Contact default bridge operators and ask them to upgrade obfsproxy package

From ACT meeting logs:

16:06:42 dcf1: How about starting with the Tor Browser default bridges?
16:06:50 meskio: +1
16:22:34 meskio: ggus: do you want to contact the default bridges about the obfs4 upgrade? or should I do it? (I guess I can find their contact somewhere in the wiki)
logs

Default bridges contact info: https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/Default-Bridges

assigned to @gus

Contacted:

fingerprint,nickname,contact
CDF2E852BF539B82BD10E27E9115A31734E378C2,Lisbeth,dgoulet@torproject.org
D9A82D2F9C2F65A18407B1D2B764F130847F8B5D,dragon,mart@greenhost.nl
011F2599C0E9B27EE74B353155E244813763C3E5,griinchux,zwiebel@quantentunnel.de
91A6354697E6B02A386312F68D82CF86824D3606,zipfelmuetze,zwiebel@quantentunnel.de
FB70B257C162BF1038CA669D568D76F5B7F0BABB,smallerRichard,tech@age.bdeb.qc.ca
2D82C2E354D531A68469ADF7F878FA6060C6BACA,KauBridgePale,tobias.pulls@kau.se
74FAD13168806246602538555B5521A0383A1875,GeorgetownPontem,msherr@cs.georgetown.edu
10A6CD36A537FCE513A322361547444B393989F0,hopperlab,singh882+torbridge@umn.edu
C5B7CD6946FF10C5B3E89691A7D3F2C122D2117C,dktoke,toke@toke.dk
5EDAC3B810E12B01F6FD8050D2FD3E277B289A08,PraxedisGuerrero,pollo@debian.org

Template

To: {email}
From: gus@torproject.org
Cc: meskio@torproject.org
Subject: Please upgrade your {nickname}'s obfsproxy package

Hi {nickname},

You are running a Tor default bridge, which is great:
https://metrics.torproject.org/rs.html#details/{fingerprint}

However, that obfsproxy version is lacking an important security update[1] and we're urging bridge operators to upgrade as soon as possible.

You can find Debian package in unstable:
https://packages.debian.org/sid/obfs4proxy

If you need help upgrading your obfsproxy, just let us know.

We appreciate a lot your effort and time!

Thank you,

Gus

[1] https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/obfs4/-/issues/33736

added Doing label

I've backport the package to debian stable, as the current one in unstable is not installable there (it depends on a newer version of libc6): https://people.torproject.org/~meskio/obfs4proxy_0.0.13-1_amd64.deb

Mart, zwiebel and Micah Sherr contacted me saying that they've upgraded the obfs4 pkg.

@meskio are we missing someone or is this done?

From your original list the only two I'm missing are:

CDF2E852BF539B82BD10E27E9115A31734E378C2,Lisbeth,dgoulet@torproject.org
FB70B257C162BF1038CA669D568D76F5B7F0BABB,smallerRichard,tech@age.bdeb.qc.ca

Did you hear anything from them?

SmallerRichard has being down and unresponsive for a while (#44 (closed)), but I expect Lisbeth might be easier to reach.

Lisbeth operator fixed it. smallerRichard is MIA.

I think we have finished here with a great success

closed

mentioned in issue tpo/applications/tor-browser#40804 (closed)

It looks like we never contacted the two briges operated by cymru.com:

obfs4
38.229.1.78:80
C8CBDB2464FC9804A69531437BCF2BE31FDD2EE4
cert=Hmyfd2ev46gGY7NoVxA9ngrPF2zCZtzskRTzoWXbxNkzeVnGFPWmrTtILRyqCTjHR+s9dg iat-mode=1
Sina Rabbani srabbani@cymru.com

obfs4
38.229.33.83:80
0BAC39417268B96B9F514E7F63FA6FBA1A788955
cert=VwEFpk9F/UN9JED7XpG1XOjm/O8ZCXK80oPecgWnNDZDv5pdkhq1OpbAH0wNqOT6H6BmRQ iat-mode=1
Sina Rabbani srabbani@cymru.com

And they seem to have an outdated version of obfs4proxy: https://github.com/ooni/probe/issues/1986#issuecomment-1134607244

@gus do you mind if I write to them asking for upgrading?

No, not at all.

Sent.