16:00:02 <meskio> #startmeeting tor anti-censorship meeting
16:00:02 <MeetBot> Meeting started Thu Jul 25 16:00:02 2024 UTC.  The chair is meskio. Information about MeetBot at http://wiki.debian.org/MeetBot.
16:00:02 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic.
16:00:05 <shelikhoo> hi!
16:00:06 <meskio> hello verybody!!
16:00:06 <shelikhoo> hi~
16:00:10 <ggus> hola
16:00:12 <meskio> here is our meeting pad: https://pad.riseup.net/p/r.9574e996bb9c0266213d38b91b56c469
16:00:14 <meskio> ask me in private to give you the link of the pad to be able to edit it if you don't have it
16:00:16 <meskio> I'll wait few minutes for everybody to add you've been working on and put items on the agenda
16:01:33 <onyinyang> hihi
16:01:42 <arma2> hello world
16:01:46 <meskio> it doesn't look like we have much to discuss
16:01:59 <meskio> I guess summer time in the north emisphere :)
16:02:13 <meskio> let's give it some minutes to see if someone has something
16:04:15 <meskio> Roger wrote up his Snowflake blocking experiment notes, https://lists.torproject.org/pipermail/anti-censorship-team/2024-July/000343.html
16:04:23 <meskio> ^- from the announcements
16:04:33 <meskio> pretty cool, I haven't fully readed yet
16:04:33 <arma2> i spoke to dcf/cohosh/shel about that at pets, but figured i should write it up for the folks who didn't make it to pets too
16:04:39 <meskio> but very interesting results
16:05:09 <arma2> tl;dr i wrote a script to be my own little great firewall for snowflake, and when i censored myself very slowly and conservatively, snowflake still kinda worked
16:05:48 <arma2> most interesting result, i believe we have a roadmap item for increasing enumeration-resistance of snowflake,
16:05:50 <gaba> o/
16:06:01 <arma2> and we could do that well by finding a way to use more of our restricted-nat proxy pool
16:06:47 <meskio> yes, that would be nice
16:07:01 <arma2> (or getting a lot more proxies into the unrestricted pool, or finding a bug where it turns out more of our proxes are actually unrestricted, or etc)
16:07:25 <ggus> i wonder how much effort worth it to do enumeration-resisance defense in snowflake. thinking of two other real world censorship events where they blocked snowflake by fingerprinting (iran and russia)
16:08:33 <arma2> i figured the first step to answering the 'worth it' part was to understand how effective a really easy attack is. and it is not completely effective.
16:08:48 <shelikhoo> we could start with some initial steps such as rate limiting the requests by source IP
16:09:03 <shelikhoo> which is not that engineering intensive
16:09:21 <shelikhoo> which should just work once we moved to use new broker
16:09:36 <trinity-1686a> finding a way to use more of our restricted-nat proxy => would be interesting to know how much is behind symmetric nat vs how much is behind various kind of cone
16:10:44 <arma2> it does seem like some more investigation of the specific nat situation for our volunteers could be a big win if we find something
16:13:02 <meskio> yep, next year we are supposed to improve the enumeration-resistance as part of a grant, we should explore a bit more what is needed there
16:13:19 <meskio> I think is nice to make it hard so censors keep trying to fingerprint instead of enumerating
16:13:29 <arma2> shelikhoo: yep! two notes on the rate limiting idea, (a) you might want to treat tor exits specially, like bridgedb does, and (b) some of the signaling channels let you know the ip address of the requestor, but some do not
16:14:39 <arma2> meskio: agreed, this is a good goal (make sure enumeration is not the lowest hanging fruit)
16:15:32 <shelikhoo> yes, we will need to consider them
16:16:15 <arma2> some future experiment i might do is simply: run snowflake on its own in a tight loop, scooping out the whole database from the broker. i expect that's what those jerks on github did / are doing.
16:16:45 <arma2> (i didn't want to do that here, because i think done poorly this experiment would actually deny service to the real snowflake users.)
16:19:58 <meskio> we should update https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/Research-ideas
16:20:07 <meskio> there is an entry about snowflake enumeration
16:20:30 <shelikhoo> yes... maybe just paste the irc log?
16:20:49 <shelikhoo> I think it is true that there is a lot of considerations we wants to make
16:21:17 <shelikhoo> and it would require a write up and issue, not something we could think up in irc meeting in real time
16:22:15 <meskio> we can link this meeting logs and arma2 email
16:22:20 <meskio> I'll do that after this meeting
16:22:42 <shelikhoo> I think even simple steps could make listing proxy with scripts much harder
16:23:45 <meskio> yep
16:24:35 <meskio> anything more on this topic?
16:24:46 <arma2> not from me
16:24:53 <shelikhoo> eof on this topic
16:25:09 <meskio> from the interesting links:
16:25:14 <meskio> https://arxiv.org/abs/2405.13310 "Bytes to Schlep? Use a FEP: Hiding Protocol Metadata with Fully Encrypted Protocols"
16:25:16 <meskio> update to https://censorbib.nymity.ch/#Fenske2023a "Security Notions for Fully Encrypted Protocols" from FOCI 2023
16:25:32 <meskio> there are also this year FOCI papers out already
16:25:59 <meskio> once more people is around we can look into our next reading paper
16:26:10 <meskio> https://github.com/tst-race/raceboat/tree/documentation Raceboat source code
16:26:13 <shelikhoo> yes! nice!
16:26:22 <arma2> there were also some censorship-related papers at pets, e.g. yeah raceboat
16:27:04 <meskio> yes, cool to see raceboat published
16:27:05 <shelikhoo> I will have a look at the race boot source code, really curious how many language they used to create it
16:27:40 <shelikhoo> I will have a look at the race boat source code, really curious how many language they used to create it
16:27:42 <meskio> is a weird mix
16:27:55 <arma2> shelikhoo: part of their goal is to have hooks in a lot of different languages, so you can write your PT in go or python or C or etc
16:28:07 <arma2> hopefully the core raceboat stuff is only one language :)
16:28:36 <shelikhoo> arma2: yes, and that would make it super super hard to get it on constraint environment like mobile
16:30:04 <shelikhoo> I chatted with them and they are not targeting iOS users
16:30:13 <shelikhoo> which we kind of do
16:30:22 <meskio> are they targeting android?
16:30:53 <shelikhoo> I think they are, or kind of?
16:31:03 <shelikhoo> I see there are arm64-v8a targets
16:31:11 <shelikhoo> so it might work on android
16:31:46 <meskio> wow, using python and go in android all together sounds complicated
16:31:58 <arma2> yes, android was one of the big target architectures for race
16:32:16 <shelikhoo> and also cpp
16:32:18 <arma2> and also yes, "what the hell why is this so complicated" is a very legitimate question :)
16:33:06 <meskio> :D
16:33:07 <shelikhoo> I think they are hiring different people with different knowledge about their favorite language
16:33:10 <onyinyang> lol
16:33:21 <shelikhoo> so as a result everyone kind of write their own thing
16:33:43 <arma2> shelikhoo: it wasn't so much hiring as 'race had different teams each doing their own thing, and the raceboat people had to handle them all'
16:33:45 <shelikhoo> then someone else is tasked with glue them all together
16:33:57 <arma2> yes
16:33:59 <shelikhoo> yes...
16:34:17 <meskio> uff
16:34:51 <arma2> which is not *too* different than the pluggable transport ecosystem
16:35:10 <arma2> which grew goptlib, something in swift, something for py, etc
16:35:30 <arma2> you could legitimately ask why *that* ecosystem is so complicated, too :)
16:35:39 <shelikhoo> yes, and we are using exec/fork/stdio and socket as interface
16:35:45 <shelikhoo> not dynamic library
16:36:00 <arma2> except on ios where it all needs to be one big blob :)
16:36:08 <shelikhoo> so the runtime is not that kind of issue when Tor's PT spec was designed
16:36:30 <shelikhoo> I believe they designed their system after Android and iOS is a thing
16:36:52 <meskio> yes,yes, but PTs were designed before mobile was a thing
16:37:11 <meskio> and now we dream on a future where PTs are arti libraries, possibly just in rust
16:37:46 <shelikhoo> that was kind of a distant future... but I will use my friday to learn rust now
16:38:04 <meskio> true, distant future
16:38:15 <meskio> rust is fun, but I find it harder to learn than go
16:38:43 <meskio> the last interesting link:
16:38:45 <meskio> https://github.com/v2fly/v2ray-core/discussions/3096
16:38:47 <meskio> V2Ray has received a security audit from 7ASecurity
16:38:49 <meskio> https://www.opentech.fund/security-safety-audits/v2ray-security-audit/
16:38:52 <meskio> congrats for v2ray
16:38:54 <meskio> pretty cool
16:39:04 <shelikhoo> hehe
16:39:04 <onyinyang> nice
16:39:11 <shelikhoo> yes! the report is now public
16:39:48 <shelikhoo> and the security audit found no major issue in V2Ray
16:39:54 <meskio> nice they didn't find anything major
16:40:43 <meskio> anything more, should we close this meeting?
16:40:48 <shelikhoo> eof from me
16:41:17 <onyinyang> fine by me
16:41:41 <meskio> #endmeeting