May 2019 - tbb-dev - lists.torproject.org

Nightly rebase experiment proposal
by Arthur D. Edelstein 03 Feb '20

03 Feb '20

Hi everyone, Here's a plan for experimenting with moving Tor Browser from ESRs to mozilla-central. Why try this? There are several reasons I can think of: * There is no mobile Firefox ESR. In order to keep mobile Tor Browser secure, we would either need to constantly monitor for security fixes and apply backports. It will be simpler to follow the Mozilla release cycle. * Tor Browser will receive all security patches and security features from Mozilla, not simply those deemed important enough to backport to the last ESR. * Closer collaboration between Mozilla and the Tor Browser team will be possible, because everyone will be focused on the same codebase. For example, non-urgent patches can land directly on mozilla-central, bypassing tor-browser.git altogether, and those patches will be deployed to Tor Browser faster than they would have been on an ESR-only schedule. Mozilla will provide expert review of patches. Also, some non-urgent patches by Tor Browser may be written by Mozilla engineers. * The Tor Browser development process will be smoother and more gradual. Instead of rebasing and patch-fixing sprints ahead of each ESR, we can automatically rebase patches every night, and fix any patch whenever its rebase fails. (The total rebase effort should be approximately the same as before.) * Patches that frequently break because they live on "hot code" can be identified and uplifted. * We'll need to continuously monitor the mozilla codebase for new features that could harm privacy. That's potentially difficult, but by focusing on Mozilla's current work, we can hopefully stop patches that affect privacy before they land. Here's how I envision the new rebase process: * An automated script rebases all tor browser patches every night against mozilla-central, mozilla-beta, mozilla-stable and mozilla-esr. An email alert will be sent if the rebase of any patch fails. (I have a prototype script that does the basic rebasing -- it found that ~40/140 patches from our ESR-52 branch could be auto-rebased onto mozilla-central without any intervention.) * Any failed patches will need to be manually fixed up promptly so that the automated rebase can resume. * Diagnostic Tor Browser bundles will be built against the latest rebase branches. We can also run regression tests. So how do we ramp up this experiment? 1. 2018-1-1 to 2017-2-22: Rebase tor-browser.git patches manually on top of Firefox 59-beta. (We have to do this anyway.) 2. 2017-2-22 to 2018-3-13: Activate a script that rebases Tor Browser patches nightly onto mozilla-(central, beta, stable, esr). 3. 2018-03-13 to 2018-05-07: Create nightly Tor Browser bundle builds based on nightly rebases. At this point, we can evaluate whether we would like to transition to releasing Tor Browser alphas based on the mozilla-beta branch. Switching Tor Browser stable to mozilla-stable can happen sometime after that. How does this sound? Interested to hear what you think. Thanks, Arthur

7 12

proposal for #10760 (Integrate TorButton to TorBrowser core ...)
by Alex Catarineu 13 Jun '19

13 Jun '19

A draft proposal for #10760 (Integrate TorButton to TorBrowser core to prevent users from disabling it) is attached. This should already address some review comments in https://trac.torproject.org/projects/tor/ticket/10760#comment:36. Feedback appreciated! -- Alex Catarineu Tor Browser Developer acat at torproject dot org gpg 3F5B D76C 2C9B D09B F4A8 0AB0 75DC D26C 3A21 2E9A

2 3

Building Tor Browser (Firefox)
by Rishabh Raj 29 May '19

29 May '19

Hello, I had previously sent a similar mail on tbb-community-team. But Georg advised me to send it on tbb-dev. So here I am. I am actually working on modifying some parts of Tor Browser for my project and for that I will need to build Tor Browser's source code. I was following this website <https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Hacking> (Georg has updated it now) and after cloning tor-browser-build repo, I did a |make nightly-linux-x86_64|, which took almost half a day to complete on my Ubuntu 18.04 system. But, since I would be making some changes to the browser (mostly Firefox code), I need to alter code and build again and again. In the above website, there is an option for '*Building Just Firefox*' and I am trying that. Coming to the updated wiki, I think there might still be some issues there. Allow me to make myself clearer: (1) Installation of packages. Some of them may be deprecated. For example I get this after running the command : ||| Reading package lists... Done Building dependency tree Reading state information... Done Package hardening-wrapper is not available, but is referred to by another package. This may mean that the package is missing, has been obsoleted, or is only available from another source E: Package 'hardening-wrapper' has no installation candidate E: Unable to locate package libgstreamer-plugins-base0.10-dev E: Couldn't find any package by glob 'libgstreamer-plugins-base0.10-dev' E: Couldn't find any package by regex 'libgstreamer-plugins-base0.10-dev' ||| (2) Assuming this is not the issue, I proceeded and made the new file |.mozconfig| and copied the given two lines into it, cloned and moved the tor-launcher as well and ran the |./mach configure --with-tor-...| command, which gives: ||| 0:04.24 checking whether the target C compiler can be used... yes 0:04.24 Traceback (most recent call last): 0:04.24 File "/home/hackyou/Desktop/tor-browser/configure.py", line 127, in <module> 0:04.24 sys.exit(main(sys.argv)) 0:04.24 File "/home/hackyou/Desktop/tor-browser/configure.py", line 29, in main 0:04.25 sandbox.run(os.path.join(os.path.dirname(__file__), 'moz.configure')) 0:04.25 File "/home/hackyou/Desktop/tor-browser/python/mozbuild/mozbuild/configure/__init__.py", line 424, in run 0:04.25 raise InvalidOptionError('Unknown option: %s' % without_value) 0:04.25 mozbuild.configure.options.InvalidOptionError: Unknown option: --with-tor-browser-version 0:04.28 *** Fix above errors and then restart with\ 0:04.28 "/usr/bin/make -f client.mk build" 0:04.29 client.mk:145: recipe for target 'configure' failed 0:04.29 make: *** [configure] Error 1 ||| I think the option "--with-tor-browser-version" is unknown as given in the error message. I removed that option and tried again and I get this error. ||| 0:02.61 checking rustc version... 1.34.2 0:02.63 checking cargo version... 1.34.0 0:02.68 Traceback (most recent call last): 0:02.68 File "/home/hackyou/Desktop/tor-browser/configure.py", line 127, in <module> 0:02.68 sys.exit(main(sys.argv)) 0:02.68 File "/home/hackyou/Desktop/tor-browser/configure.py", line 29, in main 0:02.68 sandbox.run(os.path.join(os.path.dirname(__file__), 'moz.configure')) 0:02.68 File "/home/hackyou/Desktop/tor-browser/python/mozbuild/mozbuild/configure/__init__.py", line 428, in run 0:02.68 func(*args) 0:02.68 File "/home/hackyou/Desktop/tor-browser/python/mozbuild/mozbuild/configure/__init__.py", line 474, in _value_for 0:02.68 return self._value_for_depends(obj, need_help_dependency) 0:02.68 File "/home/hackyou/Desktop/tor-browser/python/mozbuild/mozbuild/util.py", line 944, in method_call 0:02.68 cache[args] = self.func(instance, *args) 0:02.68 File "/home/hackyou/Desktop/tor-browser/python/mozbuild/mozbuild/configure/__init__.py", line 483, in _value_for_depends 0:02.68 return obj.result(need_help_dependency) 0:02.68 File "/home/hackyou/Desktop/tor-browser/python/mozbuild/mozbuild/util.py", line 944, in method_call 0:02.68 cache[args] = self.func(instance, *args) 0:02.68 File "/home/hackyou/Desktop/tor-browser/python/mozbuild/mozbuild/configure/__init__.py", line 123, in result 0:02.68 return self._func(*resolved_args) 0:02.68 File "/home/hackyou/Desktop/tor-browser/python/mozbuild/mozbuild/configure/__init__.py", line 1003, in wrapped 0:02.68 return new_func(*args, **kwargs) 0:02.68 File "/home/hackyou/Desktop/tor-browser/build/moz.configure/rust.configure", line 122, in rust_supported_targets 0:02.68 t = split_triplet(t, allow_unknown=True) 0:02.68 File "/home/hackyou/Desktop/tor-browser/python/mozbuild/mozbuild/configure/__init__.py", line 1003, in wrapped 0:02.68 return new_func(*args, **kwargs) 0:02.68 File "/home/hackyou/Desktop/tor-browser/build/moz.configure/init.configure", line 580, in split_triplet 0:02.68 cpu, manufacturer, os = triplet.split('-', 2) 0:02.68 ValueError: need more than 2 values to unpack 0:02.72 *** Fix above errors and then restart with\ 0:02.72 "/usr/bin/make -f client.mk build" 0:02.72 client.mk:145: recipe for target 'configure' failed 0:02.72 make: *** [configure] Error 1 ||| Georg had suggested that it should run without patching <https://hg.mozilla.org/integration/autoland/rev/36f4ba2fb6f5> the |init.configure| file, where the error has occurred. But it is not happening for me. I hope I can get some help here as I have been stuck for quite a while now. Kindly help me out. Warm Regards, Rishabh Raj

2 4

Next weekly Tor Browser meeting on 5/28 1730 UTC in #tor-meeting2
by Georg Koppen 26 May '19

26 May '19

Hello! Just as a reminder of what we decided on our last weekly Tor Browser meeting: there is no meeting on the next Monday, 5/27, due to a public holiday in the US (Memorial Day). We therefore moved our next weekly meeting to 5/28 1730 UTC in #tor-meeting2. So, place and time stay the same, it's just a Tuesday this time to update each other on what we are working on. See you there, Georg

1 0

EFFs privacy badger, tracking protection
by Chris Hemsing 21 May '19

21 May '19

Take standard firefox, install eff.org's privacy badge and check the tracking with: https://panopticlick.eff.org/ The result is: Protection from tracking is fine with the exception of fingerprinting. They recommend using the tor browser to defend against browser fingerprinting!! Next you take tor browser and have tracking checked with https://panopticlick.eff.org/. Of course, now the result is: the are gaps in the protection against tracking but protection against fingerprinting is fine. This means, ou should install "privacy badge". But next tor browser prevents the installation of "privacy badge"! Bang! Thus, either a) don't use tor browser and have tracking protection with the exception of fingerprinting, or b) use tor browser and have many gaps in tracking protection. As installing privacy badge used to work in the past, I fear the impossibility of installing privacy badge is a feature rather than a bug. So you end up with being tracked with or without out using the tor browser!! My proposal would be to integrate "privacy badger" just as it is the case with "HTTPS Everywhere". Chris

2 2

proposal for #28044 (Integrate Tor Launcher into tor-browser)
by Mark Smith 19 May '19

19 May '19

A draft proposal for #28044 (Integrate Tor Launcher into tor-browser) is attached. Your feedback is welcome and appreciated! -- Mark Smith Pearl Crescent http://pearlcrescent.com/

4 8