19:02:09 #startmeeting applications-team 19:02:09 Meeting started Tue Feb 9 19:02:09 2016 UTC. The chair is GeKo. Information about MeetBot at http://wiki.debian.org/MeetBot. 19:02:09 Useful Commands: #action #agreed #help #info #idea #link #topic. 19:02:34 as this is not scrum-style thing. do we have anything we want to put on the agenda 19:02:55 (apart from the usual stuff like UX) 19:02:56 ? 19:03:13 I would like to talk about valencia 19:03:16 we would like to give a Tor Messenger update 19:03:31 and also that I am back on wearing more of my PM hat so I want to help the team 19:03:59 nice. let's get started with the tor messenger update, sukhe 19:04:52 so boklm arlolra and I are working on a new release for Tor Messenger 19:05:20 one of the things we would really like to get done is the updater 19:05:33 but it's unlikely to be a part of the current release 19:06:12 but one ticket we wanted to discuss particulary is #13861 19:06:13 is great that you guys are adding that tho 19:07:10 sukhe: have you looked into the additional effort needed to take tor browser update code and adpt it for tor messenger? 19:07:18 any estimates? 19:07:25 *adapt 19:07:45 sukhe: I agree with Lunar's comment there 19:07:52 GeKo: that is one of the things I will be looking at this week. (wanted to get the conversation going) 19:08:00 Possibly relevant is #13252 as well since in the long run we will probably move to a “side by side” data storage model for Tor Browser on all platforms and you may want to do the same for Tor Messenger. 19:08:16 isabela: unfortunately right now users have to delete their accounts and start again 19:08:21 we really want to fix that 19:08:28 sukhe: yep I did last time 19:08:35 (if data is not stored in the directory hierarchy that is automatically updated, a lot of these kind of problem go away; of course new problems arise) 19:09:03 mcs: thanks; will check 19:09:10 to be clear 19:09:34 maybe that was not very clear. If the data is separate, you don’t need to worry about losing it during an upgrade 19:09:56 sorry, i'm typing slowly (choosing my words) 19:10:03 i guess i'll just drop a pointer to this 19:10:04 https://motherboard.vice.com/read/desktops-urgently-need-a-more-secure-chat-program-adium-pidgin 19:10:15 grep tor messenger 19:10:26 https://twitter.com/MacLemon/status/695030373399556096 19:10:46 so, this person strongly feels that otr keys should not be stored in a profile nested in the app dir 19:10:49 brade and I are actively working on #13252 but do not have a patch ready yet (really, a set of patches is needed). Should be ready this month though. 19:11:00 because appearently people on osx share app and then they'd leak their key 19:11:15 wow 19:11:39 i'm not sure if that's true 19:11:42 if people do that 19:11:52 but we'd like help having an answer here and doing the right thing 19:11:55 yes, while it sounds scary, I am not sure if Mac users actually do that 19:11:56 right 19:12:11 i think ricochet has two modes for this 19:12:12 Well, on OS X by default it is hard to see inside the .app bundle so users may just be unaware of this kind of possible issue. 19:12:16 (most users) 19:12:19 is special around? 19:12:31 so what is the ETA for a new release? 19:13:02 none yet, but just to be clear, the updater is unlikely to be a part of it. but we want to start working on it ASAP 19:13:29 yes, i guess you want to spend quite some time testing everything ;) 19:14:14 what we could do for the next beta is to sign the windows setup .exe. 19:14:19 mcs: re: #13252, why is that only osx specific? where do bookmarks get saved on linux/win? 19:14:27 (ignoring the signign) 19:15:04 i think we are pretty good wrt our signing setup and i could do that. maybe we can get boklm an account on that machine to so he could do taht as well 19:15:13 My limited experience with ricochet is that it uses a side-by-side model where the user’s data is inside a config.ricochet folder and the app is in Ricochet.app within the same parent folder. 19:15:23 s/to/too 19:15:48 GeKo: that'd be great 19:15:50 GeKo: I will open a ticket related to that. thanks. 19:16:21 #13252 is Mac-specific for now because it is needed for Mac signing (#6540) 19:17:42 For current versions of Tor Browser, everything in the user’s profile is stored in the app area on all 3 of our supported platforms. 19:17:54 (portable model) 19:18:45 ok, but it sounds like that will no longer be the case in the future 19:19:00 sukhe: arlolra: what i was wondering: is anybody tracking upstream security fixes wrt tor messenger? 19:19:21 arlolra: That’s my hope but the current need is for us to solve this on Mac OS. 19:19:22 given that there is no regular "fix the security bugs" release cycle 19:20:05 mcs: in that case, TM should continue to follow TB and since the biggest complaint is on osx, we all win 19:20:20 GeKo: we plan on following ESR 45 19:20:38 and making the same releases as thunderbird 19:20:52 (or instantbird if it gets its act together) 19:21:01 ha, okay, sounds goods. 19:21:02 for now, we just picked a tag, audited it, and are doing subsequent builds based on that 19:22:33 we recently investigated the impact of a libpng bug that mrphs pointed out 19:23:40 the other thing i wanted to bring up was what mike was talking about at ccc https://trac.torproject.org/projects/tor/ticket/10941#comment:9 19:23:50 but mikeperry doesn't seem to be here 19:24:10 we can yield the floor if there are other things to discuss 19:24:24 unfortunately not 19:24:27 yeah 19:24:46 so, valencia? 19:25:21 isabela: what is the plan for it? 19:28:39 while we are waiting, what tickets/documents should we be looking at to start work on the updater? (we can resume this later if isabela comes) 19:30:28 Mozilla’s documentation and the Tor Browser patches 19:30:30 https://wiki.mozilla.org/Software_Update 19:31:06 Patches for #4234 and #13379 19:31:52 You should look at the latest version of those patches from the tor-browser repo 19:32:06 thanks mcs 19:32:37 Maybe also #16940 19:34:02 There are also various Mozilla patches that have been backported to Tor Browser to support our updater patches. If you look at commits near those that I already mentioned you can find them but ping me or brade if there is confusion. 19:34:40 but there should not be that many left after the esr45 switch IIRC 19:36:24 sorry 19:36:35 got distracted with an email 19:36:39 welcome back :) 19:36:46 so, valencia? 19:36:51 True. And I just found a couple of more tickets whose commits you should look at; these will probably be merged into the #4234 patch in the ESR 45 timeframe: #16906, #16236. 19:37:07 (oops. ‘True’ was in response to GeKo earlier) 19:37:12 yes! we should do a few things to prepare for it. One is make sure we add discussion topics 19:37:23 Livestream of reinventing democracy in Europe: http://www.volksbuehne-berlin.de/livestream 19:37:24 but I want to help the teams with roadmap discussion 19:37:29 and retrospective discussion 19:37:37 I also created a wiki for the team: 19:37:49 https://trac.torproject.org/projects/tor/wiki/org/teams/ApplicationsTeam 19:38:01 (mcs: noted) 19:38:22 nice 19:38:31 I will be emailing the team stuff to read before valencia 19:38:36 should I just send it to dev list? 19:38:55 yeah, sounds like a good idea 19:38:56 I will be working on that wiki page, I just did a quick one :) 19:39:12 thanks 19:39:17 this way we might even get more feedback and topics to discuss 19:39:25 I want teams to review what they said/planned in Berlin so our memory is fresh for valencia 19:39:51 that's pretty much it, I will be hanging out more during these meetings and I am around to help 19:39:57 so ping me if you need anything 19:40:29 [done] 19:42:46 one thing that just came to mind: how do we plan the interaction with the ux team given that ux is pretty important 19:42:49 isabela: ^ 19:44:01 is the idea to see it as a sub team of the applications team 19:44:07 touching all applications 19:44:19 GeKo: i dont have any fancy response except that I hope people just show up to each team meeting depending on projects/updates or in other words, depending on the need 19:44:20 and we would then coordinate in the applications team meeting? 19:44:31 ok 19:45:03 I will be attending both meetings and will try to make sure people come and give updates etc 19:46:00 we will see more resources to help out this coordination like using trac 19:46:19 yeah, what i like to avoid is people from application x are showing up at the ux team discussing things that could be relevant to application y 19:46:35 but the latter does not benefit from it as they missed the meeting 19:46:44 yes 19:46:50 they = the devs 19:46:59 that is why I also want things documented 19:47:15 ok, sounds good 19:47:46 at what time does the UX team meet? 19:48:09 but is a good guideline to have, to ux team to make sure to involve the dev team working on the app they are researching 19:48:32 sukhe: we had a meeting this morning, will decide on a frequency for the meeting and publish on ux team wiki page 19:49:41 isabela: ok. at least one of us will attend that in the future 19:50:25 cool 19:50:40 I will update you when ppl decide on date/time for the meetings 19:51:17 * mcs thought the UX meeting was next week but saw earlier that it happened already :( 19:51:24 but you should not feel obligated to :) hopefully we will coordinate in a good way where we are not all in meetings all day 19:51:31 * mcs will be at the next one 19:52:05 isabela: i think the applications team meeting could be a meeting for this 19:52:24 with one from the ux team participating 19:53:05 (and not the other way around given that we have potentially many more applications but still only one ux team) 19:53:14 that is what I thought, if someone in the ux team meeting says ' i am looking into this app now' they should come and give an update here so the dev team knows 19:53:24 ok that's better :) 19:53:27 yes 19:53:45 cool! 19:54:19 and like the metrics team accept requests, ux would too ;) 19:54:56 if you have an app and want ppl to look into it, you can present it and see if someone take your task 19:55:00 but that is me talking :P 19:55:07 lets see how everyone agress on doing this 19:55:35 I will keep helping coordinate between teams to achieve that 19:56:18 alright, do we have something else to talk about? 19:59:15 thanks, everybody, for the meeting then 19:59:20 *baf* 19:59:23 #endmeeting