14:00:35 <hellais> #startmeeting OONI Community Meeting 2021-06-22
14:00:35 <MeetBot> Meeting started Tue Jun 22 14:00:35 2021 UTC.  The chair is hellais. Information about MeetBot at http://wiki.debian.org/MeetBot.
14:00:35 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic.
14:01:57 <slacktopus> <agrabeli> (I'm Maria, also working with OONI :$)
14:02:02 <slacktopus> <hellais> hello I’m Arturo from OONI!
14:02:51 <slacktopus> <agrabeli> This month we're having the monthly OONI Community Meeting 1 Tuesday early because we're busy next Tuesday with an OONI training. I hope this hasn't created much confusion/inconvenience!
14:03:11 <slacktopus> <anadahz> Hello!
14:03:33 <slacktopus> <agrabeli> As a reminder: Please *add topics you'd like to discuss* during the meeting today here: https://pad.riseup.net/p/ooni-community-meeting-keep :pray:
14:03:51 <slacktopus> <agrabeli> Hello @anadahz thanks for joining us! :)
14:04:42 <slacktopus> <anadahz> agrabeli: Thank you for hosting the community meeting :)
14:05:09 <slacktopus> <agrabeli> As a quick update: We have released OONI Probe Desktop 3.5.1 which supports *100% translations in Farsi and Arabic*! https://ooni.org/install/desktop
14:05:24 <slacktopus> <agrabeli> Warm thanks to the Localization Lab community for the translations! <3
14:05:51 <slacktopus> <agrabeli> So it seems we have 2 agenda topics so far, and I guess we could start with the 1st
14:06:03 <slacktopus> <agrabeli> #topic 1. Legacy probe deprecation [sbs]
14:06:14 <slacktopus> <agrabeli> @sbs would you like to share context and lead the discussion?
14:06:17 <slacktopus> <sbs> yup
14:06:55 <slacktopus> <sbs> if you currently go to the ooni website to install ooni (https://ooni.org/install) you will download what we call the "new" probe
14:07:25 <slacktopus> <sbs> this is in opposition to the "legacy" probe
14:07:43 <slacktopus> <sbs> the legacy probe is the original implementation of ooniprobe (written in python, with a web user interface)
14:08:06 <slacktopus> <agrabeli> (which was first released back in 2012)
14:08:31 <slacktopus> <sbs> the legacy probe has been deprecated for a bunch of years now
14:08:45 <slacktopus> <sbs> however, there are still a number of legacy probes around
14:09:05 <slacktopus> <sbs> we don't know the exact number but we know that they account for a significant fraction of the measurements we get
14:09:26 <slacktopus> <agrabeli>
14:09:33 <slacktopus> <sbs> in particular, ooniprobe 2.1 (the most popular legacy probe), accounts for ~20% of the measurements
14:09:38 <slacktopus> <sbs> in the last 7 days
14:09:46 <slacktopus> <agrabeli> ^^ And this graph shows just how many legacy probes are still around ,:)
14:10:14 <slacktopus> <sbs> we don't know if those are many legacy probes that run few measurements or few legacy probes that run many measurements
14:10:26 <slacktopus> <sbs> (though the latter seems more likely based on the way in which it worked)
14:10:34 <slacktopus> <sbs> there are two main problems with the legacy probe:
14:11:48 <slacktopus> <sbs> 1. data quality: the codebase is now old and there are a bunch of things that the new probes do better 2. submission of measurements: the legacy probe by default uses Tor onion services v2 to submit the measurements
14:12:05 <slacktopus> <sbs> the latter, in particular, could become a problem because such onion services will go offline
14:12:30 <slacktopus> <sbs> this will happen on October 15th 2021
14:12:58 <slacktopus> <sbs> the purpose of this discussion is to raise awareness with users who're still running the legacy probes
14:13:08 <slacktopus> <sbs> and try to explicitly nudge them towards the new probes
14:13:43 <slacktopus> <sbs> by migrating to new probes, you will provide higher quality internet-censorship data
14:14:18 <slacktopus> <anadahz> In the graph the `legacy-probe` refers to all Python versions or a specific version?
14:15:02 <slacktopus> <sbs> (we don't know for sure that after October 15th 2021 the legacy probes will necessarily stop working: some failsafe mechanisms will kick in and hence they will possibly submit measurements using `https`, but it's quite likely that there could be issues, and anyway the codebase has now been unmaintained for years)
14:15:11 <slacktopus> <agrabeli> @anadahz I think to all python versions + Lepidopter
14:15:30 <slacktopus> <sbs> @anadahz all of them, but I can tell you that the _basically only_ active version is 2.1.0
14:16:06 <slacktopus> <sbs> correction, this is not accurate
14:16:13 <slacktopus> <ivalentovitch> Buongiorno :)
14:16:17 <slacktopus> <sbs> we also have ~4% of measurements from 2.3.0
14:16:25 <slacktopus> <db1984> Hello!
14:16:30 <slacktopus> <sbs> and 1% from 2.2.0
14:16:37 <slacktopus> <anadahz> Regarding the lepidopter probes I may be able to push an update and perhaps continue using these probes if it is desired.
14:16:39 <slacktopus> <sbs> buongiornissimo!
14:16:55 <slacktopus> <agrabeli> (Welcome @ivalentovitch and @db1984! :) )
14:17:20 <slacktopus> <sbs> @anadahz afaik none of them is lepidopter
14:17:26 <slacktopus> <gus934> Hi! Gus from Tor Project! o/
14:17:35 <slacktopus> <sbs> lepidopter identifies itself as "lepidopter"
14:17:42 <slacktopus> <agrabeli> (Welcome @gus934! :) )
14:17:56 <slacktopus> <sbs> we have not seen this "software name" for quite some time now
14:18:52 <slacktopus> <anadahz> Perhaps we can see which countries and ask our friends from there if they are still having any probes deployed.
14:19:05 <slacktopus> <agrabeli> So the main issue that we face is that after 15th October 2021, we will likely *lose a large volume of measurements* once the v2 onion services are discontinued and legacy probes can no longer submit measurements. :(
14:20:30 <slacktopus> <agrabeli> These legacy probe users are really mysterious to me ,:)
14:20:46 <slacktopus> <agrabeli> I have no idea at this point who may be still running legacy probe...
14:22:02 <slacktopus> <anadahz> Most probably these probes are running on a server/embedded device.
14:22:19 <slacktopus> <agrabeli> yeah...
14:22:43 <slacktopus> <sbs> many of them were running on Debian; now I'm running a query that could be helpful to further inform the discussion
14:23:01 <slacktopus> <agrabeli> I've spammed several mailing lists (several times), reached out to people personally, sent out tweets, etc.... But at this point, I'm starting to believe that those legacy probes are abandoned (and still running somewhere). ,:)
14:23:28 <slacktopus> <anadahz> Also I recall there was a version that lepidopter was not named under but was using the OONI version instead.
14:23:54 <slacktopus> <agrabeli> ah, interesting! perhaps that's part of that too
14:24:07 <slacktopus> Action: anadahz searches the old bugs
14:24:13 <slacktopus> <sbs> @anadahz was there a version of Lepidopter w/o auto-updates?
14:25:09 <slacktopus> <anadahz> Yes but it wasn't released for public consumption.
14:25:30 <slacktopus> <sbs> okay, so I suppose that other Lepidopters _should_ have auto-updated
14:25:54 <slacktopus> <gus934> do you suspect which countries these probes are running from?
14:26:28 <slacktopus> <agrabeli> yes, I have a list (let me find it) :)
14:26:46 <slacktopus> <anadahz> @sbs yes, if they didn't hit a bug ;)
14:27:27 <slacktopus> <sbs> yeah, indeed
14:27:29 <slacktopus> <agrabeli> @gus934 here you go: https://github.com/ooni/ooni.org/issues/845
14:27:40 <slacktopus> <agrabeli> (and it includes Brazil :) )
14:27:54 <slacktopus> <gus934> oh noo
14:28:13 <slacktopus> <agrabeli> But we're also receiving a bunch of measurements from some North European countries too (like Norway, Sweden, I think)
14:28:42 <slacktopus> <anadahz> It may be useful to have the ASes on the countries too.
14:29:22 <slacktopus> <agrabeli> @gus934 I've reached out to all our Brazilian community members, and they mentioned that they're not running legacy probe, and have no idea who may be. If you have thoughts or can help spread the word, we'd greatly appreciate it! :pray:
14:29:27 <slacktopus> <anadahz> Like if there any research/university networks it may help to find/reach out to specific people.
14:29:53 <slacktopus> <agrabeli> @anadahz could it be that the Brazilian legacy measurements are coming from any of your server set-ups? :P
14:30:15 <slacktopus> <agrabeli> ^^ @federico
14:30:48 <slacktopus> <anadahz> agrabeli: I have setup a couple of probes there in the past but I don't think that any of them is still running there,
14:31:18 <slacktopus> <anadahz> I passed some probes to people though but it is highly unlikely that they are still running them.
14:31:50 <slacktopus> <anadahz> I know that some people also installed some probes after the Cryptorave.
14:32:03 <slacktopus> <anadahz> @gus934: ^
14:32:04 <slacktopus> <agrabeli> heh ,:)
14:32:13 <slacktopus> <gus934> I will check with an organization that was running some lepidopter in raspberries.
14:32:48 <slacktopus> <agrabeli> thank you!
14:33:02 <slacktopus> <hellais> These are the country codes of the legacy probes
14:33:18 <slacktopus> <hellais> Most of the measurements from legacy probes are coming from Russia
14:33:49 <slacktopus> <agrabeli> Wow! I hadn't realized that SO many were coming from Russia. ,:)
14:34:25 <slacktopus> <agrabeli> I've reached out to everyone I know in Russia, and they were kind enough to connect me with others.... but none of them know who may be running legacy probe. ,:)
14:34:42 <slacktopus> <agrabeli> There's also a fair amount coming from Italy. :thinking_face:
14:34:53 <slacktopus> <hellais> This is maybe a bit more legible
14:35:02 <slacktopus> <sbs> I don't know anything about probes from Italy :lol_y:
14:35:35 <slacktopus> <federico> the large majority of measurements comes from some 20 ASNs in RU
14:37:13 <slacktopus> <anadahz> Are all these probes send reports via onion v2?
14:37:31 <slacktopus> <jakub> yeah RU is so over-represented that I often have to cut off RU specifically when measurement hunting
14:38:12 <slacktopus> <anadahz> Having lots of measurements is actually good.not bad.
14:38:18 <slacktopus> <agrabeli> yes :S
14:38:40 <slacktopus> <agrabeli> @anadahz but we will lose all those measurements after 15th October 2021 :(
14:38:43 <slacktopus> <anadahz> Though better providing newer version of reports.
14:38:47 <slacktopus> <sbs> measurements in the last 7 days by probe, version, and platform
14:38:56 <slacktopus> <agrabeli> Unless if those users switch over to the OONI Probe apps or probe-cli
14:39:04 <slacktopus> <sbs> for the lovers of the legacy, we also have some measurement_kit 0.7.1 in here! :grimacing:
14:39:49 <slacktopus> <agrabeli> So essentially what we've been trying to do is to find those legacy probe users and encourage them to switch over to probe-cli
14:39:55 <slacktopus> <sbs> basically: ooniprobe 2.1.0 == linux, ooniprobe 2.2.0 and 2.3.0 == macos
14:40:03 <slacktopus> <agrabeli> Otherwise we'll just lose all their measurements from October 2021 onwards
14:41:11 <slacktopus> <sbs> (I think we can now move onto the next topic unless there's anything else to discuss here?)
14:41:20 <slacktopus> <agrabeli> So if you happen to know or come across any legacy probe users, *please* *ask them to switch over to OONI Probe CLI*: https://ooni.org/install/cli :pray:
14:41:29 <slacktopus> <agrabeli> ^^ Which is also supported for Linux
14:42:10 <slacktopus> <agrabeli> ^^ Especially if you know people in Russia :pray:
14:42:52 <slacktopus> <agrabeli> We'd greatly appreciate any support in this outreach effort. <3
14:43:40 <slacktopus> <agrabeli> Unless there's anything else to add, perhaps we can move on to the 2nd agenda topic?
14:43:51 <slacktopus> <agrabeli> #topic 2. Are you aware of any law(s) against performing network measurements in China? [anadahz]
14:44:02 <slacktopus> <agrabeli> @anadahz is there anything else you'd like to add/share?
14:44:24 <slacktopus> <anadahz> agrabeli: No just this.
14:44:52 <slacktopus> <anadahz> I was wondering if anyone has heard anything about laws/regulations forbidding to run network measurements in
14:45:17 <slacktopus> <anadahz> China (or other countries?)
14:46:10 <slacktopus> <agrabeli> @anadahz I'm not aware of any country that explicitly prohibits performing network measurement. And based on the legal consultation we received a few years ago (where they based their analysis of risks on China too), they mentioned that they don't believe it's explicitly prohibited anywhere. This consultation (documenting the risks) is available here: https://ooni.org/about/risks
14:46:48 <slacktopus> <agrabeli> That said, there is the risk of prosecution under other broader, vaguer laws, such as national security laws.
14:46:54 <slacktopus> <anadahz> agrabeli: thank you!
14:47:28 <slacktopus> <agrabeli> But I think a lawyer from China would be best to advise on this matter.
14:47:47 <slacktopus> <agrabeli> Does anyone else here know or have thoughts on this?
14:50:14 <slacktopus> <db1984> Sorry, I don't know anybody who may have visibility on such matter right know, but I'll look into it. If I came up with something useful I'll post the results here
14:51:07 <slacktopus> <agrabeli> thank you @db1984! :pray:
14:51:14 <slacktopus> <anadahz> ty DB!
14:52:07 <slacktopus> <agrabeli> Generally speaking though, even if network measurement is not directly prohibited from a legal perspective, there are a number of factors that need to be taken into consideration as part of threat modelling and evaluating how "safe/risky" it is to perform network measurement,
14:52:31 <slacktopus> <agrabeli> And it depends on the types of tests they perform, the types of websites they test, their personal threat model, etc.
14:53:53 <slacktopus> <hellais> For example in China there is a ban on the use of VPN technology, so if you are running a test to check if a VPN tool is blocked, you might be violating that law
14:56:42 <slacktopus> <agrabeli> And it also depends on how the act of "running a tool specifically designed to expose censorship" is perceived by an ISP or government monitoring internet activity.
14:57:01 <slacktopus> <db1984> Just a general consideration here in line with what has been said so far, I guess there are few ways to reach the purpose of avoiding people to do online measures (so accessing certain internet sites) basing the legal requirements on certain reasons like "national security", "inappropriate content" etc. etc.
14:59:48 <slacktopus> <db1984> So the question is interesting: "If there are countries in which it is explicitly forbidden by law to do online measures", but generally speaking i guess the discussion is related to the topic raised above
15:00:40 <slacktopus> <agrabeli> Indeed... Well if you folks on this channel have more thoughts/feedback/advise to share on this matter, please feel encouraged to do so :pray:
15:00:57 <slacktopus> <agrabeli> It seems we don't have any more agenda items, and we're out of time, so I guess we can end the meeting here.
15:01:06 <slacktopus> <agrabeli> Thanks so much everyone for joining us today! :)
15:01:17 <slacktopus> <ivalentovitch> Thank you :)
15:01:22 <slacktopus> <agrabeli> The next OONI Community Meeting is on Tuesday, 27th July 2021 at 14:00 UTC.
15:01:32 <slacktopus> <db1984> Thank you!!
15:01:34 <slacktopus> <agrabeli> I'll be sharing details on this channel + mailing lists per usual.
15:01:40 <slacktopus> <anadahz> thank you all!
15:01:55 <slacktopus> <agrabeli> In the meanwhile, please feel encouraged to participate in discussions on this channel on an ongoing basis. :)
15:02:10 <slacktopus> <agrabeli> Thanks again everyone! Hope you all have a good day/evening <3
15:02:26 <hellais> #endmeeting