The Tor Project issueshttps://gitlab.torproject.org/groups/tpo/-/issues2022-10-11T23:40:18Zhttps://gitlab.torproject.org/tpo/core/tor/-/issues/18644Replace our routerparse.c core with something machine-generated2022-10-11T23:40:18ZNick MathewsonReplace our routerparse.c core with something machine-generatedhttps://gitlab.torproject.org/tpo/core/tor/-/issues/27326Replace packed_cell_t and supporting code with stuff generated by trunnel2021-08-23T15:16:34Zrl1987Replace packed_cell_t and supporting code with stuff generated by trunnelTor: unspecifiedhttps://gitlab.torproject.org/tpo/web/donate-static/-/issues/71Replace pullover hoodie asset with a zip-up hoodie instead2022-05-02T16:42:45ZdonutsReplace pullover hoodie asset with a zip-up hoodie insteadI quickly reused the existing PSD of a pullover for the year end campaign, but the hoodie itself is actually zip up. Let's update the asset we're using on donate.torproject.org to more accurately reflect the real hoodie.
Here's the orig...I quickly reused the existing PSD of a pullover for the year end campaign, but the hoodie itself is actually zip up. Let's update the asset we're using on donate.torproject.org to more accurately reflect the real hoodie.
Here's the original roots graphic we're using on the "forever hoodie":
- [TorProject_Roots_FRONT_Seps.ai](/uploads/7b0347930d92ceaf4f05f3d21abb1294/TorProject_Roots_FRONT_Seps.ai)
The front graphic is the Tor Logo and text reading "torproject.org" (in mono?). Both front and back graphics are printed in a dark-ish grey metallic ink on the hoodie itself.nicobnicobhttps://gitlab.torproject.org/tpo/tpa/team/-/issues/40706replace PuppetDB to address security issues (CVE-2021-27021, jetty9)2022-03-31T19:02:54Zanarcatreplace PuppetDB to address security issues (CVE-2021-27021, jetty9)in #40699, we found that a recent buster upgrade inexplicably triggered [Debian #994843](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=994843) which seems to have appeared (at least for some users) after the `9.4.16-0+deb10u1` libjet...in #40699, we found that a recent buster upgrade inexplicably triggered [Debian #994843](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=994843) which seems to have appeared (at least for some users) after the `9.4.16-0+deb10u1` libjetty9-java upgrade, which itself occurred in August 2021.
in #40699, we have downgraded libjetty9 to workaround the issue, but that opened up a whole lot of other vulnerabilities.
this entire thing also outlined how badly puppetdb is maintained in debian. it's affected by at least one major vulnerability ([CVE-2021-27021](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990419), SQL injection) and generally is lagging significantly behind upstream.
so we might want to consider either updating or removing puppetdb completely from our infrastructure.
with @lavamind we brainstormed an action plan that looks like this:
1. [ ] test [puppet-terminus-redis](https://gitea.burntworld.ca/kienan/puppet-terminus-redis) in a lab, to see if exported resources work correctly
2. [ ] if that's a go, attempt a migration from puppetdb to redis on pauli
3. [ ] replace catalog monitoring from checking puppetdb to checking each host individually (@lavamind has a plugin for that), over NRPE
(see blockers below before embarking in this however)
For monitoring, we may want to also consider [puppet-prometheus_reporter](https://github.com/voxpupuli/puppet-prometheus_reporter) to collect catalog runs into prometheus for performance analysis. The Redis implementation doesn't keep old catalogs, which is somewhat of a step back from PuppetDB. But maybe that can be kept inside the Nagios replacement project (#29864).
For the migration, the process discovered in #40422 may be used here. Basically, to migrate to another exported resource backend, the following should happen, in strict order:
1. run puppet everywhere until all nodes have converged
2. disable puppet on all nodes (`puppet agent --disable ...`
3. install the new terminus backend
4. stop puppetdb
5. switch to new backend (e.g. `storeconfigs_backend = redis` and so on, see the terminus README) on disk (`/etc/puppet/puppet.conf` on pauli) *and* in manifests
6. enable/run/disable puppet in dry run on all nodes (`puppet agent --enable ; puppet agent --test --noop ; puppet agent --disable ...`)
7. run step 4 multiple times until you have some level of confidence you have converged (`--noop` should eventually show no change)
8. enable/run puppet everywhere in "wet" (not dry or "noop") mode
9. remove puppetdb
Be careful that Puppet *WILL* rewrite puppet.conf to point back at puppetdb if Puppet is ran without changing the manifests puppetdb should be stopped so that will only fail some manifests, but particular care should be applied to make sure the configuration is correct before puppet is ran.
Blockers:
* [x] nagios relies on puppetdb for checks (we can check directly on the hosts with another check)
* [ ] cumin relies on puppetdb for host inventoriesanarcatanarcathttps://gitlab.torproject.org/tpo/network-health/metrics/relay-search/-/issues/19538Replace raster glyphicons with vector icons for flags2020-06-27T14:25:19ZtwimReplace raster glyphicons with vector icons for flagsVector icons looks way better than tiny PNGs (especially on bigger screens).
I took ones from Font Awesome and included them. As a bonus there are some nice accessibility features in it.Vector icons looks way better than tiny PNGs (especially on bigger screens).
I took ones from Font Awesome and included them. As a bonus there are some nice accessibility features in it.Philipp Winterphw@torproject.orgPhilipp Winterphw@torproject.orghttps://gitlab.torproject.org/tpo/web/support/-/issues/154Replace recommendations to use tor-ramdisk with something better2021-09-08T19:48:52ZtraumschuleReplace recommendations to use tor-ramdisk with something betterarma lately mentioned that it is probably not a good idea anymore to use tor-ramdisk. I am looking into alternatives.
Currently tor-ramdisk is mentioned on the new (coming) community projects list (legacy/trac#16576) and the volunteer p...arma lately mentioned that it is probably not a good idea anymore to use tor-ramdisk. I am looking into alternatives.
Currently tor-ramdisk is mentioned on the new (coming) community projects list (legacy/trac#16576) and the volunteer page:
http://expyuzz4wqqyqhjn.onion/projects/projects.html.en
https://github.com/torproject/webwml/pull/38
Also the wiki links it at several places:
[[AutomationInventory]]
[[doc/VM]]
[[doc/EmbeddedTips]]
Wikipedia has a page about it (legacy/trac#27668).
Adding legacy/trac#13703 as parent to let them know of each other.
Which are good alternatives (in use)?https://gitlab.torproject.org/tpo/core/tor/-/issues/25892Replace RejectPlaintextPorts with RejectPlaintextPortPolicy2020-07-28T19:07:26ZcypherpunksReplace RejectPlaintextPorts with RejectPlaintextPortPolicyhttp://expyuzz4wqqyqhjn.onion/docs/tor-manual.html.en
RejectPlaintextPorts port,port
I want my Tor to allow only port 443(HTTPS) and 9877(XMPP).
But current RejectPlaintextPorts is not easy to use because I have to
set "RPP 0,1,2,3,4.....http://expyuzz4wqqyqhjn.onion/docs/tor-manual.html.en
RejectPlaintextPorts port,port
I want my Tor to allow only port 443(HTTPS) and 9877(XMPP).
But current RejectPlaintextPorts is not easy to use because I have to
set "RPP 0,1,2,3,4...65535".
I want something like this:
AccessibleTorPorts 443,9877
AccessibleTorPorts reject *
format:
AccessibleTorPorts port[,port...]
AccessibleTorPorts reject [port|*]Tor: unspecifiedhttps://gitlab.torproject.org/tpo/web/donate-static/-/issues/112Replace RFF language in Tor Donor FAQ2023-06-28T18:54:12ZmattlavReplace RFF language in Tor Donor FAQ[Q/A #8 in the Tor Donor FAQ](https://donate.torproject.org/donor-faq/#eu-bank-transfer) needs fixing. Right now it reads:
========
8. Can I make a donation via bank transfer?
In the U.S.: We can only accept donations via bank transfe...[Q/A #8 in the Tor Donor FAQ](https://donate.torproject.org/donor-faq/#eu-bank-transfer) needs fixing. Right now it reads:
========
8. Can I make a donation via bank transfer?
In the U.S.: We can only accept donations via bank transfer for gifts more than $1,000 USD. If you would like to make a bank transfer of more than $1,000 to the Tor Project, please contact giving(at)torproject.org with your name and phone number and Tor Project will reach out to you to coordinate your donation.
In the European Union: We have an arrangement with the Renewable Freedom Foundation to provide tax-deductible donations for Europeans. Indicate that your donation should go to the Tor Project. They will issue a donation receipt upon request. The account information is as follows:
Renewable Freedom Foundation
IBAN: DE17721500000053693701
BIC: BYLADEM1ING
Address: Sparkasse Ingolstadt, Rathausplatz 6, 85049 Ingolstadt
========
The latter, European portion of this is now obsolete, because we have a new way for people in Europe to send us money - via [this OpenCollective link](https://opencollective.com/thetorproject-europe). I presume that the first part of this Q/A will stay as it is, but we'll have to remove the RFF text and ad some new text about OpenCollective. @smith : Can you provide some copy?https://gitlab.torproject.org/tpo/network-health/sbws/-/issues/28590Replace sbws tests/integration/net.tar with an unpacked version2020-06-27T13:41:29ZteorReplace sbws tests/integration/net.tar with an unpacked versionWe don't put binary blobs in our git repositories. It makes diffs impossible. And it's a source of security issues.
Found while tracking down the commit that introduced legacy/trac#28588.We don't put binary blobs in our git repositories. It makes diffs impossible. And it's a source of security issues.
Found while tracking down the commit that introduced legacy/trac#28588.sbws: 1.0.x-finalhttps://gitlab.torproject.org/tpo/network-health/metrics/exonerator/-/issues/15002Replace search for target addresses and ports by more general exit-or-not result2020-06-27T14:23:22ZKarsten LoesingReplace search for target addresses and ports by more general exit-or-not resultWhen there's a positive result to the question "Was there a Tor relay running on this IP address?", we should not offer a subsequent form to answer the question "Was this relay configured to permit exiting to a given target?". This seco...When there's a positive result to the question "Was there a Tor relay running on this IP address?", we should not offer a subsequent form to answer the question "Was this relay configured to permit exiting to a given target?". This second search increases complexity of searches a bit, and it's unlikely that people would interpret results correctly.
Instead, we can make a more general statement about a relay permitting exiting or not. For example, the result could say "This Tor relay did not access the open Internet at that time." or "This Tor relay did permit transit of Tor traffic to the open Internet at that time." with another link for further details explaining web traffic vs. other ports etc.
People who really care about a relay's exit policy summary or even the detailed exit policy can look at the linked consensuses or server descriptors. But it's unlikely that the average user cares.https://gitlab.torproject.org/tpo/tpa/team/-/issues/13995Replace sensitive information upon submission2020-06-27T14:20:06ZbastikReplace sensitive information upon submissionI couldn't find if Trac is actually able to do so, but it be be nice if it could filter out sensitive information like bridge IP addresses.
Like when reports contain `Bridge at 'here was an IP4-address_of_the_bridge:port'` it should eit...I couldn't find if Trac is actually able to do so, but it be be nice if it could filter out sensitive information like bridge IP addresses.
Like when reports contain `Bridge at 'here was an IP4-address_of_the_bridge:port'` it should either remove the IP (IP4/IP6) address and the port or replace it.
There are people heavily familiar with RegEx so the example should be trivial to handle.Erinn ClarkErinn Clarkhttps://gitlab.torproject.org/tpo/network-health/metrics/library/-/issues/25712Replace ServerDescriptor#getHiddenServiceDirVersions with ServerDescriptor#is...2020-06-27T14:23:32ZKarsten LoesingReplace ServerDescriptor#getHiddenServiceDirVersions with ServerDescriptor#isHiddenServiceDirTor has never supported versions in the hidden-service-dir descriptor line. See the recently closed legacy/trac#25284.
We should probably reflect this by replacing `ServerDescriptor#getHiddenServiceDirVersions` with `ServerDescriptor#is...Tor has never supported versions in the hidden-service-dir descriptor line. See the recently closed legacy/trac#25284.
We should probably reflect this by replacing `ServerDescriptor#getHiddenServiceDirVersions` with `ServerDescriptor#isHiddenServiceDir`.
I'm posting a branch in a minute.Karsten LoesingKarsten Loesinghttps://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/13714Replace startpage.com with duckduckgo (startpage is hostile tor Tor users)2020-06-27T14:41:31ZTracReplace startpage.com with duckduckgo (startpage is hostile tor Tor users)Startpage.com is hostile to Tor users, and should be replaced with duckduckgo.
Statpage consistently returns error pages claiming an affinity for Tor users, but blocks searches via. Tor nonetheless. The blocking is so prevalent that a ...Startpage.com is hostile to Tor users, and should be replaced with duckduckgo.
Statpage consistently returns error pages claiming an affinity for Tor users, but blocks searches via. Tor nonetheless. The blocking is so prevalent that a Google search via Tor is more likely to succeed without a Captcha vs. startpage.com.
There is no BS with Duckduckgo, which should be the default search engine in the TBB.
Also, I suffer from Dyslexia, and it was extremely difficult to sign-up for this bugzilla due to nearly impossible to decipher capthchas. I have a very heard time reading these things. There must be a better way -- they really suck for ppl. with this disorder. JMHO.
**Trac**:
**Username**: duS3u_uus9usuhttps://gitlab.torproject.org/tpo/network-health/sbws/-/issues/30906Replace state file extension from .dat to .json2022-02-17T09:10:29ZjugaReplace state file extension from .dat to .jsonSince it is a json file.Since it is a json file.sbws: 2.0.x-final-oldhttps://gitlab.torproject.org/tpo/network-health/doctor/-/issues/25222replace static subject with summary of content2020-06-27T14:12:47Zcypherpunksreplace static subject with summary of contentDocTor's emails have a static subject "Consensus issues",
lets make the subject more useful:
* mention the highest loglevel (WARNING, NOTICE, ...) contained in the mail
* mention the type of problems detected
* mention the amount of p...DocTor's emails have a static subject "Consensus issues",
lets make the subject more useful:
* mention the highest loglevel (WARNING, NOTICE, ...) contained in the mail
* mention the type of problems detected
* mention the amount of problems per type detected
the subject for this email:
https://lists.torproject.org/pipermail/tor-consensus-health/2018-February/008491.html
would look something like:
warning: certexpiry (2), hsdir disagreement (1), badexit disagreement (1)Damian JohnsonDamian Johnsonhttps://gitlab.torproject.org/tpo/network-health/margot/-/issues/38Replace StructOpt by Clap and improve documentation2023-08-09T16:22:33ZjugaReplace StructOpt by Clap and improve documentationIt would remove some verbosity documenting commands and arguments.It would remove some verbosity documenting commands and arguments.jugajugahttps://gitlab.torproject.org/tpo/network-health/metrics/onionoo/-/issues/19253replace submodule with released dependency of metrics-lib2020-06-27T14:24:13Ziwakehreplace submodule with released dependency of metrics-libI just noticed that Onionoo is not yet using the released descriptor.jar and still has the git submodule.I just noticed that Onionoo is not yet using the released descriptor.jar and still has the git submodule.https://gitlab.torproject.org/tpo/anti-censorship/bridgedb/-/issues/40002Replace sysrqb's Travis CI references with phw's2021-07-09T18:27:08ZPhilipp Winterphw@torproject.orgReplace sysrqb's Travis CI references with phw'sOur README.rst has several links to Matt's Travis CI profile, which is no longer used. Let's update these links and use phw's profile instead.Our README.rst has several links to Matt's Travis CI profile, which is no longer used. Let's update these links and use phw's profile instead.Philipp Winterphw@torproject.orgPhilipp Winterphw@torproject.orghttps://gitlab.torproject.org/tpo/web/support/-/issues/36replace tbb uninstall section with text forwarding to https://tb-manual.torpr...2021-08-23T16:30:13Zemmapeelreplace tbb uninstall section with text forwarding to https://tb-manual.torproject.org/uninstalling/we should replace the instructions at https://support.torproject.org/tbb/tbb-28/ with a link to https://tb-manual.torproject.org/uninstalling/
it is better not to delete the page, as it may have been linked already elsewherewe should replace the instructions at https://support.torproject.org/tbb/tbb-28/ with a link to https://tb-manual.torproject.org/uninstalling/
it is better not to delete the page, as it may have been linked already elsewherehttps://gitlab.torproject.org/tpo/tpa/team/-/issues/40512replace the 'predict-os' code with prometheus2024-02-20T16:19:12Zanarcatreplace the 'predict-os' code with prometheusprometheus will soon ship support for release number metrics in the node exporter ([commit](https://github.com/prometheus/node_exporter/commit/b6215e649cdfc0398ca98df8e63f3773f1725840), not yet released) that will look something like thi...prometheus will soon ship support for release number metrics in the node exporter ([commit](https://github.com/prometheus/node_exporter/commit/b6215e649cdfc0398ca98df8e63f3773f1725840), not yet released) that will look something like this:
```
# HELP node_os_info A metric with a constant '1' value labeled by build_id, id, id_like, image_id, image_version, name, pretty_name, variant, variant_id, version, version_codename, version_id.
# TYPE node_os_info gauge
node_os_info{build_id="",id="ubuntu",id_like="debian",image_id="",image_version="",name="Ubuntu",pretty_name="Ubuntu 20.04.2 LTS",variant="",variant_id="",version="20.04.2 LTS (Focal Fossa)",version_codename="focal",version_id="20.04"} 1
# HELP node_os_version Metric containing the major.minor part of the OS version.
# TYPE node_os_version gauge
node_os_version{id="ubuntu",id_like="debian",name="Ubuntu"} 20.04
```
while we wait for this to trickle down into debian, Puppet could probably very easily write such a textfile for the node exporter to scrape.
we could use this to keep track of the upgrade progress, instead of extracting that data out of Puppet into a CSV file by hand. it's not clear to me we could easily get the prediction date though, but maybe with a little bit of python (in the `monthly-report`?) that could be done as well.
in any case, it feels like a lot of legacy code that we could scrap.anarcatanarcat