Opened 3 years ago

Last modified 3 years ago

#16716 needs_review defect

GetTor should have a way to send TPO mirrors

Reported by: ilv Owned by: ilv
Priority: Medium Milestone:
Component: Applications/GetTor Version:
Severity: Normal Keywords: sop15, mirrors
Cc: sukhbir, mrphs Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

As the summary says. This is part of the work being done in the Summer of Privacy 2015. I've created a script to get the mirrors from tpo in a secure manner here (it's my first experience with Twisted, so reviews are welcome). For the moment, it downloads tor-mirrors.csv and makes a json from that file (sample here). After #16601 this won't be necessary. A sample of the file that would be sent as an attachment to this message (mirrors_message) can be found here. The words 'mirror' and 'mirrors' trigger the option to send the mirrors in the email autoresponder (this is quite straightforward, I don't think it needs review).

It would be great to have opinions about the code and/or the list of mirrors to be sent.

Child Tickets

Change History (2)

comment:1 Changed 3 years ago by ilv

Severity: Normal

Adding quote from a short chat I had with mrphs:

"so if we're sending a download link from $mirror, we should make sure we've checked the integrity of that file before serving it to user.

one way to do it, is to check the sig right before sending it to user

another way is to make sure we check all of the mirrors periodically and randomly

and once we're about to send a link from an specific mirror, we need to check if it's been already checked in the past (eg: hour)"

See #17214.

comment:2 Changed 3 years ago by ilv

Status: newneeds_review
Note: See TracTickets for help on using tickets.