Re: [tor-dev] Tor Proposal status updates: Feb 2015

2015-02-07 Thread grarpamp
On Sun, Feb 8, 2015 at 1:57 AM, Nick Mathewson wrote: > any time soon? Other suggestions would be welcome. Everything should have a set of applicable status so parties know, possibly a pinger, in particular if the goal is to keep certain things moving along. Even if you have to use RT/trac to tr

Re: [tor-dev] Best way to client-side detect Tor user without using check.tpo ?

2015-02-07 Thread Roger Dingledine
On Sat, Feb 07, 2015 at 01:59:05PM +0100, Fabio Pietrosanti (naif) - lists wrote: > we're introducing client-side checking if a user it's on Tor or not on > the GlobaLeaks Javascript client. > > So, the TorButton approach is to load > https://check.torproject.org/?TorButton=true . Note that the T

[tor-dev] Tor Proposal status updates: Feb 2015

2015-02-07 Thread Nick Mathewson
This is an update to the Tor proposal status overview. I last sent one of these out almost a year ago; since 0.2.6 has entered feature freeze, I really ought to do this regularly again. Future versions of this document will be maintained in the torspec repository as "proposals/proposal-status.txt

[tor-dev] How to set up meek on a cooperating web server

2015-02-07 Thread David Fifield
Roger asked me what it would take to run a meek bridge on an existing hard-to-block HTTPS web site that wants to help, Wikipedia for example. The difference with our existing deployments on CDNs is that we don't expect any special cooperation by the CDN, whereas an interested site could make minor

Re: [tor-dev] Best way to client-side detect Tor user without using check.tpo ?

2015-02-07 Thread Tom Ritter
On 7 February 2015 at 06:59, Fabio Pietrosanti (naif) - lists wrote: > There's a right way to detect if a user it's on Tor, from a Browser, > without loading an external network resource? Is the javascript client loaded from a remote website? If so, what about embedding the user's remote IP and

Re: [tor-dev] Best way to client-side detect Tor user without using check.tpo ?

2015-02-07 Thread Zack Weinberg
I don't think you can reliably tell without information from the network; indeed, to the extent that you can tell *at all* without information from the network, I would expect that to be considered a bug. The tactic that occurs to me is, have the investigative media website's server stick a marker

[tor-dev] Best way to client-side detect Tor user without using check.tpo ?

2015-02-07 Thread Fabio Pietrosanti (naif) - lists
Hi all, we're introducing client-side checking if a user it's on Tor or not on the GlobaLeaks Javascript client. As far as i understood since some time ago, the right way to do it was to detect a TBB user with some fingerprinting technique, however those are going to disappear/being avoided/fixed