17:02:18 <morganava> #startmeeting Applications Team Office Hours  2025-08-20
17:02:18 <MeetBot> Meeting started Wed Aug 20 17:02:18 2025 UTC.  The chair is morganava. Information about MeetBot at http://wiki.debian.org/MeetBot.
17:02:18 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic.
17:02:48 <morganava> it's that time of the week again where we engage with the community via IRC :3
17:02:49 <dan_b> o/
17:02:53 <morganava> or at least where we are scheduled to be online ;)
17:05:33 <Jeremy_Rand_Lab19[mds]> So in the last week, the bulk of the TLS things I worked on are not directly applicable to onion services without involving Namecoin. (The relevant grants cover both TLS for onions by themselves and TLS for Namecoin, with or without onions being involved.) The main things I did involved getting TLS to work for Namecoin while keeping the entire TLS-related data (even a hash) off of the Namecoin blockchain (yay for scalability).
17:07:09 <Jeremy_Rand_Lab19[mds]> In theory you could do the same thing for onions without Namecoin but you would maybe run into problems revoking TLS certs. (The way you revoke TLS certs in Namecoin if the TLS data is off-chain is by transferring your Namecoin domain to another Namecoin address... that's not a thing for onion services so it's not really doable.)
17:07:31 <Jeremy_Rand_Lab19[mds]> And onion service descriptors have much more data capacity than a blockchain so this is not really needed anyway if you're not using Namecoin
17:07:51 <Jeremy_Rand_Lab19[mds]> Nevertheless it should come in handy for onion service users who want to have Namecoin names for their onions
17:08:15 <morganava> i've a question for you actually jeremy
17:08:44 <Jeremy_Rand_Lab19[mds]> morganava: sure what's up?
17:08:47 <morganava> are you aware of any tor-embedding apps/tools that make use of the tor-expert-bundle's pluggable-transports and bridge lines?
17:09:00 <morganava> we're working on transitioning over the meek-azure name to just meek
17:09:08 <morganava> since it hasn't used azure for quite awhile
17:09:37 <morganava> we've a tracking issue here -> https://gitlab.torproject.org/tpo/applications/team/-/issues/37
17:09:52 <Jeremy_Rand_Lab19[mds]> morganava: I am 90% sure that Whonix bundles a GUI tool for picking bridges. I am 60% sure that OnionShare has some kind of mechanism for this as well.
17:09:53 <morganava> just occurred to me you may have your fingers in other parts of the internet
17:10:24 * ma1 loves percentage confidence assessments
17:10:32 <morganava> lol
17:10:59 <Jeremy_Rand_Lab19[mds]> Sounds like perhaps poking Patrick Schleizer and/or Micah Lee might be productive to make sure that they can assess whether this will break anything for them
17:11:18 <morganava> yeah we already opened an issue with OnoinShare
17:11:24 <morganava> p sure micahlee doesn't maintain it anymore
17:11:25 <Jeremy_Rand_Lab19[mds]> I can probably poke Patrick if you like; I don't have any contact with Micah Lee
17:11:39 <Jeremy_Rand_Lab19[mds]> ah, wasn't aware that OnionShare has a new maintainer
17:11:39 <morganava> yeah that'd be good, at least point them to our tracking issue
17:11:51 <Jeremy_Rand_Lab19[mds]> (probably says something about how often I use OnionShare these days lol)
17:12:23 <Jeremy_Rand_Lab19[mds]> alright, I'll see if I can poke Patrick. What's the approximate deadline by which these changes would be deployed and/or when you would need feedback?
17:12:50 <morganava> we're targetting the 15.0 release in late sep/early to mid october
17:13:10 <Jeremy_Rand_Lab19[mds]> ok. So, it's important to look at promptly, but not an emergency
17:13:14 <morganava> but really only matters if they are using TB's built-in bridge lines
17:13:28 <morganava> the ClientTransport w/e line stays the same since it's just the user-facing name that's changing
17:13:42 <Jeremy_Rand_Lab19[mds]> I see.
17:13:52 <morganava> ie the protocol remains meek_lite
17:14:08 <Jeremy_Rand_Lab19[mds]> yeah I don't know whether this would affect Whonix
17:14:16 <Jeremy_Rand_Lab19[mds]> Definitely worth asking them
17:14:22 <Jeremy_Rand_Lab19[mds]> But there's a decent chance that it won't impact them
17:14:36 <morganava> but if they've the equivalent of our 'built-in' meek-azure bridges then there could be upgrade/migration issues if the lines are pulled from pt_config.json
17:14:45 <morganava> yeah better safe than sorry :)
17:14:53 <Jeremy_Rand_Lab19[mds]> yeah makes sense
17:16:14 <ma1> which makes me think: have we got an announcement mechanism (a mailing list or something) for heads up to downstream projects?
17:16:26 <ma1> in general
17:16:32 <morganava> tor-dev mailing list I guess?
17:16:46 <Jeremy_Rand_Lab19[mds]> ma1 (IRC): AFAIK the only thing like that is tor-dev ML but that's going to be a really bad SNR for this kind of alerts
17:16:50 <morganava> we've mostly been adding downstream people to our release-prep templates as its made sense
17:17:04 <Jeremy_Rand_Lab19[mds]> I have definitely missed relevant notices in tor-dev because the SNR is so bad
17:17:41 <dan_b> ma1: yes, tor-dev apparently. OP subscribed a long time ago I assume cus my OP mailbox got morgan's update on it
17:17:45 <Jeremy_Rand_Lab19[mds]> Starting a new mailing list for application and distro devs who are downstream of Tor seems like a not-terrible idea?
17:18:13 <morganava> maybe tor-announce
17:18:17 <Jeremy_Rand_Lab19[mds]> (specifically for notices like this, I mean)
17:18:21 <morganava> ah right a developer foucsed tor-announce
17:18:28 <dan_b> but couldnt say how many other new or newer project are on that
17:18:35 <morganava> tor-dev's activity is so little these days though
17:18:45 <morganava> its probablyf ine
17:18:57 <ma1> maybe turning it into a moderated PSA list?
17:19:11 <dan_b> something I've mentioned else where, we might almost want to start some semi official tor-client-users ... something? "council" i joked, that teams can register on
17:19:22 <dan_b> to both get updates like this, and provide feedback on arti dev in the future
17:19:38 <dan_b> and generally so the nebulous we of TPI can maybe have better insight in the tor using community
17:20:32 <dan_b> i dont even know what format most folks would want lol. RSS, email, forum, wiki, issues?
17:21:01 <ma1> tik tok
17:21:05 <dan_b> LOL
17:23:07 <Jeremy_Rand_Lab19[mds]> actually I have a question about onion TLS things. This is probably a better question for Q and Rhatto but if you guys have opinions I'd like to hear them. Which would you prefer:
17:23:10 <Jeremy_Rand_Lab19[mds]> (Option A) make onion service owners put their current TLS pubkey in their onion descriptor (you revoke by removing it); (Option B) keep the current TLS pubkey out of the onion descriptor, but if you want to revoke, you put the revocation in the onion descriptor.
17:24:11 <Jeremy_Rand_Lab19[mds]> I feel like people typically create TLS keys more often than they think a TLS key is compromised
17:24:35 <Jeremy_Rand_Lab19[mds]> So Option B might be more aligned with the common use case?
17:25:21 <Jeremy_Rand_Lab19[mds]> (to be clear this question assumes Namecoin isn't being used)
17:29:23 <PieroV> I don't really think this is something we from the apps team have expertise about ^_^;
17:30:03 <ma1> we won't talk if not in the presence of our law... of rhatto :)
17:30:13 <Jeremy_Rand_Lab19[mds]> PieroV: yeah I figured that was likely
17:30:21 <PieroV> We usually refer to people who are more into these sort of things, to avoid doing insecure stuff
17:30:24 <Jeremy_Rand_Lab19[mds]> Just didn't want to make assumptions about what you guys would care about
17:30:35 <PieroV> So, rhatto might be more useful here
17:30:57 <morganava> +1 to rhatto :3
17:31:34 <ma1> just a naive curiosity: option B would mean the descriptor should accumulate all the revocations, in case of multiple revoked certs?
17:31:54 <Jeremy_Rand_Lab19[mds]> One other thing I did do was continue looking into optimizing the binary size of the various Namecoin and Onion TLS tools I maintain, mainly by trying to replace dependencies that are overly bloated
17:32:18 <Jeremy_Rand_Lab19[mds]> So hopefully by the time you guys get something TLS-related from me for possible deployment, the binary size will be nice and small
17:32:53 <PieroV> Jeremy_Rand_Lab19[mds]: for Android x86 we're really on the edge
17:33:03 <PieroV> We pass by some tens of kB D:
17:33:20 <Jeremy_Rand_Lab19[mds]> ma1 (IRC): I'm thinking the certifications would have a built-in expiration date, so you'd only need to accumulate the revocations until expiry hits, at which point you can drop them from the descriptor
17:33:21 <PieroV> However, a cypherpunk recently suggested a few interesting compiler options
17:33:47 <PieroV> I still have to try them, but I think they'll be a Tor Browser 16.0 thing (hopefully)
17:34:52 <Jeremy_Rand_Lab19[mds]> ma1 (IRC): I assume an expiration period of maybe a year or so should be sane, but if people really want to pick a different expiry period I don't see much reason to tell them they can't, I'm not their mom and they probably understand their threat model better than I do
17:35:10 <morganava> ooh i just realised we'll be hitting android size problems sooner in the Alpha branch going forward
17:35:12 <morganava> fun
17:36:07 <Jeremy_Rand_Lab19[mds]> PieroV: ouch good to know. I don't know if we can make tens of kB be a thing but there is definitely some mad science I haven't tried yet that should yield a really big improvement compared to where things sit now
17:36:58 <Jeremy_Rand_Lab19[mds]> But anyway it sounds like whatever stuff I end up providing for deployment would probably end up in desktop before mobile, so mobile is probably a problem for future me
17:37:08 <PieroV> The cypherpunk linked to a forum post mentioning --pack-dyn-relocs=relr
17:37:14 <PieroV> I don't have a clue about what it does
17:37:24 <PieroV> visibility=hidden might also help
17:37:39 <PieroV> And then ICF (Identical Code Folding)
17:38:04 <Jeremy_Rand_Lab19[mds]> PieroV: lol, compiler flag blackmagic is very outside of my bailiwick but I enjoy the fact that it exists
17:38:18 <PieroV> This is even more obscure
17:38:21 <PieroV> It's linker magic
17:38:41 <Jeremy_Rand_Lab19[mds]> ah of course
17:38:46 <PieroV> ICF isn't even sound in some platforms
17:38:54 <PieroV> And there's a subset (--icf=safe)
17:38:56 <Jeremy_Rand_Lab19[mds]> naturally the truly insane things would be in the linker
17:39:40 <Jeremy_Rand_Lab19[mds]> (doesn't Mozilla abuse Clang linker functionality to provide some kind of proxy leak protection?)
17:40:03 <PieroV> Mozilla already uses --icf=safe in prod builds if I understand correctly
17:40:18 <PieroV> But Mozilla def abuses compilers, UB (when not undefined in Clang), and so on
17:40:22 <dan_b> morganava: have we seen any size reduction since the recent "remove a bunch of AI stuff" patch?
17:40:49 <morganava> when did it go in?
17:40:56 <morganava> should be easy enough to spot in nightlies
17:41:44 <dan_b> https://gitlab.torproject.org/tpo/applications/tor-browser/-/merge_requests/1616
17:41:47 <dan_b> looks like 6 days ago?
17:41:58 * morganava cheks
17:42:20 <Jeremy_Rand_Lab19[mds]> Oh one other fun maybe-exciting thing I'm playing around with. (Also currently Namecoin-only but could be done for onions by themselves if it's considered desirable.)
17:42:35 <Jeremy_Rand_Lab19[mds]> Self-authenticating SSH server keys
17:42:45 <Jeremy_Rand_Lab19[mds]> Works very similarly to TLS
17:43:00 <morganava> looks like no difference
17:43:08 <morganava> on android at least
17:43:08 <dan_b> morganava: huh apparently like not at all? makes me think if theres engines included to power it we didnt get them? jsut all the UI stuff?
17:43:24 <Jeremy_Rand_Lab19[mds]> Do you guys know if there exist any nontrivial set of people who run SSH on onion services? I assume it must be a thing but I have not looked.
17:43:30 <morganava> 1m on linux but would need to do like actual spreadsheets to see if it's a real effect
17:43:35 <dan_b> or we already got it in application-services noop and are just now disconnecting the UI that'd be broken?
17:43:49 <PieroV> Jeremy_Rand_Lab19[mds]: I don't think there are stats for that
17:43:53 <morganava> that sounds like a brizental question
17:44:12 <morganava> re application-services not SSH
17:44:27 <Jeremy_Rand_Lab19[mds]> PieroV: alright.
17:44:54 <dan_b> re: ssh: I remember some time ago it just wasn't possible, something to do with UDP? but it became more possible more recently? was that cus UDP support landed? or a way to force SSH to do TCP landed?
17:44:55 <Jeremy_Rand_Lab19[mds]> Do you guys have (uninformed) opinions on whether it'd be cool to have SSH over onions work without having to manually verify a key fingerprint?
17:45:40 <Jeremy_Rand_Lab19[mds]> dan_b: that's news to me, I definitely recall seeing documentation many years ago for doing SSH over onions
17:45:56 <dan_b> huh, not sure how long ago I last looked, it was a while
17:46:04 <Jeremy_Rand_Lab19[mds]> dan_b: wasn't the Silk Road guy arrested because he fucked up his SSH onion config or something?
17:46:18 <PieroV> dan_b: maybe you're referring to verifying the key over DNS, so UDP for that?
17:46:22 * Jeremy_Rand_Lab19[mds] might be misremembering
17:47:04 <Jeremy_Rand_Lab19[mds]> PieroV: oh, that definitely could be. The approach I'm doing wouldn't have that issue
17:47:47 <Jeremy_Rand_Lab19[mds]> well actually
17:47:59 <Jeremy_Rand_Lab19[mds]> I just remembered that I routinely SSH into the Namecoin.org server over Tor
17:48:08 <Jeremy_Rand_Lab19[mds]> And that's in Whonix so UDP definitely is not leaking
17:48:30 <Jeremy_Rand_Lab19[mds]> So SSH over Tor definitely is a thing, regardless of whether SSH over onions is common
17:49:14 <dan_b> ah i was referring specifically to ssh on an onion service?
17:49:16 <dan_b> but cool
17:50:27 <Jeremy_Rand_Lab19[mds]> dan_b: I vaguely recall that I gave a colleague SSH access to a VM of mine over an onion service a few years ago
17:50:33 <Jeremy_Rand_Lab19[mds]> But maybe I'm hallucinating that memory
17:50:40 <dan_b> cool!
17:50:44 <dan_b> i'll go look again then!
17:50:44 <Jeremy_Rand_Lab19[mds]> Anyway
17:51:22 <morganava> yeah setting up SSH over onion is fairly straight forward
17:51:23 <Jeremy_Rand_Lab19[mds]> Assuming that SSH over onions is possible, would self-authenticating keys be interesting/cool?
17:52:05 <Jeremy_Rand_Lab19[mds]> (I assume it should be useful for the same reasons it's cool for TLS)
17:52:46 <PieroV> I guess it's a question for SSH over onion users ^_^;
17:52:56 <Jeremy_Rand_Lab19[mds]> And yeah obviously I will poke Rhatto and Q
17:53:06 <PieroV> I prefer doing my verification once and with conventional ways :)
17:53:16 <Jeremy_Rand_Lab19[mds]> Just figured I'd be negligent to not see if you guys had opinions
17:53:59 <ma1> donuts taught us not to have opinions on what users want :)
17:54:10 <morganava> heh
17:54:15 <morganava> alright folks
17:54:20 <ma1> but thank you for your consideration <3
17:54:26 <morganava> good chatting as always
17:54:32 <morganava> but i'mg oing to end the bot so i can get some dinner <3
17:54:36 <morganava> later o/
17:54:40 <morganava> #endmeeting