Legend:
SPEC!!  - Not specified
SPEC    - Spec not finalized
        - Not done
        * Top priority
        . Partially done
        o Done
        D Deferred
        X Abandoned

For a list of good beginner projects, check out HACKING.

NEEDS TO BE WRITTEN:

For 0.0.7:
        o Specification
                o Clear up specification for multiple addrs on MAIL
        o Infrastructure -- high level
                o Servers need to download and use directories
                o Servers should use downloaded directories to print useful
                  nicknames for other servers rather than just IP addresses.
                        o For outgoing connections
                        o For incoming connections
                        o Test
                o Have callers of Packet/BuildMessage/DeliveryPacket
                  decide whether to look for a tag in the RI field.
                D Make processing thread and module thread general
                  cases of a thread pool abstraction.?
        o Spec conformance
                o Make sure we skip descriptors that don't support our
                  current Packet-Version.
        o Performance
                o Do a setsockopt(IP_TOS, IPTOS_THROUGHPUT), unless on
                  cygwin, dgux, sni-sysv.
        o UI improvements
                o Use feature values instead of raw configuration values in
                  the [Testing]/Configuration entry.
                o Allow 'mixminion ping' to take addr:port as argument.
                o Flush messages to a single mix, or set of mixes.
                        o Implement
                        o Test
                o Clean messages for a single mix, or set of mixes.
                        o Implement
                        o Test
                o Support to remove servers from imported set, or to block
                  servers from directory.
                        o Implement
                        o Test
                        o Unit tests
                o "mixminiond" frontend
        o MMTP
                o Make MMTP bursty.
                o Bandwidth throttling
                        o Limit number of simultaneous outgoing connections
                                o Implement code
                                o Implement configurability
                                o Test
                        o Limit number of bytes transmitted/read per second
                                o Implement per-connnection cap functionality.
                                o Set and adjust caps.
                                o Configuration to enable caps
                                o Test
        o Security
                X Make createPrivateDirs gripe about group-writable parent
                  dirs.  [Actually, this has been done for a while!]
        o Large reply messages and efwd messages
                o Fragment-pool logic for client
                        o Decoding messages, pooling messages
                        o Inspecting pool state
                        o Extracting reconstructed messages
                        o Test
        o Pending bugs from email
                o Better response to failed bind(2)
                o Don't make errors kill 'mixminion shell'.
                o Handle \r\n when decoding stuff.
        . Windows stuff
                - Must include openssl libs with python-needed installer
                o Use new version of py2exe

For 0.0.7rc2:
        o Man pages
        D Nuke invalid cached dir.gz; don't kill server.
        o On invalid dir_new.gz, server falls back to old one, and
          client offers -D no.
        o Document bandwidth spikiness, maybe make configurable.
        o Don't report empty directories as having a "blank line 1."
        o Rename ConnectionTimeout to Timeout in client MMTP.
        o Make everything that takes -i default to read-from-stdin.
        o Manual pages
                o Re-do man page to be generated from common source
                  on all platforms (George.)
                o The 'make install' target should install the man page
                  when appropriate
                o Add pages for 'mixminiond' and 'mixminion.conf' and
                  'mixminiond.conf'.
        o Disable -H/--hops; give good errors on PathLength, SURBPathLength
        o Fix weasel's prepend-newline bug.


For 0.0.7final:
        . Manual pages
                . Move the canonical documentation from the README into
                  the manual page .


Deferred from 0.0.7:
        - Specification
                - Clear up specification for payload versions.
                - Clear up specification for NEWS
        - Dummies and pinging [Rationale: no time]
        - Make 'SIGHUP' reload, (and 'SIGUSR' dump). [Rationale: no time]
                - SIGHUP should reconfigure everything:
                        - Logs
                        - EventStats
                        - securedelete
                        - EntropySource (discard old entropy)
                        - Configuration (as used by key)
                        - File locations (????)
                        - Network setup
                        - Module setup
                        - (What else?)
                - SIGHUP should check whether serverinfo should be
                  regenerated.
                - Add SIGUSR1 to do rotate-and-dump only.
        - MMTP [Rationale: more design needed]
                - Retrying should be per-destination, not per-packet.
                  Otherwise, we can leak which packets were first attempted
                  when.
                - Limit number of packets sent over single client
                  connection.
        - UI [Rationale: don't build stuff for integrators till after
              codecon, when I'll talk with 2 potential integrators.]
                - RFC822 interface to help integrators.
                - "-o" option for queue
                - "-i" option for flush.
                - Maildir-style exit module to help integrators.
                        - Implement MH/Maildir modes
                        - Text/binary modes
                        - With/without decoding handle
                        - Attach to any type.

For 0.0.8:
        - For petmail:
                - Working,well-designed --status-fd option
        - For mnet:
                - Implement trivial client side of client API
                - Specify pluggable modules better.
                - Consider server APIs

Require for "0.1.0" (the in-theory-as-good-as-type-II release):
  [Release criteria: Workable replacement for type II.  At least as
  anonymous, usable, secure, and portable.  Other than lack of nymservers,
  also ready to replace type I.  Interfaces are stable enough that
  integrators can start building GUIs and nymservers without expecting large
  incompatible changes.  Target: first half of 2004.  (No guarantees!)]
        - Security
                - Upgrade packet format as necessary.
        - Modules and module support
                - Use STARTTLS as available, if it's not too hard.
                - Real SMTP module
                        - Support multiple exit addresses. (cc, bcc, etc.)
                          Needs to be bandwidth-limited.
                - Support NEWS
                - Use a 'sendmail'-like program instead of a SMTP server,
                  optionally.
        - End-to-end issues
                - Minimal MIME support: allow headers; don't attempt to
                  enforce a single-best format.
        - Configurability
                - Better, documented support for http proxies for
                  downloading directories.
                - Make DH parameter length configurable at 1024 bits
                  (or higher)?
                . Freak out properly on missing/unpublishable IP.
                . Full validation function for client
                . Full validation function for server
                - Support for non-clique topologies (cliques with a few
                  missing links would be sufficient.)
                - Configurable number of threads to scale to multiple CPUs
        - Client support
                - Automatically remove old messages from client queue. (Add
                  'warn after' and 'delete after' configuration options'.)
                - Avoid timing distinguishability attack related to
                  check-dir, gen-path, read-from-stdin: only download
                  directory *AFTER* reading?  Strongly recommend a cron job?
                  Write the whole thing off as not-really-an-attack?
        - Build and install process
                - A well-tested 'make uninstall'
                - RPMS, debs, and so on
                . Make sure we run on solaris and *BSD.
                . Make the software run under cygwin
                        - Installing to relative path
                . An init.d script.
        - Support for multiple directories, with automated agreement.
                - Configurable dirserver fingerprints and URLs.
        - Full documentation
                - Complete docs for all code, with comments and examples.
                - Write guide for module developers
                - Write complete user's manual
                - Complete all other docs
                - History.
        - Dummy messages (as in batching-taxonomy)
        - DoS resistance strategy
                - Timeout connections more aggressively under heavy load
                - What else?
        - Disable heinously insecure operating modes.

Other features for "1.0" (no research required):
        - Full statistics
                - Full statistics (ask Len what the list is.)
        - Security
                - Add ability to mark nodes as having same
                  administrative domain.
                - Change pathgen to avoid two nodes with same domain
                  in a row.
                - Change pathgen to avoid using same node for entry
                  and exit?
                - Add jurisdictions to pathgen?
        - Key management
                - Document "server-DELKEYS"
                - Password-protected private identity keys
                - Password-protected private link/packet keys
                - Password-protected dirserver keys
                - There's no need to ever store MMTP keys to disk; we should
                  also rotate them more often.  (Only if identity key is
                  unencrytped.)
        - Better CLIs
                - Add a --status-fd option similar to GPG's so that
                  we can be more easily embedded.
                - Support for sending multiple copies of a packet?
        - ClientAPI correctness
                - Port ClientAPI from C API document.
                - Move other functionality into ClientUtil module.
                - ClientMain should only have CLI functionality.
        - Heavy-duty performance/DoS testing
        - Modules and module support
                - MBOX
                        - Full config validation
                        - Full boilerplate text
                - Tell ModuleManager about async code (as soon as needed)
        - Configurability
                - Make all filenames in server config relative to
                  server home, if not absolute.
                - Support for one-side-only MMTP configurations.
                - Make client-side pooling configurable and more
                  sophisticated.
                - Separate error/other log files.
                - Move boilerplate into outside files.  Add some generic
                  'Boilerplate' functionality.
                - Make SURB logging configurable.
                - Add 'ALLOW' lines to blacklist.
        - Client support
                - Some way to read a reply block *and* a message from
                  stdin?
        - Server UI functionality to inspect and clean out pools
        - Port to Twisted, if reasonable (see HACKING)
        - Send/receive large messages without having to suck them all
          into RAM at once.
                - Fragment and unfragment large messages on disk.
        - MMTP / async
               - Tests for all cases:
                        - Packet to server with bogus IP
                        - Junk
                        - Retry on bogus close.
                        - Multiple senders
                        - Bad senders
                        - Bad recipients
                        - Hunt down leaks
        - Testing
                - Test on other (non-redhat, non-linux) systems
                - COME UP WITH A REAL TESTING STRATEGY FOR PERFORMANCE AND
                  CLI'S AND MULTI-SERVER SITUATIONS.
                - Integration tests
                        - Automated tests for several servers running
                          on one machine.
                        - Tests for servers on several different
                          machines.
                - Repeatable CLI tests.
                        - For client
                        - For server

Features for "1.0" (some research/specification required):
        - Nymservers
        - Modules and module support
                - Incoming email gateway
                        - Insert encoded packet into net.
                        - Reply to a reply block
        - Configurability
                - Make listening configurable for multiple ports/ips, not
                  all of which need be published.  Perhaps allow different
                  rules for each listener. ???? Maybe not really a good idea.
        - Client support: Improved path selection
                - Watch out for servers that are really the
                  same server
                - Only pick from the directory when picking
                  random servers.
                - Notice Allow/Deny.
        - UI issues
                - Notice when out of disk space, die more cleanly.
                  (support max-disk-usage).
        - Dynamic IP support
                - Servers redirect to latest IP if old IP is down.  (Dynamic
                  IP support, after a fashion.)
        - Client support: other
                - Send message to user with known public key
                - Real PKI for end-to-end encryption
        - Directories
                - Support for full-blown multiple-server agreement mechanism
        - IPv6 support (must solve non-clique problem)
        - Generate link padding (if it helps)
        - Notice active attacks and block IPs dynamically.
        - Abuse prevention of some undetermined kind.

WHEN WE GET THE CHANCE:
        [This stuff could be for any version 1.0 or later; it's not a
         requirement for 1.0.]
        - License-friendliness:
                - Switch from OpenSSL to NSS or GNUTLS
        - GUI
        - Security
                - Memlockall wrapper
                - Support for loopback fs automation and shredding.
        - Make DB module choice configurable?
        - Consider dropping support for older Python versions?

NEEDS TO BE BENCHMARKED
- TLS for leaks
- PEM for leaks
- gen_dh for leaks
- gen_cert for leaks

-----------
(for emacs)
  Local Variables:
  mode:text
  indent-tabs-mode:nil
  fill-column:77
  End:
