18:58:55 <GeKo> #startmeeting tor browser 11/12
18:58:55 <MeetBot> Meeting started Mon Nov 12 18:58:55 2018 UTC.  The chair is GeKo. Information about MeetBot at http://wiki.debian.org/MeetBot.
18:58:55 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic.
18:58:55 <tjr> tbb meeting?
18:59:00 <GeKo> indeed!
18:59:06 <GeKo> hello all
18:59:08 <sysrqb> o/
18:59:14 <igt0> hi!
18:59:19 <GeKo> another week, another meeting
18:59:27 <GeKo> the pad is at https://storm.torproject.org/shared/tHoN4Ii7rLSjPE0OP4gydX4cMGadsXmRQNc-6lwru0N
18:59:29 <arthuredelstein> hi everyone!
18:59:36 <sisbell> hey
18:59:39 <boklm> hi!
18:59:40 <GeKo> please enter you items and mark items to talk about bold
19:00:17 <pili> hi
19:00:34 <antonela> o/
19:01:33 <pospeselr> hello!
19:01:39 <pospeselr> and congrats arthuredelstein :D
19:01:53 <GeKo> :)
19:01:55 <GeKo> indeed
19:02:17 <sysrqb> trader :)
19:02:28 <sysrqb> (just kidding!)
19:03:12 <GeKo> alright
19:03:12 <pili> :D
19:03:24 <GeKo> some folks are still typing but we should probably start
19:03:30 <GeKo> tjr: you are up
19:04:04 <tjr> cubeb audio remoting temp files
19:04:41 <GeKo> yeah, i had a hard time too, to fully grasp the reply but i can try a second time and do something about it
19:04:43 <tjr> I'm not sure if mcs or GeKo you got more out of that email than I did - I think we need to dig more into the thing and figure out when they're used, and if we want to do anything to avoid them
19:04:54 <GeKo> i agree
19:04:59 <tjr> Does that mean I can leave that with you GeKo?
19:05:04 <GeKo> yes
19:05:09 <tjr> great; thx
19:05:23 <mcs> agreed, sounds like we need to dig a little more
19:05:48 <tjr> As for the web extension process: i was worried that pref may disappear before Tor stops needing it. Do you expect to have the two extensions integrated into the browser by the next esr?
19:05:57 <tjr> Or should i make sure those prefs don't disappear?
19:06:16 <GeKo> what do you mean by integrated?
19:07:09 <GeKo> i am not sure yet whether we want to bake in noscript as, say, as systems extension
19:07:27 <tjr> Right; but noscript can function as a web extension. launcher/button can't
19:07:33 <GeKo> yep
19:07:45 <tjr> Is the plan is just to move button/launcher extensions into the source tree; or to integrate them into the browser as not-an-extension?
19:08:30 <GeKo> torbutton should vanish as an extension until we get to the next esr
19:09:03 <GeKo> then the question is whether the browser/web extension communication would hit the same issue
19:09:15 <GeKo> which i don't know the answer to
19:10:09 <tjr> Hm. okay. Well, I'll start an email discussion and just probe if these prefs are being considered for removal to be safe
19:10:36 <GeKo> i hope treating torbutton that way solves this issue, though
19:10:41 <GeKo> sounds good, thanks
19:11:06 <GeKo> tjr: re switching to the clang toolchain.
19:11:06 * tjr is fin
19:11:11 <tjr> ah, yea?
19:11:25 <GeKo> i think i'd like to have that after we have the accessibility thing in our alphas
19:11:35 <tjr> sure
19:11:51 <GeKo> i mean we need a pretty new mingw-w64 revision anyway for that
19:12:22 <GeKo> and i think getting that feature out before starting to seriously change our toolchains
19:12:34 <GeKo> is a good thing for our users
19:12:53 <GeKo> go ahead if you want to work on it :)
19:13:07 <GeKo> otherwise we'll probably pick that up in dec or so as planned
19:13:19 <tjr> Sure. My main concern/hope is getting the kinks ironed out before mid/late january while I can help
19:13:19 <GeKo> (or we work together on it. whatever works for you)
19:13:28 <GeKo> sounds doable
19:13:35 * GeKo famous last words
19:14:04 <GeKo> pospeselr: you are up
19:14:25 <pospeselr> hey hello
19:15:09 <pospeselr> I've made a few updates to the #3600 doc, trying to rectify all the conflicting issues associated with redirects and cookies and what-not
19:16:21 <tjr> I'm planning on reading the last mix and match section through carefully. But it might not be until later this week.
19:16:29 <boklm> the storm links tells me "You do not have permission to access this grain"
19:16:43 <GeKo> i try to find some time as well to  give it a second look and think more about the problem
19:16:43 <pospeselr> anyway nothing in particular to discuss at the moment, going to be focusing this week on the work that needs to happen regardless of which combo of solution we converge on
19:17:04 <pospeselr> boklm: one sec
19:17:13 <GeKo> i guess it should be https://storm.torproject.org/shared/Kw99Ow0ExZFFC6FKD5CeryfVFAoAL9Z_iEVlflI0fiL
19:17:15 <pospeselr> https://storm.torproject.org/shared/Kw99Ow0ExZFFC6FKD5CeryfVFAoAL9Z_iEVlflI0fiL
19:17:20 <boklm> thanks
19:17:24 <GeKo> seems so :)
19:17:39 <pospeselr> grabbed the wrong link from my notes :p
19:17:53 <pospeselr> anyway, that is all
19:18:01 <GeKo> thanks
19:18:04 <GeKo> sisbell: hey!
19:18:27 <sisbell> hey
19:18:53 <GeKo> so, i worry we might fall behind our plan to get TBA-a2 out next week
19:19:09 <GeKo> which is why i tried to help with #27443
19:19:41 <GeKo> my current plan is to figure out what changed in rust 1.28 to make the problem go away and hopefully just backport a tiny patch :)
19:19:43 <sisbell> I can timebox the 1/26/1.28 investigation
19:20:06 <sisbell> And then say tomorrow, if no solution, maybe go with 1.28 for now?
19:20:26 <sisbell> Then we would have time to do testing for the release
19:20:42 <GeKo> so 1.27.2 is still broken
19:20:59 <GeKo> and i know that the nightly on 06/01 is working
19:21:23 <GeKo> my plan would be that you work on the orbot build integration into tor-browser-build
19:21:41 <GeKo> while i continue the investigation for #27443 so that we save some time
19:21:55 <GeKo> i think i can figure our the issue tomorrow or on wed
19:22:08 <sisbell> GeKo: Sure, I'll start back up on orbot then + the makefile
19:22:25 <GeKo> so, it should give us plenty of time to prepare all the patches to have our stuff for building ready this week
19:22:40 <GeKo> sounds good, please coordinate with sysrqb for the build process
19:22:46 <sisbell> When does code complete need to be done, leaving time for testing?
19:23:30 <GeKo> what do you mean?
19:24:00 <sisbell> I assume there's a block of time before release that we need for testing
19:24:26 <sisbell> of the apk
19:24:46 <GeKo> yes
19:25:13 <GeKo> ideally we only need to worry about features to get in next week and test our toolchain as good as we can
19:25:22 <GeKo> but all the toolchain work landed by then
19:25:43 <sisbell> Ok, that makes sense.
19:25:53 <GeKo> great, thanks
19:26:08 <GeKo> pili: i think it's your turn
19:26:37 <pili> hi, just a reminder that we have the release meeting this week on Wednesday at 18:00 UTC
19:26:57 <GeKo> 19:00
19:27:21 <GeKo> or otherwise i can't make it (again :) )
19:27:38 * GeKo pili got stuck in CEST
19:27:42 <pili> oops, I keep getting that one wrong, I need to update my calendar :D
19:27:46 <pili> (sorry :) )
19:28:05 <GeKo> we caught it earlier this time :)
19:28:48 <pili> that's all!
19:28:56 <GeKo> okay.
19:29:10 <GeKo> arthuredelstein: do you have an update?
19:29:27 <GeKo> (i know this questions starts to sound weird, but still ;p )
19:29:59 <arthuredelstein> GeKo: Is it not visible on the document?
19:30:17 <GeKo> hm. let me reload
19:30:19 * antonela cannot bold
19:30:21 <arthuredelstein> maybe it didn't sync
19:30:34 <sysrqb> nope, not showing here, too
19:31:00 <arthuredelstein> just a sec, I will try pasting it again
19:31:14 <GeKo> antonela: hey, do we plan aUX sync this week for the security controls?
19:31:20 <GeKo> *a UX
19:31:29 <antonela> yes, we should
19:31:37 <antonela> the release metting is at the same hour
19:31:56 <antonela> do you want to take over it? or having another meeting?
19:32:09 <arthuredelstein> I pasted it again, is it visible?
19:32:14 <arthuredelstein> right above nov 5
19:32:14 <GeKo> pili: ^
19:32:26 <GeKo> arthuredelstein: now i see it, thanks
19:32:26 <pili> we could share, I don't mind :)
19:33:29 <antonela> wow i lost my update after reload for arthur :/
19:33:37 <GeKo> arthuredelstein: so, do you have determined when your last day working on code will be?
19:33:46 <GeKo> i mean as part of the tor browser team?
19:34:06 <GeKo> i am just wondering about the thing you want to do until then
19:34:09 <GeKo> *things
19:34:48 <arthuredelstein> GeKo: Last official day would be Nov. 21
19:34:56 <GeKo> or are those the items you listed on the pad
19:34:58 <GeKo> ok
19:36:31 <arthuredelstein> Let me know if there are any things it would be useful for me to do between now and then
19:37:11 <GeKo> i think getting the permissions patch working and upstreamed sounds useful
19:37:29 <GeKo> i wonder about upstreaming #22343 as well
19:37:42 <GeKo> maybe that could be something for ethan's team, though
19:37:44 <arthuredelstein> I will still be around for discussions indefinitely to help with handing things off
19:37:57 <arthuredelstein> yes, I can at least get that started
19:38:03 <GeKo> indefinitely? sounds good! :)
19:38:09 <antonela> (:
19:38:18 <arthuredelstein> assuming I am immortal :)
19:38:25 <pospeselr> hah
19:38:35 <sysrqb> reasonable assumption
19:38:56 <GeKo> arthuredelstein: could you add the items you think you need/should hand off to the discussion item on restructuring the team?
19:39:09 <GeKo> (while we finish our status updates)
19:39:26 <arthuredelstein> sure!
19:39:44 <GeKo> antonela: okay, i think you are up
19:39:59 <antonela> thanks
19:40:08 <antonela> tor browser icon survey ended and I updated the ticket with the winner! I also made a different version for each channel release
19:40:20 <antonela> which are the plans? wait for 8.5? release on next release?
19:41:28 <GeKo> hm.
19:41:53 <GeKo> i am not sure about what is needed for having different icons for different series
19:41:58 <antonela> i played with iconutil and i have an .icns for mac os. I'll have assets for tba as well, both app and playstore. I need to read more about Windows and Linux.
19:42:06 <GeKo> so far we only had one icon for everything.
19:42:16 <GeKo> thus, this might need some time for investigation
19:43:13 <GeKo> antonela: how about you finish the assets while we figure out what we need on our side for icons on three different series?
19:43:17 <pili> can we get some help from firefox folks on this tjr?
19:43:32 <sysrqb> mozilla user different branding directories for each, i tihnk we'd need some changes for supporting this
19:43:36 <pili> I assume this is something that is done for firefox also
19:43:37 <sysrqb> err, *use
19:43:42 <pili> aah
19:43:46 <GeKo> yeah
19:43:54 <pili> thanks for clarifying :)
19:44:08 <antonela> GeKo: sounds like a plan - let
19:44:09 <GeKo> who wants to grab that investigation and run with it?
19:44:15 <tjr> I dont know anything, but if you can write up what you need I can ask around?
19:44:16 <antonela> let's do it
19:44:45 <pili> tjr: it's ok, I think the team here knows how that could work :)
19:45:35 <GeKo> mcs: could brade and you put that on your list?
19:46:00 <GeKo> i think all the other folks might be busy with wrap up or tba release
19:46:09 <GeKo> or fixing test suites
19:46:46 <GeKo> pospeselr: or you if you want to have some distraction :)
19:46:52 <mcs> GeKo: We can take a look. Do we need to work on it now or soon or ?
19:46:53 <pospeselr> yeah sounds like a nice divergence
19:47:19 <antonela> pospeselr :D
19:47:20 <GeKo> mcs: nowish would be good but let richard take it
19:47:27 <GeKo> pospeselr: thanks
19:47:31 <mcs> OK; thanks!
19:47:32 <pospeselr> :D
19:47:39 <GeKo> okay, long status updates
19:47:46 <GeKo> anything more for today in that regard?
19:48:14 <GeKo> discussion time then i think
19:48:21 <GeKo> so, two announcements first
19:48:58 <GeKo> 1) it's time for ou bi-annual 1:1s again, so just to give everyone a heads-up and that everyone can start think about it
19:49:09 <GeKo> i'll reach out to folks individually
19:49:26 <GeKo> (arthuredelstein: to you as well :) )
19:49:53 <GeKo> 2) we need to restructure who is doing what now that arthur is leaving
19:50:06 <GeKo> we should all think about those items arthur started to list
19:50:24 <GeKo> we probably need to drop some and others need to get picked up by other folks
19:50:37 <GeKo> we should make a decision about it next week
19:50:49 <GeKo> to have some smooth transition
19:51:22 <mcs> Kathy and I can take the lead on the annual rebase unless someone else wants it.
19:51:29 <GeKo> arthuredelstein: the uplift/mozilla coordination is missing from the things we need to take over
19:51:35 <arthuredelstein> yes, I just added that
19:51:36 <GeKo> right?
19:51:43 <GeKo> hah, thanks
19:51:50 <GeKo> mcs: noted
19:52:05 <GeKo> alright
19:52:16 <arthuredelstein> I'm hoping to continue to attend those meetings, but good to have someone actually from Tor Browser team there.
19:52:22 <GeKo> pili: it's you again if you want about the snap store idea
19:52:41 <pili> hi, yes, not sure if everyone saw irl's email about the snap store
19:52:51 <irl> hello
19:52:56 <pili> hi :)
19:53:01 <GeKo> arthuredelstein: yeah. i think it's too important for tor/moz coordination. so we should make sure someone from tor is showing up
19:53:22 <irl> i can talk about the snap store if that is useful
19:53:22 <arthuredelstein> definitely
19:53:37 <pili> I was wondering what people here thought about it and what we can do to help out
19:53:41 <GeKo> irl: so, how is the tor browser snap created right now?
19:53:50 <pili> irl: yup might be useful to give some context
19:54:14 <irl> currently we use a modified torbrowser-launcher
19:54:29 <irl> we ship the tarball inside the snap and then when a user runs it it is extracted into their home directory on first run
19:54:36 <irl> subsequent runs just launch from the home directory
19:54:49 <irl> we use tor browser's updater to make the updates go over tor
19:55:09 <GeKo> so, this takes the builds as we distribute them?
19:55:13 <irl> yeah
19:55:47 <boklm> do snaps provide an update mechanism?
19:55:55 <sysrqb> it would be nice if we could help micah with torbrowser-launcher
19:55:56 <irl> they do
19:56:00 <sysrqb> but we're already overloaded, it seems
19:56:42 <irl> i was at canonical's offices last week and they are keen for us to get this snap into the store
19:56:47 <irl> so they can provide us with help
19:56:58 <irl> in particular, they offered to test the snap before we publish it
19:57:07 <irl> just using it to browse around and click things
19:57:23 <sysrqb> i'm worried about your comment that torbrowser-lancher spends a significant amount of time broken (in some way)
19:57:28 <irl> right
19:57:38 <irl> this is because it is broken in ubuntu's universe archive
19:57:46 <irl> while the github releases are all working nicely
19:57:51 <irl> and ubuntu ships a broken thing for 6 months
19:58:00 <sysrqb> ah!
19:58:04 <pospeselr> is that on us for not providing timely updates?
19:58:15 <irl> nope, it's on the ubuntu packaging maintainer
19:58:19 <irl> (hint: there isn't one)
19:58:19 <pospeselr> or is it a side effect of the ubuntu apt-get release cycle?
19:58:23 <boklm> do you know if the firefox snap (if it exists) is using the firefox internal updater, or using snap to update itself?
19:58:37 <irl> there is a firefox snap and the tor browser snap is based on this
19:58:44 <irl> i don't know if it's using its internal updater or not
19:58:51 <irl> i would guess not as it's system-wide installation
19:59:09 <irl> i didn't want to spend the time hacking tor browser into something that can be installed system wide
19:59:31 <boklm> ah, yes
19:59:35 <GeKo> but that would be near to have :)
19:59:41 <GeKo> *neat
19:59:55 <irl> if tor browser team make a system wide installable tor browser, i'll make a snap for it
19:59:56 <mcs> what is the advantage to us using the browser updater vs. relying on the snap update mechanism?  quicker updates?
20:00:05 <irl> mcs: easier packaging
20:00:30 <irl> if we use the snap mechanism then we have to modify torbrowser-launcher to also update the already installed tor browser
20:01:24 <boklm> so having a system installable tor browser would avoid the need to use torbrowser-launcher
20:01:34 <irl> yeah, it would look more like the firefox snap then
20:01:45 <irl> but if we had this then we'd already have torbrowser debian packages
20:02:11 <irl> this is the main debian policy blocker
20:02:20 <sysrqb> is that advantage of torbrowser-launcherover tor-browser that torbrowser-launcher comes with additional hardeneing?
20:02:26 <irl> no
20:02:32 <irl> we actually have to disable this for the snap store
20:02:44 <irl> snaps provide their own "confinement" but it's for the whole snap
20:03:01 <irl> we can't use it to isolate the different parts of tor browser as the apparmor policies in the launcher do
20:03:22 <irl> i have discussed this with canonical people, and it looks like it could go on the roadmap, but not in the near future
20:04:21 <irl> i think the main benefits of the snap are ease of installation and that we're in control of the update cycle
20:04:27 <GeKo> i wonder whether we should think harder about our linux mess
20:04:42 <GeKo> like: what do we want?
20:04:51 <GeKo> what can and should we support?
20:05:10 <irl> i did discuss briefly in mexico that we should really have a packaging/software distribution person
20:05:14 <GeKo> with my tor browser hat on  i am happy the way mozilla daies this
20:05:20 <GeKo> *does
20:05:30 <irl> what does mozilla do?
20:05:30 <GeKo> they provide the source code and ship bundles
20:05:42 <irl> what is a bundle?
20:05:52 <GeKo> but the distros pick this up and provide firefox as they see fit
20:06:00 <GeKo> a .tar.xz file
20:06:17 <GeKo> and the distros have good coordination with upstream
20:06:26 <irl> a firefox release manager was my mentor for joining the debian project
20:06:32 <GeKo> yeah
20:06:38 <irl> they are not relying on solely distros picking it up
20:06:46 <GeKo> glandium is working for mozilla as well
20:06:49 <GeKo> sure
20:07:00 <GeKo> but the point is
20:07:18 <GeKo> they don't provide linux firefox release for all the distros themselves
20:07:31 <GeKo> and we as the tor browser team should not do this either i think
20:07:46 <irl> ah right, i don't think the tor browser team should do this
20:07:57 <irl> i think we should have a packaging person
20:08:16 <sysrqb> es sense :/
20:08:16 <sysrqb> ~.
20:08:17 <GeKo> that might be a good thing, yes
20:08:34 <GeKo> so, we should look at that as part of the application team
20:08:51 <irl> for now i'm probably ok to maintain the tor browser snap but i'd be happy to hand it off as soon as a person appears to hand it off to
20:08:56 <boklm> I think having some way to install a Tor Browser on a read only partition (for system install) would be nice and allow easier packaging
20:09:05 <irl> boklm: definitely
20:09:29 <boklm> I'm wondering if Tails is doing something like that
20:09:52 <GeKo> irl: okay, how do we proceed?
20:10:19 <irl> the process can happen pretty independently of any release cycle as we can just ship whatever is the latest at the time we do it
20:10:27 <GeKo> should i reply to your mail and point to the applications team and some packaging person we might want?
20:10:30 <irl> mostly i need to coordinate with stephw
20:10:42 <irl> canonical would like to do comms stuff about it
20:10:50 <irl> GeKo: yes, that sounds good
20:10:50 <GeKo> i can imagine
20:11:20 <GeKo> okay. i'll do that tomorrow then or on wed
20:11:29 <irl> excellent (: thanks
20:11:36 <pili> sounds good :)
20:11:45 <GeKo> irl: thanks for picking that up
20:11:58 <GeKo> do we have anything else to discuss for today?
20:12:19 <boklm> later maybe we could look at integrating the snap build into our build process
20:12:49 <GeKo> hm!
20:13:10 <sysrqb> i'm still not sure i understand the benefit of using torbrowser-launcher over just shipping the tarball and extracting it
20:13:15 <sysrqb> but that's okay :)
20:13:30 <pospeselr> sysrqb: same
20:13:36 <GeKo> it gives you a more linuxy experience
20:13:42 <GeKo> about getting stuff from your distro
20:13:49 <GeKo> via apt-get
20:14:12 <GeKo> and not needing to deal with tarballs (and signatures!)
20:14:12 <sysrqb> right, but that's the benefit of the snap, right?
20:14:19 <pospeselr> but why not just have a deb for the latest tor-browser in the apt-get repos?
20:14:25 <sysrqb> i'm not sure why the snap needs to use torbrowser-launcher
20:14:32 <boklm> sysrqb: I think the issue is that snap can only install files read-only, but current tor browser bundles expect the users to have write permission on it
20:14:46 <sysrqb> ahhhh
20:14:57 <sysrqb> that'd make sense
20:14:59 <GeKo> okay folks let me end the meeting and then we can discuss further
20:15:07 <sysrqb> okay :)
20:15:12 <GeKo> sorry for the long meeting, thanks all! *baf*
20:15:15 <GeKo> #endmeeting