Pluggable Transports Tor Browser Bundles

Abstract: The 2014 edition of this discussion. How close are we to gitian builds? Who should be building? Who should be signing/uploading/announcing the releases?

Minutes

Pearl Crescent has builds which use the default PTTBB bridges, or a user can
enter their own bridges. These builds (at least the branch which Mike plans to merge) are deterministic.

Release process: at least 2 anonymous users should have a matching gitian build before it is considered for any release.

The user, if they select "default bridges" will be asked which type, and they
are given a dropdown of types. Need a BridgeDB, or some UI, to guide users
through selecting which types which might work for them. BridgeDB can also use the Accept Language header and the users IP to try to automatically select one which we think will work.

Users are still trying to use Vidalia. BridgeDB's bridge lines at this point
must either break Vidalia or torrc-editing. Nearly everyone present was in agreement to break Vidalia first, meaning that BridgeDB should add the torrc-like "Bridge " prefix back (after removing it earlier this year).

How to approve new transport? Code review, enough bridges to go into tbb means
enough bridges to offer on HTTPS BridgeDB interface.

Isis researched python sandboxing of apps with PyPy, if this is desired for
the server-side bridge bundles or a client PTTBB, then this could be added. Isis should create gitian descriptors (based on David Fifields
branch) for building PyPy with JIT and sandboxing to see if it builds
deterministically.

Users should not mix types of transports, BridgeDB should have a "That Didn't
Work!" button after bridges are received to try the next type. Need funding
for bridgefinder in the medium to long term. Need a way to probe for something
which might work on first run of PTTBB, this could be written with ooniprobe (or a subset thereof), though it will need some sort of IPC to torlauncher. Things which work for PTTBB should also work for instantbird,
and torbirdy. The social distributor would allow a way for the PTTBB client to
contact BridgeDB in an anonymous, authenticated manner and a user could prove that they have "good behaviour" (i.e. are not blocking bridges) to get more bridges of the same type which are known to PTTBB to work. The social distributor also needs funding and is in the medium to long term roadmap for Pluggable Transport and Bridge usage (meaning it would be at least a year if it got funding today).

For now, the UI workflow of a user getting bridges from BridgeDB and entering them into PTTBB in a seamless way should be improved upon.