- tbb-dev - lists.torproject.org

Fast-Forward Tor Browser version numbers
by Matthew Finkel 03 Apr '20

03 Apr '20

Hi everyone, While I'm thinking about this, I opened a ticket for changing the Tor Browser versioning scheme. https://trac.torproject.org/projects/tor/ticket/33809 =================================================== Let's say in the future Tor Browser is based on Firefox 90.0, Tor Browser Beta is based on Firefox 91.0b1, and Tor Browser Nightly is based on 92.0a1. I propose Tor Browser uses the following versioning schemes: Release: ${FF_MAJOR}.${FF_MINOR}.${PATCH} (e.g. 90.0.1) Beta: ${FF_MAJOR}.${FF_MINOR}b${PATCH} (e.g. 91.0b101) Nightly: ${FF_MAJOR}.${FF_MINOR}a1 (i.e. 92.0a1) Where ${PATCH} is (${FF_PATCH}*100) + ${TB_PATCH}), therefore we move the Firefox patch number into the third digit (hundreds) and we place the Tor Browser patch number in the first and second digits. (Initially, I began proposing (${FF_PATCH}*10), but what-if-we-need-11-releases?). That would be a sad month, but probably safe-than-sorry. I think we can re-use Firefox's alpha/nightly version number. The main advantage of this scheme is that the underlying Firefox version is immediately clear when looking at a Tor Browser version number. =================================================== We can use this thread for discussing alternatives. Thanks, Matt

1 0

Turn on geolocation in Tor Browser
by Drew Johnson 24 Mar '20

24 Mar '20

I would like to have geolocation within the Tor Browser turned on. I set geo.enabled to 'true'. If I go to www.browserleaks.org/geo<http://www.browserleaks.org/geo> it does ask for me to allow it, but it always comes back with 'POSITION_UNAVAILABLE'. I have gone through the code in nsGeolocation.cpp and it isn't obvious to me why it is returning this. Do I need to build the browser with some specific switches set? I am using 9.5a7 and building for Windows 64-bit. Thanks Drew

3 2

obfs4 in Tor Expert Bundle (was Re: [tor-relays] Stable flag not appearing on my bridge.)
by teor 18 Mar '20

18 Mar '20

Hi, > On 4 Mar 2020, at 04:21, Keifer Bly <keifer.bly(a)gmail.com> wrote: > > Thx. I was wondering if obfs4 could be included in the same file directory to download tor expert bundle from? Sorry, I didn't see your question until now. Please start a new thread for new questions! The Tor Browser team packages the Tor Expert Bundle. They should be able to answer your question. I've cc'd them on this email. T

1 0

Re: [tbb-dev] [tor-packagers] torbrowser: problems with 9.0.1 source tarball
by Nicolas Vigier 17 Mar '20

17 Mar '20

Hi! I think the best list to discuss Tor Browser build problems is the tbb-dev(a)lists.torproject.org list, so I'm anwsering there. On Fri, 15 Nov 2019, Thomas Klausner wrote: > Hi! > > I wanted to build firefox-tor-browser-68.2.0esr-9.0-1-build2 > (torbrowser 9.0.1) on NetBSD from the source tarball, but I stumbled > over a couple problems. > > The first one, .mozconfig contains --disable-eme but configure doesn't like it: > > mozbuild.configure.options.InvalidOptionError: --disable-eme is not available in this configuration > > Is this a NetBSD-specific issue or more general? In our linux, windows, macOS .mozconfigs we have the line: ac_add_options --disable-eme But I don't remember seeing this error, so it looks NetBSD-specific. > The second one: > > --- begin --- > The error occurred while processing the following file: > > /scratch/security/tor-browser/work/firefox-tor-browser-68.2.0esr-9.0-1-build2/browser/extensions/moz.build > > The underlying problem is we referenced a path that does not exist. That path is: > > /scratch/security/tor-browser/work/firefox-tor-browser-68.2.0esr-9.0-1-build2/browser/extensions/tor-launcher/moz.build > > Either create the file if it needs to exist or do not reference it. > --- end --- > > > The directory browser/extensions/tor-launcher does not exist in the > tarball, which looks like a problem with the tarball to me. This is a change from this ticket: https://trac.torproject.org/projects/tor/ticket/28044 So you can either download tor-launcher, and extract it under browser/extensions, renaming the tor-launcher-$version directory to tor-launcher: https://dist.torproject.org/torbrowser/9.0.1/src-tor-launcher-0.2.20.2.tar.… https://dist.torproject.org/torbrowser/9.0.1/src-tor-launcher-0.2.20.2.tar.… Or you can build without tor-launcher by adding "ac_add_options --disable-tor-launcher" to the .mozconfig. Nicolas

5 6

SOOC (Same Origin Onion Certificates) discussion tomorrow
by Richard Pospesel 09 Mar '20

09 Mar '20

Hi Everyone, The current UX situation around HTTPS-enabled onionsites is not the best: Tor Browser shows security warning splash screens and icons in scenarios that do not warrant them. On top of that, the only way for your onion site to not show these warnings is by getting an EV cert which is only practical if you have the $$$. alecmuffet's SOOC proposal ( https://github.com/alecmuffett/onion-dv-certificate-proposal/blob/master/te… ) does seem to fix these UX problems for us. Though the proposal is still incomplete, we can make forward progress with a prototype implementation as the certificate specification is fully fleshed out. We'll be talking about this tomorrow during the Sponsor 27 meeting tomorrow on Tuesday 10th May @ 1500UTC in #tor-meeting. Please feel free to come by if you wish to discuss. best, -Richard

1 0

How Tails is special in its use of Tor Browser
by intrigeri 18 Feb '20

18 Feb '20

Hi, we've improved our documentation about how Tails is special in its use of Tor Browser: https://tails.boum.org/contribute/design/#tor-browser I hope it helps your team keep our "special needs" in mind :) If anything is unclear, please let me know. Cheers!

3 3

Proposal process improvements
by Georg Koppen 15 Feb '20

15 Feb '20

Hello! We had been talking about potential improvements to our proposal process back at our meeting in Stockholm. We should not drop that topic (even though it looks like we did :) ) and I thought it would be smart to have a further discussion per email. To recap: Tor Browser proposals are a way to think about large/impactful browser features in a more formal way, including all stakeholders. That is, by describing those new features, what motivates them, the pros/cons, potential security/privacy issues etc. The idea is to both have a proposal to better reason about complex improvements and to document what we actually did. The proposal process started in September 2018[1] borrowing heavily from the Tor proposal process, although adapting it to Tor Browser needs. Re-reading my notes from our retrospective session it seems folks would like to see that we think differently about proposals and their lifetime and suggested specifically that Tails' blueprint system could help here. I remember not really understanding the different ways between how we think about proposals now vs. how we should. So maybe we should try to spell those perceived differences out to get a better understanding about what is lacking (it might be helpful to use actual proposals for illustration). An additional way to move the discussion forward might be to get to a common understanding about how the Tails' blueprint system works and how it could be adapted to our needs. Georg [1] https://lists.torproject.org/pipermail/tbb-dev/2018-September/000914.html

2 1

Very very slow tor-browser-build build; catastrophic recursion in rbm?
by David Fifield 12 Feb '20

12 Feb '20

I did a build of tor-browser-build build and it took even longer than I remember it taking -- from Friday until Tuesday, roughly. This is on a VPS with six 2 GHz CPUs and 16 GB RAM. Some projects I know take a long time to build, like rust and firefox, but it seemed like most of the time was being spent in the "rbm" process, not in building the projects. I don't know much about profiling Perl, but I tried a tool called NYTProf that produces HTML output: https://people.torproject.org/~dcf/graphs/nytprof-rbm-20200212-94fce31e/ The above NYTProf output is not from a full build. It's from modifying projects/snowflake/config only and then building snowflake for only one target; still it took almost an hour. perl -d:NYTProf rbm/rbm build snowflake --target testbuild --target torbrowser-linux-x86_64 nytprofhtml To my untrained eye it looks like there is some kind of exponential recursion happening around the RBM::config_p function. See here, where in building one project the function was called 89 million times: https://people.torproject.org/~dcf/graphs/nytprof-rbm-20200212-94fce31e/#su… Clicking through to the per-line view, we see that 45 million of those calls were from RBM::get_target, and most of the rest were from RBM::config: https://people.torproject.org/~dcf/graphs/nytprof-rbm-20200212-94fce31e/roo… You know how, if you write a Fibonacci number function and don't memoize the recursive calls, it ends up re-computing the same subtrees over and over and doing exponential work? def fib(n): if n == 0 or n == 1: return 1 return fib(n - 1) + fib(n - 2) It feels like something like that is happening here. There's a pattern where RBM::process_template calls a chain of functions that reaches RBM::config_p, which eventually calls RBM::process_template again. It's not an infinite loop, but it seems to be doing the same work many times. I looked at it for a bit but my Perl isn't strong enough to understand specifically what's happening. Notice how there are three loops of RBM::process_template before doing an RBM::config_p that calls back into further RBM::process_template. RBM::process_template Template::process Template::Service::process Template::Context::process Template::Document::process Template::Document::__ANON__[input text:10] Template::Stash::XS::get RBM::__ANON__[rbm/lib/RBM.pm:640] RBM::project_config RBM::process_template Template::process Template::Service::process Template::Context::process Template::Document::process Template::Document::__ANON__[input text:9] Template::Stash::XS::get RBM::__ANON__[rbm/lib/RBM.pm:640] RBM::project_config RBM::process_template Template::process Template::Service::process Template::Context::process Template::Document::process Template::Document::__ANON__[input text:18] Template::Stash::XS::get RBM::__ANON__[rbm/lib/RBM.pm:640] RBM::project_config RBM::config RBM::config_p RBM::DefaultConfig::__ANON__[rbm/lib/RBM/DefaultConfig.pm:606] RBM::input_files RBM::project_step_config RBM::project_config RBM::process_template Template::process ... et cetera ... Some more evidence is that while I was waiting for rbm to do something, I was watching the modification times of the git_clones: ls -ltrhd git_clones/*/.git | tail -n 15 It was constantly touching all different projects, but re-touching the same ones over and over.

3 5

building tb-browser 9.0.4 / how to identify if src-firefox is the right one? or a release candidate?
by clematis 12 Feb '20

12 Feb '20

Hello, As people were porting tor-browser 9.0.4 to OpenBSD ports[1], there's been some concern it was built on top of a release candidate tarball (src-firefox-tor-browser-68.4.1esr-9.0-1-build1). So two questions: 1/ How to identify a release candidate tarball? Not sure about the naming convention for the distfile. 2/ This seems to be the only one in https://dist.torproject.org/torbrowser/9.0.4/ , so if this is a RC is that still OK? And was it expected? Thank you. [1] https://marc.info/?t=157875408400001&r=1&w=2 Regards, -- clematis (0x7e96fd2400fe7b59)

2 2

Tor Browser Moving to Release Train
by Matthew Finkel 03 Feb '20

03 Feb '20

Hi everyone, Following the Mozilla All-Hands last week, we've made the decision that Tor Browser will move from being based on the Firefox ESR (extended support release) train to the Firefox (rapid) Release train. This is a large change for us, and the decision was not made easily. We finally made this decision due to the development process of Mozilla's new Android browser (Fenix) and how we plan on building Tor Browser based on it (as well as maintaining and developing the desktop browser in parallel). More details will become available as we make decisions about new processes and procedures. We'll announce meetings for discussing these topics on this list over the coming months. Thanks, Matt

1 0