Thank you Mike! Your hard work is appreciated by many.<br><br>- Kyle<br><br><br><div class="gmail_quote">On Tue, Jun 3, 2008 at 4:00 PM, Mike Perry <<a href="mailto:mikeperry@fscked.org">mikeperry@fscked.org</a>> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">The first release candidate for the next stable series of the<br>
security-enhanced Torbutton Firefox extension has been released. This<br>
release features functional support for Firefox 3. However, this<br>
support has not been extensively tested. In particular, timezone<br>
masking does not work at all. The workaround is to manually set the<br>
environment variable 'TZ' to 'UTC' before starting Firefox. This works<br>
on both Linux and Windows.<br>
<br>
Firefox 3 users should keep a close eye on Torbutton. In particular,<br>
the new Places history database code is connected to all sorts of<br>
different parts of the browser, and it is unknown if 'disabling<br>
history' actually prevents disk writes for many parts of its database.<br>
It is also possible this code may perform strange network accesses at<br>
odd times as well (the 'Livemarks' code is one case of this that has<br>
known issues). Please keep an eye on your Vidalia window. Adventurous<br>
users can also run wireshark, and/or help with the disk access<br>
auditing by running Process Monitor on their Windows systems:<br>
<a href="http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx" target="_blank">http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx</a><br>
<br>
A list of other Firefox bugs known to impact Torbutton security can be<br>
found at: <a href="https://torbutton.torproject.org/dev/design/#FirefoxSecurity" target="_blank">https://torbutton.torproject.org/dev/design/#FirefoxSecurity</a><br>
<br>
Here is the complete changelog for 1.2.0rc1:<br>
* general: FF3 should now be functional, but timezone masking is not<br>
operational<br>
* bugfix: Fix Places/history component hooking in FF3<br>
* bugfix: Disable Places database in FF3 via browser.history_expire_days=0<br>
if history writes are disabled.<br>
* bugfix: General component hooking fixes for FF3<br>
* bugfix: Block favicon leaking in FF3<br>
* bugfix: Enable safebrowsing updates in FF3 (it's finally HMACd. Yay).<br>
* bugfix: Use Greg Fleischer's new useragent prefs in FF3.<br>
* bugfix: Properly reset cookie lifetime policy when user changes<br>
cookie handling options.<br>
* bugfix: Fix 'Restore defaults' button issues with custom proxy settings<br>
* bugfix: navigator.oscpu hooking was broken in 1.1.18<br>
* bugfix: Try to prevent alleged 0x0 windows on crash recovery<br>
* bugfix: Attempt to block livemarks updates during Tor. Only<br>
partial fix. Not possible to cancel existing Livemarks timer (one fetch<br>
will still happen via Tor before disable). See Firefox Bug 436250<br>
* misc: Set plugin.disable_full_page_plugin_for_types for all plugin<br>
mimetypes just in case our custom full page blocking code fails<br>
<font color="#888888"><br>
<br>
--<br>
Mike Perry<br>
Mad Computer Scientist<br>
<a href="http://fscked.org" target="_blank">fscked.org</a> evil labs<br>
</font></blockquote></div><br>