[tor-qa] Fwd: Re: Tor Browser 6.0a5 is ready for testing

[gunes acar]

Georg,

I wonder if it's necessary to distribute Hello/Loop extension [1] with
TBB. The .xpi file amounts to 1.6 MB and WebRTC is already disabled - as
is the Firefox Hello.

I deleted the .xpi file, removed the references to the extension in
"extensions.bootstrappedAddons" and "extensions.xpiState" prefs -
nothing seemed to break.

[1]: Browser/browser/features/loop at mozilla.org.xpi


On 04/24/2016 10:45 PM, Georg Koppen wrote:
> Hello,
> 
> we are pleased to accounce that Tor Browser 6.0a5 is ready for testing
> and bundles can be found on:
> 
> https://people.torproject.org/~gk/builds/6.0a5-build3/
> 
> This will probably be our last alpha release before the stable 6.0 and
> it contains a bunch of noteworthy changes.
> 
> First, we switched the browser to Firefox ESR 45 and rebased our old
> patches/wrote new ones were necessary.
> 
> Second, we ship a new Tor alpha version, 0.2.8.2, which makes meek
> usable again and contains a number of other improvements/stability fixes.
> 
> Third, this alpha release will introduce code signing for OS X in order
> to cope with Gatekeeper. There were bundle layout changes necessary to
> adhere to code signing requirements. Please test that everything is
> still working as expected if you happen to have an OS X machine.
> 
> The fourth highlight is the fix for an installer related DLL hijacking
> vulnerability. This vulnerability made it necessary to deploy a newer
> NSIS version to create our .exe files. Please test that the installer is
> still working as expected if you happen to have a Windows machine.
> 
> Here is the full changelog since 6.0a4:
> 
> Tor Browser 6.0a5 -- April 27 2016
>  * All Platforms
>    * Update Firefox to 45.1.0esr
>    * Update Tor to 0.2.8.2-alpha
>    * Update Torbutton to 1.9.5.3
>      * Bug 18466: Make Torbutton compatible with Firefox ESR 45
>      * Translation updates
>    * Update Tor Launcher to 0.2.9.1
>      * Bug 13252: Do not store data in the application bundle
>      * Bug 10534: Don't advertise the help desk directly anymore
>      * Translation updates
>    * Update HTTPS-Everywhere to 5.1.6
>    * Update NoScript to 2.9.0.11
>    * Update meek to 0.22 (tag 0.22-18371-2)
>      * Bug 18371: Symlinks are incompatible with Gatekeeper signing
>    * Bug 15197 and child tickets: Rebase Tor Browser patches to ESR 45
>    * Bug 18042: Disable SHA1 certificate support
>    * Bug 18821: Disable libmdns support for desktop and mobile
>    * Bug 18848: Disable additional welcome URL shown on first start
>    * Bug 14970: Exempt our extensions from signing requirement
>    * Bug 16328: Disable MediaDevices.enumerateDevices
>    * Bug 16673: Disable HTTP Alternative-Services
>    * Bug 17167: Disable Mozilla's tracking protection
>    * Bug 18603: Disable performance-based WebGL fingerprinting option
>    * Bug 18738: Disable Selfsupport and Unified Telemetry
>    * Bug 18799: Disable Network Tickler
>    * Bug 18800: Remove DNS lookup in lockfile code
>    * Bug 18801: Disable dom.push preferences
>    * Bug 18802: Remove the JS-based Flash VM (Shumway)
>    * Bug 18863: Disable MozTCPSocket explicitly
>    * Bug 15640: Place Canvas MediaStream behind site permission
>    * Bug 16326: Verify cache isolation for Request and Fetch APIs
>    * Bug 18741: Fix OCSP and favicon isolation for ESR 45
>    * Bug 16998: Disable <link rel="preconnect"> for now
>    * Bug 18726: Add new default obfs4 bridge (GreenBelt)
>  * Windows
>    * Bug 13419: Support ICU in Windows builds
>    * Bug 16874: Fix broken https://sports.yahoo.com/dailyfantasy page
>    * Bug 18767: Context menu is broken on Windows in ESR 45 based Tor
> Browser
>  * OS X
>    * Bug 6540: Support OS X Gatekeeper
>    * Bug 13252: Tor Browser should not store data in the application bundle
>  * Build System
>    * All Platforms
>      * Bug 18127: Add LXC support for building with Debian guest VMs
>      * Bug 16224: Don't use BUILD_HOSTNAME anymore in Firefox builds
>    * Windows
>      * Bug 17895: Use NSIS 2.51 for installer to avoid DLL hijacking
>      * Bug 18290: Bump mingw-w64 commit we use
>    * OS X
>      * Bug 18331: Update toolchain for Firefox 45 ESR
>      * Bug 18690: Switch to Debian Wheezy guest VMs
>    * Linux
>      * Bug 18699: Stripping fails due to obsolete Browser/components
> directory
>      * Bug 18698: Include libgconf2-dev for our Linux builds
> 
> Georg
> 
> 
> 
> _______________________________________________
> tor-qa mailing list
> tor-qa at lists.torproject.org
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-qa
>