Trac issueshttps://gitlab.torproject.org/legacy/trac/-/issues2020-06-13T01:08:39Zhttps://gitlab.torproject.org/legacy/trac/-/issues/5751Standardize SOCKS extensions to support proxied DNS queries2020-06-13T01:08:39ZRobert RansomStandardize SOCKS extensions to support proxied DNS queriesTor supports anonymous DNS resolution through its SocksPort, but no application (except the `tor-resolve` utility shipped with Tor) uses that feature, probably because it's not an IETF standard. Perhaps that should be changed.
This wil...Tor supports anonymous DNS resolution through its SocksPort, but no application (except the `tor-resolve` utility shipped with Tor) uses that feature, probably because it's not an IETF standard. Perhaps that should be changed.
This will probably involve designing a new DNS-resolution SOCKS command and implementing it in Tor; Tor's current SOCKS commands are not likely to be accepted as a standard (even if they're renumbered) because they do not support most of DNS's new and interesting features.https://gitlab.torproject.org/legacy/trac/-/issues/2671Better communication for authority operators, core developers in emergency si...2020-06-13T00:06:37ZNick MathewsonBetter communication for authority operators, core developers in emergency situations When in danger or in doubt,
run in circles, scream and shout!
- traditional motto, possibly naval.
When the bug behind #2664 happened, it took us a few hours to notice. That was bad, and #2666 is about trying to notice such si... When in danger or in doubt,
run in circles, scream and shout!
- traditional motto, possibly naval.
When the bug behind #2664 happened, it took us a few hours to notice. That was bad, and #2666 is about trying to notice such situations faster. But another problem is that even after we noticed, it still took a while to sort out who knew how best to contact which operators. Probably developers should get contacted too, so they can be available to deal with bad/urgent bugs.
We should figure out, for each authority operator and core developer[*], the best two or three ways to contact them in the case of an emergency. If these ways are not something we want to publish (e.g., phone numbers), a few people should know them, and all Tor people should know who those people are and how to contact them in a hurry.
We should have some emergency-response mechanisms in place. If communications are security-sensitive, we should have a way to deal with it in place, rather than the current approach of "send gpg-encrypted email to those people whose keys you happen to have" or "immediately go dark, use OTR to talk pairwise to people you know". Those approaches scale badly; we can probably do better.
We should also have planned responses for emergency events like "A key server looks like it might have been compromised"; "somebody has reported a vulnerability"; "somebody has disclosed a vulnerability"; "one or more authorities have gone down strangely;" "looks like the network is crashing;" and so on.
[*] "core developer" is here defined as "a developer who is likely to needed urgently when something breaks."https://gitlab.torproject.org/legacy/trac/-/issues/1939Trac Homepage should be a dev landing page2020-06-12T23:51:34ZMike PerryTrac Homepage should be a dev landing pageWe need to destroy our old wiki homepage. Or at least hide it somewhere. It is inappropriate for the landing page we are trying to use to organize development information.
I have no idea how to find the list of projects or any other ven...We need to destroy our old wiki homepage. Or at least hide it somewhere. It is inappropriate for the landing page we are trying to use to organize development information.
I have no idea how to find the list of projects or any other vendibles/buddies/projects material we hashed out from our developer meeting. Which means if I can't find it, none of our volunteers can.
It should be just a click from the trac.torproject.org page to all of our company, developer and project overview material.
Trac should no longer be about informing regular users. It sucks for that. The page tiles mean you can't even find pages with google.