September 2014 - tbb-dev - lists.torproject.org

TBB 3.6.6 and self-signed certificates
by Bram de Boer 08 Oct '14

08 Oct '14

Hello, I am having trouble using TBB 3.6.6 to connect to a website that uses a self-signed certificate. In the previous 3.6.5 version I was presented the usual warning, but after double checking the certificate fingerprint I could click the [Confirm Security Exception] button and TorBrowser would connect. However, in the 3.6.6 version after I click the [Confirm Security Exception] button, the dialog window disappears, a spinner is shown and TorBrowser starts trying to connect. However the page will never load. I have searched the preferences panel but could not find any option that might be useful. I read that 3.6.6 contained some changes with respect to saving intermediate certificates to disk. Could it be this has affected the use of self-signed certificates? Any suggestion? Thanks, Bram

3 8

Reproducibility of incremental MAR files
by Nicolas Vigier 29 Sep '14

29 Sep '14

During the IRC meeting last week, we discussed about the best place to generate the incremental MAR files, and because we want them to be reproducible, gitian looked like the right place to do it. In order to see how easy it is to reproduce incremental MAR files, I decided to generate an incremental MAR on two different Linux distributions between tor-browser-linux32-4.0-alpha-2_fr.mar and tor-browser-linux32-4.0-alpha-3_fr.mar. And the result was that without doing anything special, the MAR file that was created was identical on both hosts. So it seems that using gitian is not needed in order to be able to reproduce those incremental MAR files.

1 0

ESR31 and Tor Browser 4.x
by intrigeri 23 Sep '14

23 Sep '14

Hi, is it the plan that the first Tor Browser release using ESR31 (mid-October) will be based on the Tor Browser 4.x branch, or are two efforts mostly independent from each other? Cheers, -- intrigeri

2 1

Notes from the help desk
by Matt Pagan 23 Sep '14

23 Sep '14

Hi browser devs, Apologies for missing the IRC meeting today. Some news from this past week: There's been an increase in the number of users who have trouble using Tor Browser with a VPN. In news that may or may not be related, the new silk road apparently has some instructions on their site telling users that they should use Tor from behind a VPN. So far none of the VPN users I've spoken too have provided me their Tor logs. Hopefully someone will soon. It's great that more and more YouTube videos are available in HTML5 format nowadays. However, demand for Flash in Tor Browser is still quite strong. BBC and Grooveshark are two popular sites Tor users wish they could enjoy while using Tor Browser. Another popular help desk request is for general tips on staying safe on the web. I usually direct these folks to https://www.torproject.org/download/download-easy.html.en#warning All the best, Matt Pagan

1 0

Tor Browser self-updater vs. sandboxing
by intrigeri 23 Sep '14

23 Sep '14

Hi, while discussing opportunities for increased cooperation between Tails and Freepto [1] recently, I've mentioned the upcoming Tor Browser's self-updater, and one of the Freepto developers rightly noted that there may be a fundamental incompatibility between this updater, and the desire to confine the browser in a sandbox. Indeed, it seems quite clear to me that one of the important tasks such a sandbox should fulfill would be... to avoid the confined program from modifying itself. It seems that supporting such sandboxes is part of your plans ([2], [3]), so I'm curious: what's the TBB team's take on this problem? [1] http://www.freepto.mx/ [2] https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorP [3] https://trac.torproject.org/projects/tor/ticket/5791 Cheers, -- intrigeri

2 2

Is JS monkey patching viable as a fingerprinting countermeasure?
by Arthur D. Edelstein 22 Sep '14

22 Sep '14

Hi All, I'm wondering about the history of JS fingerprinting mitigation in Tor Browser. What prompted the change of approach from JavaScript hooks to C++ patches? I had read something about a race condition discovered, but I haven't found more details. I've been thinking about the idea of developing a C++ patch for Tor Browser (and Firefox) that allows extensions to securely replace arbitrary members (functions and properties) of the global window object at runtime, before content is loaded. By "secure" I mean that, by design, there would be no workaround for content scripts to access the original window object members. (Maybe this capability already exists -- I don't know.) The advantages of this monkey patching approach over addressing fingerprinting vulnerabilities with C++ patches is (1) it would (I think) simplify fingerprinting countermeasures, and (2) it would reduce the number of Firefox C++ patches that Mozilla needs to accept. Is this idea worth pursuing further? Thanks, Arthur

3 4

64 bit Mac Builds?
by Tom Ritter 17 Sep '14

17 Sep '14

Hi all, I _think_ I've managed to build a 64-bit version of Tor Browser for Mac OS. Specifically, I built the entire bundle, but only TorBrowser was modified to be 64bit. The changes I made are here: https://github.com/tomrittervg/tor-browser/commit/79fbe1e3ffde1ac3577a9937a… (ignore the last couple lines commenting out some options I had added, then removed). The bundles are here: https://ritter.vg/misc/transient/2014-09-02-4.x-1-build1-tjr5/ It would be fantastic if anyone could test the bundles and/or the patch and determine if a) you agree it's 64 bit b) it works c) anyone else can reproduce a 64 bit build (I'm not going for full reproducibility right now, just a successfull build that is 64 bit) -tom

4 6

Tor Browser Tickets for September/FF31ESR (with volunteer tickets!)
by Mike Perry 02 Sep '14

02 Sep '14

Hey everyone, I finished updating our ticket tags for September. As I said in the IRC meeting today, I think we should be focusing our efforts on FF31ESR-related items this month. As a result, I've pushed out non-FF31ESR tickets into the October tag, but if you run out of FF31ESR items or just end up blocked, waiting for builds, and/or unable to make progress on anything FF31-related, feel free to work on your tickets from October (or anything else that comes up). Here's the link again: https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~Tor… If you're a volunteer, or you're just looking for something simple, I also tagged a few tickets that basically involve writing some content window JS or very simple patches: https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~Tor… For reference, here's the current October tickets: https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~Tor… Also for reference, here's the roadmap for the rest of the SponsorP work due Oct 31st (note that we've slipped on some items already, but right now getting FF31 working+released is more important than playing catchup on the roadmap): https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorP It would also be helpful if you could ensure that stuff you would like to work on this month is assigned to you instead of tbb-team or someone else. Feel free to reassign as necessary, especially so we can avoid duplicate work and ensure everything gets done. Also feel free to state that you may need some help from others, especially if you notice that you end up with a lot of tickets assigned to yourself :). -- Mike Perry

1 0

Alpha versions string
by Nicolas Vigier 01 Sep '14

01 Sep '14

Hello, The latest tbb alpha version is tagged on git as 'tbb-4.0a2-build1'. The testsuite scripts use the git tags to find the latest versions available that need testing, and will extract the version number from the tag as '4.0a2'. However, it is available on people.tpo in the directory '4.0-alpha-2', so the scripts won't be able to find it automatically (unless I add some code to do the translation 'a' -> '-alpha-', if this difference is wanted). Is there some reason for using a different version string in the git tag and the directory name, or could this be changed for the next alpha release ? Nicolas

1 0