17:58:36 #startmeeting 17:58:37 Meeting started Mon Aug 4 17:58:36 2014 UTC. The chair is mikeperry. Information about MeetBot at http://wiki.debian.org/MeetBot. 17:58:37 Useful Commands: #action #agreed #help #info #idea #link #topic. 17:58:52 * GeKo is here, too 18:00:25 * boklm is here too 18:00:38 last week Iprimarily spent working on the funding proposal and then the status report. tried to prepare a 4.0-alpha-1, but ran into reproducibility issues 18:02:37 this week, my goals are to get a draft writeup of the iSec report done (as a blog post), tag 4.0-alpha-1, walk helix through that release process (and/or 3.6.4), and if I'm lucky, update the design doc, and maybe write an auditing rubrik of some kind ofr Android 18:02:44 s/ofr/for 18:03:41 we also should transfer our July ticket over during this meeting 18:03:45 or after it 18:03:59 did the proposal get already sent? 18:04:37 yes, roger sent a drat out before I got your reply. however, they may want us to add a section. if they do, we can add your changes in 18:05:03 ok 18:05:49 draft, too 18:06:54 oh, I also got the Website Traffic Fingerprinting defense primitives posted on tor-dev. they also live here: https://gitweb.torproject.org/user/mikeperry/torspec.git/blob/refs/heads/multihop-padding-primitives:/proposals/ideas/xxx-multihop-padding-primitives.txt 18:07:05 I may update those this week too, and re-post 18:07:10 otherwise that's it for me 18:07:12 nice 18:09:45 * MarkSmith can go next 18:09:58 Last week, Kathy Brade and I finished support for symlinks in the Firefox updater (#12647). 18:10:08 We also did a trial rebase of the #4234 browser patches against a FF 31 tree. 18:10:15 Rebasing should not be too difficult. 18:10:24 We corresponded with boklm r.e. #12622 (he agreed to work on it -- yay!) 18:10:35 We will work with him this week to answer his questions as he comes up with a plan for implementation. 18:10:48 We also corresponded with arthuredelstein r.e. consolidating control port access code (Tor Launcher's tl-protocol.js and the new code he wrote for #8641). 18:10:56 We will work with him this week (or soon) to figure out how to merge the two implementations. 18:11:07 We also made a stopgap fix for #9516 so that tor log messages appear in the Browser Console. 18:11:19 Today we spent a little time looking at #12684 (looking at Firefox code with an aim of helping isis with that bug fix). 18:11:28 We will do a little more after this meeting. 18:11:39 In addition to what I mentioned above, this week we will rebase our #4234 patches so they can be merged into the TB 4.0 code as soon as possible after 4.0a1 is released. 18:11:48 And we will continue to work on Tor Launcher items as we have time. 18:12:04 If help is needed with FF 31 stuff, let us know. 18:12:14 (what is the deadline for switching to ESR 31?) 18:12:20 Oct 14th 18:12:40 well, would be nice to have some alpha out first :) 18:12:41 That's about what I thought. Not too far away ;) 18:13:04 or at least some nightlies 18:13:05 GeKo: have you managed to build vanilla FF31 in gitian? 18:13:34 not yet, but that is quite high on my prio list 18:13:50 * GeKo can go next 18:15:05 I tried getting #12381 fixed to no avail yet 18:15:12 then I worked on #12753 18:15:36 we might have a solution for that one now thanks to a fix by a cypherpunk. 18:15:48 I am currently rebundling my alpha build 18:15:52 a 18:15:58 s/a/s/ 18:16:26 then I tried to get Fx 31 to build under gitian starting with Linux but I ran into issues 18:16:32 that should not be so hard to fix. 18:17:08 that is planned for this week including work on #12753 if there is something left and getting an alpha release out (finally). 18:17:30 ugh fuck that bug 18:17:32 :/ 18:17:35 sorry D: 18:17:39 then I convinced myself to fix #9531 as we thought in the bug 18:17:43 and posted a fix. 18:17:50 Yawning: yeah, that one :) 18:18:24 additionally I got my VTV debugging into shape to post a bugzilla bug. 18:18:48 the findings are documented in #12427 18:18:58 apparently it's some like, python win32 issue now? 18:19:47 ("So I'm writing this thing called gobfsproxy that won't have this problem"...) >.> 18:20:02 another thing worth mentioning is I gave another part of #3455 a review and tested it finding issues with HTTPS-Everywhere. 18:21:04 Yawning: yes, we need pywin32 to convince that it does not need MSVC and related Microsoft stuff for compiling 18:21:16 that's it from me 18:21:41 * boklm can go next 18:21:43 :( 18:22:49 Last week I did not get a lot of things done as I spent a few days in a place with no internet. I mainly started thinking about what to do for #12622. 18:22:58 This week I plan to: 18:23:11 - work on a script for #12622 18:23:50 - send a summary of the results of the xpcshell tests that were run on all the tor-browser commits. http://93.95.228.164/reports/ 18:24:23 - check the tests failures we have on the nightlies, and add an option in the testsuite to hide failures for already known issues with a reference to a trac ticket 18:25:20 that's it for me 18:25:45 hi all 18:25:54 hi 18:25:57 hi 18:26:08 hi! 18:26:09 boklm: can you update https://people.torproject.org/~boklm/tbbtests/tests.html and/or https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Hacking#QAandTesting with new links? I'm especially eager to keep an eye on your per-commit invocation of xpcshell tests while we start on FF31 18:26:53 we should try to have a well documented set of test failures introduced for each commit as we rebase, so we can fix the tests or the patches, or at least be aware of them for when we update the patches in bugzilla 18:27:34 mikeperry: ok 18:28:15 isis: hey there 18:28:32 mozilla also finally branched an esr31 branch in their github export. I will import that into tor-browser.gt soon 18:29:50 oh, and ourroadmap from the dev meeting is now up at https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorP#TimelinefromDevMeeting 18:30:01 mikeperry: we have a theory that #11200 is responsible for your tbb 3.6.3 "it works once and then not after that" reports. it's not a bug in tor 0.2.4.x because tor 0.2.4.x doesn't have the patch, but tor browser does. 18:30:23 the thing I feared *sigh* 18:31:59 * arthuredelstein can go next 18:32:15 Last week I developed a patch for #8641. This week I plan to do cleanup on #3455, #8641, 18:32:15 and figure out with MarkSmith how to merge some of my #8641 code with TorLauncher. 18:32:15 (Also I hope to get started on helping with FF31 rebasing (#12620). 18:33:54 That's all for me 18:35:41 Hi devs 18:35:56 hi 18:36:12 hi 18:36:17 So my report of strange Tor problems from last time I think may have been the first stages of Iran blocking TOr 18:36:40 which support team has been encouragingg the use of bridges to get around it 18:36:56 armadev: you mean the new one that appears to bite windows users? are they just confused that 3.6.2 works for them, or is there some new interaction happening in 3.6.3? 18:37:20 armadev: (re #11200) 18:37:28 Another problem that the support team sees is the user tries to open Tor Browser and can't bc of the message "Firefox is alrady running" 18:37:50 Tor Browser is not already running, of course 18:37:59 I can't remember if I've brought this up before 18:38:05 But I see it on Mac 18:38:43 do we have a ticket for the "Firefox is already running" issue? 18:39:10 Haven't looked that hard honestly 18:39:42 I ususally say delete your Tor Browser and start over with fresh download. 18:40:11 So far that seems to be an ok solution, based on not getting a response after that usually 18:41:14 Also no indication that user was attempting to use PTs 18:41:52 mttp: what are we supposed to do with #12756? 18:42:10 it seems to me the user has a messed up system 18:42:27 or am I missing something? 18:42:30 Agreed. 18:43:23 Sorry, that guy was kinda crazy, and that's not the issue I was talking about 18:44:41 Thought it was a bug at first but later realized he had just done a bunch of weird stuff to his system. I can close it as wontfix or something with a message for him to just reinstall his OS or something 18:44:57 that would be nice, thanks 18:45:15 mikeperry: re #11200, the blog has comments from osx users who are bitten by the same bug we thought was for windows users. 18:45:17 we have https://trac.torproject.org/projects/tor/ticket/11023, but this might need a new bug with more data on OS, if any instances of firefox were running, installation directory, permissions info, etc 18:45:50 hrmm, bad time for my mac to stop working :/ 18:47:01 mikeperry: I forgot to mention that most people that see this issue say "WTF I've never had Firefox installed" 18:47:30 yeah, that is kind of a boilerplate firefox error which kind of sucks 18:49:32 hey, a new keyword! 18:49:33 federico3: i commented on #12533 18:49:42 mikeperry: what does the "D" at the end mean? 18:49:44 we may need a new ticket and a bit of investigation. if we can get a file listing of a TBB directory that is having this issue, it might help 18:50:14 GeKo: "Deliverable". I am tagging the tickets from https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorP#TimelinefromDevMeeting with that D suffix 18:50:25 I see. 18:50:29 so we can easily see just the upstream deliverables we planned to do during that month 18:50:53 while we are at it: what do we do with the security slider UI? 18:51:09 that way https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~TorBrowserTeam201408D will show us just the roadmap deliverables, and https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~TorBrowserTeam201408 will show everything 18:51:20 there is some fair amount of discussion in #9387 already 18:51:37 are the UI ideas still up-to-date? 18:53:02 mikeperry: how should I get a user to provide a file listing of their TB directory? (If it were me I'd use `tree` but installing that my be a bit more than most users can handle) 18:53:45 GeKo: well, I don't think we fully settled on a final location for the UI, but the general idea remains the same, and I updated the ticket with the prefs for each position 18:54:10 yes, I saw that. 18:55:29 the slider idea was initially armadev's. armadev, do you have any opinion on where it should live? should we show it on that initial "Connect/Configure" popup dialog, or bury it in the security settings of Torbutton? or both? 18:55:37 hmm. 18:55:40 MarkSmith: did you or brade have some advice for me (re: #12684 / #12683 / #12682) 18:55:51 upgrading tor in (old)stable causes some stuff to break for users 18:56:04 | tsocks returns "Need a password in tsocks.conf or $TSOCKS_PASSWORD to authenticate with". 18:56:21 mikeperry: I think we should have the slider definitely in the security settings in Torbutton. 18:56:22 not sure what to learn from that 18:56:26 isis: We are looking at #12684 (made one comment there; working on the other issue( 18:56:41 * helix appears 18:56:48 hi helix 18:56:51 helix: hurray! welcome 18:56:51 isis: We have not really looked at the other two bugs. 18:56:56 trygve: i replied on #9874, thanks! 18:56:59 oof, vbell off 18:57:25 are we in the free for all portion of the meeting? :) 18:57:26 MarkSmith: okay, thanks for looking at it! 18:57:38 helix: I want to try to get 4.0-alpha-1 out this week, and also 3.6.4. we should do one or both of them together, so that I can help you go through the build system and partial rebuilds, etc 18:57:43 yep 18:57:44 sounds good 18:57:56 I was going to say that releases are on my list for this week 18:58:06 I'll also continue to triage bugs and move things around 18:59:13 mikeperry: what remains for 3.6.4? are we waiting for new openssl? 18:59:32 helix: what is your availability like this week? I think a couple more things have appeared for merge for both 4.0-alpha-1 and Pearl Crescent had a fix they thought was merge-worthy for 3.6.4 IIRC 18:59:56 mikeperry: I'm pretty available, mostly after 2pm EST 19:00:21 if we could get that hang issue sorted out for 3.6.4 that would be nice. 19:00:28 bug #? 19:00:28 mikeperry: that's the stopgap fix for #9516 19:00:32 is that the windows thing? 19:00:43 probably not only windows 19:01:25 armadev suspects #11200 19:01:38 but who knows 19:01:58 I'll ping skruffy in case he has some insights 19:02:18 how is this tbb-bugs thing working out for y'all? 19:02:34 with the merged components 19:02:41 ok. GeKo and MarkSmith, can you give me a ticket list of stuff to add to 4.0 and 3.6.4? #9516 for 3.6.4. Anything else? 19:03:43 mikeperry: nothing else from us 19:04:04 armadev: is the random cypherpunks patch in #11200 sane? 19:04:25 helix: good, thanks! 19:05:17 mikeperry: I merged stuff today and I think there is nothing else. Maybe the new bridges in #12673? 19:06:34 mikeperry: and my rebuild/rebundled alpha sha256sums are on https://people.torproject.org/~gk/builds/4.0-alpha-1/ 19:06:50 hopefully we get matching builds now 19:07:13 helix: [offtopic] if you want me to look at your trac-CAPTCHA plugin problem, point me at a ticket or some code? 19:07:20 *rebuilt even 19:07:34 isis: https://trac.torproject.org/projects/tor/ticket/12721 19:09:04 thanks 19:10:09 GeKo: is it crazy to consider putting #9531 into 4.0-alpha-1? 19:10:45 mikeperry: ah, yes. No that is a good one. 19:11:24 isis: I am also wondering about #12684, as well. though I am a bit worried about altering strings 19:12:37 which means that Torbutton needs to probably not update translations any more for 3.6.x.. at least for a while 19:14:45 mikeperry: meaning... you want my strings done now? or...? 19:15:29 well, if I merge it, we shouldn't change the strings after that point 19:15:34 right 19:16:23 well, that stupid XUL thing didn't work, so... i'm okay with just having a single space between the sentences for now. 19:16:36 * GeKo nods. 19:16:46 i don't *exactly* take great delight in fidgetting with XUL strings 19:16:59 not a xulophile 19:17:12 damn straight 19:17:17 isis: brade and I think we may have a fix for the separator problem… give us an hour 19:17:24 i think i might be allergic to XUL 19:17:32 MarkSmith: great! 19:19:43 mikeperry: When you import Mozilla's FF31 branch to tor-browser.git, can you also import https://github.com/arthuredelstein/tor-browser/tree/bugIDs-tor-browser-24.7.0esr-4.x-1 ? That way I can start posting named patches for the ESR31 rebase as time allows. 19:20:25 ok 19:20:28 mikeperry: one more point belonging to the meeting: I am on vacation from August 9th up to and including August 19th without internet access. 19:21:00 thx :) 19:21:22 and: Do we have our two week schedule now? I was under the impression that we already had it but then I got surprised by the last meeting... 19:21:58 (that was the reason I did not send at least an email explaining what I did that week) 19:22:30 GeKo: ok. Before you take off, can you update any tickets of yours from https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorP#TimelinefromDevMeeting (aka TorBrowserTeam201408D) with your latest progress and branches? 19:22:46 sure 19:23:48 it seemed that we did not completely agree on bi-weekly meetings. some people felt that weekly meetings were still useful 19:23:56 aha! 19:24:31 if memory serves, MarkSmith, boklm, and possibly also arthuredelstein all preferred discussing things on a weekly basis 19:24:36 It's rare that a weekly meeting ends early due to lack of material. 19:24:57 Actually I'm OK either way 19:25:11 I am fine either way, too. 19:25:13 Was bi-weekly twice a week or once every two weeks? I forgot. 19:25:23 the latter 19:25:40 we were considering every two weeks. english is lousy at this notion ;) 19:27:38 Ever since we dropped "fortnightly" 19:27:41 ok, as for planning, I think I have transferred most tickets to https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~TorBrowserTeam201408. a few still remain in https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~TorBrowserTeam201407. we should decide which of those we want to move over to August, and which we want to push out further 19:28:07 what is TorBrowserTeam201408D about? 19:29:22 those are deliverables from our Tor Dev roadmapping session (https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorP#TimelinefromDevMeeting) 19:30:11 MarkSmith: is "09" a typo in the keyword in #11773 (just curious) 19:30:14 ah! 19:30:15 thanks 19:30:39 GeKo: not a typo; just delaying to next month 19:30:47 k 19:30:58 can always pull it in if we have time 19:31:02 to August that is 19:31:22 (that's a bug brade and I found but no one else has reported) 19:32:44 hm maybe I can rebase my windows hardening stuff to the 4.x release 19:32:51 that would be a very good use of my time 19:32:52 please :) 19:33:37 I did the gross rebase to 3.x and it was miserable, but I think I am mentally prepared to try 4.x now :) 19:33:55 mikeperry: are you aiming for the end of the week for these? 19:34:03 it is fine to push stuff out to later month tags. we've got a lot of stuff in August already ;) 19:34:26 in fact, feel free to reduce the August list by retagging for later or untagging if you think it's overlyambitious 19:35:05 especially given that we have both the FF31 rebase to get started on, as well as several upstream deliverables from the roadmap this month 19:39:03 ok, I think I have updated the tags from tickets mentioned in the scrollback here now as well 19:41:22 we should also make sure the owner is set properly, and perhaps think about priorities 19:42:33 are we realistically likely to stabilize 4.0-alpha before FF31ESR is out? I am thinking probably not? 19:43:07 I hope so at least. 19:43:18 that said ESR 31 is already out :) 19:43:41 well before it's so out that we're screwed :) 19:44:35 I think that 4.0 should have the updater working in some form or other. I think this means we should focus on rebasing everything first, and stabilizing that as 4.0 19:45:11 otherwise I worry we're going to be too distracted by trying to stablize something that doesn't have the full set of things in 4.0 that we want, and also not making enough progress on FF31 19:45:31 yes, agreed. 19:46:00 I am a little confused. Does that mean that 4.0 will not be based on ESR 31 or ? 19:46:31 I guess both updater and ESR 31 19:46:46 that's what we're discussing. I think it makes the most sense to put out a release or two of 4.0-alpha-1 with FF24 and the new directory structure, but target FF31ESR as the base for the final, stable 4.0 19:47:02 yes 19:47:13 I agree. 19:52:09 helix: thoughts on https://trac.torproject.org/projects/tor/ticket/12393? we can push that out until September if need be. 19:52:29 boklm: same question but with https://trac.torproject.org/projects/tor/ticket/12222 19:52:51 looking 19:53:48 if trac will show it to me 19:53:50 * helix waits 19:55:00 meejah: I just saw your update to https://trac.torproject.org/projects/tor/ticket/12533 19:55:36 I have some code ready-ish, where can I post it for review? 19:56:14 MarkSmith: yeah, neat idea in #12684. I thought about something along these lines while re-readinf http://xulsolutions.blogspot.de/2006/07/how-to-handle-text-and-keep-your.html 19:56:23 *reading 19:56:51 mikeperry: I can get that fixed by the end of the month 19:56:57 or at least give you an answer 19:57:13 I haven't looked at the standalone bundles in months, so I don't know offhand 19:57:57 federico3: Write a bug on trac.torproject.org and mark it 'Needs code/patch review' 19:58:25 federico3: ...and write to tbb-dev mailing list for good measure. 19:59:21 federico3: it's code for Stem? atagar uses trac.torproject.org so probably attach a patch? 19:59:22 msvb-lab: how about https://trac.torproject.org/projects/tor/ticket/3246? did you want to try that alternate patch? 19:59:43 I'm sorry I've been mostly ignoring that ticket.. :/ 20:00:03 federico3: you could also clone his git repo and post a branch somewhere (like github) too, I imagine 20:00:13 #3246 is still blowing chunks. New approach is more test oriented though, so I'm writing a cookie testbed. 20:03:59 thanks 20:04:04 ...had a small vacation problem though (similar to GeKo) which added to delay. 20:04:11 Still quite shameful though, four years in the making. 20:04:19 Time to put this bug to bed. 20:04:57 federico3: Sure, can't wait to see your code. Do a little paraphrase blurb on the mailing list and a link to the bug so people get interested. 20:04:58 but it is a tricky one 20:05:12 federico3: Paraphrase the diff patch I mean. 20:05:48 GeKo: Thanks for the mitgefuehl. Not sure how to say that. 20:06:12 "Mitgefühl" is fine :) 20:07:02 * isis owns a "Firefox Patch Issues" ticket now. wow. 20:07:30 if you need more of those just tell us :D 20:08:14 i don't mind taking more, i wouldn't mind implementing some bugs 20:08:23 err, s/implementing/fixing/ 20:09:21 nice, nice 20:09:49 mikeperry and GeKo: As my patch to #3455 breaks SSL observatory, I was wondering if we should be including SSL Observatory at all, given its obvious privacy drawbacks. 20:11:31 arthuredelstein: right now, SSL Observatory is disabled by default. I believe my patches to really make disabled mean disabled (aka no startup tests or observer registration) should be inthe HTTPS-Everywhere 4.0 series 20:12:21 my hope was that if it is enabled, it would be given a custom socks username+password, to keep submissions on their own circuit, or on unique circuits 20:12:24 yeah, I tested artur's patches against the HTTPS-E we ship in the 3.6.x serices 20:12:38 *arthur's sorry 20:12:48 Kein sorge ;) 20:12:54 *keine 20:13:18 tack 20:13:45 GeKo: You only saw SSL Obs breakage, correct? 20:14:02 I think I can test against a newer HTTPS-E and see what happens. 20:14:15 Yes, only SSL Observatory issues popped up. 20:15:25 I can provide a patch for SSL Observatory. But I guess it has to work both with and without my #3455 patch, which is a little awkward 20:16:50 yeah, that is the problem. 20:20:04 ok, I think I've fixed all the ticket owners, state, and tags for both https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~TorBrowserTeam201408D and https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~TorBrowserTeam201408 20:20:37 everyone should have a look at what's assigned to them and tbb-team and see if you think it's too much 20:20:48 the D tickets are most important 20:22:56 mikeperry: Is there a reason you did not put #12193 on isis's plate? 20:23:06 I thought I did 20:23:12 (giving the roadmap) 20:23:18 *given 20:23:43 I guess I failed to click submit 20:23:44 fixed 20:26:49 trac is also lame about updating the view of those queries. clicking "reload" causes different behavior than clicking "update" 20:27:02 reload just makes changed tickets appear in italics. update fully updates them.. 20:27:07 mikeperry: we haven't actually submitted the rfa proposal yet. so there is still time to make the pdf better if you have some way of making it better and want to do so. 20:27:22 armadev: ah, ok. GK had some changes we can fold in 20:27:36 i think the rfa folks are going to like it basically no matter what. so our job is to make their external review board approve it. 20:28:08 (or said another way, the only reason the rfa people won't like it is if they think there's a risk the external board won't like it) 20:28:32 mikeperry: It might make sense if child tickets to a parent ticket containing a "D" get also a "D" in the TorBrowserTeam keyword? 20:29:00 most of his changes were typographical in nature. he also had some comments on the release dates, but I think the dates are correct; I just used the EOL dates rather than the initial release dates 20:29:29 I asked some website to calculate those dates based on 42 week increments, so I think they are correct 20:30:49 GeKo: if you want. I wasn't sure which way to go on that one. We may want to avoid tagging child tickets to avoid clutter? or maybe we want to tag them fore completeness.. not sure 20:31:06 I suspect avoiding clutter on that monthly list is a good thing, though 20:31:20 yes, that was my second thought 20:31:30 so, parent ticket is enought 20:31:31 especially if we mean that tagging a parent ticket means "all the children must get closed, since trac requires that anyway 20:31:33 *enough 20:31:42 yeah 20:31:49 then, if a parent ticket is too large, we can just tag the relevant child tickets 20:32:50 feel free to fix that for the FF31 tickets and any others you notice. I think the shorter list for the tag view is the way to go unless we are really only planning on doing some of the child tickets 20:33:46 agreed 20:34:30 otherwise, I think we're finally done with this meeting? 20:35:03 helix: I am going to update the RFA proposal with gk's comments, and then we can start on 3.6.4 and 4.0-alpha-1 builds. when do you disappear for today? 20:35:49 I need to go run some errands for a couple of hours but I'll be back after that 20:36:36 ok. hopefully I will have updated the version files with everything relevant by then. ping me when you're back? 20:36:52 more specifically, I believe I have an availability window of 7pm-10pm EST 20:36:54 ok 20:37:47 ok. I'm going to call this meeting then. sorry for the marathon length. hopefully next monday will be shorter 20:38:24 and maybe it will be short enough that we decide we can do fortnightly meetings, if this tagging-based scheduling works out for us. but for now, we're still going to meet weekly 20:38:35 ok 20:39:07 #endmeeting *baf*