18:01:00 <GeKo> #startmeeting tor-browser 18:01:00 <MeetBot> Meeting started Mon Jun 18 18:01:00 2018 UTC. The chair is GeKo. Information about MeetBot at http://wiki.debian.org/MeetBot. 18:01:00 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic. 18:01:07 <GeKo> hi all! 18:01:09 <boklm> hi! 18:01:14 <sisbell> hello 18:01:15 <antonela> o/ 18:01:15 <GeKo> oh, richard's guest trick 18:01:18 <sysrqb> pospeselr: better :) 18:01:25 <pospeselr> s/trick/bug/g 18:01:54 <GeKo> alright, we are suppposed to have two new folks at the meeting today! exciting! 18:02:04 <GeKo> sisbell: welcome! 18:02:11 <pospeselr> oooh, new friends :) 18:02:23 <GeKo> sisbell will help with the android side of tor browser 18:02:27 <sukhe> sisbell: welcome! 18:02:31 <boklm> sisbell: welcome! 18:02:32 <sysrqb> yay! 18:02:34 <igt0> hi! sisbell welcome! 18:02:46 <sisbell> thanks everyone 18:03:17 <mcs> welcome! 18:03:34 <sysrqb> (who's the other folk?) 18:03:37 <GeKo> the other one is anny gakhokidze from mozilla 18:03:44 <sysrqb> ah 18:03:52 <antonela> sisbell: welcome! 18:03:56 <GeKo> at least they wanted to make it but maybe not to the irc part 18:04:03 <GeKo> anyway, let's get started 18:04:15 <GeKo> as usual our meeting pad is at https://storm.torproject.org/shared/tHoN4Ii7rLSjPE0OP4gydX4cMGadsXmRQNc-6lwru0N 18:04:28 <GeKo> please add what you were up to last week and what you plan to do this week 18:04:39 <GeKo> if there is stuff you want to discuss, mark it bold 18:05:01 <GeKo> or put it under the Discussion section 18:05:42 <arthuredelstein> sisbell: hi! Welcome :) 18:06:43 <GeKo> mcs: originally i wanted to look myself at #26381 but i might not have enough time for that until we start building, so, yes, please look at it 18:07:03 <mcs> GeKo: OK 18:08:25 <GeKo> pospeselr: noted, i'll take a look and we can sync after the meeting i guess 18:08:56 <GeKo> generally, grabbing tickets with ff60-esr and prio high is a safe bet 18:09:03 <pospeselr> alright I'll find myself one then! 18:09:43 <GeKo> pospeselr: oh, there is still the moz bug open about /proc requirements i think 18:09:55 <GeKo> i guess you need to decide whether you really want to have asecond review 18:10:14 <GeKo> or whether you are fine with jld's and set the checkin-needed keyword 18:10:22 <GeKo> (i think the latter is a good approach) 18:10:34 <GeKo> oh, you actually got both, nvm then 18:10:56 <GeKo> so, just setting the "checkin-needed" keyword is what you want 18:11:06 <GeKo> (probably after checking that you patch did not bitrot) 18:11:09 <GeKo> *your 18:11:46 <GeKo> arthuredelstein: do you feel we can merge #26128 18:11:46 <pospeselr> alright I'll see if it still applies 18:11:47 <GeKo> ? 18:11:59 <GeKo> or is there some follow-up needed? 18:12:03 <pospeselr> then I need to change a flag somewhere? 18:12:29 <GeKo> no, just adding the "checkin-needed" keyword. 18:12:43 <GeKo> then abot picks this up and autolands your patch 18:12:48 <pospeselr> ah I see 18:12:53 <pospeselr> did not know that 18:13:15 <GeKo> yeah, it's s different workflow... 18:13:43 <arthuredelstein> GeKo: I think the current 26128 patch is probably OK for an alpha. There are a couple of issues I'm aware of: (1) using as "http:" as a site causes what appear to be harmless CSP warnings and (2) Any custom per-site settings will be lost whenever the user changes the global security setting. Both of these problems probably require NoScript patches but maybe aren't too serious 18:14:23 <GeKo> sounds okay to me too. 18:14:38 <GeKo> i can merge the patch after the meeting 18:14:46 <GeKo> could you open follow-up tickets? 18:14:59 <arthuredelstein> sure, will do 18:15:02 <GeKo> thx 18:15:50 <GeKo> igt0: how did your torbutton testing go? 18:16:09 <GeKo> i see you had it on your plate for this week but not for next week anymore 18:16:59 <GeKo> are there some things we need to redo for mobile? 18:17:59 <igt0> GeKo, after our changes to FF60, it is working. However I embedded it inside FF. Because of the issues are discussed before. (the extension loader for mobile is different from the desktop one) 18:18:48 <GeKo> great 18:19:40 <GeKo> igt0: what's your plan for that? 18:19:57 <GeKo> i.e. should that be in the first alpha for tor browser for mobile? 18:20:21 <GeKo> in order to allow first-party domain isolation for instance? 18:20:51 <sysrqb> igt0: i think i have a solution for the extensions (and by that, i mean we can continue using Orfox's solution - using a distribution directory) 18:20:57 <igt0> GeKo, yep there are few things that are important. 18:23:14 <GeKo> sysrqb: igt0: could you coordinate and work on the respective patches 18:23:41 <GeKo> we might want to have this early in our tree i think because it might be a change we want to test thoroughly 18:24:08 <sysrqb> GeKo: yes 18:24:12 <igt0> okey dokey 18:24:18 <GeKo> great, thx 18:24:29 <GeKo> so discussion time 18:24:52 <GeKo> 1) we can use the "status: " messages the network-team is using in #tor-dev 18:25:16 <GeKo> i heard from a bunch of people that this is something we want 18:25:28 <GeKo> so, let's start with it and keep us better updated 18:25:45 <pospeselr> ok 18:25:46 <sukhe> sounds good 18:25:55 <GeKo> 2) a related point 18:26:10 <pospeselr> wasn't there a site or something that puts them all in one place, or did I dream that? 18:26:15 <sysrqb> are most of us using irssi or are there other clients that we should support? 18:26:31 <GeKo> pospeselr: there is a bot that is capturing stuff 18:26:38 <sysrqb> (regarding ahf's irssi-plug-in) 18:26:44 <GeKo> ahf wrote an irssi script that folks can use 18:26:44 <pospeselr> I use Pidgin, but I can easily switch 18:26:51 <sysrqb> ah, there s a bot? 18:27:13 <GeKo> well, i had ahf's thing in mind 18:27:19 <sysrqb> okay 18:27:26 <GeKo> probably mislabeled as bot 18:27:42 <GeKo> okay, the second item: 18:27:55 <GeKo> this is mostly a reminder 18:28:05 <sysrqb> i know nick opened a ticket for creating service for tracking this 18:28:06 <sysrqb> that it seems like that will not be available very soon 18:28:06 <sysrqb> (sorry, lag) 18:28:19 <GeKo> if you come a cross a bug you need longer to fix, please file it on trac anyway 18:28:26 <GeKo> and work further on it afterwards 18:28:39 <GeKo> that helps finding workaround and fixes faster 18:28:57 <sukhe> related: should we assign to individuals instead of say tbb-team? 18:29:09 <sukhe> I was not sure if I should remove tbb-team from the assigned list 18:29:25 <GeKo> i am fine with that 18:29:30 <sukhe> ok 18:29:30 <GeKo> and know pospeselr is doing that 18:29:42 <GeKo> but if you do so, please add tbb-team to the cc list 18:30:02 <GeKo> because there are folks that filter their important bugs via the tbb-team owner 18:30:12 <mcs> GeKo: what do you mean by “if you come a cross a bug you need longer to fix, please file it on trac anyway” 18:30:16 <GeKo> and they would lose bug updates 18:30:26 <mcs> Do you mean “please make sure everything has a trac ticket”? 18:30:34 <mcs> (every known issue) 18:30:56 <GeKo> i want to avoid that we start working on bugs, say for days or weeks 18:31:08 <GeKo> which are not filed yet and then file them when a patch is ready 18:31:22 <mcs> GeKo: Got it. 18:31:38 <boklm> (adding tbb-team to the cc list also allows receiving updates through the tbb-bugs mailing list) 18:31:40 <GeKo> because that's a potential waste of dev time as we are working around the globe and find fixes faster together 18:31:54 <GeKo> boklm: yeah that 18:32:24 <GeKo> igt0: re your points 18:32:32 <mcs> Taking ownership while actively working on a ticket seems like a good idea too (and something I sometimes forget to do). 18:32:44 <GeKo> agreed 18:33:01 <GeKo> and i am fine supporting different approaches or converging on one 18:33:05 <sukhe> yeah, that is why I thought we should assign instead of just being on the CC since assign is more explicit 18:33:18 <GeKo> right now there are folks using a keyword like GeorgKoppen201806 18:33:34 <GeKo> or one directly assigns the ticket to oneself 18:33:40 <GeKo> either way works for me at least 18:34:09 <GeKo> igt0: okay, so service workers are disabled in esr60 18:34:29 <GeKo> so we are still good here because dealing with that one will be a nightmare 18:34:42 <GeKo> but eventually we need to take that hit 18:34:54 <GeKo> we have a ticket on trac but i have not looked that deep yet 18:35:35 <GeKo> #15563 18:35:45 <igt0> okey, it is because google is pushing hard PWA on mobile now. So we are going to see more and more sites using it. 18:36:02 <GeKo> yep 18:36:16 <GeKo> re orbot 18:36:30 <GeKo> that's still the guardion project doing so 18:36:39 <GeKo> we are no in charge for the browser side only 18:37:08 <GeKo> sysrqb: so, re tor browser for android based on esr60 18:37:14 <GeKo> what do other folks thinkg? 18:37:16 <GeKo> *think 18:37:27 <GeKo> are we good with that idea? 18:38:22 <sysrqb> when arthuredelstein and i spoke at the all-hands, this seemed like the best idea 18:38:27 <mcs> It is confusing to me to call is esr60 since there is no such thing from Mozilla… or am I confused? 18:38:46 <sysrqb> and isabela agreed, but i want to make sure we are all in agreement 9as much as possible) 18:38:56 <sysrqb> mcs: that is true 18:39:08 <mcs> Is it really “Firefox for Android 60 with security patches that we (Tor Browser tean) notices?" 18:39:20 <GeKo> yes 18:39:20 <sysrqb> that's probably closer to the truth 18:39:24 <mcs> I think the idea is good as long as we can be “in the loop” with Mozilla for potential fixes. 18:39:43 <arthuredelstein> we would need to use the esr60 branch, not the regular 60 branch 18:40:04 <arthuredelstein> to get backported security fixes 18:40:06 <GeKo> yes, this worked out more or less in the past but there is room for improvement 18:40:16 <igt0> So, For the amount of people we have, it is great, my concern is when FF updates the android SDK and we don't. 18:40:22 <GeKo> (the "in the loop" part) 18:40:42 <GeKo> igt0: they won't for esr60 18:41:07 <GeKo> but i can feel your pain :) 18:41:28 <igt0> I mean, if they update in the next versions and we need it for fix a sec bug. 18:41:32 <sysrqb> i think it's unlikely they will move to a newer SDK version and break backporting 18:41:35 <GeKo> so, i guess the best we can do is catch the problematic things on mozilla-central 18:41:36 <sysrqb> but it is a risk 18:41:39 <mcs> igt0: Is your concern that newer patches will require a newer Android SDK? or something else? (I know very little about all things Android) 18:41:51 <GeKo> and then start early backporting and testing 18:41:56 <igt0> mcs, yes 18:42:24 <mcs> I can see how that could be messy. But there is risk no matter what we do :) 18:42:30 <GeKo> sysrqb: i think we should try it 18:42:36 <sysrqb> okay 18:42:39 <GeKo> and we are still in the alpha cycle for a while 18:42:57 <igt0> yep, I am +1 for using esr60, though. 18:43:01 <GeKo> so we can get used to it to a good workflow that tries to minimize disruption and surprises 18:43:04 <sysrqb> true, we have a few months for testing this plan 18:43:35 <GeKo> great, that takes one of my concerns away 18:43:39 <arthuredelstein> If there are any mobile-specific security fixes, I wonder if we could convince Mozilla to backport them to esr60 18:44:01 <GeKo> i doubt that 18:44:08 <arthuredelstein> It seems like a reasonable request under the goal of "help Tor Browser" 18:44:11 <GeKo> i mean they won't even have infra to test that 18:44:12 <arthuredelstein> similar to uplift 18:44:40 <arthuredelstein> oh, because there is no taskcluster build for mobile esr? 18:44:42 <GeKo> and they won't want to ship a patch where they don't know the impact 18:44:44 <GeKo> yes 18:44:58 <GeKo> so, it's not just a matter of backporting 18:45:18 <GeKo> well, sure we could try asking but i am skeptical tbh 18:45:51 <GeKo> alright, release preparations 18:46:08 <GeKo> so, for the stable i need somone looking at #26221 18:46:22 <arthuredelstein> (I'm thinking given that fennec development has slowed it might not be such a large request. But I'm not sure who to ask.) 18:46:50 <GeKo> there will be another review needed for another crash bug fix backport 18:46:59 <GeKo> i'll ping people if needed 18:47:16 <GeKo> who wants to help with building the stable? 18:47:35 <arthuredelstein> I'm available to help 18:47:45 <GeKo> great, thanks 18:48:18 <GeKo> so, i hope we have evertyhing ready for starting the build on wed latest thu 18:48:23 <GeKo> now the alpha 18:48:37 <GeKo> i think we are in good shape toochain-wise 18:48:51 <GeKo> and our three blockers from last time shouls be good as well 18:49:03 <GeKo> so the plan is to start building the next alpha based on esr60 18:49:22 <GeKo> now, what ux features should we try to still squeeze in? 18:49:47 <boklm> what was the 3) from last time? 18:50:02 <GeKo> we'll get the new circuit display, and the .onion padlock indicator 18:50:04 <antonela> i added bullet points there, basically circuit display and onion padlock indicator 18:50:11 <antonela> I was trying to pushing it out because we all wanted it for the alpha but we need to continue working on it. So, i'm afraid we will not have onboarding for alpha release, but we will working on it to have the best version for stable. 18:50:27 <GeKo> boklm: a patch for the proxy bypass bug that we needed a new patch for esr60 for 18:50:35 <boklm> ah ok, thanks 18:50:36 <GeKo> it seems we'll get a last minute one 18:50:37 <antonela> that said, our research coordinator starts this week so we will collect alpha's issues/feedback and work together with the community team on it 18:51:02 <GeKo> antonela: sounds good 18:51:23 <GeKo> do you think we could get a new set of icons replacing the tor browser icon for the alpha? 18:51:43 <antonela> good question, i think my last version needs review 18:51:46 <GeKo> or do you want to have all this landed in one alpha 18:51:54 <GeKo> ? 18:52:13 <antonela> the brand update is something i'd like to have 18:52:33 <antonela> but wondering how deep i can work on it during colombia 18:52:45 <arthuredelstein> I will try and finish #26321 and #26322 this week (minor fixups for circuit display) 18:52:52 <GeKo> great 18:52:54 <antonela> cool, thanks arthur 18:53:06 <GeKo> antonela: so, this would be #25693? 18:53:31 <GeKo> or #25702? 18:53:45 <antonela> the second one 18:53:58 <antonela> the first one is almost done, we are using entire Photon UI for this release 18:54:10 <antonela> all the ui/ux improvements were based on it 18:54:28 <antonela> so basically what is missing is the brand update, which is closer to @25702 18:54:32 <antonela> oops # 18:55:17 <antonela> also, during all hands, the design team at firefox shared with me their Sketch design files (similar to give you access to a repo ha) so will make all browser related work easier and faster \o/ 18:55:30 <GeKo> \o/ 18:55:56 <GeKo> antonela: so, what do you propose? we have time, say, until thursday to include stuff 18:56:53 <antonela> cool, i'll work on the icons this week and probably we will have it then 18:57:07 <GeKo> nice 18:57:11 <antonela> thursday eod? 18:57:23 <GeKo> in our tor-browser repo yes 18:57:27 <antonela> perfect 18:57:40 <GeKo> okay, sandboxing 18:58:00 <GeKo> i heard there was quite some discussion around that at the all hands meeting 18:58:24 <arthuredelstein> yes! 18:58:27 <GeKo> sysrqb: i wonder whether we should essentially have an extra meeting just for that item with some more stakeholders if needed 18:58:46 <sysrqb> GeKo: that's probably a good idea, yes 18:58:50 <GeKo> and meanwhile you update your plan and we can resume discussin it 18:58:54 <GeKo> or better 18:59:09 <GeKo> you update it and we have the meeting afterwards 18:59:21 <sysrqb> sounds good 18:59:31 <GeKo> using it as a blueprint or possible approach to discuss 18:59:39 <sysrqb> yeah 19:00:02 <GeKo> fwiw, i am a huge fan of this separate launcher idea just did not have the time to drive this 19:00:09 <GeKo> so, i am excited :) 19:00:19 <sysrqb> let's see what we can do :) 19:00:24 <GeKo> and let's use the momentum we have 19:00:44 <GeKo> great 19:00:58 <GeKo> does that sound like a good plan to everyone? 19:01:20 <arthuredelstein> sounds good to me! 19:02:08 <GeKo> arthuredelstein: sysrqb: do you have the feeling it would be worthwhile inviting moz sandboxing folks to mexico? 19:02:24 <GeKo> so far i was reluctant because i felt it would waste their time 19:02:32 <GeKo> as we were not ready yet 19:02:37 <GeKo> dealing with other stuff 19:03:09 <GeKo> but i guess after we got 8.0 out there is still some time to work harder on sandboxing plans/ideas 19:03:14 <GeKo> that might change that... 19:03:26 <arthuredelstein> I think tjr invited somebody already possibly 19:04:17 <GeKo> okay, i'll check with him but what's your feeling here? 19:04:30 <sysrqb> yes, it would likely be a good diea 19:04:31 <sysrqb> i tink tom invited jim (his manager) 19:04:32 <sysrqb> i dont remember who else was invited from that team 19:05:12 <GeKo> okay, i'll coordinate with him and let jon know then, thanks 19:05:15 <arthuredelstein> I guess I'm not sure given that what we want to do is perhaps somewhat orthogonal to what Mozilla wants to do. 19:05:42 <GeKo> yes that's been one of my main concerns 19:06:02 <sysrqb> my thinking is maybe they make progress on their sandboxing within the next 3 months, and we can benfit from that 19:06:05 <sysrqb> (knowlege/experience/...) 19:06:14 <arthuredelstein> What's probably a good idea is whoever works on the sandbox stays in close contact with members of the Mozilla team 19:06:16 <sysrqb> *benefit 19:06:32 <GeKo> agreed to both 19:06:49 <GeKo> okay, final point then i guess, next meeting 19:06:55 <sysrqb> arthuredelstein: true, 19:07:09 <GeKo> i'll be travelling next monday evening UTC and parts of tuesday 19:07:15 <GeKo> so i can't make the monday meeting 19:07:23 <GeKo> could we move it to tuesday instead? 19:07:33 <GeKo> same time, same place? 19:07:40 <sysrqb> works for me 19:07:41 <mcs> GeKo: Tuesday is OK for me. 19:07:57 <boklm> Tuesday works for me 19:08:04 <arthuredelstein> me too 19:08:08 <igt0> it works for me 19:08:27 <sysrqb> sisbell: (next tor browser meeting next tuesday same time, instead of next monday) 19:08:36 <sysrqb> works for you? 19:08:42 <sisbell> that works 19:08:46 <GeKo> great 19:09:03 <GeKo> alright, do we have anything else for today? 19:09:15 <GeKo> (apart from "sorry for the long meeting") 19:09:47 <GeKo> okay, does not seem to be th case 19:09:53 <GeKo> sorry for the long meeting 19:09:56 <sukhe> (ok for me as well) 19:10:01 <GeKo> *baf* 19:10:08 <GeKo> #endmeeting