15:01:58 <pili> #startmeeting S27 11/12
15:01:58 <MeetBot> Meeting started Tue Nov 12 15:01:58 2019 UTC.  The chair is pili. Information about MeetBot at http://wiki.debian.org/MeetBot.
15:01:58 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic.
15:02:13 <dgoulet> o/
15:02:15 <antonela> o/
15:02:19 <acat> hi!
15:02:22 <pili> I moved the pad here for now: https://pad.riseup.net/p/s27-meeting-keep
15:02:22 <mcs> hi everyone
15:02:29 * GeKo is somewhat here
15:02:34 <pili> since we'll be decommissioning soon
15:02:47 <asn> hello all
15:03:17 <pili> decommissioning storm soon I should say
15:03:23 <pili> please add your notes
15:03:26 * asn doing
15:03:35 * antonela too
15:03:38 <alecmuffett> politeness question: if I have a blob of text that may need discussion later, does it get pasted into the channel, or into the pastebin?
15:05:30 <asn> dgoulet: i did the onionbalance part
15:05:47 <asn> alecmuffett: hmm i think it should probably get pasted into the channel
15:05:47 <pili> alecmuffett: best to put it in the pad :)
15:05:50 <pili> oh
15:05:53 <asn> ah ok please follow pili
15:05:57 <pili> depends when you want to discuss it! :D
15:06:17 <pili> if we're discussing it as part of a discussion point you can put it in the channel at that point
15:06:26 <alecmuffett> pili: we'll see how the discussion goes.  I am still not sure what's happening. :-)
15:06:29 <mcs> adding a brief description in the pad under Discussion seems like a good idea
15:06:34 <pili> mcs: +1
15:07:12 <pili> alecmuffett: so we have this onion services project that we're working on and we have a regular meeting to discuss progress and blockers
15:07:20 <pili> every so often we invite external stakeholders
15:07:37 <pili> and right now people are adding their updates to the pad: https://pad.riseup.net/p/s27-meeting-keep
15:07:54 <pili> sorry, I shouldn't assume everyone knows how these things work :)
15:08:21 <pili> we'll give a few more minutes for people to add updates and then we can start the discussion part of the meeting based on what's on the pad
15:08:26 <alecmuffett> < thank you :-) >
15:10:42 <asn> acat: hey thx for the demo! that's cool stuff!!
15:11:01 <acat> :) thanks
15:11:02 <pili> ok, I think we can start
15:11:51 <pili> so we'll start with discussion of Objective 2, Activity 3: Notify users if a current website they are visiting on Tor Browser has an onion service version
15:11:56 <pili> #30024
15:12:22 <pili> acat has been working on #21952
15:12:28 <antonela> good stuff acat !
15:13:00 <asn> yep i like his demo a lot!
15:13:03 <pili> antonela, acat is there any thing that you need to discuss regarding implementation or do you have any questions to resolve on this?
15:13:06 <dgoulet> acat: +9k
15:13:07 <asn> is this a true thing or a mockup so to speak?
15:13:28 <antonela> well, we should run a round of review
15:13:39 <acat> it works, it's the same branch i posted in the ticket
15:13:42 <antonela> im going to be in vacs next week but i'll put it top prior when im back
15:13:44 <antonela> i have questions
15:13:46 <asn> acat: epic
15:14:33 <antonela> one of them is how we are going to manage the persistency, like will we allow users to opt-in via about:preferences and will we have a list?
15:14:53 <antonela> (i dont need answers, just to share my first throughs)
15:15:06 <acat> persistency of automatic redirects settings, right?
15:15:11 <antonela> yes
15:15:18 <asn> per-site or global?
15:15:22 <antonela> both?
15:15:25 <asn> ack
15:15:47 <antonela> and the second question is about performance, the demo loads so fast
15:15:58 <asn> hehe
15:15:59 <antonela> can/are we re use the circuit? should we? should not?
15:16:40 <asn> potentially... maybe... probably we shouldn't... need to think more... unlikely for this sponsor...
15:16:47 <asn> something between the above
15:16:50 <acat> (it loads fast because the .onion and not-onion circuits were already created, that was cheating a bit)
15:16:55 <antonela> :)
15:17:29 <antonela> anyways, good stuff
15:17:37 <asn> yes good stuff
15:17:47 <asn> i see this as an experiemnt anyhow
15:17:52 <antonela> it is
15:18:01 <mcs> I wonder if we should blank the content area or show some clear indication while the .onion is loading
15:18:12 <antonela> good point mcs
15:18:17 <pili> are we planning to release this on some future Tor Browser, e.g 9.5
15:18:19 <asn> to figure out further UX stuff, and behaviors, and also ideas and concepts like what alec has written in the pad
15:18:20 * antonela takes notes
15:18:21 <mcs> (normal browser loading indicator is kind of subtle)
15:18:33 <pili> since we're talking about experimenting... ;)
15:18:38 <asn> :)
15:18:48 <antonela> we can have something also loading at the pill, will think about it
15:19:06 <antonela> since the user focus is already there
15:19:15 <antonela> not sure why but i feel like we talked about it before
15:19:30 <pili> :) I don't remember but maybe it was before my time
15:19:59 <pili> ok, anything else on this?
15:20:03 <mcs> I assume we will release something in a Tor Browser alpha and then try to get feedback
15:20:18 <antonela> mcs that is the plan, yes
15:20:22 <pili> ok, good
15:20:23 <mcs> good :)
15:20:24 <asn> great
15:20:29 <asn> ++acat
15:20:44 <acat> so about the persistence of the setting
15:20:57 <acat> it's still not decided whether it will be global or per-site, right?
15:21:24 <asn> noope
15:21:31 <antonela> i made a proposal to make global, but i see it working per site as well
15:21:50 <antonela> *to make it
15:21:53 <asn> global seems more safe in terms of info leaks
15:21:59 <asn> per-site leaks info about previous visits
15:22:07 <mcs> on the other hand, per site settings are kind of like browser history so we may want to have both options
15:22:12 <mcs> what asn said :)
15:22:21 <acat> yes, i was also thinking about tracking potential
15:22:30 <antonela> https://share.riseup.net/#46aPJezMDWU82l-j7yFwqw
15:22:30 <asn> so perhaps we should play it safe for the beginning
15:22:33 <asn> after all this is an experiment
15:22:37 <acat> although we should be careful this only happens on top-level loads and not iframes and so on, but still
15:22:39 * asn checks antonela
15:22:56 <asn> interesting antonela
15:23:02 <asn> not sure what "Websites already known" means
15:23:09 <asn> but this seems like a plausible settings
15:23:09 <antonela> that is the per-site stuff
15:23:31 <antonela> yes, lets say you opt-in for a site, that is a site you already know
15:23:43 <antonela> but yes, we can think about it
15:24:28 <acat> ok, one more thing: are we considering having some visual feedback when a redirect to .onion has occurred?
15:24:50 <antonela> where exactly?
15:24:58 <antonela> the url gets updated with the onion icon
15:25:16 <acat> i think mcs suggestion of blanking in content goes in this direction (if i'm not wrong), but i was thinking of sth more explicit
15:25:26 <antonela> and also we can have a loading animation at the pill as an option for mcs's point
15:25:45 <antonela> yep, we can make it more explicit
15:25:52 <asn> what does "blanking in content" means?
15:26:05 <mcs> something more obvious and clear would be better than just blanking
15:27:06 <acat> i was thinking something like firefox does with the new tracking protection ui, there's an separate (sometimes animated) icon in the urlbar, left to the lockpad
15:27:17 <acat> just a suggestion, there are many options i guess
15:27:42 <antonela> yep, a gradient effect could work
15:29:03 <acat> ok, so i can try to implement the automatic redirects and persistence next (global, for now), and maybe try some visual feedback of the redirect?
15:29:23 <pili> ok, this could be a good point to throw in the discussion about #32256
15:29:31 <antonela> acat: could you work on about:preferences first?
15:29:45 <antonela> acat: i can work on the visual feedback when im back
15:29:57 * asn is slightly familiar with #32256
15:29:59 <pili> (sorry, carry on)
15:30:07 <pili> #32256 can wait a bit longer
15:30:24 <acat> antonela: sure! makes sense
15:30:33 <antonela> acat: awesome, great work!!
15:32:14 <pili> ok
15:32:19 <pili> let's move on to #32256 then?
15:32:34 <asn> ack
15:33:04 <pili> alecmuffett: I don't know if you want to start or whether others have some other opinions or discussion points based on your notes?
15:34:04 <pili> I've added this ticket as an S27-can
15:34:24 <pili> not sure if GeKo or mcs or anyone else on the browser team have any views on this
15:34:30 <alecmuffett> I've posted my thoughts in the pad, and I've been sporadically batting these issues back and forth with GK in one of the trac tickets
15:34:37 <alecmuffett> so I'm interested to hear opinions
15:35:10 <GeKo> pili: my views are on the ticket :)
15:35:23 <GeKo> although we are still not done
15:35:30 <mcs> I have not read all of the discussion in #32256 yet so I do not have an opinion right now (sorry!)
15:35:48 <GeKo> i think the important point here is
15:35:51 <alecmuffett> My goal is to increase adoption by simplifying/enabling use of standard features as-used in common big websites.
15:36:02 <alecmuffett> (and: standard webclients, too)
15:36:03 <GeKo> that we want to have a way to signal the server we support onions
15:36:15 <GeKo> without them needing some hacks to figure that out
15:36:38 <GeKo> like looking at relay list
15:36:39 <GeKo> s
15:37:08 <asn> right
15:37:11 <alecmuffett> For those who have not read the ticket, my solution to GeKo's need would be to add "... Tor/1" to the User Agent, or similar string
15:37:25 <asn> i've mainly read the first post by alec, but not the subsequent discussion
15:37:28 <asn> i found it reasonable
15:37:46 <asn> but i also felt it shakes The Foundations. but perhaps that's a good thing.
15:38:08 <asn> where by foundations, i mean "tor browser should not make it easy for websites to learn that it's tor browser"
15:38:16 <asn> but i definitely get alec's argument against The Foundations.
15:38:34 <asn> so yeah i'm kinda neutral here, and I could get persuaded that alec's way is the right way.
15:38:40 <pili> there are already some sites that automatically re-direct you to the onion site if they "somehow know" you have "onion capabilities"
15:39:03 <pili> we had a brief discussion about this some days ago on some channel ( I forget the site and which channel unfortunately...)
15:39:17 <alecmuffett> my argument: "we're already past the point where we can assume ignorance on the part of people who want to BLOCK tor clients, without adding commensurate ease for people to BE NICE TO tor clients."
15:40:13 <pili> based on the behaviour for that website I'm assuming it's not actually that hard to already be nice to onion-capable clients by offering them the .onion site if available
15:40:18 <alecmuffett> pili: Yes; that's in the ticket too.  PrivacyInternational have one such.   It;s a horrible hack, and if replicated would kill websites that want to scrape the consensus.
15:40:30 <pili> ah, yes, that's the one
15:40:34 <alecmuffett> I would know, because I once did much the same at Facebook.
15:40:41 <pili> :)
15:40:44 <alecmuffett> <sorry>
15:40:57 <asn> i feel like the main argument against #32256 is "How many more websites will block Tor if we change the UA?"
15:41:13 <GeKo> one thing i realized during the discussion is that we want to retain the option of users opting out
15:41:28 <asn> oh an option!
15:41:29 <GeKo> that is they might decide to not have this site loaded over onion
15:41:38 <alecmuffett> expecting all the world's onion-friendly websites to poll a directory of IP addresses of exit nodes (which: is incomplete and flaky) is suboptimal for adoption.
15:41:50 <alecmuffett> GeKo: maybe.
15:42:02 <alecmuffett> Have you tried opting-out of HTTPS recently?
15:42:20 <GeKo> well
15:42:35 <GeKo> we move forward with the onion-location work in #21952
15:42:52 <GeKo> which includes options for users
15:42:57 <antonela> mostly (hoping) for opt-in s
15:43:05 <GeKo> it would be weird if #32256 would ignore that decision
15:43:32 <alecmuffett> GeKo: the "Onion-Location" idea is lovely, but I don't know any site that would adopt it
15:44:58 <asn> fwiw, i doubt we can take this decision in this meeting
15:45:01 <asn> so how should we proceed?
15:45:04 <asn> (someone had to say this)
15:45:04 <pili> so what I'm getting from this discussion is that if we were to consider sending a user agent to allow websites to identify tor browser we would have to allow users to consent to be re-directed to the onion site
15:45:08 <pili> asn: thanks :)
15:45:23 <pili> and yes, it doesn't seen like we will make a decision
15:45:37 <GeKo> asn: what decision?
15:45:48 <asn> do #32256 or not
15:46:00 <GeKo> you mean as part of s27?
15:46:14 <asn> in general i guess (?)
15:46:18 <alecmuffett> You might get *some* adoption of "Onion-Location" if it's easy to detect/offer Tor-capable clients, but frankly whomever is tasked with onionification of their site, wants to see their metrics for usage go *up* and will therefore issue a straightforward "Location" header
15:46:19 <GeKo> or in general?
15:46:19 <asn> or as part of s27
15:46:28 <asn> not sure.... it's the s27 meeting after all...
15:46:29 <alecmuffett> Because that will make their boss happy.
15:47:00 <GeKo> alecmuffett: yeah, and we produce a browser trying to make the user happy
15:47:05 <pili> I think it could be interesting to figure out a) if it makes sense to prototype this as part of S27 and how much effort that would be b) the reasons why we wouldn't want to do #32256 c) how to ensure users can opt-in
15:47:22 <antonela> i feel #32256 is out of scope s27
15:47:43 <antonela> altho is a good topic to discuss for the future of onions
15:47:47 <alecmuffett> GeKo: I understand that, and it's a primary tension between Tor-as-exit-nodes versus Tor-as-onion-networking
15:48:37 <pili> ok, I think we can wrap this up for now and continue on the ticket
15:48:40 <asn> ack
15:48:43 <GeKo> alecmuffett: i think we can get both groups happy fwiw
15:48:54 <asn> i also wanted to ask how mcs found our client auth branch wrt client auth
15:48:55 <GeKo> but we should be careful not throwing either under the bus
15:48:57 <asn> is it good enough for now mcs?
15:49:02 <pili> I want to have at least 10 minutes for the last point
15:49:07 <asn> ah sorry
15:49:08 <asn> there is a last point?
15:49:12 <pili> asn: it's fine, go ahead
15:49:14 <asn> which one is it?
15:49:17 <pili> about O2A5 and HTTPSE
15:49:19 <asn> oh yes
15:49:38 <alecmuffett> GeKo: That's cool; the question then becomes "does being redirected to a Tor-specific Onion Site generally make you Happy or Unhappy as a Tor user?"
15:49:39 <pili> although it's more about who will work on it from browser side, so maybe we can take that to the browser meeting later on today
15:49:50 <alecmuffett> Given that video works faster, I lean towards Happy.
15:50:04 <mcs> asn: it seems to be good enough. we are not yet using all of the new capabilities, e.g., the control port commands for listing and removing keys but I assume they work :)
15:50:11 <asn> mcs: ack!
15:50:18 <asn> pili: ok on to the last point
15:50:32 <mcs> asn: getting that merged into tor soon would be cool!
15:50:47 <asn> dgoulet: are we waiting for something there before merging?
15:50:50 <asn> or just testing from TB team?
15:51:27 <dgoulet> for adding/removing client auth, waiting on nothing
15:51:42 <dgoulet> asn: although it is in needs_revision, not sure why
15:51:51 <asn> mcs: ok we will look into it
15:51:55 <asn> hm
15:52:33 <pili> GeKo: do we have any idea about who can work on HTTPSE yet? or should we take that to the team meeting?
15:52:54 <GeKo> when would that work start?
15:53:17 <pili> last I double checked it was scheduled for this month (november)
15:53:28 <pili> but maybe we need to move to next month (december)
15:53:34 <GeKo> because we have right now 2 or 3 people working on s27 stuff
15:53:50 <GeKo> and adding that one would mean yet another one
15:54:18 <GeKo> i really like to get some info back from the eff folks as well if possible
15:54:21 <pili> yeah
15:54:27 <pili> ok, let's move to december then
15:54:30 <GeKo> i wonder whether we should ping them harder
15:54:48 <GeKo> that's what i would suggest, yes
15:55:03 <pili> yup, probably
15:55:04 <pili> maybe try other channels also
15:55:05 <pili> all right, any other last minute items for the last 5 minutes?
15:55:48 <antonela> should we develop a plan b if eff folks don't reply?
15:56:11 <asn> let's also include bill on our  bump email to eff
15:56:26 <pili> antonela: yes, I think we might have to
15:56:43 <antonela> is not bill there?
15:56:53 <asn> not on the thread im looking at
15:56:57 <asn> To: alexis@eff.org, andres <andres@eff.org>, Jeremy Gillula <jeremy@eff.org>
15:57:20 <GeKo> yeah, we should add him in the second ping
15:57:23 <pili> is bill still involved with httpse though? I wasn't sure that's why I didn't include him
15:57:23 <antonela> oki, i could add bill
15:57:28 <asn> i'm also not sure exactly what is to be discussed with EFF
15:57:46 <antonela> check if they are going to maintain httpse, lists?
15:57:47 <GeKo> well, the maintenance
15:57:48 <alecmuffett> pili: Just an appeal: I understand that the goal of Tor is primarily (?) to protect the user; but the site administrators who are attempting to build user experiences over Onion are not the enemy of Tor users.
15:57:50 <pili> well, whether there is anyone from EFF we need to work with on this
15:57:57 <GeKo> and they miigh help with parts
15:58:04 <GeKo> yeah
15:58:07 <GeKo> *might
15:58:14 <asn> right
15:58:16 <pili> alecmuffett: got it :)
15:58:22 <asn> fwiw, we greatly restricted the scope of O2A5 in stockholm
15:58:28 <asn> to the point that i feel like the mods are not gonna be so big
15:58:51 <GeKo> yeah
15:59:04 <GeKo> i am not worried if the eff is not doing anything here
15:59:05 <asn> it's still worth talking to them
15:59:16 <GeKo> exactly
15:59:17 <pili> ok, so we start this work in december
15:59:22 <pili> ideally with their knowledge
15:59:27 <GeKo> yep
15:59:27 <asn> ok
15:59:30 <asn> who wants to write the bump email
15:59:30 <asn> ?
15:59:47 <pili> I can do it and I also don't mind if someone else wants to give it a try ;)
15:59:52 <GeKo> pili seems to be a good choice
16:00:05 <asn> ack
16:00:35 <pili> ok, will do that
16:00:58 <asn> ok great
16:01:02 <pili> let's leave things there then
16:01:03 <pili> ending the meeting...
16:01:04 <antonela> awesome
16:01:05 <pili> #endmeeting