[tor-dev] Attributes of Current Public Bridges

2014-01-20 Thread Matthew Finkel
Hi everyone, Over the last few days there were a few questions raised regarding the current status of public bridges and their pluggable transports. I've written a script to gather some data points using the sanitized bridge descriptors and extrainfo documents provided on metrics.tp.o. If anyone i

Re: [tor-dev] Unable to clone gitian-builder repository

2014-01-20 Thread David Fifield
On Mon, Jan 20, 2014 at 06:16:46PM -0500, Jacob Garber wrote: > I apologise if this doesn't belong in this list and for my inexperience. > I am trying to clone the gitian-builder repository to test out the > deterministic builds, but > I'm running into an issue: > "warning: remote HEAD refers to no

[tor-dev] Unable to clone gitian-builder repository

2014-01-20 Thread Jacob Garber
I apologise if this doesn't belong in this list and for my inexperience. I am trying to clone the gitian-builder repository to test out the deterministic builds, but I'm running into an issue: "warning: remote HEAD refers to nonexistent ref, unable to checkout." It creates the gitian-builder direct

[tor-dev] Security issue

2014-01-20 Thread tortestprivacy tortestprivacy
Hello I found a security issue in Tor. With Tor Browser Bundle default settings any web-site can access to local resources by JavaScript and XMLHttpRequest. For example ANY web-site can scan local ports sending a requests to http://127.0.0.1:port and see what port is opened. For example: http:

Re: [tor-dev] Allowing NAT for relay/exit nodes - Bootstrap file size

2014-01-20 Thread Ximin Luo
This would be a nice-to-have, but not a priority for Tor. OTOH, that functionality is more vital for i2p, who are exploring the idea of integrating into Tor's PT system: https://trac.torproject.org/projects/tor/ticket/10629 Also, right now, no PT servers can actually traverse NAT. In the future

[tor-dev] txtorcon 0.9.1

2014-01-20 Thread meejah
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I am pleased to announce that txtorcon v0.9.1 is now available. This release adds quite a few minor bug-fixes, simplifies GeoIP handling (with support for both pre- and post 0.3 pygeoip APIs), a tutorial-style walkthrough, the availability of a "wh

Re: [tor-dev] Allowing NAT for relay/exit nodes - Bootstrap file size

2014-01-20 Thread Juan Berner
Yes, but the point of flash proxies, is to use them as bridges, what I meant is to allow OR's behind NAT to be relays or even exit nodes. 2014/1/20 David Fifield > On Mon, Jan 20, 2014 at 05:00:38PM -0200, Juan Berner wrote: > > 1) Allow NAT clients to be TOR relay nodes (even maybe exit nodes)

Re: [tor-dev] Allowing NAT for relay/exit nodes - Bootstrap file size

2014-01-20 Thread David Fifield
On Mon, Jan 20, 2014 at 05:00:38PM -0200, Juan Berner wrote: > 1) Allow NAT clients to be TOR relay nodes (even maybe exit nodes) , this > would > be done using a queue system, possibly in a hidden service but not necessary, > where nat relay nodes can query what tor clients want to connect to the

[tor-dev] Allowing NAT for relay/exit nodes - Bootstrap file size

2014-01-20 Thread Juan Berner
Hi, Im wondering if you have considered this, I haven't seen it anywhere: 1) Allow NAT clients to be TOR relay nodes (even maybe exit nodes) , this would be done using a queue system, possibly in a hidden service but not necessary, where nat relay nodes can query what tor clients want to connect

Re: [tor-dev] Projects to combat/defeat data correlation

2014-01-20 Thread Roger Dingledine
On Mon, Jan 20, 2014 at 05:30:27PM +0100, Philipp Winter wrote: > On Sat, Jan 18, 2014 at 01:40:43AM +, Matthew Finkel wrote: > > obfs3 is supposed to be fairly difficult to detect because entropy > > estimation is seemingly more difficult than typically assumed, > > and thus far from what has

Re: [tor-dev] Projects to combat/defeat data correlation

2014-01-20 Thread Philipp Winter
On Sat, Jan 18, 2014 at 01:40:43AM +, Matthew Finkel wrote: > obfs3 is supposed to be fairly difficult to detect because entropy > estimation is seemingly more difficult than typically assumed, > and thus far from what has been seen in practice this seems to be true. There's a recent paper whi

Re: [tor-dev] Projects to combat/defeat data correlation

2014-01-20 Thread Philipp Winter
On Mon, Jan 20, 2014 at 08:30:12AM -0500, Ian Goldberg wrote: > On Sat, Jan 18, 2014 at 01:40:43AM +, Matthew Finkel wrote: > > obfs3 is supposed to be fairly difficult to detect because entropy > > estimation is seemingly more difficult than typically assumed, > > and thus far from what has be

Re: [tor-dev] A threshold signature-based proposal for a shared RNG

2014-01-20 Thread Ian Goldberg
On Fri, Jan 17, 2014 at 10:01:13PM -0600, Nicholas Hopper wrote: > > Yes: Nick (who would probably be the one writing the code anyway) > > generates the shares encrypted to keys generated by the authority > > operators, sends them to the authority operators, and forgets the > > intermediate results

Re: [tor-dev] Projects to combat/defeat data correlation

2014-01-20 Thread Ian Goldberg
On Sat, Jan 18, 2014 at 01:40:43AM +, Matthew Finkel wrote: > obfs3 is supposed to be fairly difficult to detect because entropy > estimation is seemingly more difficult than typically assumed, > and thus far from what has been seen in practice this seems to be true. Wouldn't the way to detect

[tor-dev] IRC meeting on Wed, Jan 22, 18:00 UTC to discuss next steps for Weather rewrite

2014-01-20 Thread Karsten Loesing
Hi devs, we're going to have an IRC meeting to discuss next steps for the Weather rewrite: Wednesday, January 22, at 18:00 UTC in #tor-dev on OFTC. http://www.timeanddate.com/worldclock/fixedtime.html?iso=20140122T18 Everyone's invited to join the discussion. Abhiram, Norbert, and Oliver, wh