18:01:16 <GeKo> #startmeeting tor browse
18:01:16 <MeetBot> Meeting started Mon Oct  3 18:01:16 2016 UTC.  The chair is GeKo. Information about MeetBot at http://wiki.debian.org/MeetBot.
18:01:16 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic.
18:01:21 <GeKo> ha!
18:01:25 <GeKo> *browser
18:01:35 <boklm> hi!
18:01:39 <Yawning> herro
18:01:44 <mcs> hi
18:01:49 <GeKo> hi everybody and welcome to the first meeting after the seattle one
18:02:01 <GeKo> i hope you had a good time and are now fully recovered
18:02:23 <GeKo> to sprint through october for sponsorU :)
18:02:41 <Yawning> >.<
18:02:43 <arthuredelstein> hi!
18:03:26 <GeKo> okay, let's get started with some status updates before we move on to the discussion phase
18:04:41 <GeKo> the past two weeks i worked on a bunch of things.
18:05:14 <GeKo> highlights were #13893 and #20184
18:05:30 <femme> hi
18:05:51 <GeKo> i investigated #20195 because it made me nervous
18:06:10 <Yawning> it's weird, sorry bout that, no idea what's going on
18:06:14 <GeKo> that one is fun too; i am about to update the ticket
18:06:22 <GeKo> (no spoilers before)
18:06:29 <GeKo> thanks for finding it :)
18:06:52 <GeKo> then i reviewed quite some tickets, e.g. #20111
18:07:15 <GeKo> where we found that something is still missing wrt unix domain socket usage
18:07:51 <Yawning> yeah I need to sit down and fix some of that stuff
18:08:02 <GeKo> i got involved in the cloudflare thing where i started pondering their blinding specification over the weekend
18:08:35 <GeKo> Yawning: do you think we could get #18753 done too in that wake?
18:08:55 <GeKo> that broke a lot of OS X users
18:09:22 <GeKo> that might be it from the last couple of days for me
18:09:42 <GeKo> this week i'll focus on getting the planning done for the remaining SponsorU stuff
18:09:53 <Yawning> not sure about that one, think nickwas making noises in that direction
18:10:04 <GeKo> i want to work on #20184
18:10:15 <GeKo> and we'll see what else comes up
18:10:29 <GeKo> Yawning: okay, i'll poke him later about it
18:10:34 <nickm> I'll take a patch for #18753 if somebody writes one this week. Or if nobody is planning to, I can write one today.
18:10:51 <GeKo> woah, thanks
18:11:12 <GeKo> currently nobody is planning to write one afaict...
18:11:22 <mcs> nickm: that would be awesome (writing a patch)
18:12:24 * mcs can give a status report next
18:12:35 <GeKo> yeah, i think i am done
18:12:42 <mcs> Since our last team meeting, Kathy and I created a revised patch for #20111 and investigated #20261 (a related ticket).
18:12:49 <mcs> We investigated #20210.
18:12:55 <mcs> We backported some Mozilla patches to fix #20204.
18:13:00 <mcs> We spent some time learning about the MacOS sandbox for #20121.
18:13:06 <mcs> We made a plan to fix #20185 (which we will work on this week).
18:13:12 <mcs> We also reviewed several patches and helped with bug triage.
18:13:22 <mcs> Also, Mark was in Seattle last week for the Tor meeting.
18:13:28 <mcs> We had a lot of good discussions related to Tor Browser, Mozilla, and other topics.
18:13:34 <mcs> This week we plan to work on #20185 and MacOS sandboxing (#20121).
18:13:38 <mcs> That’s all for now.
18:14:48 * arthuredelstein can go
18:14:50 <GeKo> mcs: fwiw: i just read the plan in comment
18:14:52 <GeKo> 3
18:14:59 <GeKo> (i forgot to look at it)
18:15:10 <GeKo> and i had a similar idea.
18:15:22 <GeKo> so, if that is the thing you want to do: +1
18:16:09 <mcs> The proposal is to do all of 1 - 4. Is taht what you are agreeing to or just 3?
18:16:28 <GeKo> the "3" belonged to "comment" :)
18:16:40 <mcs> ah, got it. thanks.
18:16:41 <GeKo> so, yes, 1 - 4
18:16:53 <mcs> that is what we will do then.
18:16:58 <GeKo> cool
18:19:33 <mcs> who is next?
18:19:43 <arthuredelstein> I can go
18:19:47 <arthuredelstein> Since last time,
18:19:51 <arthuredelstein> I wrote patches for #17904, #17546, #20123, #18093, #20043.
18:20:01 <arthuredelstein> The last two need revisions, which I hope to complete this week.
18:20:08 <arthuredelstein> I also started working on #20244 and I opened #20264 (maybe a good discussion topic today).
18:20:17 <arthuredelstein> I posted some notes from the meeting at
18:20:23 <arthuredelstein> https://trac.torproject.org/projects/tor/wiki/org/meetings/2016SummerDevMeeting/Notes/AntiFingerprinting?version=2
18:20:26 <arthuredelstein> https://trac.torproject.org/projects/tor/wiki/org/meetings/2016SummerDevMeeting/Notes/GrowingTor?version=1
18:20:33 <arthuredelstein> and there are some more on our meetings with Mozilla that I will post later.
18:20:53 <arthuredelstein> On the Mozilla side, I reviewed bugzil.la/277803 (favicon isolation), and posted a patch for bugzil.la/1305144 (.onion referrer hiding).
18:21:05 <arthuredelstein> This week I plan to work on more SponsorU tickets.
18:21:09 <arthuredelstein> That's it for me.
18:21:49 <isabela> (just a quick note that I will update the wiki with the suggested roadmap we created in Seattle)
18:21:52 <isabela> o/
18:22:03 <GeKo> thanks
18:22:19 * boklm can go next
18:22:32 <boklm> Since last meeting I helped publish the alpha release, worked on #19067, and last week was at the Seattle meeting
18:22:35 <boklm> This week I'm planning to work on fixes related to the dmg2mar script (#20210, #20182, #20186, #20217, #20183), and #19067
18:22:48 <boklm> That's it for me.
18:24:29 <GeKo> arthuredelstein: re your anti-fingerprinting notes:
18:24:44 <GeKo> yes, updating the design document is still very high on my priority list
18:25:06 <GeKo> but i can't guarantee that it will get done in oct due to the sponsorU stuff
18:25:28 <GeKo> i am almost done up to and inlcuding the cross-origin linkability section
18:25:44 <GeKo> so there is already a fair amount of stuff covered at least ;)
18:25:54 <arthuredelstein> GeKo: No worries! That wasn't intended as pressure. :)
18:26:28 <GeKo> nah, the pressure is there with or without the wiki entry
18:26:43 <GeKo> because not getting this updated timely sucks quite a lot
18:27:02 <arthuredelstein> We were discussing with EFF how to make a full list of possible fingerprinting vectors, so the design document is a good source for that.
18:27:18 <GeKo> good idea.
18:27:34 <GeKo> re that our GSoC project could play an important role here as well
18:28:24 <arthuredelstein> Yes, I think so.
18:28:25 <GeKo> which could be tailored to the questions we have without having the issue of all the legacy data panopticlick brings along
18:28:58 <GeKo> anyway, before we start discussing stuff: is there anybody else for a status update?
18:29:06 <Yawning> I can go though I didn't do much
18:29:07 <GeKo> *else here
18:29:08 <Yawning> >.>
18:29:23 <GeKo> welcome back, fwiw!
18:29:29 <Yawning> went to the dev meetihng, talked about sandboxing stuff
18:29:31 <GeKo> nice to have you around again
18:29:48 <Yawning> hey, even when I wasn't on irc much I posted bugs and replied to some e-mail >.>
18:30:05 <mcs> I have some sandboxing notes to post (from the dev meeting)
18:30:27 <GeKo> Yawning: sure, sure :)
18:30:28 <mcs> (mostly Yawning talked about what he has done)
18:31:06 <GeKo> so you all have the big plan we just need to execute, right?
18:31:14 <Yawning> p much
18:31:25 <Yawning> assuming I made the right design decisions
18:31:32 <GeKo> neat
18:31:51 <arthuredelstein> Yawning: What help do you need from the rest of us at this stage?
18:32:00 <Yawning> "does my design suck"
18:32:09 <Yawning> "ability to hide updater related ui elements"
18:32:22 <Yawning> "figure out how to make firefox work without a /proc filesystem, (SIGSEGV)"
18:32:43 <Yawning> "Do I need to care about D-Bus/IBus (hard)?"
18:33:08 <Yawning> "Is 'you must install bubblewrap from your distribution's pacage manager' acceptable"
18:33:20 <Yawning> prolly other things I'll think about it some
18:33:37 <arthuredelstein> These seem like good things for tickets. Shall I file them?
18:33:44 <Yawning> I've been filing issues on my bug tracker
18:33:45 <Yawning> sec
18:34:07 <Yawning> https://git.schwanenlied.me/yawning/sandboxed-tor-browser/issues?state=open&milestone=3
18:34:13 <Yawning> that's my task list
18:34:17 <mcs> Are we at the discussion stage of the meeting now?
18:34:21 <Yawning> it's a huge amount of work, but I think I can do most of them
18:34:40 <Yawning> also we need to figure out packaging and stuff
18:34:57 <Yawning> the good news is, my prototype works, now with audio >.>
18:35:10 <arthuredelstein> Awesome.
18:35:14 <GeKo> mcs: yes
18:35:20 <Yawning> (I have a separate list of things that we should investigate when moving from early adopter alpha to production)
18:35:59 <arthuredelstein> Yawning: So if there are things we can help with (investigate or patch), probably the best thing is if you can file a ticket on trac.
18:36:12 <Yawning> mmk
18:36:19 <Yawning> I think the UI element one already has a ticket
18:36:24 <Yawning> though not sure if't scomplete or not
18:36:44 <Yawning> the "firefox crashes without /proc" thing is technically a upstream bug
18:36:51 <mcs> It seems like sandboxing is the biggest / riskiest Sponsor U task that remains on our list. I want to propose that maybe Kathy and I should do what we can for OSX and Arthur should work with Yawning to finish the Linux work.
18:37:00 <Yawning> (and certain functionality, eg: about:memory will break)
18:37:09 <mcs> A lot of the work may be deciding how to ship something.
18:37:14 <mcs> (what to cut etc.)
18:37:22 <Yawning> yeah
18:37:53 <Yawning> is there a trac keyword I should use?
18:38:01 <arthuredelstein> mcs: I second that proposal.
18:38:03 <GeKo> mcs: in general this sounds not bad
18:38:19 <GeKo> i can work on linux sanboxing, too, now that the emet stuff seems to be fixed
18:38:22 <mcs> It does not seem like we will have time to ship the sandbox enabled with our regular alpha. So we may need to make it ioptional of have a separate release like hardened.
18:38:23 <GeKo> *sandboxing
18:38:38 <mcs> GeKo: that is good news!
18:38:39 <Yawning> #20083 and #20219 are the tickets I did file arleady
18:38:55 <Yawning> well, the dist.top/aus1 situation in general
18:38:57 <GeKo> there are still torbutton conversion things we need to fix
18:39:15 <GeKo> like #19459 and #16622
18:39:22 <Yawning> mcs: well, my approach lets you sandbox alpha/release/hardened
18:39:35 <Yawning> since it downloads the bundle, and supports (in theory) specifying the channel
18:39:43 <GeKo> but apart from that we are not in bad shape
18:39:46 <Yawning> OSX model prolly different
18:39:52 <mcs> Yawning: True. So maybe in that case the sandbox is a separate thing.
18:39:58 <Yawning> yeah
18:40:00 <mcs> (that we ship separately)
18:40:03 <GeKo> oh, i have to think about what to do with #10281
18:40:05 <GeKo> :(
18:40:25 <mcs> I am less clear what we will end up with on OSX but hope to have a plan soon.
18:41:01 <Yawning> the general vibe I got from the meeting is that some but not everyone thought my approach was reasonable, with the "not everyone" just not being there >.>
18:41:11 <GeKo> arthuredelstein: i guess if you could focus on the remaining conversion tickets. i could start with the sandboxing stuff
18:41:16 <arthuredelstein> Yawning: I think we don't have a keyword. Maybe start using tbb-sandboxing?
18:41:18 <Yawning> so unless someone tells me otherwise I will proceed with "make what I have usable"
18:41:21 <Yawning> k
18:41:26 <GeKo> and you could just join the club later on :)
18:41:39 <arthuredelstein> GeKo: Yes, that's fine with me as well.
18:42:06 <Yawning> The proc thing is a nice to have but can probably slip fwiw
18:42:23 <Yawning> perfect is the enemy of good etc
18:42:32 <GeKo> arthuredelstein: we alredy have tbb-sandboxing
18:42:38 <GeKo> #19750 has it
18:42:57 <GeKo> which is the parent ticket for All The Stuff
18:43:26 <Yawning> Also I know that whatever UI I bolt onto the sandbox launcher of doom won't be localized with the time constraints we have
18:43:29 <Yawning> :/
18:43:45 <Yawning> because I'm only bilingual, and I'm a crap UI programmer
18:43:55 <mcs> I am not sure it is worthwhile to spend a lot of time on UI at this point.
18:43:58 <arthuredelstein> GeKo: Aha! I should have remembered that.
18:44:03 <mcs> (as in, we don’t have a lot of time)
18:44:12 <GeKo> Yawning: i think that falls under alpha quality and is okay
18:44:16 <Yawning> yah
18:44:22 <Yawning> I'll do something basic
18:44:27 <GeKo> yes.
18:44:37 <Yawning> most of the rest of the stuff I need to think about except international input is like... fairly easy I think
18:44:56 <Yawning> I mean, the foundation is solid enough that I've been using it for a bit over a week
18:45:58 <arthuredelstein> Very exciting.
18:46:14 <GeKo> indeed. and thanks, yawning, for getting this going
18:46:57 <GeKo> okay, it seems we have kind of a plan for that one
18:47:10 <GeKo> do we have something else to discuss?
18:47:17 <dcf1> me
18:47:29 <Yawning> "yawning dissapears into the cat cave, and code comes out"
18:47:35 <dcf1> I would like to have some Tor Browser dev help on #20250
18:47:46 <dcf1> I don't have a macOS Sierra machine to test
18:48:32 <dcf1> I thought for sure the cause was the version of Go used to compile: https://trac.torproject.org/projects/tor/ticket/20250#comment:11
18:48:40 <dcf1> But that didn't help this user.
18:49:17 <dcf1> In any case, we are going to have to start compiling Go programs even in the stable release with Go 1.6.3+, or there are likely to be problems with Sierra.
18:49:38 <GeKo> who of us has a 10.12 OS X machine to look at that?
18:49:40 <dcf1> The upgrade to 1.6.3 is currently blocked on #20030, which is a small patch I have to merge.
18:49:51 <dcf1> I'll file a ticket for the Go upgrade, but I'm stumped on #20250.
18:49:57 <dcf1> That's all from me.
18:50:18 <mcs> Kathy and I now have a 10.12 system. But I am not sure how to debug the problem.
18:50:20 <arthuredelstein> dcf1: Maybe test on a MacOS VPS?
18:50:27 <mcs> We will try to reproduce to start though.
18:50:34 <GeKo> thanks
18:50:39 <dcf1> thanks
18:51:14 <dcf1> According to the Go release notes, our alpha release built with Go 1.6.3 should be new enough to avoid the Sierra issues.
18:51:43 <mcs> The claim is that one of the meek processes is crashing? I guess I need to read the ticket more carefully.
18:52:15 <mcs> Kathy and I will see what we can learn and we will comment in the ticket.
18:52:32 <Yawning> (I have no idea what to do about sandboxed meek/fte btw)
18:52:40 <dcf1> The reporter says the pluggable transport dies, sometimes after a few minutes of operation (which is the weird part)
18:52:51 <GeKo> that's probably a thing for the follow-up funding :)
18:52:57 <Yawning> (My current plan is "too bad so sad, I might unbreak meek at a later date, it's an alpha")
18:53:05 <GeKo> yes
18:53:21 <Yawning> GeKo: another thing for followup would be "Tor Browser should support Wayland"
18:53:34 <Yawning> but not an aplha thing by any reasonable strech of the imagination
18:54:02 <GeKo> indeed
18:54:13 <Yawning> (even with all the stuff that'll prolly get cut, it will be a good alpha assuming I can execute I think)
18:54:40 <Yawning> I guess meek_lite is an option.  We ship it but don't use it
18:55:03 <mcs> meek_lite is meek without a browser, right?
18:55:09 <Yawning> correct
18:55:09 <dcf1> Yes meek_lite or just meek-client without meek-client-torbrowser
18:55:43 <mcs> What is the difference btw those two options? Two different implementations or the same thing or ?
18:55:46 <Yawning> it's integrated into obfs4 as a space saving measure for android
18:55:55 <Yawning> apart from that they're identical for the most part
18:55:59 <mcs> Yawning: thanks
18:56:31 <GeKo> okay, anything else for today?
18:57:07 <Yawning> neg, I shall codecave/file tickets, but mostly codecave
18:57:38 <arthuredelstein> I filed #20264 -- does anyone have opinions on this?
18:58:08 <GeKo> i think this is a worthwhile thing to do
18:58:18 <mcs> agreed
18:58:18 <GeKo> but probably not for october
18:58:25 <Yawning> is that the "medium high is the new medium" thing?
18:58:29 <GeKo> we might want to think a bit more about it
18:58:29 <arthuredelstein> Oh, I just saw the new comments.
18:58:30 <GeKo> yes
18:58:57 <GeKo> but generally, it always felt to me a bit weird to have a medium-low setting
18:59:20 <GeKo> and i think just having low - medium - hight is a good solution
18:59:24 <GeKo> *high
19:00:14 <GeKo> alright, 19:00 UTC
19:00:36 <GeKo> thanks for the meeting and a productive week everybody *baf*
19:00:39 <GeKo> #endmeeting