- tor-announce - lists.torproject.org

New Release: Tor Browser 13.5a8 (Android, Windows, macOS, Linux)
by Richard Pospesel 17 May '24

17 May '24

Hi everyone, Tor Browser 13.5a8 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-alpha-release-tor-browser-135a8/ Changelog: > Tor Browser 13.5a8 - May 16 2024 > * All Platforms > * Bug 42290: "DuckDuckGoOnion" is a weird naming format for onion search engines [tor-browser] > * Bug 42549: Remove brand.dtd [tor-browser] > * Bug 42560: Rebase Tor Browser alpha onto 115.11.0esr [tor-browser] > * Bug 42565: Backport Android and desktop security fixes from Firefox 126 [tor-browser] > * Bug 42583: Modify moz-support-link [tor-browser] > * Bug 41137: Build gcc-cross and tor-expert-bundle for linux-aarch64 [tor-browser-build] > * Bug 241: Move network.proxy.failover_direct=false pref to base-browser [mullvad-browser] > * Windows + macOS + Linux > * Updated Firefox to 115.11.0esr > * Bug 41621: Tweak about:torconnect styling [tor-browser] > * Bug 41930: intl.accept_languages gets into a stuck modifed state [tor-browser] > * Bug 42391: IndexDB's private directory not removed on browser shutdown in global private browsing mode [tor-browser] > * Bug 42405: Fix betterboxing + findbar horizontal bounce if the scrollbar is not an overlay [tor-browser] > * Bug 42541: Circuit Display does not work when using Conjure pluggable transport [tor-browser] > * Bug 42542: Quirks when onion authentication prompt is shared between two tabs [tor-browser] > * Bug 42557: Fix regression in Onion Services authentication prompt focus [tor-browser] > * Bug 42573: Tweak language notification to avoid formatValue [tor-browser] > * Bug 42574: Exempt pdf.js from letterboxing [tor-browser] > * Windows + macOS > * Bug 41405: Win ≤8.1 and macOS ≤10.14 not supported in ESR 128 [tor-browser] > * Bug 42347: Add a banner warning users about the upcoming EOL for Win ≤8.1 and macOS ≤10.14 [tor-browser] > * Linux > * Bug 41136: Include *.deb in the list of files to gpg sign [tor-browser-build] > * Android > * Updated GeckoView to 115.11.0esr > * Bug 42317: Update "Security Settings" menu item [tor-browser] > * Bug 42409: TTP-03-011 WP3: Potential DoS due to Deep Link abuse [tor-browser] > * Bug 42552: TBA: formatting APIs are en-US only [tor-browser] > * Bug 42562: Restrict the accepted languages to the ones whose localization is available [tor-browser] > * Bug 42566: Remove 'Enable beta connection features' menu item in stable release channel [tor-browser] > * Bug 42567: Remove 'Enable beta connection features' toggle [tor-browser] > * Bug 42571: The new bootstrap on Android breaks if the browser goes in background [tor-browser] > * Bug 42576: Backport Bug 1885171: use the private keyboard for prompts on Android [tor-browser] > * Bug 42578: Reject Android "open in Tor Browser" intent [tor-browser] > * Bug 42582: Accepted languages should use id and he on Android [tor-browser] > * Bug 41143: Enable multi-locales also on GeckoView [tor-browser-build] > * Build System > * All Platforms > * Updated Go to 1.21.10 > * Bug 41001: Create Release Prep MR generating script [tor-browser-build] > * Bug 41148: Update projects/browser/Bundle-Data/Docs/Licenses/NoScript.txt [tor-browser-build] > * Bug 40076: Correctly refresh file when computing input_files_id and a file is set as refresh_input [rbm] > * Android > * Bug 42568: Remove legacy tor dependencies from firefox-android [tor-browser] best, -richard

1 0

New Release: Tor Browser 13.0.15 (Android, Windows, macOS, Linux)
by Richard Pospesel 14 May '24

14 May '24

Hi everyone, Tor Browser 13.0.15 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-13015/ Changelog: > Tor Browser 13.0.15 - May 14 2024 > * All Platforms > * Bug 42559: Rebase Tor Browser stable onto 115.11.0esr [tor-browser] > * Windows + macOS + Linux > * Updated Firefox to 115.11.0esr > * Bug 42391: IndexDB's private directory not removed on browser shutdown in global private browsing mode [tor-browser] > * Bug 42532: Use the HomePage module for new identity checks [tor-browser] > * Bug 42557: Fix regression in Onion Services authentication prompt focus [tor-browser] > * Bug 42565: Backport Android and desktop security fixes from Firefox 126 [tor-browser] > * Android > * Updated GeckoView to 115.11.0esr > * Bug 42195: Fix "What's new" URL to direct to latest version [tor-browser] > * Bug 42562: Restrict the accepted languages to the ones whose localization is available [tor-browser] > * Build System > * macOS > * Bug 42535: mac: app change to ja doesn't apply ja translations to most (all?) chrome [tor-browser] best, -richard

1 0

New Release: Tor Browser 13.5a7 (Android, Windows, macOS, Linux)
by Nicolas Vigier 30 Apr '24

30 Apr '24

Hi everyone, Tor Browser 13.5a7 has now been published for all platforms. For details please see our blog post: https://blog.torproject.org/new-alpha-release-tor-browser-135a7/ Changelog: * All Platforms * Updated Tor to 0.4.8.11 * Bug 40919: Consider dropping protection against line-height introduced in #23104 [tor-browser] * Bug 42315: compat: why is eventCounts undefined? [tor-browser] * Bug 42476: Only allow Lox (invites) in alpha and nightly builds [tor-browser] * Bug 42479: Switch from localized strings to error codes in TorConnect errors [tor-browser] * Bug 42512: Rebase Tor Browser alpha onto 115.10.0esr [tor-browser] * Bug 42521: Remove unused onboarding strings [tor-browser] * Bug 42529: Try not to spoof system-ui in contexts exempt from RFP [tor-browser] * Bug 42537: Move Fluent files from "browser" to "toolkit" [tor-browser] * Bug 42538: Move onion icons to toolkit [tor-browser] * Bug 41111: Use Lyrebird to provide WebTunnel PT Client [tor-browser-build] * Windows + macOS + Linux * Updated Firefox to 115.10.0esr * Bug 40843: Add a working state to the Internet test button in connection settings [tor-browser] * Bug 41622: Convert onion site errors to the new neterror template [tor-browser] * Bug 41966: Cannot remove locales from the locale alternatives list [tor-browser] * Bug 42192: Correctly round new windows when bookmarks toolbar is set to "Only Show on New Tab" [tor-browser] * Bug 42202: Fluent migration: crypto safety [tor-browser] * Bug 42206: Fluent migration: about:rulesets [tor-browser] * Bug 42207: Fluent migration: preferences [tor-browser] * Bug 42210: Fluent migration: download warning [tor-browser] * Bug 42457: Loading icon for bridge pass (Lox) invites [tor-browser] * Bug 42489: Lox module notifications [tor-browser] * Bug 42490: Install svg from branding theme to browser/chrome/icons/default [tor-browser] * Bug 42496: Moat refresh bug [tor-browser] * Bug 42500: When startup window is maximized per letterboxing.rememberSize on startup, the restore button shrinks it to its minimum size [tor-browser] * Bug 42504: TB Bookmarks: Add the Tor forum .onion to the bookmarks [tor-browser] * Bug 42510: SETCONF Tor control protocol command should not be used when system Tor is configured / TOR_SKIP_LAUNCH=1 is not honored [tor-browser] * Bug 42511: false positive message: browser tab bar shows "Not connected" even though connected in a system Tor etc. context [tor-browser] * Bug 42520: Correctly record new initial window size after auto-shrinking [tor-browser] * Bug 42532: Use the HomePage module for new identity checks [tor-browser] * Bug 42533: Add Lox notification for activeLoxId [tor-browser] * Bug 42540: Fix gNetworkStatus.deinint typo [tor-browser] * Bug 289: The Letterboxing>Content Alignment heading doesn't follow the Firefox design document capitalization [mullvad-browser] * Windows * Bug 41901: windows: FontSubstitutes can leak system locale [tor-browser] * Linux * Bug 41112: Fix indentation of projects/browser/RelativeLink/start-browser [tor-browser-build] * Android * Updated GeckoView to 115.10.0esr * Updated zstd to 1.5.6 * Bug 42017: TBA13: system/widget font tests: font-family not returned in getComputedStyle [tor-browser] * Bug 42195: Fix "What's new" URL to direct to latest version [tor-browser] * Bug 42486: firefox-android bridge settings sometimes dont save [tor-browser] * Bug 42522: The quick connect switch on Android seems too much on the right side [tor-browser] * Build System * All Platforms * Updated Go to 1.21.9 * Bug 42516: Make tb-dev worktree-compatible [tor-browser] * Bug 41122: Add release date to rbm.conf [tor-browser-build] * Windows + macOS + Linux * Bug 42501: Move `--disable-eme` to OS- and architecture-specific mozconfigs [tor-browser] * Bug 42519: Update the profile directory patch to check both for `system-install` and for `is-packaged-app` file [tor-browser] * macOS * Bug 42535: mac: app change to ja doesn't apply ja translations to most (all?) chrome [tor-browser] * Bug 41124: Since TB/MB 13.5a5 macos signed installers contain all .DS_Store [tor-browser-build] * Linux * Bug 42491: Add mozconfig-linux-aarch64 [tor-browser] * Android * Bug 40992: Updated torbrowser_version number is not enough to change firefox-android versionCode number [tor-browser-build] * Bug 41127: Android testbuilds fail because of the too early MOZ_BUILD_DATE [tor-browser-build]

1 0

[RELEASE] Onionprobe release 1.2.0
by rhatto 24 Apr '24

24 Apr '24

Greetings, We just released Onionprobe 1.2.0, a tool for testing and monitoring the status of Onion Services: https://gitlab.torproject.org/tpo/onion-services/onionprobe This release requires a database migration for those using the monitoring node: https://gitlab.torproject.org/tpo/onion-services/onionprobe/-/blob/main/doc… # ChangeLog ## v1.2.0 - 2024-04-24 ### Features * New metrics ([tpo/onion-services/onionprobe#78][]): * From the outer descriptor wrapper: * `descriptor-lifetime`. * `revision-counter`. * From the second layer of encryption: * `single-onion-service`. * `pow-params`. * HSDir latency when fetching descriptors. * Enhanced Grafana Dashboard ([tpo/onion-services/onionprobe#80][]) with the following new visualizations: * Overview: * Current failure rate of onionsites. * Total expiring certificates in the next 7 days. * List of certificate expirations up to the next 180 days. * List of unreachable instances. * Graph with the total unreachable instances. * List of invalid HTTPS certificates. * List of services with HTTPS errors. * Performance: * Total of minimum, average and maximum service connection latency. * Total of minimum, average and maximum descriptor fetch latency. * Chart of minimum, average and maximum service connection latency. * Chart of minimum, average and maximum descriptor fetch latency. * Rate of services using the single hop mode, relative to the total services monitored. * List of slow services. * Descriptors: * List of services missing a published descriptor. * Chart of the minimum, average and maximum descriptor sizes (decrypted outer layer). * Chart of the minimum, average and maximum descriptor sizes (decrypted second layer). * Introduction points: * Chart of minimum, average and maximum number of introduction points per service. * List of services and it's number of introduction points. * HSDir: * Total number of HSDirs tested. * Chart of minimum, average and maximum HSDir latency for fetching descriptors. * List of HSDirs sorted by descriptor fetch latency. * Proof of Work (PoW): * Ratio of services with PoW enabled, relative to the total services monitored. * Total number of services with PoW enabled. * Chart of minimum, average and maximum PoW v1 effort seem. * List of services with PoW enabled. * List of services with PoW enabled with effort greater than zero. * Improved log message for elapsed time. * New log messages for: * Number of introduction points. * HS_DESC events: * Descriptor reachability. * HSDir used. * Create a GitLab release at every new tag (experimental) ([tpo/onion-services/onionprobe#82][]). * Running lintian on CI to check the generated Debian package. [tpo/onion-services/onionprobe#78]: https://gitlab.torproject.org/tpo/onion-services/onionprobe/-/issues/78 [tpo/onion-services/onionprobe#80]: https://gitlab.torproject.org/tpo/onion-services/onionprobe/-/issues/80 [tpo/onion-services/onionprobe#82]: https://gitlab.torproject.org/tpo/onion-services/onionprobe/-/issues/82 ### Fixes * Manpage generation is now compatible with the Onion Services Ecosystem Portal ([tpo/onion-services/ecosystem#1][]). * Use the correct copyright line in source files. * Support for a wider range of [pyca/cryptography][] versions at `setup.cfg`. * Display Tor bootstrap messages only for the debug log level. * Disable stem logging if log level is below debug ([tpo/onion-services/onionprobe#63][]). * Exit codes now reflects reality ([tpo/onion-services/onionprobe#64][]). * Calculate the elapsed time for descriptors right after fetching. * Updated the [SecureDrop list][]. * Upgraded Grafana image to 10.4.2. * Upgraded Alertmanager image to 0.27.0. * Upgraded Prometheus image to 2.51.2. * Upgraded PostgreSQL image to 16. Please run the [needed upgrading steps](upgrading.md#major-upgrades). * Upgraded CI and container images to Debian bookworm. * Upgraded `vendors/onion-mkdocs`. [tpo/onion-services/ecosystem#1]: https://gitlab.torproject.org/tpo/onion-services/ecosystem/-/issues/1 [pyca/cryptography]: https://cryptography.io [tpo/onion-services/onionprobe#63]: https://gitlab.torproject.org/tpo/onion-services/onionprobe/-/issues/63 [tpo/onion-services/onionprobe#64]: https://gitlab.torproject.org/tpo/onion-services/onionprobe/-/issues/64 [SecureDrop list]: https://gitlab.torproject.org/tpo/onion-services/onionprobe/-/blob/main/con… -- Silvio Rhatto pronouns he/him

1 0

New Release: Tor Browser 13.0.14 (Android, Windows, macOS, Linux)
by Richard Pospesel 16 Apr '24

16 Apr '24

Hi everyone, Tor Browser 13.0.14 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-13014/ Changelog: > Tor Browser 13.0.14 - April 16 2024 > * All Platforms > * Updated Tor to 0.4.8.11 > * Bug 41676: Set privacy.resistFingerprinting.testing.setTZtoUTC as a defense-in-depth [tor-browser] > * Bug 42335: Do not localize the order of locales for app lang [tor-browser] > * Bug 42428: Timezone offset leak via document.lastModified [tor-browser] > * Bug 42472: Timezone may leak from XSLT Date function [tor-browser] > * Bug 42508: Rebase Tor Browser stable onto 115.10.0esr [tor-browser] > * Windows + macOS + Linux > * Updated Firefox to 115.10.0esr > * Bug 42172: browser.startup.homepage and TOR_DEFAULT_HOMEPAGE are ignored for the new window opened by New Identity [tor-browser] > * Bug 42236: Let users decide whether to load their home page on new identity. [tor-browser] > * Bug 42468: App languages not sorted correctly in stable [tor-browser] > * Linux > * Bug 41110: Avoid Fontconfig warning about "ambiguous path" [tor-browser-build] > * Android > * Updated GeckoView to 115.10.0esr > * Bug 42509: Backport Android security fixes from Firefox 125 [tor-browser] > * Build System > * All Platforms > * Updated Go to 1.21.8 > * Bug 41107: Update download-unsigned-sha256sums-gpg-signatures-from-people-tpo for new type of URL [tor-browser-build] > * Bug 41122: Add release date to rbm.conf [tor-browser-build] > * Android > * Bug 40992: Updated torbrowser_version number is not enough to change firefox-android versionCode number [tor-browser-build] best, -richard

1 0

[RELEASE] Tor 0.4.8.11
by David Goulet 10 Apr '24

10 Apr '24

Greetings, We just released tor 0.4.8.11. https://forum.torproject.org/t/stable-release-0-4-8-11/12265 Here is the ChangeLog. Changes in version 0.4.8.11 - 2024-04-10 This is a minor release mostly to upgrade the fallbackdir list. Worth noting also that directory authority running this version will now automatically reject relays running the end of life 0.4.7.x version. o Minor feature (authority): - Reject 0.4.7.x series at the authority level. Closes ticket 40896. o Minor feature (dirauth, tor26): - New IP address and keys. o Minor feature (directory authority): - Allow BandwidthFiles "node_id" KeyValue without the dollar sign at the start of the hexdigit, in order to easier database queries combining Tor documents in which the relays fingerprint does not include it. Fixes bug 40891; bugfix on 0.4.7 (all supported versions of Tor). o Minor features (fallbackdir): - Regenerate fallback directories generated on April 10, 2024. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2024/04/10. o Minor bugfixes (directory authorities): - Add a warning when publishing a vote or signatures to another directory authority fails. Fixes bug 40910; bugfix on 0.2.0.3-alpha. Cheers! David -- hGC+wGuxU8cGa7qMZ0dChtr3rKmMLXWpwr7PX8zIlP8=

1 0

New Release: Tor Browser 13.5a6 (Android, Windows, macOS, Linux)
by Richard Pospesel 28 Mar '24

28 Mar '24

Hi everyone, Tor Browser 13.5a6 has now been published for all platforms. For details please see our blog post: - $(BLOG_POST_URL) Changelog: > Tor Browser 13.5a6 - March 28 2024 > * All Platforms > * Bug 41114: Fix no-async-promise-executor on TorConnect [tor-browser] > * Bug 41676: Set privacy.resistFingerprinting.testing.setTZtoUTC as a defense-in-depth [tor-browser] > * Bug 42336: Review the relationship between TorSettings and the TorProvider [tor-browser] > * Bug 42428: Timezone offset leak via document.lastModified [tor-browser] > * Bug 42435: Update moat domain fronting configuration [tor-browser] > * Bug 42437: Drop "torbrowser.version" preference [tor-browser] > * Bug 42444: Remove the "Prioritize .onion sites when known" option [tor-browser] > * Bug 42449: Rebase Tor Browser alpha onto Firefox 115.9.0esr [tor-browser] > * Bug 42459: Add startpage onion service to list of search providers [tor-browser] > * Bug 42466: Drop the "Onion Logo" from trademark statement [tor-browser] > * Bug 42472: Timezone May leak from XSLT Date function [tor-browser] > * Bug 42473: ESR 115.9.1 fixes [tor-browser] > * Bug 42481: Modularize SecurityLevel [tor-browser] > * Bug 41105: Bump version of snowflake to v2.9.2 [tor-browser-build] > * Windows + macOS + Linux > * Updated Firefox to 115.9.0esr > * Bug 41916: Letterboxing preferences UI [tor-browser] > * Bug 41918: Add option to reuse last window size when letterboxing is enabled [tor-browser] > * Bug 42203: Fluent migration: about dialog [tor-browser] > * Bug 42209: Fluent migration: tor circuit [tor-browser] > * Bug 42211: Fluent migration: new identity [tor-browser] > * Bug 42214: Fluent migration: security level [tor-browser] > * Bug 42236: Let users decide whether to load their home page on new identity. [tor-browser] > * Bug 42443: Shrink the window to match letterboxing size when the emtpy area is doble-clicked [tor-browser] > * Bug 42446: Improve accessible descriptions in built-in dialog [tor-browser] > * Bug 42458: Update the "Submit Feedback" link in "About Tor Browser" [tor-browser] > * Windows > * Bug 42377: Hidden fonts are automatically added to the allow list [tor-browser] > * Linux > * Bug 42438: Adapt the data import wizard to use the original $HOME on Linux [tor-browser] > * Bug 41110: Avoid Fontconfig warning about "ambiguous path" [tor-browser-build] > * Android > * Updated GeckoView to 115.9.0esr > * Bug 41187: Improve Android's bridge settings UI [tor-browser] > * Bug 42427: Do not ship bridges as prefences anymore [tor-browser] > * Build System > * All Platforms > * Updated Go to 1.21.8 > * Bug 41102: src archive does not match likely due to mismatched xz-utils version [tor-browser-build] > * Bug 41107: Update download-unsigned-sha256sums-gpg-signatures-from-people-tpo for new type of URL [tor-browser-build] > * Bug 40073: We should remove ./ when using 7-zip for zip files [rbm] > * Windows + macOS + Linux > * Bug 42305: (Semi-)Automatically merge translation resources across tor browser releases (desktop) [tor-browser] > * Bug 41088: Remove use of projects/browser/run_scripts [tor-browser-build] > * Windows > * Bug 41097: authenticode-timestamping.sh fails to run again because tmp-timestamp already exists [tor-browser-build] > * Android > * Bug 40502: Do not recommend addons on Tor Browser [tor-browser] > * Bug 41082: Package tor expert bundle on android as .aar that firefox-android can use in lieu of tor-android-service with geckoview bootstrap [tor-browser-build] best, -richard

1 1

[RELEASE] Onionspray release 1.6.1
by rhatto 26 Mar '24

26 Mar '24

Greetings, We just released Onionspray 1.6.1. This is a maintenance release, with some fixes and a few minor underlying features. Operators are advised to reconfigure and restart their services to apply template updates. The full ChangeLog is available at https://gitlab.torproject.org/tpo/onion-services/onionspray/-/blob/main/doc… -- Silvio Rhatto pronouns he/him

1 0

New Release: Tor Browser 13.0.13 (Windows, macOS, Linux)
by Richard Pospesel 22 Mar '24

22 Mar '24

Hi everyone, Tor Browser 13.0.13 has now been published for all Desktop platforms. This is an unscheduled emergency release for our Desktop platforms only. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-13013/ Changelog: > Tor Browser 13.0.13 - March 22 2024 > * Windows + macOS + Linux > * Updated Firefox to 115.9.1esr > * Bug 42473: ESR 115.9.1 fixes [tor-browser] > * Bug 42474: Rebase stable browsers on 115.9.1 [tor-browser] best, -richard

1 0

New Release: Tor Browser 13.0.12 (Android, Windows, macOS, Linux)
by Nicolas Vigier 19 Mar '24

19 Mar '24

Hi everyone, Tor Browser 13.0.12 has now been published for all platforms. For details please see our blog post: https://blog.torproject.org/new-release-tor-browser-13012/ Changelog: * All Platforms * Updated Snowflake to 2.9.2 * Bug 42376: The placeholder of datetime inputs keeps being localized when spoof English is on [tor-browser] * Bug 42378: spoof english + htmlform <details> can leak app language [tor-browser] * Bug 42444: Remove the "Prioritize .onion sites when known" option [tor-browser] * Bug 42448: Rebase Tor Browser stable onto Firefox 115.9.0esr [tor-browser] * Bug 42459: Add startpage onion service to list of search providers [tor-browser] * Bug 41105: Bump version of snowflake to v2.9.2 [tor-browser-build] * Windows + macOS + Linux * Updated Firefox to 115.9.0esr * Windows * Bug 42377: Hidden fonts are automatically added to the allow list [tor-browser] * Android * Updated GeckoView to 115.9.0esr * Bug 42407: TTP-03-010 WP3: Potential phishing [tor-browser] * Build System * All Platforms * Updated Go to 1.21.8 * Bug 41102: src archive does not match likely due to mismatched xz-utils version [tor-browser-build]

1 0