March 2015 - tbb-dev - lists.torproject.org

FWD: privacy/security guidance docs for W3C groups
by mikeperry＠torproject.org 11 May '15

11 May '15

Yan was kind enough to send this to me as a heads up. We both agreed that the Security & Privacy questionnaire needs a Threat Model for Third Party Tracking, so that it is easier to build a single option for controlling third party tracking identifiers, like we did with our 'privacy.thirdparty.isolate' option. She suggested that we should create an issue for this at https://github.com/mikewest/spec-questionnaire/issues, describing how Tor Browser deals with this threat model, and what we would like to see in terms of how API designers should address it. Are there any other issues or suggestions we should make there, in either that document, or the fingerprinting guidance draft? ----- Forwarded message from Yan Zhu <yzhu(a)yahoo-inc.com> ----- Date: Thu, 19 Mar 2015 16:06:27 +0000 (UTC) From: Yan Zhu <yzhu(a)yahoo-inc.com> Subject: privacy/security guidance docs for W3C groups Hi technologist-ish people, The W3C has been working on some privacy and security guides for working groups to consider when writing new specs. As you probably know, it has historically been easy for new specifications to accidentally (or intentionally) introduce web tracking methods and increase browser security surface. We are trying to take steps towards preventing this by encouraging/forcing working groups to do a security/privacy self-review of specs in the future. I'd be curious to hear your feedback on the following two guides if you have any: * https://mikewest.github.io/spec-questionnaire/security-privacy/ - a general collection of security/privacy questions that groups should ask about new specs * https://w3c.github.io/fingerprinting-guidance/ - a guide to mitigating fingerprinting. I'm thinking the "Best Practices Section" could get merged into the questionnaire above. Thanks,Yan ----- End forwarded message ----- -- Mike Perry

3 3

Upgrade path for MacOS users?
by Mike Perry 31 Mar '15

31 Mar '15

I was reviewing the 32bit end-of-life MacOS post, and noticed that it states that all Mac users (32 bit or 64 bit) will have to manually update from 4.0 to 4.5: https://blog.torproject.org/blog/end-life-plan-tor-browser-32-bit-macs Is this still the case? Are there any workarounds we can do for this? Do we have the ability to send out the 64 bit full MAR for all OSX users on 10.7 or newer (who should all be 64 bit, or 64 bit capable)? If we release a 4.0.7 just for the remaining 10.6 users, can we check for 64 bit support in some way? According to this support page, it seems the official way to check is to actually inspect the CPU model name: https://support.apple.com/en-us/HT3696 Oddly, it also sounds like 10.6 machines that have 64bit-capable CPUs can run 64bit apps even if the kernel is 32bit: http://appleinsider.com/articles/08/10/28/road_to_mac_os_x_snow_leopard_64_… It seems as though we may also be able to recommend that 10.6 users can try to boot into 64 bit mode: https://support.apple.com/en-us/HT3773 But I've seen reports that switching kernels like this can result in buggy operation in comments on this post: http://osxdaily.com/2009/09/07/how-to-tell-if-youre-running-the-32-bit-or-6… -- Mike Perry

2 1

TBB forensic analysis
by jack bloom 31 Mar '15

31 Mar '15

hi all, I've read Runa's forensic analysis of the TBB (https://research.torproject.org/techreports/tbb-forensic-analysis-2013-06-2…) and I'm currently redoing the analysis of the current TBB. I'm more or less following what runa did (plus ram dump/hibernation file), I was wondering if you have any suggestions, ideas or any other kind of input on the subject. I asked on #tor and they suggested to say something here. jb

3 2

EU Summer Time Shift
by Mike Perry 30 Mar '15

30 Mar '15

Apparently it's now Summer Time in the EU. This means that the TBB meeting is now one hour later there. Does this cause a problem for anyone? If we can keep the meeting at 19:00 UTC year-round, that may simplify dealing with this daylight savings nonsense, but I also realize that this may be late (9pm?) for most of Europe. Does anyone have a problem with 19:00 UTC tomorrow? Should we move it back to 18:00 UTC? -- Mike Perry

4 4

Re: [tbb-dev] [Tails-dev] Fwd: [Mozilla Enterprise] Firefox ESR 31.5.2 release
by Georg Koppen 21 Mar '15

21 Mar '15

intrigeri: > Hi, > > seems like we should start preparing an emergency point-release... > what are you folks availability or lack thereof to prepare it, test > it, and get it out of the door? I have not had a chance to talk to Mike yet but my plan it to prepare an emergency Tor Browser release with 31.5.3. I hope I have everything ready to get the build going today. Georg

2 1

Update on TBB roadmap
by Isabela 11 Mar '15

11 Mar '15

Hello everyone. In Valencia dev meeting we did an exercise to help create a roadmap (1yr) for the different Tor projects and organizational work. I've collected those roadmaps and published them here: https://trac.torproject.org/projects/tor/wiki/org/roadmaps (I will be sending a similar email to the other dev and org teams as well. ) The folks in this list should look at the roadmaps for *Tor Browser**,* specially for the tables (specially for March and April) and fill up the empty cells for: * sponsor -> if work is related to a particular sponsor * who -> person(s) who the task should be assigned to * tickets -> ticket(s) related to the task (please create them if appropriate) * date -> estimation dates are always good :) Let me know if you have questions, here is a direct link to Tor Browser roadmap: https://trac.torproject.org/projects/tor/wiki/org/roadmaps/TorBrowser thanks everyone, Isabela

1 0

Timeline for the rebase on Firefox 38?
by intrigeri 07 Mar '15

07 Mar '15

Hi, is the plan to migrate to Firefox 38 once the FF 31 ESR series stops being supported by Mozilla, that is on August 11, or earlier? Cheers, -- intrigeri

2 1

Firefox 37 (and 31.6.0esr?) release moved up one week
by anonym 06 Mar '15

06 Mar '15

Hi, Firefox 37 was supposed to be released on 2015-04-07 but has been moved up one week, to 2015-03-31 [1], to not coincide with Easter. I suppose the same goes for the 31.6.0esr release (why shouldn't it?). If that's so, will you also move up the release date for the next Tor Browser for a same day release with the corresponding Firefox ESR release? The same apparently goes for Firefox 38 (moved up one week) but Firefox 39 will be on schedule (so there will be *seven* weeks between 38 and 39). I guess that in general I'm interested to know if you'll always aim to follow Mozilla's release schedule. This is quite relevant for us Tails developers to know, so we can adapt our release cycle according to your (and indirectly, Mozilla's) release dates. Cheers! [1] https://wiki.mozilla.org/RapidRelease/Calendar#Future_branch_dates

2 1

Using ASAN as a protection mechanism
by Tom Ritter 03 Mar '15

03 Mar '15

Here is the blog post I mentioned: http://scarybeastsecurity.blogspot.com.es/2014/09/using-asan-as-protection.… It seems like the changes he recommends are not trivial changes unfortunately. -tom

1 0