Projects to contribute to

wage slave for the best open source project you think people should contribute to Bonus points if the project has guides on how newcomers can contribute to the project

Tor Project

Debian has good community support for package maintainers. Package maintenance in general is a good way to dip your toes in the water.

>>21334 Don’t. https://www.hackerfactor.com/blog/index.php?/archives/888-Tor-0day-Stopping-Tor-Connections.html

>>21337 I read, and this guy's just a clout chaser. His "exploits" are trash.

>>21339 This. This guy is an idiot.

>>21337 It's just another TCP problem. I wouldn't be surprised. There's a lot of protocols that had blatant 0days but they wontfix or even remake standards because gotta keep that open door compatibility going.

>>21337 I'm bored, so I'm reading. I decided to look over his claims for validity (as a responsible Tor user). So far I've found he covers (poorly): >https://www.hackerfactor.com/blog/index.php?/categories/19-Tor >The threat model Tor advertises >How to optimize a linux server (lol) >Well known and understood attack vectors >lots and lots and lots of handwavy "it happened to me, trust me guys, I'm dead serial" >Attacks only a true global adversary could make, but made to sound likely, scary, and novel (none of these things are true). >Identifying Tor nodes accepting connections, even though that's not part of the threat model (which doesn't concern itself with enumeration of public nodes) >Uses examples of people arrested for skipping the great firewall of china, but notes that they weren't using Tor. Funny how that works >Same thing with Kashmir. (sense a pattern developing? It's almost like Tor's blending-in code is working) >The US example is hilarious, because the student was (1) not using a tor-traffic-hiding protocol, so it was "overt Tor traffic" (which is identifiable as Tor, but nothing more) and (2) was the only person using Tor on the whole campus at the time the bomb threat was made. This is bad opsec, but let's leave it to our mighty teacher to point out how tor is vulnerable. >"In each of these examples, nobody was arrested for using Tor." It's almost like the point is to create fear rather than inform us of an actual risk. FUD, perhaps? >Lots of hand waving about tor bridges. He makes them out to be a fingerprint, while constantly interjecting these little caveats about "well, sometimes", and "but they get randomized regularly", etc. To say he actively undermines his case would be nothing short of an understatement. >He actively fails to understand, or intentionally misrepresents, how bridges are allocated to make it seem like you can effectively enumerate them. This is blatantly false. >More handwaving about tor (private) bridges. This time he claims that connecting to a given IP multiple times over a period would indicate that its a bridge. lol, this seems to be a fundamental misunderstanding of how network traffic works, which is scary for somebody who bills himself as an expert. >This gem: "While you are not unique, you are very distinct. This allows me to associate your real IP address with traffic from a known Tor exit node." There's a technological and logical leap here that defies explanation. For this "vulnerability" he isn't assuming a global adversary ("In particular, it requires someone with a god's-eye view who can see all exit node and internet traffic."; which would imply some level of volume analysis necessary to correlate these two endpoints). As tor routes traffic to another country by default, you need to have cooperation all along the chain, which doesn't happen. >"Tracking Vulnerability #6: Using Unlisted and Private Bridges to Identify Possession". This one is hilarious, he basically assumes they've already proven you're using a private/unlisted bridge, and this basically is the part where they show up and prove it by looking at your settings. >The conclusions are all premised, again, on *global* adversarial conditions, but he misrepresents this as a nation-state condition, rather than global. Very sneaky and disingenuous. >"Security vs Security" >>Me smart, make deep philosophical argomant >"The captcha system used by the Tor Project was cutting edge seven years ago. However, "secure enough" is a moving target. By today's standards, this is one of the weakest captcha systems available." Oh wow, a plausible attack vector to enumerate bridges. Oh waiiiiiit, they have other mitigations. But, that's no excuse for the Tor project, let's give the guy a break and accept that this is a glaring oversight. >"it immediately connects to all of them [bridges]". Again, not knowing how network traffic looks for people who browse a handful of sites. >"On 2020-07-30, the Tor Project tweeted a response to my previous two public disclosures. While I expected a response, I thought it would have been addressed directly to me, or possibly delivered through private channels since they know how to contact me. I did not expected them to omit me from the recipient list." The Tor project knows a clout chaser when they see one. Listen to that whine. >He gets really mad about semantics, since he's wrong and everybody else (in the know) knows better. >"Unfortunately, you only addressed three topics, while these blog entries point out substantially more issues. In addition, your reply includes many comments that imply confusion and misunderstanding on your part. In this letter, I am detailing these specific issues. I also noticed that you sent a variation of your Twitter response to reporter Catalin Cimpanu at ZDNet" >"However, the scrollbar profiling issue is more substantial." I've never seen somebody so upset by a scrollbar before. For reference, the "0day" is you can sniff the width of a scroll bar, which varies from platform to platform, predictably. This effectively allows you to "maybe, possibly, kinda, sort of" pin down their platform. To what? One of three? LOL ya, dangerous stuff. >"In your reply, you point out that TLS fingerprinting is not new. And I agree: in my first "0day" blog entry, under the heading "Dropping 0Days", I explicitly mentioned that I found these independently but that they may not be new.". A clear indication he doesn't know what 0days are. Also, for the worried, this only applies to direct connections, which aren't designed to be robust against identification. >"it does not explain why, over the last few years, you have normalized to a homogeneous solution using a single pluggable transport: obfs4." This guy is good at complaining, and very bad at either contributing, or analyzing. obfs4 is highly effective, and continuously developed to maintain its safety and security. His contribution? Bitch and moan. >"the only new pluggable transport is Snowflake, and it has been in testing since 2016". It's almost like they take their jobs seriously and don't release an unproven product... >"My working code is currently deployed on a few high-volume networks and takes almost no resources." This is effectively a "no u". Note he never makes an effort to actually show them the source code, or provide any iota of actionable information. It's ~magic~. >"My solution can detect private obfs4 bridges", which is why so many dissidents in China are being arrested. Oh wait, they're not? LOL. I think a nation state with more resources and know how would've figured this out a long time ago. Again, however, obfs4 is an evolving protocol - it isn't static and responds to failures rapidly. >"[meek] just requires tracking the TCP payload size and the time between request and reply." This is not a safe way to detect fuarrrkall lol. The false positive rate would be insane if anybody actually tried this. But hey, meek isn't obfs4, so let's give the guy a well-deserved point. >Oh, a citation: https://medium.com/@phoebecross/using-tor-in-china-1b84349925da . Look carefully at the image at the top, it's the official website. youdontsay.gif. The rest of the page trumpets things like meek/obfs4: >>Method 1: Tor with Meek-Azure Bridge >>Method 2: Tor with Private Obfs4 Bridge >>Method 5: Snowflake >"However, I know of no public disclosure for detecting and blocking obfs4. Without the disclosure, developers won't be able to identify and address the limitations that make obfs4 detectable." People who depend on Tor would be very loud if it was failing as horrifically as this guy makes it out to. So basically, he's spewing FUD. That's about as far as I'm going to read. I'm going to try his obfs4 detection method. It makes a lot of assumptions that I don't trust, I suspect it'll have a high false positive rate. He makes a hilarious observation that the US gov isn't going after dark markets and cp rings, due to "due process" when Snowden debunked any such notion. If they could, they would. That would've been a plume of feathers in their cap to justify the mass surveillance programs (there's laws in the books about drug distribution for terrorist funding ends, and it would be trivial to make such a case in court for many of these markets which also distribute fake documents, and weapons fitting that criteria). This also applies to his woes of some mystical corporate super sniffer: if they were coordinating and sharing traffic enough to unmask tor users' behaviors, then (1) they'd be reporting servers left and right and (2) the government would know and subpoena the soykaf out of them. We can look at the overwhelming evidence of how dark markets are operating normally, and the ones that are taken down is owed to poor opsec. We could assume they're lying and using parallel construction, but then why aren't they going after all the current major players? Governments don't just lose interest like that. Also, all the cp rings? A smidgen of observation and logic will reveal that his concerns are hilariously unfounded, hyperbolic, self-aggrandizing, and overtly untrue. Overall, this guy is just thumping his chest and making a splash because he wants that sweet sweet online recognition. The Tor project rightfully knows better than to reward a clout chaser, as another lain so eloquently put it. Put your tin foil hats away, lains, there's scary things out there but this ain't it. But you know, if you're truly paranoid, consider contributing to the Tor project. Under many eyes, all bugs are shallow, as the adage goes.

>>21332 What kind of software are you interested in? What skills do you have right now? What size / organization of project would you prefer? Nobody can answer your question without knowing this.

>>21354 >>"Tracking Vulnerability #6: Using Unlisted and Private Bridges to Identify Possession" lolwut. That isn't a vulnerability, he's totally padding his numbers with blatant bullshit.

>>21334 How does one contribute (code) to Tor without being a lvl 100 crypto and network wizard?

>>21364 look through the bug tracker and work on quality of life improvements. for instance, you can make things like guard node selection more customizable.

>>21365 This. Tor requires a lot of code work to customize. You can make good improvements by giving users more power over their nodes and onions.

>>21358 I was actually looking to learn a skillset from participating in this,the organization don't really matter all that much as long as the project is worthwhile

I code mostly C#, SQL and Ruby, are there any projects that you think I could contribute?

>>21484 I can tell you don't program much by your post, so probably not. The programming language a project is isn't really a big factor to whether or not you can contribute to it. You will spend more time understanding the project enough to contribute than it takes to learn a new programming language. If you really don't want to learn another language you can just search github for whatever language you want to use, but don't think that knowing the language will just let you jump in.

>>21492 >I can tell you don't program much by your post Not for free, but I've been thinking I should build up my Github profile.

>>21332 OpenBSD Although your code would probably be too bad to be accepted. You can still send them money and hardware though.

>>21379 Find a project that you actually use and like and contribute to that, otherwise you're just going to get instantly demotivated.