16:00:02 <meskio> #startmeeting tor anti-censorship meeting 16:00:02 <MeetBot> Meeting started Thu Jul 25 16:00:02 2024 UTC. The chair is meskio. Information about MeetBot at http://wiki.debian.org/MeetBot. 16:00:02 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic. 16:00:05 <shelikhoo> hi! 16:00:06 <meskio> hello verybody!! 16:00:06 <shelikhoo> hi~ 16:00:10 <ggus> hola 16:00:12 <meskio> here is our meeting pad: https://pad.riseup.net/p/r.9574e996bb9c0266213d38b91b56c469 16:00:14 <meskio> ask me in private to give you the link of the pad to be able to edit it if you don't have it 16:00:16 <meskio> I'll wait few minutes for everybody to add you've been working on and put items on the agenda 16:01:33 <onyinyang> hihi 16:01:42 <arma2> hello world 16:01:46 <meskio> it doesn't look like we have much to discuss 16:01:59 <meskio> I guess summer time in the north emisphere :) 16:02:13 <meskio> let's give it some minutes to see if someone has something 16:04:15 <meskio> Roger wrote up his Snowflake blocking experiment notes, https://lists.torproject.org/pipermail/anti-censorship-team/2024-July/000343.html 16:04:23 <meskio> ^- from the announcements 16:04:33 <meskio> pretty cool, I haven't fully readed yet 16:04:33 <arma2> i spoke to dcf/cohosh/shel about that at pets, but figured i should write it up for the folks who didn't make it to pets too 16:04:39 <meskio> but very interesting results 16:05:09 <arma2> tl;dr i wrote a script to be my own little great firewall for snowflake, and when i censored myself very slowly and conservatively, snowflake still kinda worked 16:05:48 <arma2> most interesting result, i believe we have a roadmap item for increasing enumeration-resistance of snowflake, 16:05:50 <gaba> o/ 16:06:01 <arma2> and we could do that well by finding a way to use more of our restricted-nat proxy pool 16:06:47 <meskio> yes, that would be nice 16:07:01 <arma2> (or getting a lot more proxies into the unrestricted pool, or finding a bug where it turns out more of our proxes are actually unrestricted, or etc) 16:07:25 <ggus> i wonder how much effort worth it to do enumeration-resisance defense in snowflake. thinking of two other real world censorship events where they blocked snowflake by fingerprinting (iran and russia) 16:08:33 <arma2> i figured the first step to answering the 'worth it' part was to understand how effective a really easy attack is. and it is not completely effective. 16:08:48 <shelikhoo> we could start with some initial steps such as rate limiting the requests by source IP 16:09:03 <shelikhoo> which is not that engineering intensive 16:09:21 <shelikhoo> which should just work once we moved to use new broker 16:09:36 <trinity-1686a> finding a way to use more of our restricted-nat proxy => would be interesting to know how much is behind symmetric nat vs how much is behind various kind of cone 16:10:44 <arma2> it does seem like some more investigation of the specific nat situation for our volunteers could be a big win if we find something 16:13:02 <meskio> yep, next year we are supposed to improve the enumeration-resistance as part of a grant, we should explore a bit more what is needed there 16:13:19 <meskio> I think is nice to make it hard so censors keep trying to fingerprint instead of enumerating 16:13:29 <arma2> shelikhoo: yep! two notes on the rate limiting idea, (a) you might want to treat tor exits specially, like bridgedb does, and (b) some of the signaling channels let you know the ip address of the requestor, but some do not 16:14:39 <arma2> meskio: agreed, this is a good goal (make sure enumeration is not the lowest hanging fruit) 16:15:32 <shelikhoo> yes, we will need to consider them 16:16:15 <arma2> some future experiment i might do is simply: run snowflake on its own in a tight loop, scooping out the whole database from the broker. i expect that's what those jerks on github did / are doing. 16:16:45 <arma2> (i didn't want to do that here, because i think done poorly this experiment would actually deny service to the real snowflake users.) 16:19:58 <meskio> we should update https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/Research-ideas 16:20:07 <meskio> there is an entry about snowflake enumeration 16:20:30 <shelikhoo> yes... maybe just paste the irc log? 16:20:49 <shelikhoo> I think it is true that there is a lot of considerations we wants to make 16:21:17 <shelikhoo> and it would require a write up and issue, not something we could think up in irc meeting in real time 16:22:15 <meskio> we can link this meeting logs and arma2 email 16:22:20 <meskio> I'll do that after this meeting 16:22:42 <shelikhoo> I think even simple steps could make listing proxy with scripts much harder 16:23:45 <meskio> yep 16:24:35 <meskio> anything more on this topic? 16:24:46 <arma2> not from me 16:24:53 <shelikhoo> eof on this topic 16:25:09 <meskio> from the interesting links: 16:25:14 <meskio> https://arxiv.org/abs/2405.13310 "Bytes to Schlep? Use a FEP: Hiding Protocol Metadata with Fully Encrypted Protocols" 16:25:16 <meskio> update to https://censorbib.nymity.ch/#Fenske2023a "Security Notions for Fully Encrypted Protocols" from FOCI 2023 16:25:32 <meskio> there are also this year FOCI papers out already 16:25:59 <meskio> once more people is around we can look into our next reading paper 16:26:10 <meskio> https://github.com/tst-race/raceboat/tree/documentation Raceboat source code 16:26:13 <shelikhoo> yes! nice! 16:26:22 <arma2> there were also some censorship-related papers at pets, e.g. yeah raceboat 16:27:04 <meskio> yes, cool to see raceboat published 16:27:05 <shelikhoo> I will have a look at the race boot source code, really curious how many language they used to create it 16:27:40 <shelikhoo> I will have a look at the race boat source code, really curious how many language they used to create it 16:27:42 <meskio> is a weird mix 16:27:55 <arma2> shelikhoo: part of their goal is to have hooks in a lot of different languages, so you can write your PT in go or python or C or etc 16:28:07 <arma2> hopefully the core raceboat stuff is only one language :) 16:28:36 <shelikhoo> arma2: yes, and that would make it super super hard to get it on constraint environment like mobile 16:30:04 <shelikhoo> I chatted with them and they are not targeting iOS users 16:30:13 <shelikhoo> which we kind of do 16:30:22 <meskio> are they targeting android? 16:30:53 <shelikhoo> I think they are, or kind of? 16:31:03 <shelikhoo> I see there are arm64-v8a targets 16:31:11 <shelikhoo> so it might work on android 16:31:46 <meskio> wow, using python and go in android all together sounds complicated 16:31:58 <arma2> yes, android was one of the big target architectures for race 16:32:16 <shelikhoo> and also cpp 16:32:18 <arma2> and also yes, "what the hell why is this so complicated" is a very legitimate question :) 16:33:06 <meskio> :D 16:33:07 <shelikhoo> I think they are hiring different people with different knowledge about their favorite language 16:33:10 <onyinyang> lol 16:33:21 <shelikhoo> so as a result everyone kind of write their own thing 16:33:43 <arma2> shelikhoo: it wasn't so much hiring as 'race had different teams each doing their own thing, and the raceboat people had to handle them all' 16:33:45 <shelikhoo> then someone else is tasked with glue them all together 16:33:57 <arma2> yes 16:33:59 <shelikhoo> yes... 16:34:17 <meskio> uff 16:34:51 <arma2> which is not *too* different than the pluggable transport ecosystem 16:35:10 <arma2> which grew goptlib, something in swift, something for py, etc 16:35:30 <arma2> you could legitimately ask why *that* ecosystem is so complicated, too :) 16:35:39 <shelikhoo> yes, and we are using exec/fork/stdio and socket as interface 16:35:45 <shelikhoo> not dynamic library 16:36:00 <arma2> except on ios where it all needs to be one big blob :) 16:36:08 <shelikhoo> so the runtime is not that kind of issue when Tor's PT spec was designed 16:36:30 <shelikhoo> I believe they designed their system after Android and iOS is a thing 16:36:52 <meskio> yes,yes, but PTs were designed before mobile was a thing 16:37:11 <meskio> and now we dream on a future where PTs are arti libraries, possibly just in rust 16:37:46 <shelikhoo> that was kind of a distant future... but I will use my friday to learn rust now 16:38:04 <meskio> true, distant future 16:38:15 <meskio> rust is fun, but I find it harder to learn than go 16:38:43 <meskio> the last interesting link: 16:38:45 <meskio> https://github.com/v2fly/v2ray-core/discussions/3096 16:38:47 <meskio> V2Ray has received a security audit from 7ASecurity 16:38:49 <meskio> https://www.opentech.fund/security-safety-audits/v2ray-security-audit/ 16:38:52 <meskio> congrats for v2ray 16:38:54 <meskio> pretty cool 16:39:04 <shelikhoo> hehe 16:39:04 <onyinyang> nice 16:39:11 <shelikhoo> yes! the report is now public 16:39:48 <shelikhoo> and the security audit found no major issue in V2Ray 16:39:54 <meskio> nice they didn't find anything major 16:40:43 <meskio> anything more, should we close this meeting? 16:40:48 <shelikhoo> eof from me 16:41:17 <onyinyang> fine by me 16:41:41 <meskio> #endmeeting