- tbb-commits - lists.torproject.org

[tor-browser/tor-browser-68.2.0esr-9.5-1] Bug 1556017 - Fixing the off-by-one-pixel issue of find bar and devtool iframe for Letterboxing. r=johannh
by gk＠torproject.org 01 Nov '19

01 Nov '19

commit e10f77aa1b2f91f861841118fa634bbf94429f31 Author: Tim Huang <tihuang(a)mozilla.com> Date: Tue Jun 11 08:53:44 2019 +0000 Bug 1556017 - Fixing the off-by-one-pixel issue of find bar and devtool iframe for Letterboxing. r=johannh This patch fixes the off-by-one-pixel issue of Letterboxing. For FindBar, it will be created when the user requests it and will be hidden if the user close it after that. The problem of the original approach is that it only observes the existance of the FindBar element but not the fact that whether or not it is visible. So, it will miscalculate the offset of FindBar after it has been created and closed. For devtools, the original approach adds one pixel offset for the separator. However, this one pixel offset is not required since there is no extra separator outside the devtools iframe. So, we don't need that and this patch removes this one pixel for the devtools. Differential Revision: https://phabricator.services.mozilla.com/D34156 --HG-- extra : moz-landing-system : lando --- toolkit/components/resistfingerprinting/RFPHelper.jsm | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/toolkit/components/resistfingerprinting/RFPHelper.jsm b/toolkit/components/resistfingerprinting/RFPHelper.jsm index a5d5bed86f98..f73ccf1797b0 100644 --- a/toolkit/components/resistfingerprinting/RFPHelper.jsm +++ b/toolkit/components/resistfingerprinting/RFPHelper.jsm @@ -408,12 +408,12 @@ class _RFPHelper { // If the findbar or devtools are out, we need to subtract their height (plus 1 // for the separator) from the container height, because we need to adjust our - // letterboxing to acount for it; however it is not included in that dimension + // letterboxing to account for it; however it is not included in that dimension // (but rather is subtracted from the content height.) - let findBar = browserContainer.getElementsByClassName("findbar-container"); - let findBarOffset = findBar.length ? findBar[0].clientHeight + 1 : 0; + let findBar = win.gFindBarInitialized ? win.gFindBar : undefined; + let findBarOffset = (findBar && !findBar.hidden) ? findBar.clientHeight + 1 : 0; let devtools = browserContainer.getElementsByClassName("devtools-toolbox-bottom-iframe"); - let devtoolsOffset = devtools.length ? devtools[0].clientHeight + 1 : 0; + let devtoolsOffset = devtools.length ? devtools[0].clientHeight : 0; return { contentWidth,

1 0

[tor-browser/tor-browser-68.2.0esr-9.5-1] Bug 1534339 - make OriginAttributes deserializable; r=baku
by gk＠torproject.org 01 Nov '19

01 Nov '19

commit 6dfcb949b8375614b588a191035c5cc36fa3e943 Author: Liang-Heng Chen <xeonchen(a)gmail.com> Date: Wed Oct 23 14:10:19 2019 +0000 Bug 1534339 - make OriginAttributes deserializable; r=baku `CreateSuffix` is irreversible by `PopulateFromSuffix` because it uses a multi-to-one mapping. Since only ':' will happen in a IPv6 format, we can make it a 1-to-1 mapping so that the `firstPartyDomain` is consistent after `CreateSuffix` and `PopulateFromSuffix`. Differential Revision: https://phabricator.services.mozilla.com/D47910 --HG-- extra : moz-landing-system : lando --- caps/OriginAttributes.cpp | 10 +++++++--- caps/tests/gtest/TestOriginAttributes.cpp | 2 ++ 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/caps/OriginAttributes.cpp b/caps/OriginAttributes.cpp index 0737bce36321..e987f0e4fc2e 100644 --- a/caps/OriginAttributes.cpp +++ b/caps/OriginAttributes.cpp @@ -13,6 +13,9 @@ #include "nsIURI.h" #include "nsURLHelper.h" +static const char kSourceChar = ':'; +static const char kSanitizedChar = '+'; + namespace mozilla { using dom::URLParams; @@ -158,8 +161,7 @@ void OriginAttributes::CreateSuffix(nsACString& aStr) const { if (!mFirstPartyDomain.IsEmpty()) { nsAutoString sanitizedFirstPartyDomain(mFirstPartyDomain); - sanitizedFirstPartyDomain.ReplaceChar( - dom::quota::QuotaManager::kReplaceChars, '+'); + sanitizedFirstPartyDomain.ReplaceChar(kSourceChar, kSanitizedChar); params.Set(NS_LITERAL_STRING("firstPartyDomain"), sanitizedFirstPartyDomain); @@ -246,7 +248,9 @@ class MOZ_STACK_CLASS PopulateFromSuffixIterator final if (aName.EqualsLiteral("firstPartyDomain")) { MOZ_RELEASE_ASSERT(mOriginAttributes->mFirstPartyDomain.IsEmpty()); - mOriginAttributes->mFirstPartyDomain.Assign(aValue); + nsAutoString firstPartyDomain(aValue); + firstPartyDomain.ReplaceChar(kSanitizedChar, kSourceChar); + mOriginAttributes->mFirstPartyDomain.Assign(firstPartyDomain); return true; } diff --git a/caps/tests/gtest/TestOriginAttributes.cpp b/caps/tests/gtest/TestOriginAttributes.cpp index 582de8c1c9d3..e86c5248689d 100644 --- a/caps/tests/gtest/TestOriginAttributes.cpp +++ b/caps/tests/gtest/TestOriginAttributes.cpp @@ -26,6 +26,8 @@ static void TestFPD(const nsAString& spec, const nsAString& fpd) { ASSERT_EQ(NS_NewURI(getter_AddRefs(url), spec), NS_OK); attrs.SetFirstPartyDomain(true, url); EXPECT_TRUE(attrs.mFirstPartyDomain.Equals(fpd)); + + TestSuffix(attrs); } TEST(OriginAttributes, Suffix_default)

1 0

[tor-browser-build/master] Bug 32342 - Store omni.ja after recreating apk
by gk＠torproject.org 01 Nov '19

01 Nov '19

commit 3c7fb0e610a4f85d7b157221ac9049d99d958c24 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Nov 1 13:38:19 2019 +0000 Bug 32342 - Store omni.ja after recreating apk --- projects/tor-browser/build.android | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/projects/tor-browser/build.android b/projects/tor-browser/build.android index 2c1c3b2..5148c36 100644 --- a/projects/tor-browser/build.android +++ b/projects/tor-browser/build.android @@ -54,5 +54,9 @@ cd tmp zip_args => '$apk', }) %] +# omni.ja was likely deflated in the above zipping operation. It must be stored, instead. +zip $apk -d assets/omni.ja +zip -Z store $apk assets/omni.ja + # Sign a QA build. This apk is not a debug version and doesn't contain a debug flag in the manifest java -jar /usr/share/apksigner/apksigner.jar sign --verbose --min-sdk-version [% c("var/android_min_api") %] --ks $rootdir/android-qa.keystore --out $qa_apk --in $apk --ks-key-alias androidqakey --key-pass pass:android --ks-pass pass:android

1 0

[tor-browser/tor-browser-68.2.0esr-9.5-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 01 Nov '19

01 Nov '19

commit b9e148eb996515e18ce47cd42f18b6dd967c1cbd Author: Georg Koppen <gk(a)torproject.org> Date: Fri Oct 11 17:51:32 2019 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. --- browser/app/profile/000-tor-browser.js | 36 +--------------------------------- 1 file changed, 1 insertion(+), 35 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 23a64c0cf2d3..9f2537df5557 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -21,7 +21,6 @@ pref("startup.homepage_override_url", "https://blog.torproject.org/category/tags pref("app.update.promptWaitTime", 3600); pref("app.update.badge", true); pref("app.update.notifyDuringDownload", true); -pref("extensions.hotfix.id", ""); // Bug 16837: Disable hotfix updates as they may cause compat issues #ifndef XP_MACOSX // Disable staged updates on platforms other than macOS. @@ -50,7 +49,6 @@ pref("browser.cache.disk.enable", false); pref("browser.cache.offline.enable", false); pref("permissions.memory_only", true); pref("network.cookie.lifetimePolicy", 2); -pref("browser.download.manager.retention", 1); pref("security.nocertdb", true); // Disk activity: TBB Directory Isolation @@ -71,7 +69,6 @@ pref("browser.send_pings", false); pref("geo.enabled", false); pref("geo.wifi.uri", ""); pref("browser.search.suggest.enabled", false); -pref("browser.safebrowsing.enabled", false); pref("browser.safebrowsing.malware.enabled", false); pref("browser.safebrowsing.phishing.enabled", false); pref("browser.safebrowsing.downloads.enabled", false); @@ -84,15 +81,9 @@ pref("browser.safebrowsing.provider.google4.updateURL", ""); pref("browser.safebrowsing.provider.google4.gethashURL", ""); pref("browser.safebrowsing.provider.mozilla.updateURL", ""); pref("browser.safebrowsing.provider.mozilla.gethashURL", ""); -pref("browser.download.manager.scanWhenDone", false); // prevents AV remote reporting of downloads pref("extensions.ui.lastCategory", "addons://list/extension"); -pref("datareporting.healthreport.service.enabled", false); // Yes, all three of these must be set pref("datareporting.healthreport.uploadEnabled", false); pref("datareporting.policy.dataSubmissionEnabled", false); -// Don't fetch a localized remote page that Tor Browser interacts with, see -// #16727. And, yes, it is "reportUrl" and not "reportURL". -pref("datareporting.healthreport.about.reportUrl", "data:text/plain,"); -pref("datareporting.healthreport.about.reportUrlUnified", "data:text/plain,"); // Make sure Unified Telemetry is really disabled, see: #18738. pref("toolkit.telemetry.unified", false); pref("toolkit.telemetry.enabled", false); @@ -105,19 +96,14 @@ pref("services.sync.engine.prefs", false); // Never sync prefs, addons, or tabs pref("services.sync.engine.addons", false); pref("services.sync.engine.tabs", false); pref("extensions.getAddons.cache.enabled", false); // https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/ -pref("browser.newtabpage.preload", false); // Bug 16316 - Avoid potential confusion over tiles for now. pref("browser.newtabpage.enabled", false); -pref("browser.search.countryCode", "US"); // The next three prefs disable GeoIP search lookups (#16254) -pref("browser.search.region", "US"); +pref("browser.search.region", "US"); // The next two prefs disable GeoIP search lookups (#16254) pref("browser.search.geoip.url", ""); pref("browser.fixup.alternate.enabled", false); // Bug #16783: Prevent .onion fixups // Make sure there is no Tracking Protection active in Tor Browser, see: #17898. pref("privacy.trackingprotection.pbmode.enabled", false); // Disable the Pocket extension (Bug #18886 and #31602) -pref("browser.pocket.enabled", false); pref("extensions.pocket.enabled", false); -pref("browser.pocket.api", ""); -pref("browser.pocket.site", ""); pref("network.http.referer.hideOnionSource", true); // Disable ServiceWorkers by default @@ -139,7 +125,6 @@ pref("general.useragent.vendor", ""); pref("general.useragent.vendorSub", ""); pref("dom.enable_performance", false); pref("browser.zoom.siteSpecific", false); -pref("intl.charset.default", "windows-1252"); pref("browser.link.open_newwindow.restriction", 0); // Bug 9881: Open popups in new tabs (to avoid fullscreen popups) pref("dom.gamepad.enabled", false); // bugs.torproject.org/13023 // Disable video statistics fingerprinting vector (bug 15757) @@ -149,10 +134,8 @@ pref("media.benchmark.vp9.threshold", 0); // Disable device sensors as possible fingerprinting vector (bug 15758) pref("device.sensors.enabled", false); pref("dom.enable_resource_timing", false); // Bug 13024: To hell with this API -pref("dom.enable_user_timing", false); // Bug 16336: To hell with this API pref("privacy.resistFingerprinting", true); pref("privacy.resistFingerprinting.block_mozAddonManager", true); // Bug 26114 -pref("dom.event.highrestimestamp.enabled", true); // Bug #17046: "Highres" (but truncated) timestamps prevent uptime leaks pref("privacy.suppressModifierKeyEvents", true); // Bug #17009: Suppress ALT and SHIFT events" pref("ui.use_standins_for_native_colors", true); // https://bugzilla.mozilla.org/232227 pref("privacy.use_utc_timezone", true); @@ -221,14 +204,12 @@ pref("browser.eme.ui.enabled", false); pref("media.gmp-widevinecdm.visible", false); pref("media.gmp-widevinecdm.enabled", false); pref("media.eme.enabled", false); -pref("media.eme.apiVisible", false); pref("media.mediadrm-widevinecdm.visible", false); // WebIDE can bypass proxy settings for remote debugging. It also downloads // some additional addons that we have not reviewed. Turn all that off. pref("devtools.webide.autoinstallADBHelper", false); pref("devtools.webide.autoinstallFxdtAdapters", false); pref("devtools.webide.enabled", false); -pref("devtools.appmanager.enabled", false); // The in-browser debugger for debugging chrome code is not coping with our // restrictive DNS look-up policy. We use "127.0.0.1" instead of "localhost" as // a workaround. See bug 16523 for more details. @@ -302,18 +283,6 @@ pref("browser.search.geoSpecificDefaults", false); pref("browser.search.order.extra.1", "DuckDuckGo"); pref("browser.search.order.extra.2", "YouTube"); -// Audio_data is deprecated in future releases, but still present -// in FF24. This is a dangerous combination (spotted by iSec) -pref("media.audio_data.enabled", false); - -// If true, remote JAR files will not be opened, regardless of content type -// Patch written by Jeff Gibat (iSEC). -pref("network.jar.block-remote-files", true); - -// Disable RC4 fallback. This will go live in Firefox 44, Chrome and IE/Edge: -// https://blog.mozilla.org/security/2015/09/11/deprecating-the-rc4-cipher/ -pref("security.tls.unrestricted_rc4_fallback", false); - // Enforce certificate pinning, see: https://bugs.torproject.org/16206 pref("security.cert_pinning.enforcement_level", 2); @@ -326,9 +295,6 @@ pref("security.enterprise_roots.enabled", false); // Don't ping Mozilla for MitM detection, see bug 32321 pref("security.certerrors.mitm.priming.enabled", false); -// Enforce SHA1 deprecation, see: bug 18042. -pref("security.pki.sha1_enforcement_level", 2); - // Disable the language pack signing check for now on macOS, see #31942 #ifdef XP_MACOSX pref("extensions.langpacks.signatures.required", false);

1 0

[tor-browser-build/maint-9.0] Release preparations for 9.0.1
by gk＠torproject.org 01 Nov '19

01 Nov '19

commit 3d5f4308312bdece464dba6b55ef0be33f6bb257 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Nov 1 15:21:58 2019 +0000 Release preparations for 9.0.1 Changelog update and versions bump --- projects/firefox/config | 2 +- .../tor-browser/Bundle-Data/Docs/ChangeLog.txt | 22 ++++++++++++++++++++++ projects/tor-launcher/config | 2 +- rbm.conf | 6 +++--- 4 files changed, 27 insertions(+), 5 deletions(-) diff --git a/projects/firefox/config b/projects/firefox/config index 47d70a1..c3bd1f2 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build1' +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build2' tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git git_submodule: 1 diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index e2e668f..e19b00e 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,25 @@ +Tor Browser 9.0.1 -- November 4 2019 + * All Platforms + * Update NoScript to 11.0.4 + * Bug 21004: Don't block JavaScript on onion services on medium security + * Bug 27307: NoScript marks HTTP onions as not secure + * Bug 30783: Fundraising banner for EOY 2019 campain + * Bug 32321: Don't ping Mozilla for Man-in-the-Middle-detection + * Bug 27268: Preferences clean-up + * Windows + OS X + Linux + * Update Tor Launcher to 0.2.20.2 + * Bug 32164: Trim each received log line from tor + * Translations update + * Bug 31803: Replaced about:debugging logo with flat version + * Bug 31764: Fix for error when navigating via 'Paste and go' + * Bug 32169: Fix TB9 Wikipedia address bar search + * Bug 32210: Hide the tor pane when using a system tor + * Bug 31658: Use builtin --panel-disabled-color for security level text + * Bug 32188: Fix localization on about:preferences#tor + * Bug 32184: Red dot is shown while downloading an update + * Android + * Bug 32342: Crash when changing the browser locale + Tor Browser 9.0 -- October 22 2019 * All Platforms * Update Firefox to 68.2.0esr diff --git a/projects/tor-launcher/config b/projects/tor-launcher/config index c4010e7..5eef2e2 100644 --- a/projects/tor-launcher/config +++ b/projects/tor-launcher/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 0.2.20.1 +version: 0.2.20.2 git_url: https://git.torproject.org/tor-launcher.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg diff --git a/rbm.conf b/rbm.conf index 926e3aa..dc43b62 100644 --- a/rbm.conf +++ b/rbm.conf @@ -24,10 +24,10 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '9.0' - torbrowser_build: 'build2' + torbrowser_version: '9.0.1' + torbrowser_build: 'build1' torbrowser_incremental_from: - - 8.5.5 + - 9.0 project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[tor-browser-build/maint-9.0] Bug 32342 - Store omni.ja after recreating apk
by gk＠torproject.org 01 Nov '19

01 Nov '19

commit f9d0383fb9e7585e8476029913c1a22572fa042e Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Nov 1 13:38:19 2019 +0000 Bug 32342 - Store omni.ja after recreating apk --- projects/tor-browser/build.android | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/projects/tor-browser/build.android b/projects/tor-browser/build.android index 2c1c3b2..5148c36 100644 --- a/projects/tor-browser/build.android +++ b/projects/tor-browser/build.android @@ -54,5 +54,9 @@ cd tmp zip_args => '$apk', }) %] +# omni.ja was likely deflated in the above zipping operation. It must be stored, instead. +zip $apk -d assets/omni.ja +zip -Z store $apk assets/omni.ja + # Sign a QA build. This apk is not a debug version and doesn't contain a debug flag in the manifest java -jar /usr/share/apksigner/apksigner.jar sign --verbose --min-sdk-version [% c("var/android_min_api") %] --ks $rootdir/android-qa.keystore --out $qa_apk --in $apk --ks-key-alias androidqakey --key-pass pass:android --ks-pass pass:android

1 0

[tor-browser/tor-browser-68.2.0esr-9.0-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 01 Nov '19

01 Nov '19

commit 5e83d0a74e4d5ccaef5275e3cc0bfe36e77e9315 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Oct 11 17:51:32 2019 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. --- browser/app/profile/000-tor-browser.js | 36 +--------------------------------- 1 file changed, 1 insertion(+), 35 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 1a4f6c9bff97..baf5c8e765de 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -21,7 +21,6 @@ pref("startup.homepage_override_url", "https://blog.torproject.org/category/tags pref("app.update.promptWaitTime", 3600); pref("app.update.badge", true); pref("app.update.notifyDuringDownload", true); -pref("extensions.hotfix.id", ""); // Bug 16837: Disable hotfix updates as they may cause compat issues #ifndef XP_MACOSX // Disable staged updates on platforms other than macOS. @@ -50,7 +49,6 @@ pref("browser.cache.disk.enable", false); pref("browser.cache.offline.enable", false); pref("permissions.memory_only", true); pref("network.cookie.lifetimePolicy", 2); -pref("browser.download.manager.retention", 1); pref("security.nocertdb", true); // Disk activity: TBB Directory Isolation @@ -71,7 +69,6 @@ pref("browser.send_pings", false); pref("geo.enabled", false); pref("geo.wifi.uri", ""); pref("browser.search.suggest.enabled", false); -pref("browser.safebrowsing.enabled", false); pref("browser.safebrowsing.malware.enabled", false); pref("browser.safebrowsing.phishing.enabled", false); pref("browser.safebrowsing.downloads.enabled", false); @@ -84,15 +81,9 @@ pref("browser.safebrowsing.provider.google4.updateURL", ""); pref("browser.safebrowsing.provider.google4.gethashURL", ""); pref("browser.safebrowsing.provider.mozilla.updateURL", ""); pref("browser.safebrowsing.provider.mozilla.gethashURL", ""); -pref("browser.download.manager.scanWhenDone", false); // prevents AV remote reporting of downloads pref("extensions.ui.lastCategory", "addons://list/extension"); -pref("datareporting.healthreport.service.enabled", false); // Yes, all three of these must be set pref("datareporting.healthreport.uploadEnabled", false); pref("datareporting.policy.dataSubmissionEnabled", false); -// Don't fetch a localized remote page that Tor Browser interacts with, see -// #16727. And, yes, it is "reportUrl" and not "reportURL". -pref("datareporting.healthreport.about.reportUrl", "data:text/plain,"); -pref("datareporting.healthreport.about.reportUrlUnified", "data:text/plain,"); // Make sure Unified Telemetry is really disabled, see: #18738. pref("toolkit.telemetry.unified", false); pref("toolkit.telemetry.enabled", false); @@ -105,19 +96,14 @@ pref("services.sync.engine.prefs", false); // Never sync prefs, addons, or tabs pref("services.sync.engine.addons", false); pref("services.sync.engine.tabs", false); pref("extensions.getAddons.cache.enabled", false); // https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/ -pref("browser.newtabpage.preload", false); // Bug 16316 - Avoid potential confusion over tiles for now. pref("browser.newtabpage.enabled", false); -pref("browser.search.countryCode", "US"); // The next three prefs disable GeoIP search lookups (#16254) -pref("browser.search.region", "US"); +pref("browser.search.region", "US"); // The next two prefs disable GeoIP search lookups (#16254) pref("browser.search.geoip.url", ""); pref("browser.fixup.alternate.enabled", false); // Bug #16783: Prevent .onion fixups // Make sure there is no Tracking Protection active in Tor Browser, see: #17898. pref("privacy.trackingprotection.pbmode.enabled", false); // Disable the Pocket extension (Bug #18886 and #31602) -pref("browser.pocket.enabled", false); pref("extensions.pocket.enabled", false); -pref("browser.pocket.api", ""); -pref("browser.pocket.site", ""); pref("network.http.referer.hideOnionSource", true); // Disable ServiceWorkers by default @@ -139,7 +125,6 @@ pref("general.useragent.vendor", ""); pref("general.useragent.vendorSub", ""); pref("dom.enable_performance", false); pref("browser.zoom.siteSpecific", false); -pref("intl.charset.default", "windows-1252"); pref("browser.link.open_newwindow.restriction", 0); // Bug 9881: Open popups in new tabs (to avoid fullscreen popups) pref("dom.gamepad.enabled", false); // bugs.torproject.org/13023 // Disable video statistics fingerprinting vector (bug 15757) @@ -149,10 +134,8 @@ pref("media.benchmark.vp9.threshold", 0); // Disable device sensors as possible fingerprinting vector (bug 15758) pref("device.sensors.enabled", false); pref("dom.enable_resource_timing", false); // Bug 13024: To hell with this API -pref("dom.enable_user_timing", false); // Bug 16336: To hell with this API pref("privacy.resistFingerprinting", true); pref("privacy.resistFingerprinting.block_mozAddonManager", true); // Bug 26114 -pref("dom.event.highrestimestamp.enabled", true); // Bug #17046: "Highres" (but truncated) timestamps prevent uptime leaks pref("privacy.suppressModifierKeyEvents", true); // Bug #17009: Suppress ALT and SHIFT events" pref("ui.use_standins_for_native_colors", true); // https://bugzilla.mozilla.org/232227 pref("privacy.use_utc_timezone", true); @@ -221,14 +204,12 @@ pref("browser.eme.ui.enabled", false); pref("media.gmp-widevinecdm.visible", false); pref("media.gmp-widevinecdm.enabled", false); pref("media.eme.enabled", false); -pref("media.eme.apiVisible", false); pref("media.mediadrm-widevinecdm.visible", false); // WebIDE can bypass proxy settings for remote debugging. It also downloads // some additional addons that we have not reviewed. Turn all that off. pref("devtools.webide.autoinstallADBHelper", false); pref("devtools.webide.autoinstallFxdtAdapters", false); pref("devtools.webide.enabled", false); -pref("devtools.appmanager.enabled", false); // The in-browser debugger for debugging chrome code is not coping with our // restrictive DNS look-up policy. We use "127.0.0.1" instead of "localhost" as // a workaround. See bug 16523 for more details. @@ -304,18 +285,6 @@ pref("browser.search.geoSpecificDefaults", false); pref("browser.search.order.extra.1", "DuckDuckGo"); pref("browser.search.order.extra.2", "YouTube"); -// Audio_data is deprecated in future releases, but still present -// in FF24. This is a dangerous combination (spotted by iSec) -pref("media.audio_data.enabled", false); - -// If true, remote JAR files will not be opened, regardless of content type -// Patch written by Jeff Gibat (iSEC). -pref("network.jar.block-remote-files", true); - -// Disable RC4 fallback. This will go live in Firefox 44, Chrome and IE/Edge: -// https://blog.mozilla.org/security/2015/09/11/deprecating-the-rc4-cipher/ -pref("security.tls.unrestricted_rc4_fallback", false); - // Enforce certificate pinning, see: https://bugs.torproject.org/16206 pref("security.cert_pinning.enforcement_level", 2); @@ -328,9 +297,6 @@ pref("security.enterprise_roots.enabled", false); // Don't ping Mozilla for MitM detection, see bug 32321 pref("security.certerrors.mitm.priming.enabled", false); -// Enforce SHA1 deprecation, see: bug 18042. -pref("security.pki.sha1_enforcement_level", 2); - // Disable the language pack signing check for now on macOS, see #31942 #ifdef XP_MACOSX pref("extensions.langpacks.signatures.required", false);

1 0

[tor-browser/tor-browser-68.2.0esr-9.5-1] squash! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 01 Nov '19

01 Nov '19

commit 15c35b79675acbfb5949aae6d18630ce20050891 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Oct 31 16:16:31 2019 +0000 squash! TB4: Tor Browser's Firefox preference overrides. Bug 32321: Disable Mozilla's MitM pings --- browser/app/profile/000-tor-browser.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 3d0de789205b..23a64c0cf2d3 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -323,6 +323,9 @@ pref("security.family_safety.mode", 0); // Don't allow MitM via enterprise roots, see bug 30681 pref("security.enterprise_roots.enabled", false); +// Don't ping Mozilla for MitM detection, see bug 32321 +pref("security.certerrors.mitm.priming.enabled", false); + // Enforce SHA1 deprecation, see: bug 18042. pref("security.pki.sha1_enforcement_level", 2);

1 0

[tor-browser/tor-browser-68.2.0esr-9.0-1] squash! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 01 Nov '19

01 Nov '19

commit a467e27614c9632cd847a3fd3d1487ae57a87cc2 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Oct 31 16:16:31 2019 +0000 squash! TB4: Tor Browser's Firefox preference overrides. Bug 32321: Disable Mozilla's MitM pings --- browser/app/profile/000-tor-browser.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 1501edf47b90..1a4f6c9bff97 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -325,6 +325,9 @@ pref("security.family_safety.mode", 0); // Don't allow MitM via enterprise roots, see bug 30681 pref("security.enterprise_roots.enabled", false); +// Don't ping Mozilla for MitM detection, see bug 32321 +pref("security.certerrors.mitm.priming.enabled", false); + // Enforce SHA1 deprecation, see: bug 18042. pref("security.pki.sha1_enforcement_level", 2);

1 0

[tor-browser/tor-browser-68.2.0esr-9.0-1] fixup! Pick up latest Torbutton code
by gk＠torproject.org 01 Nov '19

01 Nov '19

commit da0e9c1862df3455d2f76ae360134429c6c49d95 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Nov 1 13:35:22 2019 +0000 fixup! Pick up latest Torbutton code --- toolkit/torproject/torbutton | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/toolkit/torproject/torbutton b/toolkit/torproject/torbutton index 9d744c6adc5e..e864f0fe4cfa 160000 --- a/toolkit/torproject/torbutton +++ b/toolkit/torproject/torbutton @@ -1 +1 @@ -Subproject commit 9d744c6adc5ee3608e519c5db49528cd6ee6fe54 +Subproject commit e864f0fe4cfabdc76bc8df312c8509071d4f3d75

1 0