tor-webwml.git

Moved contribute.html to old-contribute.html moved new-contribute.html to contribute.html
Parent 96b7b4ef2
Andrew Lewman

Andrew Lewman commited on 2005-06-29 04:32:55
Zeige 2 geänderte Dateien mit 375 Einfügungen und 139 Löschungen.

contribute.html
Zeige Datei @ 4a5048d11
... ... 
@@ -1,5 +1,4 @@
1 
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
2 
-"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
1 
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
3 2
4 3 
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
5 4 
 <head>
... ... 
@@ -39,165 +38,193 @@
39 38 
 <div class="main-column">
40 39
41 40 
 <!-- PUT CONTENT AFTER THIS TAG -->
42 
-
43 
-<h2>Tor: Contribute</h2>
44 
-<hr />
45 
-
46 
-<p>Ongoing needs:</p>
47 
-<ul>
48 
-<li>We need users like you to try Tor out, and let the Tor developers
49 
-know about bugs you find or features you don't find.</li>
50 
-<li>Please consider <a
51 
-href="cvs/tor/doc/tor-doc.html#server">running a
52 
-server</a> to help the Tor network grow.</li>
53 
-<li>We especially need people with Windows programming skills
54 
-to run an exit server on Windows, to help us debug.</li>
55 
-<li>Run a <a href="cvs/tor/doc/tor-doc.html#hidden-service">Tor hidden
56 
-service</a> and put interesting content on it.</li>
57 
-<li>Tell your friends! Get them to run servers. Get them to run hidden
58 
-services. Get them to tell <i>their</i> friends.</li>
59 
-<li>What else needs to be documented? What is mis-documented?</li>
60 
-<li>Consider joining the <a href="http://secure.eff.org/tor">Electronic
61 
-Frontier Foundation</a>. More EFF donations means more freedom in the world,
62 
-including more Tor development.</li>
63 
-</ul>
64 
-
65 
-<p>We also have many project-lets: short-term or self-contained tasks
66 
-that would be really helpful for somebody to tackle so we can keep
67 
-focusing on Tor.</p>
68 
-
69 
-<p>Writing project-lets:</p>
70 
-<ul>
71 
-<li>Does somebody want to help maintain this website, or help with
72 
-documentation, or help with managing our TODO and handling bug reports?</li>
73 
-<li>We may have too <i>much</i> documentation. It's spread out too far
74 
-and duplicates itself in places. Can you help us consolidate?</li>
75 
-<li>Please help translate the web page and documentation
76 
-into other languages. See the <a href="translation.html">translation guidelines</a>
77 
-if you want to help out. (Examples:
78 
-<a href="http://membres.lycos.fr/geolemalin/anonymat_garantit.htm">French</a>
79 
-, <a href="http://tor.freesuperhost.com/">Persian</a> and
80 
-<a href="http://www.gamevn.com/forum/showthread.php?t=103346">Vietnamese</a>.)</li>
81 
-<li>Please fix up <a
82 
-href="http://wiki.noreply.org/wiki/TheOnionRouter/TorFAQ">the FAQ Wiki</a>,
83 
-and if you know the answer to a question in the "unanswered FAQs" list,
84 
-please answer it.</li>
85 
-</ul>
86 
-
87 
-<p>Packaging project-lets:</p>
41 
+    <h2>Six things everyone can do now:</h2>
42 
+    <ol>
43 
+    <li> We need users like you to try Tor out, and let the Tor developers know about bugs you find or features you don't find.</li>
44 
+    <li> Please consider running a server to help the Tor network grow.</li>
45 
+    <li> We especially need people with Windows programming skills to run an exit server on Windows, to help us debug.</li>
46 
+    <li> Run a Tor hidden service and put interesting content on it.</li>
47 
+    <li> Tell your friends! Get them to run servers. Get them to run hidden services. Get them to tell their friends.</li>
48 
+    <li> Consider joining the Electronic Frontier Foundation. More EFF donations means more freedom in the world, including more Tor development.</li>
49 
+    </ol>
50 
+
51 
+<h2>Coding Challenges</h2>
88 52 
 <ul>
89 
-<li>We're always looking for better Windows installers. Specifically,
90 
-it would be great if somebody were to extend our NSIS-based windows
91 
-installer to include FreeCap and Privoxy.</li>
92 
-<li>Our OS X installer can't be uninstalled. Are there non-sucky OS X
93 
-packagers that have uninstall capabilities? This is becoming an
94 
-increasing bother.</li>
95 
-</ul>
96 
-
97 
-<p>Organizational and application testing project-lets:</p>
98 
-<ul>
99 
-<li>We've got a list of potentially useful programs you might
100 
-run with Tor <a href="users.html">here</a>. We also have the <a
101 
-href="http://wiki.noreply.org/wiki/TheOnionRouter/TorifyHOWTO">Torify
102 
-howto</a>. Can somebody try them out, simplify the explanations, expand
103 
-them where they need it, document them better, and make them all-around
104 
-more useful?</li>
53 
+<li>Update crypto usage to use openssl aes when available.</li>
54 
+<li>Implement a buffer design modelled after the linux kernel buffer design.</li>
55 
+<li>how do ulimits work on win32, anyway?  (We should handle WSAENOBUFS as needed, look at the MaxConnections registry entry, look at the MaxUserPort entry, and look at the TcpTimedWaitDelay entry. We may also want to provide a way to set them as needed. See bug 98.)</li>
56 
+<li>Implement reverse DNS (already specified)</li>
57 
+<li>Implement a FirewalledIPs config option that works like FirewallPorts.</li>
58 
+<li>Make configure.in handle cross-compilation</li>
59 
+<li>Have NULL_REP_IS_ZERO_BYTES default to 1.</li>
60 
+<li>Make with-ssl-dir disable search for ssl.</li>
61 
+<li>Implement preservation of reputation through reboots for clients and dirservers. </li>
62 
+<li>Add in support egd or other non-OS-integrated strong entropy sources.</li>
63 
+<li>Implement password protection for on-disk identity key</li>
64 
+<li>Implement a way to get autoconf to install things into ~/.tor.</li>
65 
+<li>Change server descriptors to declare log level.</li>
66 
+<li>Add in support for clients to avoid servers that are too loggy based upon user configuration of acceptable log level.</li>
67 
+<li>Separate node discovery from routing to allow neat extensions.  [Goodell?]</li>
68 
+<li><ul>
69 
+<li>Add SetServerStatus control event to adjust verified/running status of nodes.</li>
70 
+<li>Add NoDownload config option to prevent regular directory downloads from happening.</li>
71 
+</ul></li>
72 
+<li>Choosing exit node by meta-data, e.g. country.</li>
73 
+<li>Use cpuworker for more heavy lifting.</li>
74 
+<li><ul>
75 
+<li>Signing (and verifying) hidserv descriptors</li>
76 
+<li>Signing (and verifying) intro/rend requests</li>
77 
+<li>Signing (and verifying) router descriptors</li>
78 
+<li>Signing (and verifying) directories</li>
79 
+<li>Doing TLS handshake (this is very hard to separate out, though)</li>
80 
+</ul></li>
81 
+<li>Buffer size pool: allocate a maximum size for all buffers, not a maximum size for each buffer. So we don't have to give up as quickly (and kill the thickpipe!) when there's congestion.</li>
82 
+<li>Add alternative versions of crypto.c and tortls.c to use libnss or libgcrypt+gnutls.</li>
83 
+<li>Implement a way to stop falling back to forbidden ports when FascistFirewall blocks all good dirservers, if there is already a good, cached directory locally.</li>
84 
+<li>Extend our NSIS-based windows installer to include FreeCap and/or Privoxy.</li>
85 
+<li>Develop a way to handle OS X installation and uninstallation.</li>
86 
+<li>Develop a GUI or other controller program, to do configuration, etc.  See our control specification for details, and the rudimentary demonstration Python control script. </li>
87 
+<li><ul>
88 
+<li>Design an interface for the control program. You can use any license you want, but we'd recommend 3-clause BSD or maybe GPL; and we can only help out if your license conforms to the DFSG.</li>
89 
+<li>Periodically people running servers tells us they want to have one
90 
+    BandwidthRate during some part of the day, and a different
91 
+    BandwidthRate at other parts of the day. Rather than coding this
92 
+    inside Tor, we should have a little script that speaks via the Tor
93 
+    Controller Interface, and does a setconf to change the bandwidth
94 
+    rate. Perhaps it would run out of cron, or perhaps it would sleep
95 
+    until appropriate times and then do its tweak (that's probably more
96 
+    portable). Can somebody write one for us and we'll put it inside
97 
+    tor/contrib/?</li>
98 
+</ul></li>
99 
+<li>Develop a way to become a Windows NT service.  </li>
100 
+<li>Develop a systray app for Tor under MS Windows (all versions).  </li>
101 
+<li>Integrate a good (portable, fast, clean, BSD-free) asynchronous DNS library so we don't have to keep forking DNS worker threads to do gethostbyname.</li>
105 102 
 </ul>
106 103
107 
-<p>Programmer and developer project-lets:</p>
104 
+<h2>Documentation Challenges</h2>
108 105 
 <ul>
109 
-<li>We need somebody to code up a GUI or other
110 
-controller program, to do configuration, etc. See our <a
111 
-href="cvs/tor/doc/control-spec.txt">control specification</a> for details,
112 
-and the <a href="cvs/tor/contrib/TorControl.py">rudimentary demonstration
113 
-Python control script</a>. No, we don't know what the interface should look
114 
-like.  You can use any license you want, but we'd recommend 3-clause BSD or
115 
-maybe GPL; and we can only help out if your license conforms to the
116 
-<a href="http://www.debian.org/social_contract.html#guidelines">DFSG</a>.</li>
117 
-<li>Periodically people running servers tells us they want to have one
118 
-BandwidthRate during some part of the day, and a different BandwidthRate
119 
-at other parts of the day. Rather than coding this inside Tor, we should
120 
-have a little script that speaks via the Tor Controller Interface, and does
121 
-a setconf to change the bandwidth rate. Perhaps it would run out of cron,
122 
-or perhaps it would sleep until appropriate times and then do its tweak
123 
-(that's probably more portable). Can somebody write one for us and we'll
124 
-put it inside <a href="cvs/tor/contrib/">tor/contrib/</a>?</li>
125 
-<li>Does somebody want to do up a patch so we can be an NT service? Or
126 
-so we can go in the system tray?</li>
127 
-<li>A good (portable, fast, clean, BSD-free) asynchronous DNS library
128 
-would be really handy, so we don't have to keep forking DNS worker
129 
-threads to do gethostbyname.</li>
130 
-<li>Can somebody take a look at Martin's <a
131 
-href="http://wiki.noreply.org/wiki/TheOnionRouter/SquidProxy">Squid
132 
-and Tor</a> page, and update it to reflect Tor's
133 
-<a href="http://tor.eff.org/tor-manual.html">RedirectExit</a> config
134 
-option?</li>
135 
-<li>See the <a href="cvs/tor/doc/TODO">TODO</a> and
136 
-<a href="cvs/tor/doc/HACKING">HACKING</a> files in the Tor distribution
137 
-for more ideas.</li>
106 
+<li>Write server instructions for OSX and Windows operators.</li>
107 
+<li>Improve and clarify the wiki entry on port forwarding. url?</li>
108 
+<li>Document how to do exit node caching: tie into squid or other caching web proxy.</li>
109 
+<li>Help maintain this website; code, content, css, overall layout,</li>
110 
+<li>Help with documentation </li>
111 
+<li>Help consolidate documentation.  We may have too much documentation.  It's spread out too far and duplicates itself in places. </li>
112 
+<li>Help translate the web page and documentation into other languages.  See the translation guidelines if you want to help out. (Examples: French , Persian and Vietnamese.)</li>
113 
+<li>If you know the answer to a Wiki question in the "unanswered FAQs" list, please answer it. url?</li>
114 
+<li>Take a look at Martin's Squid and Tor page, and update it to reflect Tor's RedirectExit config option. url?</li>
138 115 
 </ul>
139 116
140 
-<p>Security project-lets: We need people to attack the implementation
141 
-and clean it up, and also to attack the design and experiment with
142 
-defenses.</p>
117 
+<h2>Testing Challenges</h2>
143 118 
 <ul>
144 
-<li>We need somebody to <a
145 
-href="http://en.wikipedia.org/wiki/Fuzz_testing">fuzz</a> Tor. Are there
146 
-good libraries out there for what we want? What are the first steps? Win
147 
-fame by getting credit when we put out a new release because of you!</li>
148 
-<li>Website volume fingerprinting attacks (<a
149 
-href="http://freehaven.net/anonbib/#back01">Back et al</a>, <a
150 
-href="http://freehaven.net/anonbib/#hintz02">Hintz</a>).
151 
-Defenses include a large cell size, <a
152 
-href="http://freehaven.net/anonbib/#timing-fc2004">defensive dropping</a>,
153 
-etc. How well does each approach work?</li>
119 
+<li>Test out why some of our tor servers have dns resolvers that resolve
120 
+unknown addresses to 127.0.0.1.</li>
121 
+<li><ul>
122 
+<li>Identify the servers that experience this issue. </li>
123 
+<li>Identify how to cause and repair the issue in BIND, DJBDNS, or
124 
+whatever daemon the misconfigured servers use.</li>
125 
+</ul></li>
126 
+<li>Figure out how to setup web proxy gateways to let normal people
127 
+browse hidden services.  (This has been done a few times, but nobody has
128 
+sent us code.)</li>
129 
+<li>Investigate privoxy vs. freecap for win32 clients</li>
130 
+<li>Evaluate, create, and document a list of programs that work with
131 
+Tor.  </li>
132 
+<li>Perform a security analysis of Tor with "fuzz". Determine if there
133 
+good libraries out there for what we want. Win fame by getting credit
134 
+when we put out a new release because of you!</li>
135 
+<li>Website volume fingerprinting attacks (Back et al, Hintz). Defenses
136 
+include a large cell size, defensive dropping, etc. How well does each
137 
+approach work?</li>
154 138 
 <li>The end-to-end traffic confirmation attack. We need to study
155 
-long-range dummies more, along with traffic shaping. How much traffic
156 
-of what sort of distribution is needed before the adversary is confident
157 
-he has won?</li>
158 
-<li>It's not that hard to DoS Tor servers or dirservers. Are puzzles
159 
-the right answer? What other practical approaches are there?</li>
160 
-<li>What sensitive info squeaks by privoxy? Are other html scrubbers
161 
-better?</li>
139 
+long-range dummies more, along with traffic shaping. How much traffic of
140 
+what sort of distribution is needed before the adversary is confident he
141 
+has won?</li>
142 
+<li>Determine what sensitive info squeaks by privoxy. </li>
143 
+<li>Deteremine if there are other html scrubbers that are better than
144 
+privoxy.</li>
162 145 
 </ul>
163 146
164 
-<p>Designer project-lets:</p>
147 
+<h2>Research Challenges</h2>
165 148 
 <ul>
149 
+<li>Arranging membership management for independence.</li>
150 
+<li><ul>
151 
+<li>Sybil defenses without having a human bottleneck.</li>
152 
+<li>How to gather random sample of nodes.</li>
153 
+<li>How to handle nodelist recommendations.</li>
154 
+<li>Consider incremental switches: a p2p tor with only 50 users has
155 
+different anonymity properties than one with 10k users, and should be
156 
+treated differently.</li>
157 
+</ul></li>
158 
+<li>Incentives to relay; incentives to exit.</li>
159 
+<li>Allowing dissidents to relay through Tor clients.</li>
160 
+<li>Experiment with mid-latency systems. How do they impact usability,
161 
+    how do they impact safety?</li>
162 
+<li>Understand how powerful fingerprinting attacks are, and experiment
163 
+    with ways to foil them (long-range padding?).</li>
164 
+<li>Come up with practical approximations to picking entry and exit in
165 
+    different routing zones.</li>
166 
+<li>Find ideal churn rate for helper nodes; how safe is it?</li>
167 
+<li>Attacking freenet-gnunet/timing-delay-randomness-arguments.</li>
168 
+<li>Is exiting from the middle of the circuit always a bad idea?</li>
169 
+<li>IPv6 support (For exit addresses)</li>
170 
+<li><ul>
171 
+<li>Spec issue: if a resolve returns an IP4 and an IP6 address,
172 
+      which to use?</li>
173 
+<li>Add to exit policy code</li>
174 
+<li>Make tor_gethostbyname into tor_getaddrinfo</li>
175 
+<li>Make everything that uses uint32_t as an IP address change to use
176 
+      a generalize address struct.</li>
177 
+<li>Change relay cell types to accept new addresses.</li>
178 
+<li>Add flag to serverdescs to tell whether IPv6 is supported.</li>
179 
+</ul></li>
180 
+<li>patch tsocks with our current patches + gethostbyname, getpeername,
181 
+etc.</li>
182 
+<li>make freecap (or whichever) do what we want.</li>
183 
+<li>scrubbing proxies for protocols other than http.</li>
184 
+<li>We need better default privoxy configs to ship.</li>
185 
+<li>We need a good scrubbing HTTP proxy; privoxy is unmaintained and
186 
+sucky.</li>
187 
+<li>A DNS proxy would let unmodified socks4/socks5 apps to work
188 
+well.</li>
189 
+<li>Add SOCKS support to more applications</li>
190 
+<li>store hidden service information to disk: dirservers forget service
191 
+descriptors when they restart; nodes offering hidden services forget
192 
+their chosen intro points when they restart.</li>
193 
+<li>It's not that hard to DoS Tor servers or dirservers. Are puzzles the
194 
+right answer? What other practical approaches are there?</li>
166 195 
 <li>Server CPU load is high because clients keep asking to make new
167 
-circuits, which uses public key crypto. Possible defenses include:
168 
-using helper nodes (fixed entry nodes); rate limiting the number of
169 
-create cells handled per second; having clients retry failed extensions
170 
-a few times; implementing ssl sessions; and using hardware crypto when
196 
+circuits, which uses public key crypto. Possible defenses include: using
197 
+helper nodes (fixed entry nodes); rate limiting the number of create
198 
+cells handled per second; having clients retry failed extensions a few
199 
+times; implementing ssl sessions; and using hardware crypto when
171 200 
 available.</li>
172 201 
 <li>We fear we might not work very well when servers have asymmetric
173 
-bandwidth. Because Tor has separate TCP connections between each hop,
174 
-if the incoming bytes are arriving just fine and the outgoing bytes
175 
-are all getting dropped on the floor, the TCP push-back mechanisms
176 
-don't really transmit this information back to the incoming streams.
177 
-Perhaps Tor should detect when it's dropping a lot of outgoing packets,
178 
-and rate-limit incoming streams to regulate this itself? We need somebody
179 
-who's good with networks to simulate this and help design solutions.</li>
202 
+bandwidth. Because Tor has separate TCP connections between each hop, if
203 
+the incoming bytes are arriving just fine and the outgoing bytes are all
204 
+getting dropped on the floor, the TCP push-back mechanisms don't really
205 
+transmit this information back to the incoming streams. Perhaps Tor
206 
+should detect when it's dropping a lot of outgoing packets, and
207 
+rate-limit incoming streams to regulate this itself? We need somebody
208 
+who's good with networks to simulate this and help design
209 
+solutions.</li>
180 210 
 <li>Right now the hidden service descriptors are being stored on the
181 211 
 dirservers, but any reliable distributed storage system would do (for
182 212 
 example, a DHT that allows authenticated updates). Can somebody figure
183 213 
 out our best options and decide if they're good enough?</li>
184 
-<li>How hard is it to patch bind or a DNS proxy to redirect requests
185 
-to Tor via our tor-resolve socks extension? What about to convert UDP
186 
-DNS requests to TCP requests and send them through Tor?</li>
214 
+<li>How hard is it to patch bind or a DNS proxy to redirect requests to
215 
+Tor via our tor-resolve socks extension? What about to convert UDP DNS
216 
+requests to TCP requests and send them through Tor?</li>
187 217 
 <li>Tor provides anonymous connections, but if you want to keep multiple
188 218 
 pseudonyms in practice (say, in case you frequently go to two websites
189 
-and if anybody knew about both of them they would conclude it's you),
190 
-we don't support that well yet. We should find a good approach and
191 
-interface for handling pseudonymous profiles in Tor. See <a
192 
-href="http://archives.seul.org/or/talk/Dec-2004/msg00086.html">this
193 
-post</a> and <a
194 
-href="http://archives.seul.org/or/talk/Jan-2005/msg00007.html">followup</a>
195 
-for details.</li>
219 
+and if anybody knew about both of them they would conclude it's you), we
220 
+don't support that well yet. We should find a good approach and
221 
+interface for handling pseudonymous profiles in Tor. See this post and
222 
+followup for details.</li>
223 
+<li>Congestion control. Is our current design sufficient once we have
224 
+heavy use? Need to measure and tweak, or maybe overhaul.</li>
196 225 
 </ul>
197 226
198 
-<p>Drop by <a href="irc://irc.oftc.net/tor">the #tor IRC channel at irc.oftc.net</a> or
199 
-<a href="mailto:tor-volunteer@freehaven.net">email
200 
-tor-volunteer@freehaven.net</a> if you want to help out!</p>
227 
+Drop by the #tor IRC channel at irc.oftc.net or email tor-volunteer@freehaven.net if you want to help out!
201 228
202 229 
 </div><!-- #main -->
203 230 
 </div>
old-contribute.html
Zeige Datei @ 4a5048d11
... ... 
@@ -0,0 +1,209 @@
1 
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
2 
+"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
3 
+
4 
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
5 
+<head>
6 
+  <title>Tor: Contribute</title>
7 
+  <meta name="Author" content="Roger Dingledine" />
8 
+  <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1" />
9 
+  <link rel="stylesheet" type="text/css" href="stylesheet.css" />
10 
+  <link rel="shortcut icon" type="image/x-icon" href="/favicon.ico" />
11 
+</head>
12 
+<body>
13 
+
14 
+<!-- TITLE BAR & NAVIGATION -->
15 
+
16 
+<table class="banner" border="0" cellpadding="0" cellspacing="0">
17 
+    <tr>
18 
+        <td class="banner-left"></td>
19 
+        <td class="banner-middle">
20 
+            <a href="index.html">Home</a>
21 
+          | <a href="howitworks.html">How It Works</a>
22 
+          | <a href="download.html">Download</a>
23 
+          | <a href="documentation.html">Docs</a>
24 
+          | <a href="users.html">Users</a>
25 
+          | <a href="faq.html">FAQs</a>
26 
+          | <a class="current">Contribute</a>
27 
+          | <a href="developers.html">Developers</a>
28 
+          | <a href="research.html">Research</a>
29 
+          | <a href="people.html">People</a>
30 
+        </td>
31 
+        <td class="banner-right"></td>
32 
+    </tr>
33 
+</table>
34 
+
35 
+<!-- END TITLE BAR & NAVIGATION -->
36 
+
37 
+<div class="center">
38 
+
39 
+<div class="main-column">
40 
+
41 
+<!-- PUT CONTENT AFTER THIS TAG -->
42 
+
43 
+<h2>Tor: Contribute</h2>
44 
+<hr />
45 
+
46 
+<p>Ongoing needs:</p>
47 
+<ul>
48 
+<li>We need users like you to try Tor out, and let the Tor developers
49 
+know about bugs you find or features you don't find.</li>
50 
+<li>Please consider <a
51 
+href="cvs/tor/doc/tor-doc.html#server">running a
52 
+server</a> to help the Tor network grow.</li>
53 
+<li>We especially need people with Windows programming skills
54 
+to run an exit server on Windows, to help us debug.</li>
55 
+<li>Run a <a href="cvs/tor/doc/tor-doc.html#hidden-service">Tor hidden
56 
+service</a> and put interesting content on it.</li>
57 
+<li>Tell your friends! Get them to run servers. Get them to run hidden
58 
+services. Get them to tell <i>their</i> friends.</li>
59 
+<li>What else needs to be documented? What is mis-documented?</li>
60 
+<li>Consider joining the <a href="http://secure.eff.org/tor">Electronic
61 
+Frontier Foundation</a>. More EFF donations means more freedom in the world,
62 
+including more Tor development.</li>
63 
+</ul>
64 
+
65 
+<p>We also have many project-lets: short-term or self-contained tasks
66 
+that would be really helpful for somebody to tackle so we can keep
67 
+focusing on Tor.</p>
68 
+
69 
+<p>Writing project-lets:</p>
70 
+<ul>
71 
+<li>Does somebody want to help maintain this website, or help with
72 
+documentation, or help with managing our TODO and handling bug reports?</li>
73 
+<li>We may have too <i>much</i> documentation. It's spread out too far
74 
+and duplicates itself in places. Can you help us consolidate?</li>
75 
+<li>Please help translate the web page and documentation
76 
+into other languages. See the <a href="translation.html">translation guidelines</a>
77 
+if you want to help out. (Examples:
78 
+<a href="http://membres.lycos.fr/geolemalin/anonymat_garantit.htm">French</a>
79 
+, <a href="http://tor.freesuperhost.com/">Persian</a> and
80 
+<a href="http://www.gamevn.com/forum/showthread.php?t=103346">Vietnamese</a>.)</li>
81 
+<li>Please fix up <a
82 
+href="http://wiki.noreply.org/wiki/TheOnionRouter/TorFAQ">the FAQ Wiki</a>,
83 
+and if you know the answer to a question in the "unanswered FAQs" list,
84 
+please answer it.</li>
85 
+</ul>
86 
+
87 
+<p>Packaging project-lets:</p>
88 
+<ul>
89 
+<li>We're always looking for better Windows installers. Specifically,
90 
+it would be great if somebody were to extend our NSIS-based windows
91 
+installer to include FreeCap and Privoxy.</li>
92 
+<li>Our OS X installer can't be uninstalled. Are there non-sucky OS X
93 
+packagers that have uninstall capabilities? This is becoming an
94 
+increasing bother.</li>
95 
+</ul>
96 
+
97 
+<p>Organizational and application testing project-lets:</p>
98 
+<ul>
99 
+<li>We've got a list of potentially useful programs you might
100 
+run with Tor <a href="users.html">here</a>. We also have the <a
101 
+href="http://wiki.noreply.org/wiki/TheOnionRouter/TorifyHOWTO">Torify
102 
+howto</a>. Can somebody try them out, simplify the explanations, expand
103 
+them where they need it, document them better, and make them all-around
104 
+more useful?</li>
105 
+</ul>
106 
+
107 
+<p>Programmer and developer project-lets:</p>
108 
+<ul>
109 
+<li>We need somebody to code up a GUI or other
110 
+controller program, to do configuration, etc. See our <a
111 
+href="cvs/tor/doc/control-spec.txt">control specification</a> for details,
112 
+and the <a href="cvs/tor/contrib/TorControl.py">rudimentary demonstration
113 
+Python control script</a>. No, we don't know what the interface should look
114 
+like.  You can use any license you want, but we'd recommend 3-clause BSD or
115 
+maybe GPL; and we can only help out if your license conforms to the
116 
+<a href="http://www.debian.org/social_contract.html#guidelines">DFSG</a>.</li>
117 
+<li>Periodically people running servers tells us they want to have one
118 
+BandwidthRate during some part of the day, and a different BandwidthRate
119 
+at other parts of the day. Rather than coding this inside Tor, we should
120 
+have a little script that speaks via the Tor Controller Interface, and does
121 
+a setconf to change the bandwidth rate. Perhaps it would run out of cron,
122 
+or perhaps it would sleep until appropriate times and then do its tweak
123 
+(that's probably more portable). Can somebody write one for us and we'll
124 
+put it inside <a href="cvs/tor/contrib/">tor/contrib/</a>?</li>
125 
+<li>Does somebody want to do up a patch so we can be an NT service? Or
126 
+so we can go in the system tray?</li>
127 
+<li>A good (portable, fast, clean, BSD-free) asynchronous DNS library
128 
+would be really handy, so we don't have to keep forking DNS worker
129 
+threads to do gethostbyname.</li>
130 
+<li>Can somebody take a look at Martin's <a
131 
+href="http://wiki.noreply.org/wiki/TheOnionRouter/SquidProxy">Squid
132 
+and Tor</a> page, and update it to reflect Tor's
133 
+<a href="http://tor.eff.org/tor-manual.html">RedirectExit</a> config
134 
+option?</li>
135 
+<li>See the <a href="cvs/tor/doc/TODO">TODO</a> and
136 
+<a href="cvs/tor/doc/HACKING">HACKING</a> files in the Tor distribution
137 
+for more ideas.</li>
138 
+</ul>
139 
+
140 
+<p>Security project-lets: We need people to attack the implementation
141 
+and clean it up, and also to attack the design and experiment with
142 
+defenses.</p>
143 
+<ul>
144 
+<li>We need somebody to <a
145 
+href="http://en.wikipedia.org/wiki/Fuzz_testing">fuzz</a> Tor. Are there
146 
+good libraries out there for what we want? What are the first steps? Win
147 
+fame by getting credit when we put out a new release because of you!</li>
148 
+<li>Website volume fingerprinting attacks (<a
149 
+href="http://freehaven.net/anonbib/#back01">Back et al</a>, <a
150 
+href="http://freehaven.net/anonbib/#hintz02">Hintz</a>).
151 
+Defenses include a large cell size, <a
152 
+href="http://freehaven.net/anonbib/#timing-fc2004">defensive dropping</a>,
153 
+etc. How well does each approach work?</li>
154 
+<li>The end-to-end traffic confirmation attack. We need to study
155 
+long-range dummies more, along with traffic shaping. How much traffic
156 
+of what sort of distribution is needed before the adversary is confident
157 
+he has won?</li>
158 
+<li>It's not that hard to DoS Tor servers or dirservers. Are puzzles
159 
+the right answer? What other practical approaches are there?</li>
160 
+<li>What sensitive info squeaks by privoxy? Are other html scrubbers
161 
+better?</li>
162 
+</ul>
163 
+
164 
+<p>Designer project-lets:</p>
165 
+<ul>
166 
+<li>Server CPU load is high because clients keep asking to make new
167 
+circuits, which uses public key crypto. Possible defenses include:
168 
+using helper nodes (fixed entry nodes); rate limiting the number of
169 
+create cells handled per second; having clients retry failed extensions
170 
+a few times; implementing ssl sessions; and using hardware crypto when
171 
+available.</li>
172 
+<li>We fear we might not work very well when servers have asymmetric
173 
+bandwidth. Because Tor has separate TCP connections between each hop,
174 
+if the incoming bytes are arriving just fine and the outgoing bytes
175 
+are all getting dropped on the floor, the TCP push-back mechanisms
176 
+don't really transmit this information back to the incoming streams.
177 
+Perhaps Tor should detect when it's dropping a lot of outgoing packets,
178 
+and rate-limit incoming streams to regulate this itself? We need somebody
179 
+who's good with networks to simulate this and help design solutions.</li>
180 
+<li>Right now the hidden service descriptors are being stored on the
181 
+dirservers, but any reliable distributed storage system would do (for
182 
+example, a DHT that allows authenticated updates). Can somebody figure
183 
+out our best options and decide if they're good enough?</li>
184 
+<li>How hard is it to patch bind or a DNS proxy to redirect requests
185 
+to Tor via our tor-resolve socks extension? What about to convert UDP
186 
+DNS requests to TCP requests and send them through Tor?</li>
187 
+<li>Tor provides anonymous connections, but if you want to keep multiple
188 
+pseudonyms in practice (say, in case you frequently go to two websites
189 
+and if anybody knew about both of them they would conclude it's you),
190 
+we don't support that well yet. We should find a good approach and
191 
+interface for handling pseudonymous profiles in Tor. See <a
192 
+href="http://archives.seul.org/or/talk/Dec-2004/msg00086.html">this
193 
+post</a> and <a
194 
+href="http://archives.seul.org/or/talk/Jan-2005/msg00007.html">followup</a>
195 
+for details.</li>
196 
+</ul>
197 
+
198 
+<p>Drop by <a href="irc://irc.oftc.net/tor">the #tor IRC channel at irc.oftc.net</a> or
199 
+<a href="mailto:tor-volunteer@freehaven.net">email
200 
+tor-volunteer@freehaven.net</a> if you want to help out!</p>
201 
+
202 
+</div><!-- #main -->
203 
+</div>
204 
+  <div class="bottom" id="bottom">
205 
+     <i><a href="mailto:tor-webmaster@freehaven.net" class="smalllink">Webmaster</a></i> -
206 
+     $Id$
207 
+  </div>
208 
+</body>
209 
+</html>
0 210