah
15:36:50 <aguestuser> sysrqb maybe i could hold questions and we can chat after meeting to make a gameplan?
15:37:02 <sysrqb> maybe the best next steps are for aguestuser and me look through the current status of all of the patches
15:37:22 <sysrqb> PieroV: if you can open a MR with your tor-browser-build patches, that will help
15:37:38 <sysrqb> and we can see how far we get in the Fenix96 build
15:37:38 <PieroV> aguestuser: for example, clang 13.0.0 has some problems with compiler_rt, so it fails to compile even the testing programs
15:37:54 <PieroV> sysrqb: I started from boklm's mozilla_96
15:38:07 <sysrqb> ah, okay, great
15:38:12 <PieroV> So he suggested that I push on my fork instead
15:38:20 <sysrqb> sounds good to me
15:38:41 <PieroV> However that is not enough to get geckoview picked up
15:38:53 <boklm> tor-browser-build#40418 is the ticket
15:39:06 <PieroV> I haven't understood why, but my geckoview is created as geckoview-beta-omni
15:39:39 <PieroV> so android-components pickup Mozilla's geckoview
15:40:09 <sysrqb> interesting, okay
15:41:02 <richard> ok donuts, so whats' the deal with tor-browser#19850 ?
15:41:21 <sysrqb> ( aguestuser let's sync after the meeting)
15:41:39 <donuts> richard: well since HTTPS-E is in maintenance mode pending final deprecation, I thought we should get this back on the roadmap soon
15:41:49 <aguestuser> sysrqb +1
15:42:00 <donuts> I was going to do a recap in the ticket first to make sure I understand all the moving parts, and then we can take it from there?
15:42:37 <GeKo> yes, please
15:42:40 <donuts> replacing human readable onion names for securedrop will be tricky, but maybe there's a workaround
15:42:58 <GeKo> that's a thing i like to see with my network-health hat getting moved forward :)
15:43:09 <GeKo> (as well)
15:43:17 <donuts> aha :)
15:43:22 <sysrqb> :)
15:43:24 <richard> so IIRC the plan from last year was to integrate https-everywhere rust implementation into firefox directly
15:43:30 <richard> and yank out the deprecated extension
15:43:35 <donuts> oh I see
15:43:52 <donuts> where's that happening?
15:44:04 <richard> sysrqb: do you know if anything has changed in this space to make us change plans?
15:44:07 * Jeremy_Rand_Talos_ notes that Namecoin could hypothetically be a thing for replacing HTTPSE :)
15:44:58 <donuts> this is just to replace the old proof of concept rather than do human readable onions for real
15:45:26 <boklm> does eff plan to maintain the https-everywhere rust implementation?
15:45:32 <sysrqb> richard: no, i believe the most recent plan we have is: 1) try integrating the https-e core lib and continue using the FPF securedrop ruleset, drop https-e as a webex and enable HTTPS-Only Mode
15:45:47 <GeKo> richard: i think the plan was always to get https-only mode going
15:46:03 <sysrqb> 2) re-evaulate if one of these fails
15:46:13 <Jeremy_Rand_Talos_> donuts, right, I know.  And Namecoin makes some different tradeoffs than HTTPSE.  So it won't meet everyone's needs.
15:46:16 <richard> right that makes sense
15:46:19 <GeKo> https-e is just a hack along that way
15:46:59 <richard> so as to where/when that woudl be happening I would think that'd be a logical next thign to tackle after s96 work is complete
15:47:04 <donuts> Jeremy_Rand_Talos_: yep :)
15:47:42 <donuts> richard: is there a date for actual HTTPS-E deprecation? the links I can find just say late 2022
15:47:50 <donuts> and TB12 may be cutting it a bit close
15:47:55 <richard> sysrqb^ ?
15:48:16 <sysrqb> i believe it is "ASAP but without hurting us"
15:48:17 <donuts> (assuming after S96 is complete = TB12 probably)
15:48:32 <sysrqb> i don't know if Tor Browser is the only blocker for EFF drpoping https-e support
15:48:45 <sysrqb> but we are likely one of the only reasons
15:49:00 <sysrqb> but we are in contact with them (and FPF)
15:49:25 <sysrqb> and I mentioned to richard that PieroV  may be a good person to pick up this project in the near future
15:49:32 <richard> mmhm
15:49:35 <donuts> got it, ty for the info
15:49:44 <sysrqb> and coordinate with both orgs
15:50:09 <PieroV> sysrqb: which project, exactly?
15:50:33 <PieroV> (and I know EFF, but what is FPF?)
15:50:41 <richard> freedom of the press foundation iirc?
15:50:48 <sysrqb> PieroV: replacing the https-everywhere webextension with Firefox's HTTPS-Only Mode
15:50:49 <donuts> yep :)
15:50:51 <donuts> PieroV: tor-browser#19850 I assume
15:50:58 <richard> donuts: yep
15:51:12 <PieroV> oh, okay, thanks :)
15:51:30 <sysrqb> PieroV: and continue consuming the Securedrop ruleset and redirects using the https-everywhere core library (rust)
15:51:45 <sysrqb> so there are a few different parts in this project
15:52:26 <donuts> iirc the security slider flips some HTTPS-E prefs, right? Do we need to rip that out and do something different there too?
15:52:31 <aguestuser> PieroV for context: FPF maintains Securedrop, which leverages a set of custom rulesets to allow them to give newsrooms memorable urls for onion services for leakers to use instead of long hard-to-remember hhashes
15:52:42 <aguestuser> (sorry if you already knew that!)
15:53:11 <donuts> for ref: https://securedrop.org/news/introducing-onion-names-securedrop/
15:53:12 <PieroV> Yeah, I encountered this, and also opened a ticket about it, because it has a small problem with opening links in new tabs/windows :)
15:53:21 <aguestuser> :)
15:53:21 <richard> donuts: i don't remember if security slider/level touches https prefs
15:53:22 <sysrqb> donuts: i don't believe the security slider changes any https-e configuration
15:53:29 <donuts> oh okay great, ty both
15:53:34 <PieroV> So I also know securedrop, but I didn't remember that it is maintained by FPF
15:53:47 <richard> ok, we're nearing the hour
15:53:56 <richard> do we have anything else pressing? we all good for now?
15:54:05 <PieroV> A small question
15:54:08 <Jeremy_Rand_Talos_> richard, see my bold item
15:54:14 <donuts> thanks for the https info, got a better understanding of the plan there now!
15:54:24 <donuts> I'll have a think about the UX aspects too
15:54:39 <richard> Jeremy_Rand_Talos_ looks like that'd be me, could you forward it to me?
15:54:54 <PieroV> About #40777: https://gitlab.torproject.org/tpo/applications/tor-launcher/-/merge_requests/16/diffs this is to be also fixed, then right?
15:55:16 <Jeremy_Rand_Talos_> richard, via private email?
15:55:28 <richard> yeah that works
15:55:38 <Jeremy_Rand_Talos_> yes, I will forward it your way, thanks.
15:56:05 <sysrqb> tor-browser#40777
15:56:48 <sysrqb> PieroV: is that a question for richard and/or donuts ?
15:56:55 <PieroV> Yep
15:56:57 <richard> yeah
15:57:03 <PieroV> For donuts in particular
15:57:17 <donuts> does it need review?
15:57:25 <PieroV> In tor-browser!247 I basically applied the same fix of tor-launcher!16, but I can amend it and add Network
15:57:28 <donuts> but yep that needs fixed please
15:57:28 <GeKo> someone should check out https://gitlab.torproject.org/tpo/applications/fenix/-/issues/40204
15:57:43 * donuts is checking...
15:57:50 <GeKo> it came up during my network audit and i am not well-versed enough in mobile land for that one
15:57:56 <sysrqb> aguestuser: ^
15:58:24 <richard> assigned to a guest :)
15:58:26 <sysrqb> may be a good experience
15:58:51 <aguestuser> ay
15:59:13 <donuts> Pierov: uhhhh I'm going to have a think about this
15:59:24 <PieroV> Ok, no problem :)
15:59:26 <donuts> thanks!
15:59:28 <richard> alright
15:59:29 <richard> then with that
15:59:44 <richard> any last words?
15:59:58 <richard> because if not
16:00:00 <richard> goodbye
16:00:01 <richard> #endmeeting