November 2014 - tbb-dev - lists.torproject.org

Tor Messenger and Certificates
by Sukhbir Singh 01 Dec '14

01 Dec '14

Hi list, We are thinking of including certificates for OFTC, CCC, etc. with Tor Messenger, since some of these popular chat servers use self-signed certificates. Quick questions about this: - Is this a good idea -- including these certificates by default? Or should we let the users click on "add exception" and then add the certificates themselves? - What is a good way of achieving this (adding these certificates) as part of the build process? I can't seem to find a "proper" way and documentation seems to be lacking. I think we have to update cert8.db as part of the default profile, but I was wondering if there is some documentation or a preferred way of doing this. Thanks, -- Sukhbir

5 7

Developing using Tor
by Delton Barnes 14 Nov '14

14 Nov '14

Hello, I would like to do some development but would prefer to anonymously. I am on a machine where traffic is not routed through Tor by default. Initially there is this step: git clone https://git.torproject.org/builders/tor-browser-bundle.git That would associate my IP address with Tor development. Would it work to instead just do that via torsocks? torsocks git clone https://git.torproject.org/builders/tor-browser-bundle.git Are there other instances where there might be non-Tor connections? (Build scripts?) -Delton

3 2

missing tbb-dev meeting
by Arthur D. Edelstein 10 Nov '14

10 Nov '14

Hi All, Due to travel, I'll have limited connectivity and somewhat limited work time for this week. As I won't be able to be at today's tbb-dev IRC meeting, here's my report and plans. Last week I worked on tor circuit display issues that came to light in the alpha release. I wrote patches for * tor-control-port.js freezes browser https://trac.torproject.org/projects/tor/ticket/13651 * various fixes for tor circuit display needed https://trac.torproject.org/projects/tor/ticket/13666 I also wrote first versions of patches for two more tickets. * Circuit display is broken if bridges are being used. https://trac.torproject.org/projects/tor/ticket/13671 * The circuit display dropdown should be optional. https://trac.torproject.org/projects/tor/ticket/13672 The latter two tickets need further revision. An additional annoying bug cropped up in my first attempt at #13672. I also have a question about what the right design is for #13671 -- any advice would be welcome. This week, as time allows, I will try to finish patches for #13671 and #13672, and work on fixing up unit tests for our Firefox patches. Arthur

1 0

TBB design doc updated for 4.0
by Mike Perry 07 Nov '14

07 Nov '14

Hello all, I've finally updated the design doc to cover TBB 4.0: https://www.torproject.org/projects/torbrowser/design/ In particular, the fingerprinting section saw substantial updates: https://www.torproject.org/projects/torbrowser/design/#fingerprinting-linka… I also added a build security section that could probably use more links and more details: https://www.torproject.org/projects/torbrowser/design/#BuildSecurity Feedback welcome! Patches are even more welcomer! ;) The source repo lives at: https://gitweb.torproject.org/tor-browser-spec.git/tree/refs/heads/master:/… -- Mike Perry

3 5

Two small patches against gitian-builder
by Lunar 07 Nov '14

07 Nov '14

Hi! Attached are two small improvements to gitian-builder. Hope that helps, -- Lunar <lunar(a)torproject.org>

2 1

auto-rebasing tor-browser patches on gecko-dev master
by Nicolas Vigier 06 Nov '14

06 Nov '14

Hello, A few days ago on #tor-dev: 01:20 < mikeperry> arthuredelstein,boklm: I'm going into mozilla next wednesday, and I suspect they're going to want to make progress on getting our branch running in their testing infrastructure.. a thought occurrs: what if we were to make an auto-rebasing script that periodically tries to rebase our patches on to master from https://github.com/mozilla/gecko-dev? then we'd not only have early warning if they break our new tests, but also when our patches begin 01:21 < mikeperry> it may mean more work in terms of constantly fixing broken patches though.. I think I can do something to try to automatically rebase our patches on gecko-dev master, build and run the tests every night, then send an email if the rebase failed, the build failed, or a test that was successful the previous day failed. Sometimes the auto-rebasing will fail. Maybe we can have a 'nightly' or 'master' branch where we push manually rebased patches when auto-rebasing failed ? I don't know how often the auto-rebasing will fail, and how much work it will be to manually fix it though. Does it look like a good idea ?

3 4

Https Everywhere and custom rules
by Karel Bílek 04 Nov '14

04 Nov '14

Hello, sorry if I am posting it to a wrong place, but it seemed like the perfect one. I am using Chromium with "HTTPS Everywhere" and I love how easy is to add a new website rules there. I just click on the icon and basically click on "add". I am now trying Tor Browser, and it's more difficult by several factors. I have to go to a certain folder inside the very complicated Tor Browser folder, find one that seems like the correct one, manually (!) write XML rules, restart Tor browser, and hope that it works and that the next Tor Browser update won't delete everything. I realize that it's technically a fault of HTTPS Everywhere for Firefox, not you, but it's a giant usability letdown. Are there any plans to fix that, either in HTTPS Everywhere for Firefox itself or separately inside Tor Browser bundle? Karel

2 1

Cookie protection does nothing
by Karel Bílek 03 Nov '14

03 Nov '14

I have another question, again I am not sure if this is the right place to ask (sorry if I am spamming your development list with unrelated stuff, please tell me where to go with this if this is a wrong place), I cannot figure out if "cookie protections", that appear under Tor button in TBB, even do something and how to make them work. I can't protect (or unprotect) any cookie, nothing I do or select in the table has any effect whatsoever on my browsing. Cookies are never saved, every time I click on "new identity" I am with a clean slate, the table in "cookie protections" is always empty no matter what I do. Is that correct? If it is, why is the option even there, shouldn't it be removed? Karel

3 3

Meeting Reminder: Daylight savings time change
by Mike Perry 03 Nov '14

03 Nov '14

Hey everyone, Just a reminder that the clocks have changed in the US again. I guess Europe already changed last week, so we should be synced again. This means that the TBB meeting on Nov 3rd (tomorrow/today) will be at 19:00 UTC, 20:00 CET, 14:00 EST, and 11:00 PST. (I think I did that right). If this is suddenly bad for people, please speak up. -- Mike Perry

1 0

Releasing 4.0.1 w/o update notification
by Mike Perry 02 Nov '14

02 Nov '14

Hey everyone, I think it is probably most wise to release 4.0.1 without an in-browser update or update notification, or at best, only an update for Windows users. If we do want to update only the Windows users, what's the best way to do that? Is it even a good idea, given that we're aware that it may actually break things for some of them due to https://trac.torproject.org/projects/tor/ticket/13594? Right now, I am thinking the circumstances mean "no update" for this reason, but if anyone disagrees, feel free to say so. -- Mike Perry

4 6