August 2018 - tbb-dev - lists.torproject.org

Nightly rebase experiment proposal
by Arthur D. Edelstein 03 Feb '20

03 Feb '20

Hi everyone, Here's a plan for experimenting with moving Tor Browser from ESRs to mozilla-central. Why try this? There are several reasons I can think of: * There is no mobile Firefox ESR. In order to keep mobile Tor Browser secure, we would either need to constantly monitor for security fixes and apply backports. It will be simpler to follow the Mozilla release cycle. * Tor Browser will receive all security patches and security features from Mozilla, not simply those deemed important enough to backport to the last ESR. * Closer collaboration between Mozilla and the Tor Browser team will be possible, because everyone will be focused on the same codebase. For example, non-urgent patches can land directly on mozilla-central, bypassing tor-browser.git altogether, and those patches will be deployed to Tor Browser faster than they would have been on an ESR-only schedule. Mozilla will provide expert review of patches. Also, some non-urgent patches by Tor Browser may be written by Mozilla engineers. * The Tor Browser development process will be smoother and more gradual. Instead of rebasing and patch-fixing sprints ahead of each ESR, we can automatically rebase patches every night, and fix any patch whenever its rebase fails. (The total rebase effort should be approximately the same as before.) * Patches that frequently break because they live on "hot code" can be identified and uplifted. * We'll need to continuously monitor the mozilla codebase for new features that could harm privacy. That's potentially difficult, but by focusing on Mozilla's current work, we can hopefully stop patches that affect privacy before they land. Here's how I envision the new rebase process: * An automated script rebases all tor browser patches every night against mozilla-central, mozilla-beta, mozilla-stable and mozilla-esr. An email alert will be sent if the rebase of any patch fails. (I have a prototype script that does the basic rebasing -- it found that ~40/140 patches from our ESR-52 branch could be auto-rebased onto mozilla-central without any intervention.) * Any failed patches will need to be manually fixed up promptly so that the automated rebase can resume. * Diagnostic Tor Browser bundles will be built against the latest rebase branches. We can also run regression tests. So how do we ramp up this experiment? 1. 2018-1-1 to 2017-2-22: Rebase tor-browser.git patches manually on top of Firefox 59-beta. (We have to do this anyway.) 2. 2017-2-22 to 2018-3-13: Activate a script that rebases Tor Browser patches nightly onto mozilla-(central, beta, stable, esr). 3. 2018-03-13 to 2018-05-07: Create nightly Tor Browser bundle builds based on nightly rebases. At this point, we can evaluate whether we would like to transition to releasing Tor Browser alphas based on the mozilla-beta branch. Switching Tor Browser stable to mozilla-stable can happen sometime after that. How does this sound? Interested to hear what you think. Thanks, Arthur

7 12

Next Tor Browser meeting is on Tuesday, 9/4 1800 UTC
by Georg Koppen 27 Aug '18

27 Aug '18

Hi! As next Monday, 9/3, is a national holiday in the US (Labor day) we'll move the weekly Tor Browser meeting by one day. The next meeting will then be at Tue, 9/4, 1800 UTC in #tor-meeting on irc.oftc.net. See you there, Georg

1 0

Fwd: Following FOSS communities: new icon for Fennec in F-Droid
by Matthew Finkel 27 Aug '18

27 Aug '18

It's only tangentially relevant - but interesting.

1 0

Tor Browser for Android Build Script
by Matthew Finkel 27 Aug '18

27 Aug '18

Hi everyone, I wrote a build script for TBA-alpha, while integration into tor-browser-build is still being worked on. It works well on Debian Stretch and Ubuntu Bionic (the only two systems on which I tested it). It creates a (configurable) build directory where it clones or downloads every component and then builds them as needed - checking file hashes, commits hashes, and tags when relevant. I don't expect many of you will care too much about this, but you can give it a try if you want. One suggestion I have is creating a new user for this (I create a user named tba_builder), simply so there is a clean build environment. The script, by default, runs `git clean` within the git repos before configuring them, so if you don't want your working directory destroyed you should comment those lines in the script before running it. When I run it, I don't provide any command line arguments: tba_builder@localhost:~$ time ./build_tba_alpha and it creates a directory called tba_build_dir, changes directory into that directory, and then sets HOME=`pwd`. Unfortunately, some of the Adnroid build system continue writing in /home/tba_builder instead of /home/tba_builder/tba_build_dir, but it wasn't worth spending time troubleshooting that. Almost all of the values are configurable, simply look at the variables at the top of the script and you can override them by setting environment variable before executing the script. Let me know if you have any questions. - Matt

1 0

Tor Browser for arm64/v8 on RPi3
by procmem 08 Aug '18

08 Aug '18

Hi. We (Whonix) are working on RPi3 support which opens a lot of usecases and allows cheaper access to anonymity than before. For regular cleint side non-onion usage we consider Tor Browser an essential basic application. Can you please consider making TBB builds for arm64? Is the current Tor Browser port for Android helpful for such a project?

2 1

Feedback on the embedding API in tor_api.h
by isabela 03 Aug '18

03 Aug '18

Hello tor browser mobile devs! I am writing to you because you are part of a group of mobile developers that we (Tor network team) are contacting to ask for feedback on work we have done to help mobile devs embed Tor in their apps. We did a survey with other mobile devs (back in mid 2017) and based on some of that feedback we created the 'tor_api.h' controller API - you can read more about this work at the ticket #23684 [1]. We would be very thankful if you could spend a bit of your time looking at what we built, and if possible testing it to give us feedback (or report bugs). This will help us fix what is broken and improve it! Please create a child ticket to our #25510 [2] master ticket for collecting feedback and/or bug reports. Thank you in advance! Isabela [1] https://trac.torproject.org/projects/tor/ticket/23684 [2] https://trac.torproject.org/projects/tor/ticket/25510

3 4