[tor-project] Notes from the Tor Browser meeting, Oct 22 2018

Georg Koppen gk at torproject.org
Tue Oct 23 06:15:00 UTC 2018


Hi!

We had another weekly Tor Browser meeting yesterday. For those
interested in the chat backlog, see:

http://meetbot.debian.net/tor-meeting/2018/tor-meeting.2018-10-22-18.00.log.txt

The items from our pad are:

Discussion:
    - [tjr] TBB 8 Retrospective. Proposed Times:
         - Tuesday: 3 PM UTC
         - Thu/Fri 2:30 PM UTC
         - Either this week or next; same times. (GeKo: Next week Tue 3
PM UTC sounds good)
         - Ideally would like to get georg, boklm, arthur and anyone
else interested


tjr
 - Regrets for missing last weeks meeting and saying nothing
 - Tickets I think we can close:
     https://trac.torproject.org/projects/tor/ticket/13410 (Disable
self-signed certificate warnings when visiting .onion sites) [GeKo: I
don't think we tackled that issue]
     https://trac.torproject.org/projects/tor/ticket/22162 We did this,
right? (Review speculative connections)  [GeKo: I don't think we got to
that yet]
 - I want to start filing sandbox tickets.
   - Specifically: If an attacker's goal is to identify a user outside
Tor, by stealing a persistent identifier and causing a proxy bypass, and
they can accomplish these goals inside the Content Process, I see no
reason to spend efforts on sandboxing the parent first.  (Excepting
promoting architectural decisions that will make it easier to do the
Parent later.)
   - So I want to file tickets about issues we need to fix in the
content process to block the attacker.
   - First examples: PTCPSocket and PUDPSocket IPC methods look  like
they would allow this; although I haven't tested
 - Maybe landing fuzzyfox this week?
 - mingw-clang
   - Landed pdb support, and it works! symbolized stack traces, yay!
   - Got --enable-sandbox to compile with help from Martin
   - Working on why build doesn't run:
https://bugzilla.mozilla.org/show_bug.cgi?id=1497895
   - Also doing various build cleanup stuff:
https://bugzilla.mozilla.org/show_bug.cgi?id=1500802 and children;
https://bugzilla.mozilla.org/show_bug.cgi?id=1500102


mcs and brade:
  Last week
    - Finished #26263 (browser app icon positioned incorrectly in macOS
DMG installer window).
       - With the same patch, we also fixed #25151 (Update Tor Browser
branding on installation).
    - Helped with #28039 (Tor Browser log is not shown anymore in
terminal since Tor Browser 8.5a2).
    - Reviewed the team roadmap, especially our tasks.
  Upcoming:
    - We will be on vacation Tuesday, October 23 - Wednesday, October 31.


sysrqb:
    Last week:
        Reviewed #26690 (Padlock icon for TBA)
        Reviewed #27111 (about:tor for TBA)
        Began creating a patch for #24920 (TBA should only  have Private
Tabs)
        Continued Rust audit (#27616)
        Investigated #27431/#28125 (TBA DNS leak)
        S19 text
    This week:
        Create branch for patching #28125 (TBA DNS leak)
        Finish rust audit - #27616
        At funder's meeting this week


pili:

    Last week:

    Sponsor19 report brainstorming

    Tor Browser Release meeting

    This week:

    Looking to label tickets with Sponsors

    Evaluating best ways to track roadmap items, spreadsheet, other...

    Orfox issues - are we tracking all the relevant issues sent over by
Fabiola from Guardian Project? How are they identified?

    [sysrqb: No, and unfortunately we're mostly ignoring Orfox
currently. We should follow up on those issues and decide on a plan for
Orfox]


GeKo:
    Last week:
        -release prep
        -reviews
        -worked on #26475, Tor Browser design doc update (#25021),
#28039, and #28075
        -meetings and syncs
        -ticket triage (there is no Applications/Torbutton anymore,
please use Applications/Tor Browser + keyword `tbb-torbutton, similar
things will happen this week with Applications/Tor bundles/installation:
it will DIE; please use Applications/Tor Browser + keyword `tbb-rbm` if
really needed)
    This week:
        -release help
        -more work Tor Browser design doc update
        -die, Applications/Tor bundles/installation, die (#20648)
        -looking into singe-locale language repacks (#27466)
        -mail to Apple about their experiences with redirect isolation


sisbell:
  Last week:
    - # 27441 Debian image to use stretch (ready to merge)
    - # 26696 Platform def in rbm,conf (ready to merge)
    - # 26976 hardening wrapper - closed (don’t need to fix)
    - # 26975 Mobile branding (fixed/closed)
    - # 26697 Android toolchain - removed gradle dependencies (now in
Firefox project)
    - # 27443 Firefox for Android - applied boklm patch for a script to
download and package artifacts
  This Week:
    - Investigate if patches (or parts of patches) needed with latest setup
    - Investigate if sdk 23 still needed with latest Firefox code

        [sysrqb: we should be targeting 26, so I don't think we need 23
for anything(?)]


arthuredelstein:

    Last week:

    Patches for:

     #26498 (Fix bn-BD and es-AR locale for Tor Browser)

     #28082 (Add 4 more Tor Browser locales)

     #28111 (For about:tor, use a Tor Browser icon in identity box)

     #22343 (Save as... in the context menu results in using the
catch-all circuit)

     #28093 (2018 Tor Browser Android donation banner)

    Worked on:

    https://bugzilla.mozilla.org/show_bug.cgi?id=1330467 (When
"privacy.firstparty.isolate" is true, double-key permissions to origin +
firstPartyDomain)

    S19 text

    This week:

    Keep trying to finish permissions FPI

    Help to look at redirect FPI approaches

    Help with TBA donation banner? (#28093) (GeKo: igt0 put this on his
plate and is coordinating with antonela in case there are assets that
need to get adapted)


boklm:
    Last week:
        - helped with building the new releases
        - reviewed and tested patches for:
            - #21704 (Abort install if CPU is missing SSE2 support)
            - #26475 (ESR60-based Tor Browser bundles are not built
reproducibly with Stylo enabled using rustc > 1.25.0)
        - reviewed patches for #26693 (Integrate Tor Browser for Android
into tor-browser-build)
        - made patch for #27438 (Android Gradle Build Downloads)
        - started looking at #28117 (Some URLs can't be downloaded with
LC_ALL=C)
        - worked on tor browser testsuite setup (#26149)
    This week:
        - help publish the new releases
        - enable running testsuite on nightly builds (#26149)
        - check if more updates are needed for #25030


pospeselr:
    Last week:
        - #3600 work (redirect cookies)

            - began work on design doc (turns out this is a really hard
problem)

      - fixed a few bugs in tbblogger

    This week:
        - #finish design doc edits and post on storm
        - #3600


igt0:
   Last week:
      - #25013 (Sent a patch and tested on android and desktop with
different locales)
      -  Reviewed and tested #28104
   This week:
      - More work on #25013
     - Update #26690 (padlock icon for tba)
     - Update #27111 (about:tor button for tba)


Georg

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.torproject.org/pipermail/tor-project/attachments/20181023/02d93677/attachment.sig>


More information about the tor-project mailing list