18:01:23 <mikeperry> #startmeeting tbb-dev
18:01:23 <MeetBot> Meeting started Mon Jul 13 18:01:23 2015 UTC.  The chair is mikeperry. Information about MeetBot at http://wiki.debian.org/MeetBot.
18:01:23 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic.
18:01:31 <mikeperry> ok, let's get started
18:01:38 * isabela is around
18:02:23 <mikeperry> Last week, I spent the first part of the week investigating various 5.0a3 issues. I filed #16523, #16522, and wrote fixes for #16316 and #16510.
18:02:31 <mikeperry> I also traced #16528 to IndexedDB. IndexedDB is actually good from a third party tracking perspective (blocked from all third parties), but a nightmare from a supercookie perspective (there is no programmatic way to clear the IndexedDB store).
18:02:35 <mikeperry> While playing with #16495, I updated all of the debugging instructions on the hacking guide (https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Hacking#DebuggingtheTorBrowser).
18:02:43 <mikeperry> I then attempted to review HTTP/2, but quickly got sucked into #16469 instead.  I sent some emails to researchers, and have still some more to send. I will update #16469 with information.
18:02:51 <mikeperry> After that, I spent some time with organizational things (the strategy project, proposals, etc).
18:03:46 <mikeperry> This week, my plan is to write up my thoughts on #16469, and finish #14952. This plan may not survive contact with The Enemy.
18:04:05 <mikeperry> that's it for me
18:10:06 * amoghbl1 n8fr8 and amoghbl1 here for updates on Orfox
18:10:27 <mikeperry> hrm.. it appears we're missing mcs. I thought their vacation started next week..
18:10:30 <mikeperry> ok
18:10:41 * arthuredelstein can go after amoghbl1
18:10:52 * boklm can go after arthuredelstein
18:11:13 <amoghbl1> we've managed to get two plugins into the apk
18:11:27 <amoghbl1> That's HTTPSEverywhere
18:11:35 <amoghbl1> and NoScripts 3.5 alpha
18:12:02 <amoghbl1> Moved back to the old User Agent after the discussion we had here last week
18:12:23 <n8fr8> (NoScripts 3.5 alpha is the latest available mobile version of NoScript)
18:12:56 <mikeperry> where does he keep that?
18:13:00 <amoghbl1> Made more android changes to do with the startup UI of the application and removed some Health Reporter and Crash Reporter stuff that used to send out a notification on installation.
18:13:22 <amoghbl1> https://github.com/amoghbl1/orfox-addons is the submodule mikeperry
18:13:34 <n8fr8> He keeps it in an XPI and not in any sort of version control. We are going to put it into git, and manage change tracking ourself.
18:13:58 <n8fr8> https://noscript.net/nsa/
18:13:59 <mikeperry> ah
18:14:22 <amoghbl1> and they get added in before the apk is built
18:14:38 <mikeperry> are you aware of https://github.com/avian2/noscript? I wonder if that avian2 person would be willing to maintain NoScript 3.5 history too
18:14:47 <amoghbl1> https://github.com/amoghbl1/Orfox/blob/master/jenkins-build#L51
18:15:05 <amoghbl1> Oh interesting, thanks mikeperry
18:15:37 <mikeperry> possibly worth emailing them. they are doing  decent job of tracking the desktop noscript.. maybe they just need to be pointed at the mobile one, too
18:16:21 <amoghbl1> will do
18:17:05 <amoghbl1> that's it from orfox
18:18:16 <arthuredelstein> So, last week I wrote a patch for #16522.
18:18:33 <mikeperry> (aha, mcs+brade's vacation did start today.. I probably should have written that down)
18:18:38 <arthuredelstein> And I did some investigation of #16326, which it turns out doesn't need to be solved until we rebased to FF45-ESR.
18:19:05 <arthuredelstein> Finally I worked on #13313. I have a prototype more or less working on linux, based on David's work, plus a patch I've written for https://bugzilla.mozilla.org/show_bug.cgi?id=1121643.
18:19:24 <arthuredelstein> So this week I will work on getting the #13313 patches working for Mac and Windows. I thought I would also have a look at #15781 and #13017.
18:19:49 <arthuredelstein> That's it for me
18:21:26 <mikeperry> arthuredelstein: what was your estimation on mediasource: uri's again?
18:24:03 <mikeperry> amoghbl1: also, what is your plan for this week? and/or when do you need me to send you info about stripping down Torbutton?
18:26:18 <mikeperry> amoghbl1: aha, n8fr8 sent a mail to tbb-dev earlier today
18:29:54 <mikeperry> boklm: we may have lost amoghbl1 and arthuredelstein. you should jump in now
18:30:02 <boklm> ok
18:30:11 <arthuredelstein> I think I'm back, but might have missed something?
18:30:18 <amoghbl1> I'm back too
18:30:43 <boklm> Last week I started adding tests for #15802. I also set up a machine I will be using to do Tor Browser builds.
18:30:47 <boklm> I looked a little at #15864 but I'm not sure what needs to be done. Should we create a directory somewhere to put small "release process scripts" such as one to create the .htaccess file ?
18:30:57 <boklm> This week I'm planning to add more tests for #15802 and look at #13496.
18:31:16 <boklm> That's it for me
18:31:51 <mikeperry> arthuredelstein: I asked about mediasource uri's, but I just saw #16429.
18:32:15 <arthuredelstein> Yes, that branch has my patches for mediasource
18:32:29 <mikeperry> arthuredelstein: did you verify that the tests fail without the isolation patches?
18:35:46 <mikeperry> boklm: for #15864, I think the best plan is to rename sha256sums.txt and sha256sums-incrementals.txt in the scripts that generate them, as well as the ./upload-signature.sh and ./check-match.sh scripts
18:35:47 <arthuredelstein> Hmm, I can't remember if I did that specifically. The regression patch does include tests to confirm that isolation is turned off when the "privacy.thirdparty.isolate" pref is set to false. Which I guess is almost the same thing?
18:36:07 <mikeperry> boklm: the .htaccess file can then just be a static file we include in the bbuild dir
18:36:25 <arthuredelstein> But I will also try reverting the patch to make sure.
18:36:54 <arthuredelstein> Actually, I guess it's not the same thing.
18:38:16 <mikeperry> arthuredelstein: yeah, it depends on how the tests work.. my guess is that bit will still "pass" without the patch
18:38:53 <arthuredelstein> Yes, it should indeed.
18:39:20 <boklm> mikeperry: ok, so we want to rename the sha256sums files everywhere, even for non-final builds on people.tpo ?
18:39:50 <mikeperry> boklm: the goal with #15864 is to get rid of the scriptlet from the releaseprocess nodes entirely, and have the gitian build system behave as if the canonical names for the sha256sum files were sha256sums-unsigned-build*.
18:39:55 <mikeperry> boklm: I believe so, yes
18:40:03 <boklm> ok
18:43:34 <mikeperry> arthuredelstein: in general, I think we should verify that all of our tests actually fail when the patches are dropped. if you can think of any that we might have forgotten to test this with, perhaps boklm can help go through them with his per-commit test failure analysis scripts?
18:44:56 <arthuredelstein> mikeperry: It's a good idea. I'll make a ticket for this task.
18:45:09 <mikeperry> the main risk for us is if Mozilla refactors some functionality to suddenly and mysteriously use a different code path tht bypasses our privacy features. this has actually happened a few times in the past. I think guarding against this specific type of regression is probably the single most important property for our tests to have
18:47:51 <mikeperry> boklm: are you ok doing the actual analysis of ensuring the tests fail when patches are ommitted if arthuredelstein gives you a list of patches to focus on?
18:48:24 <mikeperry> (just trying to save arthuredelstein from spinning his wheels doin a lot of builds, since there is plenty other ff38 work for him to do :)
18:48:34 <boklm> ok, I can look at that
18:49:52 <arthuredelstein> thanks boklm :) Let me know if I can help!
18:51:39 <arthuredelstein> I'll try to get a list together later today
18:51:54 <boklm> ok, thanks
18:53:31 <mikeperry> alright then. any other questions or 5.0 issues? I've been looking through https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~TorBrowserTeam201507 and it looks like I have a few tickets to review, and some more to deduplicate
18:54:36 <arthuredelstein> (I just confirmed that the blob and mediasource URI tests both fail when the isolation patch is reverted)
18:54:40 <mikeperry> we're still aiming for a code freeze and a build tag by the 24th/27th, unless it will be problematic for GeKo to build/sign on the road
18:56:15 <mikeperry> in which case it will likely be the 31st, and a lot of hoping and praying nothing serious enough to require extensive modifications is found before Aug 11th
18:59:04 <mikeperry> ok. I think that wraps it up then at just under 1hr
18:59:11 <mikeperry> thanks, everyone!
18:59:18 <mikeperry> #endmeeting *baf*