17:29:59 <sysrqb> #startmeeting Tor Browser Meeting 7 October, 2019 17:29:59 <MeetBot> Meeting started Mon Oct 7 17:29:59 2019 UTC. The chair is sysrqb. Information about MeetBot at http://wiki.debian.org/MeetBot. 17:29:59 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic. 17:30:11 <sysrqb> o/ 17:30:19 <mcs> hi 17:30:20 <Jeremy_Rand_Talos> hello! 17:30:34 <acat> hi! 17:30:45 <sisbell> hi 17:31:13 <tjr> o/ 17:31:17 <sysrqb> Okay, i see people are still writing 17:31:17 <brade> hi 17:31:23 <GeKo> hihi! 17:31:35 <sysrqb> we can start in another minute 17:31:47 <antonela> \hello! 17:33:08 <pili> hi :) 17:33:10 <sysrqb> is pili around? 17:33:13 <sysrqb> ah, ehllo :) 17:33:16 <sysrqb> *hello 17:33:17 <pili> o/ :D 17:33:26 <pili> sorry, bit late :) 17:33:31 <sysrqb> no worries 17:33:44 <pospeselr> \o/ 17:33:48 <sysrqb> and sisbell ? 17:33:55 <sisbell> one sec 17:33:58 <sysrqb> okay 17:35:33 <sysrqb> okay, i don't see anyone with bolded items 17:35:46 * antonela goes to the pad, late sorry 17:35:50 <boklm> hi 17:36:03 <sysrqb> does anyone have something they want to discuss from the weekly updates? 17:36:30 <sysrqb> i'll wait a minute, maybe pili has something :) 17:36:39 <pili> I'm good, you can go ahead :) 17:36:46 <sysrqb> oh, okay! :) 17:37:10 <sysrqb> okay, we have two discussion points for this meeting 17:37:30 <sysrqb> the first item is not really for discussion (unless there's a major blocker) 17:37:45 <sysrqb> we're going to try releasing another alpha early next week 17:37:57 <sysrqb> so that means code freeze by Thursday, end-of-day 17:38:04 <GeKo> tjr: do you think it's reasonable to just squeeze https://bugzilla.mozilla.org/show_bug.cgi?id=1585351 into the next, last alpha? 17:38:09 <sysrqb> (ideally code will be finished earlier than that) 17:38:13 <GeKo> or should it have a bit more testing? 17:38:18 * sysrqb pauses for GeKO 17:38:21 <sysrqb> *o 17:38:22 <GeKo> oh, sorry 17:38:26 <sysrqb> np! 17:38:34 <GeKo> i thought we were already at item 2) 17:38:37 <tjr> GeKo: I have not tested it. So I would not 17:38:52 <GeKo> okay 17:39:01 <GeKo> then probably 9.5a1 material 17:39:38 <sysrqb> okay, and this leads into the second question. 17:39:58 <sysrqb> how do people feel about the current set of tickets we're targetting for 9.0? 17:40:20 <sysrqb> in particular, the tickets we want in this next alpha, and the tickets we want to squeeze into 9.0 later 17:40:33 <sysrqb> should we reconsider any tickets? 17:40:42 <sysrqb> and their priority? 17:41:21 <antonela> which is the query sysrqb? tbb-9.0-must-alpha? 17:41:28 <mcs> https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~tbb-9.0-must-alpha&order=id 17:41:29 <sysrqb> https://trac.torproject.org/projects/tor/query?status=accepted&status=assigned&status=merge_ready&status=needs_information&status=needs_review&status=needs_revision&status=new&status=reopened&keywords=~tbb-9.0-must&order=priority 17:41:36 <mcs> or that one :) 17:41:40 <antonela> nice, thanks 17:41:46 <sysrqb> there is the question about must-be-in-an-alpha-first 17:42:01 <sysrqb> and then squeezing into 9.0 after it becomes stable 17:42:13 <sysrqb> the latter set of tickets should be small :) 17:42:25 <sysrqb> unless it bakes in 9.5 for a little time 17:42:56 <antonela> all the tickets im interested on are there, groot here 17:43:39 <sysrqb> nice. pospeselr acat sisbell 17:44:05 <sysrqb> do any of you have opinions on any tickets? 17:44:36 <pospeselr> 31286 should be ready by Thursday 17:44:37 <sisbell> All of mine seem still open due to one issue, the dependency list 17:44:54 <sisbell> But I feel this is resolved after the investigation this morning 17:44:55 <pospeselr> barring something catastropihc 17:44:55 <sysrqb> boklm: i think you already have your plate full. do you have any tickets you'd like re-prioritized? 17:44:58 <GeKo> sisbell: there is #30665 that would be neat to get fixed for the alpha 17:45:10 <GeKo> there is still a comment unadressed 17:45:29 <GeKo> *unaddressed 17:45:55 <GeKo> sysrqb: i wonder what to do with the obfs4 custom bridge ticket 17:46:00 <sisbell> Right, I see that now. I'll invesigate 17:46:10 <GeKo> i agree it would be neat to have that fixed for 9.0 17:46:20 <GeKo> but if so i think we should have this for 9.0a8 17:46:25 <GeKo> and not ship it directly to stable 17:46:39 <acat> i thought about doing #31602 for the alpha, it should be just a pref fix, other than that ok for me 17:46:49 <GeKo> yeah 17:47:17 <sysrqb> GeKo: at this point, i think it should go into 9.5a and then backport it to 9.0 after it bakes 17:47:44 <GeKo> acat: the important ticket from your list is #13543 17:48:05 <GeKo> so we might need some workaround if we don't get it fixed properly for the alpha 17:48:16 <GeKo> sysrqb: sounds reasonable 17:48:25 <sysrqb> GeKo: i don't think i'm confortable solving that this week, espeicialy with all the other tor-android-service+TOPL changes happening in this release 17:48:35 <sysrqb> *comfortable 17:48:49 <GeKo> wfm 17:49:08 <GeKo> acat: i think i can do #31942 tomorrow. should not be too hard to test and write a patch for 17:49:16 <GeKo> (if that helps you any) 17:49:35 * boklm plans to review #29013 to get it in the alpha 17:49:44 <acat> GeKo: ok, then i'll remove it from my list 17:49:48 <acat> thanks 17:49:53 <GeKo> sure 17:50:05 <acat> but #13543 is not for the alpha, right 17:50:07 <acat> ? 17:50:25 <acat> tbb-9.0-must 17:50:57 <GeKo> depending on the fix someone comes up with 17:51:07 <GeKo> i think the real fix is someting for the alpha 17:51:18 <GeKo> and depending on "real" even for 9.5a1 17:51:29 <GeKo> but we need to do something about it for 9.0 17:51:44 <sysrqb> 17:50 < acat> but #13543 is not for the alpha, right 17:51:45 <sysrqb> 17:50 < acat> but #13543 is not for the alpha, right 17:51:45 <sysrqb> 17:50 < acat> but #13543 is not for the alpha, right 17:51:45 <sysrqb> 17:50 < acat> but #13543 is not for the alpha, right 17:51:45 <sysrqb> 17:50 < acat> but #13543 is not for the alpha, right 17:51:48 <sysrqb> 17:50 < acat> but #13543 is not for the alpha, right 17:51:50 <sysrqb> 17:50 < acat> but #13543 is not for the alpha, right 17:51:53 <sysrqb> 17:50 < acat> but #13543 is not for the alpha, right 17:51:54 <GeKo> huh 17:51:55 <sysrqb> 17:50 < acat> but #13543 is not for the alpha, right 17:51:58 <sysrqb> 17:50 < acat> but #13543 is not for the alpha, right 17:52:08 <GeKo> lol we lost our mod 17:52:24 <GeKo> what do we do, what do we do... 17:52:33 <antonela> oh whats going on 17:52:34 <antonela> lol 17:52:36 <sysrqb> that was excting. sorry about that everyone 17:52:41 <GeKo> wb 17:52:44 <pospeselr> lol 17:52:47 <sysrqb> thanks. 17:52:50 <GeKo> nice stunt, sysrqb 17:52:52 * antonela likes chaos 17:52:55 <Jeremy_Rand_Talos> haha 17:53:10 <sysrqb> in any case, back to the meeting? :) 17:53:15 <acat> :) 17:53:54 <sysrqb> okay, GeKo, i think you're next 17:54:22 <sysrqb> oh, one more thing 17:54:29 <sysrqb> sorry GeKo 17:54:54 <sysrqb> pospeselr: are you interested in helping with building this release? 17:55:12 <pospeselr> yeah, now that the gradel issue seems to be resolved 17:55:21 <pospeselr> i can donate some CPU cycles :) 17:55:28 <sysrqb> yep, great 17:55:29 <sysrqb> thanks 17:55:41 <sysrqb> okay, moving on :) 17:55:44 <sysrqb> GeKo: . 17:55:53 <GeKo> okay 17:56:28 <GeKo> before i look finally over acat's work for #25711 i wanted to know from the crowd whether we are good with the broom icon 17:56:31 <GeKo> ugh 17:56:33 <GeKo> #27511 17:56:49 <GeKo> that's what acat worked with and which looks good to me 17:57:00 <GeKo> but there is still time so swap the icon with another one 17:57:41 <pospeselr> very nice broom :) 17:57:51 <Jeremy_Rand_Talos> broom looks great to me (from my not-an-expert-on-UX perspective) 17:57:56 <mcs> I think the broom is fine. Our users will have to learn what it is in any case. I assume there is a tooltip? 17:58:11 <acat> mcs: yes 17:58:22 * boklm likes the broom 17:58:22 <antonela> mcs and we have an onboarding card? 17:58:39 <antonela> very spooky, specially for an october release :) 17:58:41 <mcs> yes that will also help 17:58:51 <sysrqb> antonela: heh :) 18:00:02 <sysrqb> (i'm okay fine with the broom) 18:00:23 <GeKo> okay. good 18:00:40 <GeKo> antonela: are we good with all the strings we need for 9.0? 18:01:10 <antonela> i saw your comment and mcs review on the onboarding ticket, will iterate it today/tomorrow morning 18:01:17 <GeKo> okay. 18:01:20 <antonela> almost there, just want to see what title we want to have 18:01:26 <GeKo> that's actually the part that is really urgent 18:01:37 <GeKo> so we get as much time as possible for translators 18:01:40 <antonela> i know, that is why i ping steph last week and we reviewed those 18:01:47 <pili> which file are the strings going to be in and is that in transifex already? 18:02:08 <antonela> pili: we are talking about #31768 18:02:15 <pili> yup 18:02:15 <GeKo> you are talking abour #31768? 18:02:18 <GeKo> ah 18:02:26 <antonela> oh, yes i am 18:02:38 <pili> well, any tickets which have new strings that need translation for 9.0 :) 18:02:59 <GeKo> where our other strings are 18:03:04 <GeKo> into torbutton 18:03:17 <mcs> browserOnboarding.properties (I think) 18:03:19 <pospeselr> gah that reminds me, we may need new strings for #31286 as well 18:03:24 <GeKo> the file (browserOnboarding.properties) is in transifex 18:03:35 <sysrqb> pospeselr: right, that was another question 18:03:36 <GeKo> pospeselr: that would have b een my next question 18:03:40 <antonela> pospeselr: we have the torlauncher ones? 18:03:41 <GeKo> heh 18:03:47 <sysrqb> are we reusing the same strings as torlauncher? 18:03:52 <antonela> pospeselr's thread 18:03:53 <sysrqb> :) 18:03:53 <pospeselr> the majority can be reused 18:03:53 <sysrqb> heh 18:04:07 <pospeselr> but there's copy in the the description for 'Bridges' 18:04:12 <antonela> true 18:04:27 <pili> ok 18:04:34 <pospeselr> and we probably need something for the Tor log viewer UX 18:04:51 <pili> so, the torbutton strings I think are ok because any changes get picked up and updated in transifex? 18:04:56 <pili> emmapeel: is that right? ^ 18:05:00 <pospeselr> i'll put string integration at the top of my list for today 18:05:05 <sysrqb> thanks 18:05:29 <GeKo> pili: yes, that's correct 18:05:39 <pili> ok, cool :) 18:05:47 <sysrqb> there will be a log viewer now? instead of copy-to-clipboard? 18:05:50 <sysrqb> pospeselr: ^ 18:06:04 <sysrqb> (i haven't followed closely) 18:06:39 <pospeselr> https://share.riseup.net/#vndYLqGb3jNSQazS0OlJyA 18:06:39 <pospeselr> :) 18:06:41 <antonela> is a default popup, you can copy or read (i think) 18:06:47 <antonela> there you are 18:07:02 <antonela> fancy pospeselr 18:08:09 <sysrqb> nice, okay 18:08:14 <pospeselr> mostly would just need something real for 'View the Tor logs' and "View Logs..." 18:08:19 <sysrqb> +1 for usability 18:08:32 <pospeselr> everything else can be scrounged elsewhere 18:08:35 <sysrqb> cool 18:08:54 <sysrqb> okay, anything else for this? 18:09:14 <sysrqb> (we started at the broom icon and then moved onto string localization) 18:09:19 <antonela> i think we are good 18:09:26 <antonela> good journey tho! 18:09:31 <sysrqb> :) 18:09:38 <sysrqb> okay, pili, you're next 18:09:44 <pospeselr> :) 18:09:56 <pili> hi, just a friendly reminder to update "actual points" when the ticket is closed :) 18:10:03 <pili> or you could do it when you send it for review 18:10:13 <pili> and then update the points if there are revisions needed :) 18:10:28 <pili> whatever is easiest for people ;) 18:10:48 * mcs appreciates the reminder because I am not yet in the habit of adding points 18:10:54 <sysrqb> +1 18:11:09 <mikeperry> what are the tickets for the ff68esr networking and feature reviews? 18:11:14 <sysrqb> antonela: your weekly status update contains '?'. do you want answers for those? 18:11:21 <sysrqb> or did you already receive answers? 18:11:28 <antonela> yes 18:11:31 * antonela goes to update it 18:12:07 <GeKo> mikeperry: the feature review i am working on i #31591 and #31597 18:12:36 <GeKo> network is #31144 18:13:03 <sysrqb> mikeperry: anything you want to talk about, while we're all here? 18:14:09 <mikeperry> yeah I have a handful of questions about stuff I have noticed, if now is a good time. otherwise I can put them on the ticket 18:14:22 <sysrqb> now is a great time 18:15:17 <mikeperry> ok.. so first in my list is devtools.. is that disabled? I vaguely recall us disabling it before 18:15:54 <GeKo> the whole devtools? no 18:15:57 <GeKo> what in particular? 18:17:08 <mikeperry> debugger discovery 18:17:14 <mikeperry> let me find the file again 18:18:50 <sysrqb> (we have about 10 min, just fyi, so we can use the ticket for all the other items on your list) 18:19:59 <mikeperry> damnit... yeah I need to go through and find file locations for all of these.. they are just keywords+components at this point 18:20:45 <sysrqb> okay, if working through these on the ticket will be esaier, then we can do that 18:21:45 * Jeremy_Rand_Talos has a minor inquiry Namecoin-related if there's time today 18:22:10 <mikeperry> these were all in old code surrounding changed lines, and not the diff itself, so I didn't take great notes on them, but I watned to double check 18:22:31 <mikeperry> I will go throiugh and find them again and list them on the bug 18:22:37 <GeKo> thanks 18:22:44 <sysrqb> mikeperry: okay, thanks 18:23:04 <sysrqb> okay, Jeremy_Rand_Talos 18:23:17 <Jeremy_Rand_Talos> So, Electrum client verifies TLS certs of Electrum servers in 2 ways -- self-signed certs are verified via TOFU pinning; CA-signed certs are verified via standard CA verification. 18:23:58 <Jeremy_Rand_Talos> The latter method means that Electrum needs to distribute a copy of the Mozilla root CA list in binaries, which turns out to be rather big (275.5 KiB) 18:25:26 <Jeremy_Rand_Talos> It was pointed out to me by Ryan Castellucci that we could just remove all the uncommonly used root CA's from that list. The only CA that's actually used by any public Electrum Namecoin servers in the wild is Let's Encrypt. Leaving the top 7 root CA's (corresponding to top 10 intermediate CA's in Alexa top 1m) reduces the size to 12.7 KiB 18:26:21 <Jeremy_Rand_Talos> I think that's a useful space savings. The only implication for security I can see is that it reduces CA diversity mildly. Given that Let's Encrypt is the only CA used in the wild right now, I think this is a theoretical concern that's not going to have an impact. 18:26:55 <Jeremy_Rand_Talos> Are there any strong reasons I'm missing that we should keep all of the CA's, or is this change okay? 18:27:34 <sysrqb> without thinking too hard about this, that would've been my suggestion, too 18:27:37 <Jeremy_Rand_Talos> Note that if all of the selected CA's decide to mass-revoke certs to attack Namecoin users, the servers could simply switch to self-signed and use TOFU 18:28:10 <sysrqb> i guess it depends on how likely it is Electrum servers will use certs signed by other, weird CAs 18:29:03 <sysrqb> but, if that happens, and the CAs "mass revoke", then you're probably screwed for other reasons 18:29:11 <Jeremy_Rand_Talos> sysrqb, I think it's unlikely, but if desired I could try to rig up a script that checks the CA's used by the Electrum servers for Bitcoin, which will give a better sample size than Namecoin since Bitcoin has a lot more servers 18:30:19 <sysrqb> that's probably a good idea 18:31:30 <sysrqb> i also don't have a good understanding of how Electrum servers are used/selected 18:31:59 <sysrqb> but we're at 1hour now 18:32:02 <Jeremy_Rand_Talos> sysrqb, ok. I'll write a script for that and see how the stats look. In terms of what's a blocker for getting into Nightly, should I get those stats before a Nightly merge, or should we stick to the top 7 root CA's, or should we leave in the whole set of root CA's and accept the larger binary size initially? 18:32:06 <sysrqb> so we can pick this up next week 18:32:11 <Jeremy_Rand_Talos> yes, that's fine 18:32:35 <sysrqb> yeah, let's discuss this next week 18:32:36 <sysrqb> thanks! 18:32:46 <Jeremy_Rand_Talos> great, sounds good 18:32:49 <sysrqb> okay, thanks everyone! 18:32:52 <antonela> thanks o/ 18:32:57 <sysrqb> #endmeeting