18:01:40 <GeKo> #startmeeting
18:01:40 <MeetBot> Meeting started Mon Oct  2 18:01:40 2017 UTC.  The chair is GeKo. Information about MeetBot at http://wiki.debian.org/MeetBot.
18:01:40 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic.
18:02:07 <GeKo> alright, i hope everyone made it to the new meeting channel
18:02:14 <isabela> heehe
18:02:20 <GeKo> let's start with the weekly status update
18:02:34 <GeKo> who wants to go first today?
18:02:43 * arthuredelstein can go
18:02:59 <arthuredelstein> This past week I worked on ubsan: https://bugzilla.mozilla.org/1404547
18:03:17 <arthuredelstein> I focused on trying to land the -fsanitize=enum patches in Mozilla so that we can add that flag to the Mozilla debug build. The next flag I plan to work on is fsanitize=signed-integer-overflow -- I have a few patches for that as well but there are many more to do.
18:03:42 <arthuredelstein> I also worked on #22343. I'm trying to writing unit tests to cover every possibility and then hopefully that will smoke out any more bugs in my patch.
18:03:59 <arthuredelstein> I met with the Mozilla uplift team and reviewed a couple of their uplifted patches.
18:04:08 <arthuredelstein> And I revised my patch for #23025.
18:04:45 <arthuredelstein> This week I plan to try to finish #22343 and fsanitize=enum.
18:04:52 <arthuredelstein> This week I plan to try to finish #22343 and fsanitize=enum.
18:04:56 <arthuredelstein> And also high on my list is fixing #18101 (for Mac and Windows) and #23024.
18:05:02 <arthuredelstein> Stupid copy/paste
18:05:09 <arthuredelstein> That's it for me.
18:05:19 <GeKo> thanks. who is next?
18:05:34 <tjr> I can go
18:05:52 <tjr> I worked on MinGW some more, moving it closed to final merge. Got some mingw bugs fixed upstream
18:06:07 <tjr> I talked with nmago about the crash reporter a bit
18:06:29 <tjr> He seems to have found some unexpected code and behavior that was different from what he saw before.
18:06:56 <tjr> breakpad bypassing the proxy
18:07:12 <GeKo> wow
18:07:13 <tjr> also the about:config setting doesn't seem to apply, and he needed to edit a .ini file
18:07:19 <tjr> So we're going to dig into that more
18:08:03 <tjr> tor recently grew an http proxy IIRC, so if we need to use that I presume we'll be able to in some nearish future version of Tor Browser?
18:08:16 <GeKo> yes
18:08:28 <tjr> Okay cool.  That's it for me
18:09:02 <GeKo> thanks. who is next?
18:09:14 * pospeselr can go
18:09:41 <pospeselr> looks like my fix for #22501 went in last week, and patch for #13398 has been approved
18:10:06 <pospeselr> spent a fair bit of time in different VMs/configurations trying to repro #23016 (with no luck)
18:11:05 <pospeselr> GeKo: could use another ticket to look at in parallel while we wait for more info from intrigeri
18:11:12 <pospeselr> That's it for me
18:12:04 * mcs will go next
18:12:19 <GeKo> pospeselr: i think comment:22 might have a hint
18:12:39 <GeKo> the locales reconfiguration might help you
18:12:53 <GeKo> both intrigeri and i don't use a en-US system
18:13:04 <pospeselr> ok!
18:13:15 <GeKo> and i tracked it down on my system to javascript.use_us_english_locale
18:13:26 <GeKo> flipping that pref fixes the problem on my system
18:13:52 <GeKo> now the question is why is that an issue and why is that related to multiprocess mode (in my case at least)
18:14:12 <arthuredelstein> That's interesting. I think javascript.use_us_english_locale is a bit different in Firefox IIRC.
18:14:22 <GeKo> arthuredelstein: it happens there as well
18:14:28 <pospeselr> ah ok awesome
18:14:33 <GeKo> i mean to file a firefox bug late
18:14:34 <GeKo> r
18:14:37 <GeKo> or tomorrow
18:14:51 <GeKo> but i wanted to get some feedback from intrigeri first
18:14:58 <GeKo> whether that fixes his issue as well
18:15:24 <GeKo> pospeselr: that said feel free to pick any ticket tagged with TorBrowserTeam201710 that interests you
18:15:27 <pospeselr> should any fix for that be done on the firefox side of things and wait for the fix to come down, or both?
18:15:40 <pospeselr> assuming it's a FF problem
18:15:43 <GeKo> yeah, good question
18:15:46 <pospeselr> okay!
18:16:15 <GeKo> if we can easily provide a patch we should do it ourselves and upstream it
18:16:44 <GeKo> mcs: alright, sorry for the delay
18:16:46 <pospeselr> understood
18:16:47 <GeKo> you have the floor
18:16:58 <mcs> okay
18:17:03 <mcs> Last week, Kathy and I made more progress on #23262 and along the way we also took care of some #23261 leftovers.
18:17:10 <mcs> We reviewed Isabela’s roadmap – especially the UX items – and added some more items plus some links to tickets.
18:17:15 <mcs> We met with catalyst and isabela to discuss the fancy progress bar for Tor Launcher, along with possible improvements in tor’s bootstrap status reporting.
18:17:21 <mcs> This is a sketch of what the progress bar will eventually look like: https://marvelapp.com/3f6102d/screen/31457651
18:17:26 <mcs> For now, Tor Launcher will have a simple progress bar; once the tor improvements are ready, we can work on the fancier one that should provide a better user experience.
18:17:33 <mcs> Last week we also did some research for #23136 and exchanged some email with dcf and isis.
18:17:38 <mcs> This week we plan to continue working on #23136 with the goal of creating a good plan for implementation.
18:17:43 <mcs> That’s all for us.
18:18:04 <GeKo> what does "merge_ready" for #23261 mean?
18:18:11 <GeKo> who needs to do something here?
18:18:59 <mcs> I don’t think that ticket should be merge_ready because the code is not. I forgot that linda made that change at some point.
18:19:10 <mcs> I will adjust the status in the ticket.
18:19:18 <GeKo> and could you give a rough percentage value for how far we already are wrt to the bridge selection improvement and moat?
18:19:28 <GeKo> like could we say in both cases that 50% is done?
18:19:39 <GeKo> or 50% in the former and 20% in the latter?
18:20:13 <GeKo> it's just for the spreadsheet
18:20:22 <GeKo> to give a rough estimate on where we are
18:20:41 <mcs> I am not sure what the scope of the bridge selection improvement is, but if it includes all of the UX changes I would say we are 85% done.
18:20:53 <isabela> mcs: on network team meeting just before this one isis gave an update on moat server - eta is mid this week to have something you can start using
18:20:54 <mcs> moat is more like 20%
18:21:11 <GeKo> okay, sounds reasonable, thanks
18:21:12 <mcs> isabela: I saw that; thanks for asking isis for us.
18:21:19 <isabela> cool
18:21:25 <isabela> i was thinking we follow up on this on wed
18:21:31 <isabela> i will send email to everyone to do so
18:22:12 <GeKo> who else is here for a status update?
18:22:21 * boklm can go next
18:22:31 <GeKo> please do!
18:22:38 <boklm> This past week I helped publishing the new releases.
18:22:43 * isabela has some points to share with the team :) eventually
18:22:46 <boklm> I fixed #23680, started thinking about #23657, and finished #23384.
18:22:50 <boklm> I also signed a Tor Messenger release and fixed #23734 and #23385
18:22:59 <boklm> I created a ticket for creating a VM for fpcentral: #23737
18:23:13 <boklm> This week I'm planning to work on #23738 (once the fpcentral VM has been created) and get back to the Windows 64 build.
18:23:22 <boklm> That's it for me
18:23:34 <GeKo> yes, those are the most important issues.
18:23:55 <GeKo> one thing you can work on, too, is getting debug builds integrated into tor-browser-build
18:24:16 <boklm> debug builds?
18:24:23 <GeKo> we have a fuzzing deliverable and i think having those build using them would be good
18:24:52 <GeKo> well, if we think we want to fuzz our patches without a special type of build fine
18:25:11 <boklm> do we have a ticket for that?
18:25:42 <boklm> #21998
18:25:45 <GeKo> yes
18:25:48 <boklm> ok
18:26:06 <GeKo> and the activity mentioned Rigorously memory safety test (eg: fuzzing) using Address Sanitizer builds
18:26:28 <boklm> ok
18:26:31 <GeKo> so strictly speaking we could think about doing something else instead of fuzzing
18:27:08 <GeKo> i am fine if we want
18:27:48 <GeKo> but we want to start to fuzz our code anyway
18:27:59 <GeKo> so we could use to set some infrastructure up for it
18:28:08 <boklm> ok
18:28:33 <GeKo> boklm: my current plan is that you could mostly work on that in november
18:28:53 <boklm> that sounds good
18:28:54 <GeKo> we'll see if that works out given the other things on your plate
18:28:59 <GeKo> good!
18:29:11 <GeKo> alright, i think i can go now
18:29:25 <GeKo> this week i got dragged into #23016
18:29:50 <GeKo> we had a rather bumpy release that needed more attention than usual
18:29:58 <GeKo> especially due to noscript bugs
18:30:30 <GeKo> like #23718, #23723 and #23724
18:30:48 <GeKo> i spent some time on #21256
18:30:59 <GeKo> and on #23409
18:31:27 <GeKo> additionally the clouldfalre extension review related things ate quite some time
18:31:51 <GeKo> i reviewed #13398
18:32:08 <GeKo> and started to look at the patch for #16678
18:32:22 <GeKo> this week i plan to be afk tomrrow
18:32:44 <GeKo> but apart from that i hope to finish review for #16678 and get #23409 done
18:33:12 <GeKo> then i'll probably spend some time preparing all the meetings we'll have next week
18:33:33 <GeKo> the cloudflare extension will be a topic this week as well
18:33:47 <GeKo> and i'll be doing the being-of-the-month-admin-stuff
18:34:05 <GeKo> not sure what time will remain for looking at code :/
18:34:08 <GeKo> or other issues
18:34:14 <GeKo> that's it for me
18:34:21 * isabela could go
18:34:42 <mcs> What are our plans with respect to the Cloudflare extension? [maybe this is a good discussion topic?]
18:35:30 <GeKo> mcs: we can discuss it a bit later, yes
18:35:36 <mcs> sounds good
18:36:30 <GeKo> isabela: please go
18:36:40 <isabela> ok
18:37:15 <isabela> thanks for the input on the roadmap last week, i ran that with the ux team and we picked some stuff - the final list of what we are adding in the designer proposal is here
18:37:23 <isabela> https://docs.google.com/document/d/1kE6YbB1ecaXXFCLkLU2BmDVngb1u-IRZG2MW5tRKvns/edit#
18:37:27 <isabela> if you are curious :)
18:38:07 <isabela> another thing is that, I want to update the tor launcher feature brief with all the current work and decisions we are making
18:38:30 <isabela> i want to share this with otf at the end of our contract when we are done with the tor launcher and moat deliverables
18:38:52 <isabela> as of 'what is our vision for future iteractions here'
18:39:19 <isabela> otf will ask about that for sure :) and I have spoke about it with adam too
18:39:26 <isabela> for montreal
18:40:19 <GeKo> you want to have a session for it in montreal?
18:40:20 <isabela> i would like to ask the team 1. be part of the website redesign discussion :) specially because of the download path
18:40:38 <isabela> GeKo: nope
18:41:48 <isabela> and 2. i will put together the mobile sponsor8 deliverables by timeline order
18:42:04 <isabela> so you all can take those into consideration specially for things like
18:42:12 <isabela> changing the toolbar features
18:42:40 <isabela> from now on whatever you do on desktop will need a way to exist on mobile :)
18:42:57 <isabela> to take that into consideration when talking about roadmap tasks etc
18:43:06 <isabela> that's it
18:43:38 <GeKo> thanks
18:43:57 <GeKo> who else is here for a status update?
18:45:00 <GeKo> okay discussion time
18:45:25 <GeKo> i don't have anything in particular, so let's move to the cloudflare extension
18:46:20 <GeKo> to give some background: the underlying issue is that tor browser users have been seen a lot of CAPTCHAs due
18:46:40 <GeKo> to cloudflare giving tor exit relays a bad reputation
18:46:57 <GeKo> they guard that way against potential attacks
18:47:16 <GeKo> which led to users abandoning tor browser because they thought our browser is broken
18:48:04 <GeKo> they are developing an extension that tries to solve this issue in a privacy-preserving way by using some clever anonymous credential system where you need to spend tokens to avoid CAPTCHAs
18:48:21 <GeKo> i am currently reviewing that extension and provide feedback
18:48:43 <GeKo> our plans regarding the extension: that's a tricky issue
18:49:26 <GeKo> let me put it that way: we are currently looking only that it addresses tor browser needs
18:49:39 <GeKo> from a review point of view
18:50:01 <GeKo> but that does not mean that it automatically gets included once it is compatible with our design document
18:50:27 <mcs> That seems like a good first step. We don’t have to make a decision yet about whether to recommend it, bundle it, or recommend that people avoid it.
18:50:32 <GeKo> there are much far-reaching things to concern like what about non tor-browser tor users?
18:50:40 <GeKo> that don't have xul and js available?
18:50:51 <GeKo> mcs: yes
18:50:59 <arthuredelstein> Is there are place we can see the code?
18:51:13 <GeKo> we'll have at least two sessions in montreal about this topic
18:51:23 <GeKo> and i bet a bunch of other discussions
18:51:34 <GeKo> arthuredelstein: not yet, it's behind a private github repo
18:51:35 <mcs> Bundling is also costly for our small team due to potential for updates of the brower or extension to cause problems… see recent NoScript problems.
18:51:54 <GeKo> yeah, but that's the least of my problems with it right now :)
18:52:42 <GeKo> from a technical point of view one of the most problematic issues it that it needs third party cookies allowed
18:53:08 <GeKo> to avoid spending too many tokens on third-party requests behind cloudflare
18:53:24 <GeKo> and we are currently having those cookies disabled
18:53:26 <GeKo> but there is more
18:54:00 <GeKo> anyway, the technical side is currently being worked on and we'll have plenty of time to discuss that and other related issues in montreal i guess
18:54:01 <msvb-lab> GeKo: I believe there's still an outstanding bug for third party cookies.
18:54:32 <GeKo> well, double-keying should work
18:54:46 <arthuredelstein> Is it a webextension?
18:54:46 <GeKo> but we need to verify that and fix the cookie manager UI
18:54:49 <GeKo> yes
18:54:55 <tjr> I didn't realize third party cookies were disabled; i didn't think they mattered much with FPI
18:55:24 <GeKo> yes, we want to enable them
18:55:44 <GeKo> but did not get around yet to solving the two remaining tickets for it
18:56:55 <GeKo> #21905 is the one
18:57:10 <GeKo> and #10535 the other
18:57:16 <GeKo> err #10353
18:57:46 <GeKo> anything else to discuss today (or some additional points)?
18:58:28 <arthuredelstein> GeKo: I'm curious -- what privacy-preserving mechanism are they using?
18:58:57 <mcs> I have just a quick question: the deadline for our current Sponsor4 contract is to deliver by 12/1/2017, correct?
18:59:11 <GeKo> yes
18:59:19 <mcs> thx
18:59:26 <GeKo> arthuredelstein: blinded tokens
18:59:27 <mcs> I just wanted to be sure
19:00:08 <GeKo> thanks all for the meeting *baf*
19:00:11 <GeKo> #endmeeting