Mirrors issueshttps://gitlab.torproject.org/tpo/web/mirrors/-/issues2022-05-27T18:20:07Zhttps://gitlab.torproject.org/tpo/web/mirrors/-/issues/31990How should we proceed with website mirrors?2022-05-27T18:20:07ZPhilipp Winterphw@torproject.orgHow should we proceed with website mirrors?We discussed the current status of website mirrors at [our Oct 3 anti-censorship meeting](http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-10-03-17.00.log.html). The following questions and arguments came up:
* Should we veri...We discussed the current status of website mirrors at [our Oct 3 anti-censorship meeting](http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-10-03-17.00.log.html). The following questions and arguments came up:
* Should we verify mirrors' authenticity? If so, how? If we verify mirrors, we may want to do it continuously because a mirror may be authentic at time _t_ but serve malware at time _t+1_. We may also want to verify mirrors in a way that makes it difficult for the mirror to distinguish between a user browsing the mirror and us verifying the mirror.
* People let us know when they set up new mirrors but we currently ignore volunteers because of our policy of only considering mirrors run by trusted contacts.
* Let's keep in mind that people generally search for "download tor" and click on whatever shows up first in their favourite search engine. By obsessing too much over the authenticity of mirrors we may be missing the bigger issue.
* Our old website [has a list of mirrors](https://2019.www.torproject.org/getinvolved/mirrors.html.en).
* Some of us believe that the risk of having mirrors outweighs their value while others believe the opposite.
* Website mirrors are frequently not subject to censorship, so users who are unable to browse torproject.org can still browse our mirrors and download Tor Browser from there. GetTor could therefore send users a link to mirrors – and add PGP verification instructions to its email, so the user doesn't need to trust the mirrors).https://gitlab.torproject.org/tpo/web/mirrors/-/issues/28166Add info on how to prevent logging of IP addresses2020-06-27T14:30:13ZtraumschuleAdd info on how to prevent logging of IP addresseshttps://lists.torproject.org/pipermail/tor-mirrors/2018-October/001188.htmlhttps://lists.torproject.org/pipermail/tor-mirrors/2018-October/001188.htmltraumschuletraumschulehttps://gitlab.torproject.org/tpo/web/mirrors/-/issues/28083Sort website mirror list by region2020-06-27T14:30:13ZtraumschuleSort website mirror list by regionhttps://www.torproject.org/getinvolved/mirrors.html.en should make it easy to pick a mirror near you.
Similar to https://www.debian.org/mirror/list
Suggested by https://lists.torproject.org/pipermail/tor-mirrors/2018-October/001179.htmlhttps://www.torproject.org/getinvolved/mirrors.html.en should make it easy to pick a mirror near you.
Similar to https://www.debian.org/mirror/list
Suggested by https://lists.torproject.org/pipermail/tor-mirrors/2018-October/001179.htmltraumschuletraumschulehttps://gitlab.torproject.org/tpo/web/mirrors/-/issues/27942tor-mirrors.csv: update (sub)regions2021-08-30T18:42:56Ztraumschuletor-mirrors.csv: update (sub)regionsThe hint is from this mail:
https://lists.torproject.org/pipermail/tor-mirrors/2018-April/001158.html
> Most subRegion/region entries are most likely wrong? At least there are different interpretations on what it should be.The hint is from this mail:
https://lists.torproject.org/pipermail/tor-mirrors/2018-April/001158.html
> Most subRegion/region entries are most likely wrong? At least there are different interpretations on what it should be.traumschuletraumschulehttps://gitlab.torproject.org/tpo/web/mirrors/-/issues/27585Revision of tor-mirrors.csv2021-08-30T18:42:51ZtraumschuleRevision of tor-mirrors.csvSee https://lists.torproject.org/pipermail/tor-mirrors/2018-April/001158.html:
https://gitweb.torproject.org/project/web/webwml.git/plain/include/tor-mirrors.csv
1) The .csv is in need of cleanup, there is a mix of TRUE/FALSE/True/Fals...See https://lists.torproject.org/pipermail/tor-mirrors/2018-April/001158.html:
https://gitweb.torproject.org/project/web/webwml.git/plain/include/tor-mirrors.csv
1) The .csv is in need of cleanup, there is a mix of TRUE/FALSE/True/False/YES/NO/Yes/No that should be streamlined into one flavour.
2) Most subRegion/region entries are most likely wrong? At least there are different interpretations on what it should be.
3) The tormirror.snydernet.net entry is missing a region entry, causing the rest of the entries to become misalignedtraumschuletraumschulehttps://gitlab.torproject.org/tpo/web/mirrors/-/issues/22182Revision of perl script for updating mirror page on website2021-08-30T18:42:49ZSamdneyRevision of perl script for updating mirror page on websiteRevision of perl script which pulls in the entries from include/tor-mirrors.csv and put the entries on https://www.torproject.org/getinvolved/mirrors
In legacy/trac#22150 arma wrote:
_"A) We should think about ways to automate the scri...Revision of perl script which pulls in the entries from include/tor-mirrors.csv and put the entries on https://www.torproject.org/getinvolved/mirrors
In legacy/trac#22150 arma wrote:
_"A) We should think about ways to automate the script. Maybe we shouldn't spend too much energy on this one until we've thought about how the mirror pages will fit into the future website redo."_
Script: https://gitweb.torproject.org/project/web/webwml.git/tree/update-mirrors.pl
Topics after a first review of the existing script:
1. I found several small perl bugs (or better, "not a nice coding style", not really bugs) in the existing script
1. The current way how the script is checking the mirror sites, isn't the best (it is looking for existing .xpi, .dmg, .exe, .tar.gz files)
1. The script has to be run manually at the moment. Can this be done automatically in the future (without creating security issues)? Have also attention here on the existing mailing list (https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-mirrors)SamdneySamdneyhttps://gitlab.torproject.org/tpo/web/mirrors/-/issues/22150Our website mirror community needs some love2021-06-11T15:34:21ZRoger DingledineOur website mirror community needs some love(I'm using the Applications -> GetTor component, since there is nothing suitable in the Community component. Maybe that ought to get fixed too? I'm not sure.)
We have a pile of website mirrors:
https://www.torproject.org/getinvolved/mir...(I'm using the Applications -> GetTor component, since there is nothing suitable in the Community component. Maybe that ought to get fixed too? I'm not sure.)
We have a pile of website mirrors:
https://www.torproject.org/getinvolved/mirrors
along with instructions for setting up a mirror:
https://www.torproject.org/docs/running-a-mirror
and a mailing list with our excited mirror operator volunteers:
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-mirrors
The first page above is generated from a script in the webwml repository:
'make mirrors' runs ./update-mirrors.pl which pulls in the entries from include/tor-mirrors.csv.
I just ran the script today (May 3 2017):
https://lists.torproject.org/pipermail/tor-commits/2017-May/122271.html
and it looks like it was last run in Sept 2016.
So:
A) We should think about ways to automate the script. Maybe we shouldn't spend too much energy on this one until we've thought about how the mirror pages will fit into the future website redo.
B) We should figure out how to handle the community of mirror operators better. There's a mailing list, tor-mirrors, where people send mail to sign up their mirrors, and then nobody does anything. I bet we can improve on that process. :)