April 2016 - tor-commits - lists.torproject.org

[translation/https_everywhere_completed] Update translations for https_everywhere_completed
by translation＠torproject.org 22 Apr '16

22 Apr '16

commit 371cba91be5e78762d497f7b73f1b3c495f40dbc Author: Translation commit bot <translation(a)torproject.org> Date: Fri Apr 22 09:15:20 2016 +0000 Update translations for https_everywhere_completed --- fa/https-everywhere.dtd | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/fa/https-everywhere.dtd b/fa/https-everywhere.dtd index 0115af2..c2309b9 100644 --- a/fa/https-everywhere.dtd +++ b/fa/https-everywhere.dtd @@ -3,14 +3,18 @@ <!ENTITY https-everywhere.about.ext_description "وب را رمزگذاری کنید! از امنیت HTTPS بصورت خودکار برای بسیاری از وب‌سایت‌ها استفاده کنید."> <!ENTITY https-everywhere.about.version "نسخه"> <!ENTITY https-everywhere.about.created_by "نوشته‌شده توسط"> +<!ENTITY https-everywhere.about.and "، و"> <!ENTITY https-everywhere.about.librarians "کتابداران قوانین"> <!ENTITY https-everywhere.about.thanks "با تشکر از"> +<!ENTITY https-everywhere.about.many_contributors "بسیار زیادی همکار، از جمله"> +<!ENTITY https-everywhere.about.noscript "همچنین، تکه‌کدهایی از HTTPS Everywhere براساس کد NoScript توسط Giorgio Maone و دیگران نوشته شده است. ما از کار فوق‌العاده‌شان سپاسگذاریم!"> <!ENTITY https-everywhere.about.contribute "اگر شما از HTTPS همه‌جا راضی هستید، پیشنهاد می‌کنیم"> <!ENTITY https-everywhere.about.donate_tor "به Tor کمک مالی کنید."> <!ENTITY https-everywhere.about.tor_lang_code "fa"> <!ENTITY https-everywhere.about.or "یا"> <!ENTITY https-everywhere.about.donate_eff "به EFF کمک مالی کنید."> +<!ENTITY https-everywhere.menu.donate_eff_imperative "به EFF کمک مالی کنید."> <!ENTITY https-everywhere.menu.about "درباره‌ی HTTPS همه‌جا"> <!ENTITY https-everywhere.menu.observatory "تنظیم‌های رصدخانه‌ی SSL"> <!ENTITY https-everywhere.menu.globalEnable "HTTPS همه‌جا را فعال کنید"> @@ -34,17 +38,19 @@ <!ENTITY https-everywhere.prefs.reset_default "بازگشت به تنظیم‌های اولیه"> <!ENTITY https-everywhere.prefs.view_xml_source "مشاهده منبع XML"> -<!ENTITY https-everywhere.source.downloading "در حال دانلود"> -<!ENTITY https-everywhere.source.filename "نام فایل"> -<!ENTITY https-everywhere.source.unable_to_download "امکان دانلود منبع وجود ندارد."> +<!ENTITY https-everywhere.chrome.stable_rules "قوانین پایدار"> +<!ENTITY https-everywhere.chrome.stable_rules_description "اجبار اتصال رمزگذاری شده به این وب سایت:"> +<!ENTITY https-everywhere.chrome.experimental_rules "قوانین تجربی"> +<!ENTITY https-everywhere.chrome.experimental_rules_description "ممکن است علت، هشدار و یا شکستگی باشد. غیر فعال به طور پیش فرض."> +<!ENTITY https-everywhere.chrome.add_rule "اضافه کردن یک قانون برای این سایت"> +<!ENTITY https-everywhere.chrome.add_new_rule "اضافه کردن یک قانون جدید برای این سایت"> +<!ENTITY https-everywhere.chrome.always_https_for_host "همیشه از https برای این میزبان استفاده شود"> +<!ENTITY https-everywhere.chrome.host "ميزبان:"> +<!ENTITY https-everywhere.chrome.show_advanced "نمایش پیشرفته"> +<!ENTITY https-everywhere.chrome.hide_advanced "مخفی‌کردن پیشرفته"> +<!ENTITY https-everywhere.chrome.rule_name "نام قانون"> +<!ENTITY https-everywhere.chrome.regex "عبارت‌های منظم منطبق شده"> +<!ENTITY https-everywhere.chrome.redirect_to "تغییر مسیر به"> +<!ENTITY https-everywhere.chrome.status_cancel_button "لغو"> -<!ENTITY https-everywhere.popup.title "آگهی از همه جا HTTPS نسخه 4.0development.11"> -<!ENTITY https-everywhere.popup.paragraph1 "اوه! شما از نسخه پایدار «همه جا HTTPS» استفاده می کردید، اما احتمالا ما به طور تصادفی در حین آخرین انتشار، شما را به نسخه در حال توسعه ارتقا دادیم. "> -<!ENTITY https-everywhere.popup.paragraph2 "آیا مایلید به نسخه‌ی پایدار بازگردید؟"> -<!ENTITY https-everywhere.popup.paragraph3 "ما خوشحال می شویم اگر شما همچنان از آخرین نسخه‌ی در حال توسعه منتشر شده ما استفاده کنید! شاید اینجا و آنجا به یکی دو مشکل برخورد کنید که می توانید آنها را به آدرس https-everywhere(a)eff.org اطلاع دهید. با عرض پوزش به خاطر مشکلات احتمالی و با تشکر به خاطر استفاده از «همه جا HTTPS»."> -<!ENTITY https-everywhere.popup.keep "آخرین نسخه پایدار را داونلود کن"> -<!ENTITY https-everywhere.popup.revert "آخرین نسخه پایدار را داونلود کن"> -<!ENTITY https-everywhere.ruleset-tests.status_title "تست قوانین HTTPS همه جا"> -<!ENTITY https-everywhere.ruleset-tests.status_cancel_button "لغو"> -<!ENTITY https-everywhere.ruleset-tests.status_start_button "آغاز">

1 0

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 22 Apr '16

22 Apr '16

commit 759c87f6d65e45ae413aa61d874b6ea2d28ed6ff Author: Translation commit bot <translation(a)torproject.org> Date: Fri Apr 22 09:15:15 2016 +0000 Update translations for https_everywhere --- fa/https-everywhere.dtd | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fa/https-everywhere.dtd b/fa/https-everywhere.dtd index 5a3ee14..c2309b9 100644 --- a/fa/https-everywhere.dtd +++ b/fa/https-everywhere.dtd @@ -7,7 +7,7 @@ <!ENTITY https-everywhere.about.librarians "کتابداران قوانین"> <!ENTITY https-everywhere.about.thanks "با تشکر از"> <!ENTITY https-everywhere.about.many_contributors "بسیار زیادی همکار، از جمله"> -<!ENTITY https-everywhere.about.noscript "Also, portions of HTTPS Everywhere are based on code from NoScript, by Giorgio Maone and others. We are grateful for their excellent work!"> +<!ENTITY https-everywhere.about.noscript "همچنین، تکه‌کدهایی از HTTPS Everywhere براساس کد NoScript توسط Giorgio Maone و دیگران نوشته شده است. ما از کار فوق‌العاده‌شان سپاسگذاریم!"> <!ENTITY https-everywhere.about.contribute "اگر شما از HTTPS همه‌جا راضی هستید، پیشنهاد می‌کنیم"> <!ENTITY https-everywhere.about.donate_tor "به Tor کمک مالی کنید."> <!ENTITY https-everywhere.about.tor_lang_code "fa"> @@ -49,7 +49,7 @@ <!ENTITY https-everywhere.chrome.show_advanced "نمایش پیشرفته"> <!ENTITY https-everywhere.chrome.hide_advanced "مخفی‌کردن پیشرفته"> <!ENTITY https-everywhere.chrome.rule_name "نام قانون"> -<!ENTITY https-everywhere.chrome.regex "Matching regex"> +<!ENTITY https-everywhere.chrome.regex "عبارت‌های منظم منطبق شده"> <!ENTITY https-everywhere.chrome.redirect_to "تغییر مسیر به"> <!ENTITY https-everywhere.chrome.status_cancel_button "لغو">

1 0

[tor-launcher/master] Getting new strings translated
by gk＠torproject.org 22 Apr '16

22 Apr '16

commit 14c8fff57bcf60d11416cec46d9d560ae132a033 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 22 08:13:05 2016 +0000 Getting new strings translated --- src/chrome/locale/en/network-settings.dtd | 2 +- src/chrome/locale/en/torlauncher.properties | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/src/chrome/locale/en/network-settings.dtd b/src/chrome/locale/en/network-settings.dtd index 75ece3b..0d2e9dc 100644 --- a/src/chrome/locale/en/network-settings.dtd +++ b/src/chrome/locale/en/network-settings.dtd @@ -65,7 +65,7 @@ <!ENTITY torsettings.copyLog "Copy Tor Log To Clipboard"> <!ENTITY torsettings.bridgeHelpTitle "Bridge Relay Help"> <!ENTITY torsettings.bridgeHelp1 "If you are unable to connect to the Tor network, it could be that your Internet Service Provider (ISP) or another agency is blocking Tor.  Often, you can work around this problem by using Tor Bridges, which are unlisted relays that are more difficult to block."> -<!ENTITY torsettings.bridgeHelp1B "You may use the preconfigured, provided set of bridge addresses or you may obtain a custom set of addresses by using one of these three methods:"> +<!ENTITY torsettings.bridgeHelp1B "You may use the preconfigured, provided set of bridge addresses or you may obtain a custom set of addresses by using one of these methods:"> <!ENTITY torsettings.bridgeHelp2Heading "Through the Web"> <!ENTITY torsettings.bridgeHelp2 "Use a web browser to visit https://bridges.torproject.org"> <!ENTITY torsettings.bridgeHelp3Heading "Through the Email Autoresponder"> diff --git a/src/chrome/locale/en/torlauncher.properties b/src/chrome/locale/en/torlauncher.properties index 0ef4437..6b471a3 100644 --- a/src/chrome/locale/en/torlauncher.properties +++ b/src/chrome/locale/en/torlauncher.properties @@ -36,6 +36,7 @@ torlauncher.quit_win=Exit torlauncher.done=Done torlauncher.forAssistance=For assistance, contact %S +torlauncher.forAssistance2=For assistance, visit %S torlauncher.copiedNLogMessages=Copy complete. %S Tor log messages are ready to be pasted into a text editor or an email message.

1 0

[research-web/master] add another recommended research group
by arma＠torproject.org 22 Apr '16

22 Apr '16

commit f274b4d50aeea7db4cbb0537935be98425d91bed Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Apr 22 01:11:19 2016 -0400 add another recommended research group --- htdocs/groups.html | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/htdocs/groups.html b/htdocs/groups.html index e30ad5c..c746c6c 100644 --- a/htdocs/groups.html +++ b/htdocs/groups.html @@ -48,6 +48,11 @@ group at Georgetown. <li>Matt Wright's <a href="http://isec.uta.edu/">iSec</a> group at UTA. </li> +<li><a href="http://www0.cs.ucl.ac.uk/staff/G.Danezis/">George +Danezis</a>'s and <a href="http://sec.cs.ucl.ac.uk/users/smurdoch/">Steven +Murdoch</a>'s group at <a href="http://sec.cs.ucl.ac.uk/home/">University +College London</a>. +</li> </ul> </div>

1 0

[research-web/master] link to the safety board from the other pages
by arma＠torproject.org 22 Apr '16

22 Apr '16

commit 63483403edd7e85b3fa510d108baebe6243350a1 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Apr 22 01:06:19 2016 -0400 link to the safety board from the other pages --- htdocs/groups.html | 1 + htdocs/ideas.html | 1 + htdocs/index.html | 1 + 3 files changed, 3 insertions(+) diff --git a/htdocs/groups.html b/htdocs/groups.html index a923d6d..e30ad5c 100644 --- a/htdocs/groups.html +++ b/htdocs/groups.html @@ -15,6 +15,7 @@ width="193" height="79"></a></td> <td class="banner-middle"> <a href="index.html">Home</a> + <a href="safetyboard.html">Safety Board</a> Groups <a href="ideas.html">Ideas</a> <a href="techreports.html">Tech Reports</a> diff --git a/htdocs/ideas.html b/htdocs/ideas.html index 904ddaa..c411ff6 100644 --- a/htdocs/ideas.html +++ b/htdocs/ideas.html @@ -15,6 +15,7 @@ width="193" height="79"></a></td> <td class="banner-middle"> <a href="index.html">Home</a> + <a href="safetyboard.html">Safety Board</a> <a href="groups.html">Groups</a> Ideas <a href="techreports.html">Tech Reports</a> diff --git a/htdocs/index.html b/htdocs/index.html index 50921b7..ec433d0 100644 --- a/htdocs/index.html +++ b/htdocs/index.html @@ -15,6 +15,7 @@ width="193" height="79"></a></td> <td class="banner-middle"> Home + <a href="safetyboard.html">Safety Board</a> <a href="groups.html">Groups</a> <a href="ideas.html">Ideas</a> <a href="techreports.html">Tech Reports</a>

1 0

[research-web/master] add an in-progress tor research safety board page
by arma＠torproject.org 22 Apr '16

22 Apr '16

commit 2a8bad5f20954bc53e1ae0dd9075ff372a922852 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Apr 22 01:05:46 2016 -0400 add an in-progress tor research safety board page --- htdocs/safetyboard.html | 251 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 251 insertions(+) diff --git a/htdocs/safetyboard.html b/htdocs/safetyboard.html new file mode 100644 index 0000000..12c8dec --- /dev/null +++ b/htdocs/safetyboard.html @@ -0,0 +1,251 @@ +<html> +<head> +<title>Tor Research Safety Board</title> +<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1"> +<link href="css/stylesheet-ltr.css" type="text/css" rel="stylesheet"> +<link href="/images/favicon.ico" type="image/x-icon" rel="shortcut icon"> +</head> +<body> + +<table class="banner" border="0" cellpadding="0" cellspacing="0" summary=""> +<tr> + <td class="banner-left"> + <a href="index.html"> + <img src="/images/top-left.png" alt="Click to go to home page" + width="193" height="79"></a></td> + <td class="banner-middle"> + <a href="index.html">Home</a> + Safety Board + <a href="groups.html">Groups</a> + <a href="ideas.html">Ideas</a> + <a href="techreports.html">Tech Reports</a> + </td> + <td class="banner-right"></td> +</tr> +</table> + +<div class="center"> +<div class="main-column"> +<h2>Tor Research Safety Board</h2> +<br> + +<p><center><i>This page is under construction. Don't believe everything on it yet!</i></center> + +<ul> +<li><a href="#what">What is the Tor Research Safety Board?</a></li> +<li><a href="#guidelines">What are the safety guidelines?</a></li> +<li><a href="#how">How can I submit a request for advice?</a></li> +<li><a href="#examples">What are some example papers that are in-scope?</a></li> +<li><a href="#who">Who is on the Board?</a></li> +<li><a href="#faq">FAQ</a></li> +</ul> + +<hr> +<a id="what"></a> +<h3><a class="anchor" href="#what">What is the Tor Research Safety +Board?</a></h3> +<br> + +<p> +We are a group of researchers who study Tor, and who want to <b>minimize +privacy risks while fostering a better understanding of the Tor network +and its users</b>. We aim to accomplish this goal in three ways: + +<ol> +<li>developing and maintaining a set of guidelines that researchers can +use to assess the safety of their Tor research.</li> +<li>giving feedback to researchers who use our guidelines to assess the +safety of their planned research.</li> +<li>teaching program committees about our guidelines, and encouraging +reviewers to consider research safety when reviewing Tor papers.</li> +</ol> + +<hr> +<a id="guidelines"></a> +<h3><a class="anchor" href="#guidelines">What are the safety +guidelines?</a></h3> +<br> + +<p> +Here's a start: + +<ol> +<li>Use a test Tor network whenever possible. +<li>Only attack yourself / your own traffic. +<li>Only collect data that is safe to make public. +<li>Don't collect data you don't need (minimization). +<li>Limit the granularity of data (e.g. use bins or add noise). +<li>The benefits should outweigh the risks. +<li>Consider auxiliary data (e.g. third-party data sets) when assessing +the risks. +<li>Consider whether the user meant for that data to be private. +</ol> + +<p> +There's plenty of room for further improvement here. In fact, we think +this list itself is a really interesting research area. Please help! + +<hr> +<a id="how"></a> +<h3><a class="anchor" href="#how">How can I submit a request for advice?</a></h3> +<br> + +<p> +The vision is that you (the researchers) think through the safety +of your plan, write up an assessment based on our guidelines, and send +it to us. Then we look it over and advise you about how to make your +plan safer, how to make your arguments crisper, or what parts really +seem too dangerous to do. Later (e.g. when your paper gets published) we'll +encourage you to make your assessment public. Over time we'll grow a +library of success cases, which will provide best practices guidance +for being safe, and also provide templates for writing good assessments. + +<p> +We hope that going through this process will help you think clearly +about the benefits and risks of your experiment. Hopefully our feedback +on your thoughts will help too. At the same time, this process will help +Tor by letting us know what research is happening — which in turn +can help you, since we might be able to let you know about a concurrent +experiment that will mess up your results. + +<p> +To best help you, we want to hear about four aspects of your proposed +experiment or research plan: +<ol> +<li>What are you trying to learn, and why is that useful for the +world? That is, what are the hoped-for benefits of your experiment? +<li>What exactly is your plan? That is, what are the steps of your +experiment, what will you collect, how will you keep it safe, and +so on. +<li>What attacks or risks might be introduced or assisted because of your +actions or your data sets, and how well do you resolve each of them? Use +the "safety guidelines" above to help in the brainstorming and analysis. +<li>Walk us through why the benefits from item 1 outweigh the remaining +risks from item 3: why is this plan worthwhile despite the remaining +risks? +</ol> + +<p>We encourage you to include your assessment as a section of your +research paper — one of the goals here is that reviewers on +program committees come to expect a section in Tor papers that explains +what mechanisms the researchers used for ensuring privacy risks +were handled, and argues that the balance between new understanding +and risk is worthwhile. For space reasons, you might include a streamlined +version in the main body of the paper and a more detailed version in +an appendix. + +<p> +In the future, we'd like to come up with a more thorough template for +self-assessments, to help you make sure you don't miss any critical +areas. Please let us know what would help you most. + +<p>Contact address coming soon. In the meantime, mailing Roger is not +a terrible plan. + +<hr> +<a id="examples"></a> +<h3><a class="anchor" href="#examples">What are some example papers that are in-scope?</a></h3> +<br> + +<p> +This is where the templates and example self-assessments will go. + +<hr> +<a id="who"></a> +<h3><a class="anchor" href="#who">Who is on the Board?</a></h3> +<br> + +<p> +The current people who have expressed interest in the board are: +<ul> +<li><a bunch of swell people from the PETS reviewing community, +whose names I shouldn't add here until they've at least read this draft +page></li> +</ul> + +<hr> +<a id="faq"></a> +<h3><a class="anchor" href="#faq">FAQ</a></h3> +<br> + +<p><b>Why now?</b> +The importance of Tor is growing in the world, and interest from +researchers remains high as ever. Each week we run across a new paper +that maybe didn't think things through in terms of keeping their users +safe. We've seen lately that simply having a sensitive data set, even +if you plan to never give it out, can put users at real risk. +At the same time, we've seen exciting papers like PrivEx, which show +that studying how to do research safely can be a research field in itself. +Now is the perfect time for us to work to shape future research +so we build habits of safety in our community, and so we help people to +understand what is possible. + +<p><b>What about bad people who don't care about being safe?</b> +A safety board cannot by itself stop all dangerous Tor research. Plenty +of people out there don't play the academic game, and some people don't +care about user safety at all. Our goal here is to support the people +who want to cooperate, while showing to the world that it's possible to +do good Tor research safely. + +<p><b>Can't I just run Tor relays and do my experiment without telling you?</b> +Please don't! The directory authorities have been much more conservative +lately (after the CMU incident in particular) in terms of looking for +suspicious patterns or behavior, and removing suspicious relays from the +network. If the directory authority operators know about you, understand +your research, and can read about why the benefits are worth the risks +in your case, they will likely leave your relays in place, rather than +surprising you by kicking your relays out of the network mid experiment. + +<p><b>Can I do this assessment and review process even if I'm not writing +an academic paper?</b> +Please do! Our goal as stated above is "to minimize privacy risks while +fostering a better understanding of the Tor network and its users". If +your end goal is something other than a research paper, that's great too. + +<p><b>Is this an ethics board?</b> +We framed this idea as a safety board, not an ethics board. We think +safety is a narrower scope: we aim to describe <i>how</i> to be safe, +and we aim to make it the norm that reviewers and program committees +expect to see an analysis of why an experiment/measurement is safe. We +also are not adding new bottlenecks to the research process, such as +mandating that we have to vet the analysis first — that's ultimately +between the researchers and the program committees. We aren't trying to +replace IRBs or other projects like ethicalresearch.org. + +<p><b>What about confidentiality?</b> +We will keep assessments that we receive confidential in the same +way that program committees do. You're coming to us much earlier in +the process (ideally before the research is performed and before the +paper is written), which we recognize requires more trust. We hope we +add enough value to your research that you find this tradeoff worthwhile. + +<p><b>So you want conferences to adopt your guidelines?</b> +Not quite. We would be sad if program chairs told their reviewers "Make +sure the paper follows Tor's guidelines for safe research." We would +instead like the chairs to tell the reviewers "Make sure the paper has +performed safe research. If you're unsure what that means, I encourage +you to read Tor's guidelines to get ideas on what to consider." That is, +we want the reviewers to always be thinking through, for each paper, +whether this is a safe or unsafe situation. Reviewers should enforce +the ethical requirements of the conference they're reviewing for — +or their own ethical principles, if the conference neglected to have an +opinion on the topic. Our goal here is to help them think through what +to look for. + +<p><b>Is Tor going to do this assessment process for its design +decisions and statistics collection?</b> +Absolutely! You'll notice a big improvement over the years +between <a href="https://trac.torproject.org/13988">our +early statistics collection choices</a> and <a +href="https://blog.torproject.org/blog/some-statistics-about-onions">our +later ones</a>. That learning process is part of what led to this +safety board. We'd like to revisit many of Tor's design choices, +especially once we've worked through some other examples here. We'd +love to have your help there. + +</div> +</div> + +</body> +</html> +

1 0

[meek/master] Add Go version to version output.
by dcf＠torproject.org 22 Apr '16

22 Apr '16

commit c2432765d6655aed5ebe7e393e31e14096e4a545 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Apr 21 19:19:09 2016 -0700 Add Go version to version output. --- meek-server/meek-server.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/meek-server/meek-server.go b/meek-server/meek-server.go index 1eab1e5..bb861bd 100644 --- a/meek-server/meek-server.go +++ b/meek-server/meek-server.go @@ -22,6 +22,7 @@ import ( "os" "os/signal" "path" + "runtime" "sync" "syscall" "time" @@ -367,7 +368,7 @@ func main() { log.Fatalf("error in ServerSetup: %s", err) } - log.Printf("starting version %s", programVersion) + log.Printf("starting version %s (%s)", programVersion, runtime.Version()) listeners := make([]net.Listener, 0) for _, bindaddr := range ptInfo.Bindaddrs { if port != 0 {

1 0

[tor-browser-spec/master] FF45 network audit notes w/ finished XPCOM review.
by mikeperry＠torproject.org 22 Apr '16

22 Apr '16

commit 4e1a7e2cb23a9f6b7f33bf460f48571e771e951b Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Apr 21 18:46:04 2016 -0700 FF45 network audit notes w/ finished XPCOM review. --- audits/FF45_NETWORK_AUDIT | 94 +++++++++++++++++++++++++---------------------- 1 file changed, 51 insertions(+), 43 deletions(-) diff --git a/audits/FF45_NETWORK_AUDIT b/audits/FF45_NETWORK_AUDIT index a11efc9..7f3169a 100644 --- a/audits/FF45_NETWORK_AUDIT +++ b/audits/FF45_NETWORK_AUDIT @@ -314,30 +314,35 @@ Misc XPCOM: + ./layout/build/nsLayoutModule.cpp - @mozilla.org/network/*socket* (grep -R "@mozilla.org/network/" . | grep socket | grep -v udp-socket) - - ./dom/presentation/provider/TCPPresentationServer.js - - XXX: Server-side listening socket? MDN docs indicate the Presentation + + ./dom/network/TCPSocket.cpp + + Already checked + + ./netwerk/build/nsNetCID.h + + ./dom/presentation/provider/TCPPresentationServer.js + + XXX: Server-side listening socket? MDN docs indicate the Presentation stuff is not live yet - - ./dom/ipc/preload.js - - ./netwerk/protocol/websocket/WebSocketChannel.cpp - - ./devtools/shared/security/socket.js - - ./mobile/android/chrome/content/WebappRT.js - - ./browser/extensions/loop/chrome/content/modules/MozLoopPushHandler.jsm - - ./toolkit/modules/Sntp.jsm - - ./toolkit/modules/secondscreen/RokuApp.jsm - - ./toolkit/xre/nsAppRunner.cpp - - + ./addon-sdk/source/lib/sdk/io/stream.js - + Addon APIs + + https://developer.mozilla.org/en-US/docs/Web/API/Presentation + + dom.presentation.enabled is currently false + - ./dom/network/TCPServerSocket.cpp + - ServerSocket: + - Presentation server (disabled) + - Android stuff: XXX: + - ./dom/media/android/AndroidMediaResourceServer.cpp + - ./build/mobile/sutagent/android/ + - ./gfx/layers/LayerScope.cpp + - is this e10s multiprocess stuff? + + ./dom/push/PushServiceWebSocket.jsm + ./dom/ipc/preload.js - + ./dom/network/TCPServerSocket.js - - ./mobile/android/chrome/content/WebappRT.js - - Debugger? - - XXX: Pretty sure this is only for 'webapps', but it sets some scary - prefs that might impact other browser operation if an app is - installed? - + ./netwerk/build/nsNetCID.h + + ./netwerk/protocol/websocket/WebSocketChannel.cpp + + ./netwerk/protocol/websocket/WebSocketChannelParent.cpp + + ./services/sync/tps/extensions/mozmill/resource/stdlib/httpd.js + + ./browser/extensions/loop/chrome/content/modules/MozLoopPushHandler.jsm + + ./toolkit/modules/Sntp.jsm + + FxOS only + + ./toolkit/modules/secondscreen/RokuApp.jsm + + Disabled already + + ./toolkit/xre/nsAppRunner.cpp - Debugger stuff - - XXX: Has several prefs: + - XXX: Has several prefs: Verify we set these - devtools.webide.enabled - devtools.debugger.enabled? - devtools.debugger.remote-enabled @@ -347,12 +352,16 @@ Misc XPCOM: - ./toolkit/devtools/client/connection-manager.js - ./toolkit/devtools/client/dbg-client.jsm - ./toolkit/devtools/security/socket.js - - ./toolkit/modules/Sntp.jsm - - B2G ntp - - ./toolkit/xre/nsAppRunner.cpp + - ./devtools/shared/security/auth.js + - ./mobile/android/chrome/content/WebappRT.js + - Debugger? + - XXX: Pretty sure this is only for 'webapps', but it sets some scary + prefs that might impact other browser operation if an app is + installed? + createTransport() - - ./netwerk/base/Dashboard.cpp - -XXX: What the hell is this? + + ./netwerk/base/Dashboard.cpp + + The only problematic function seems to be requestConnection, used + only by tests. + Found earlier: + ./toolkit/devtools/security/socket.js: + ./toolkit/modules/Sntp.jsm: @@ -363,32 +372,31 @@ Misc XPCOM: - Misc XPCOM Contract-ID/CID defines: - NS_*SOCKET*_C should get them all (grep -R "NS_" | grep SOCKET | grep "_C") - + WebRTC and mtransport (disabled) + + WebRTC and mtransport (disabled)a + + dom/bluetooth/bluedroid/BluetoothDaemonInterface.cpp (B2G) + + dom/presentation/PresentationSessionTransport.cpp + + pref dom.presentation.* + + dom/media/bridge/MediaModule.cpp + + Compiled out by webrtc + + netwerk/base/nsIOService.cpp + + netwerk/standalone/nsNetModuleStandalone.cpp + + netwerk/sctp/datachannel/DataChannel.cpp + + Disabled with Webrtc + + security/manager/ssl/SSLServerCertVerification.cpp + + security/manager/ssl/SharedSSLState.cpp: + + Webrtc stuff (disabled) + + mtransport stuff (disabled) - gfx/layers/LayerScope.cpp - - XXX - - + NS_SOCKETTRANSPORTSERVICE_* - + Proxied if TCP - + Udp limited to mtransport and webrtc - + NS_UDPSOCKET_* - + - XXX: e10s? + netwerk/protocol/websocket/WebSocketChannel.cpp: + netwerk/protocol/http/nsHttpHandler.cpp: + netwerk/protocol/http/nsHttpConnectionMgr.cpp: + netwerk/protocol/http/TunnelUtils.cpp: + netwerk/protocol/ftp/nsFtpConnectionThread.cpp: + netwerk/protocol/ftp/nsFtpControlConnection.cpp - + netwerk/base/nsIOService.cpp: - + dom/media/bridge/MediaModule.cpp - + Compiled out by webrtc - + dom/workers/ServiceWorkerEvents.cpp: - + dom/bluetooth2/bluedroid/BluetoothDaemonInterface.cpp - + b2g only - + security/manager/ssl/src/SSLServerCertVerification.cpp: + security/manager/ssl/src/nsNSSCallbacks.cpp: + security/manager/ssl/src/nsNSSModule.cpp: + security/manager/ssl/src/nsTLSSocketProvider.cpp: - + security/manager/ssl/src/SharedSSLState.cpp: + Gstreamer @@ -396,7 +404,7 @@ Misc XPCOM: + Uses ChannelMediaResource underneath, and ultimately an nsIChannel + Only exception seems to be if an RtspMediaResource could be used, but this appears to be FxOS-only. - + XXX: Note for FxOS tor support. This may be an issue. + - XXX: No, rtsp is now enabled for android! Android Java calls: + Uses HttpURLConnection:

1 0

[tor-browser-bundle/hardened-builds] fetch-inputs.sh: checkout git repositories with -f
by gk＠torproject.org 21 Apr '16

21 Apr '16

commit 55d7ae68564373617ee5a7bd54833ec203afedb0 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Apr 21 23:00:28 2016 +0200 fetch-inputs.sh: checkout git repositories with -f Update git repositories using "git checkout -f" to throw away local changes. This avoids an error when updating https-everywhere where a submodule was merged to the main repository. --- gitian/fetch-inputs.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index 7c9daee..4f3c886 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -99,7 +99,7 @@ update_git() { fi if [ -n "$tag" ]; then - (cd "$dir" && git checkout "$tag") + (cd "$dir" && git checkout -f "$tag") fi # If we're not verifying tags, then some of the tags

1 0

[tor-browser-bundle/master] fetch-inputs.sh: checkout git repositories with -f
by boklm＠torproject.org 21 Apr '16

21 Apr '16

commit 3fbe2d1801286eefceb1d83dfab4e6b62d38c720 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Apr 21 23:00:28 2016 +0200 fetch-inputs.sh: checkout git repositories with -f Update git repositories using "git checkout -f" to throw away local changes. This avoids an error when updating https-everywhere where a submodule was merged to the main repository. --- gitian/fetch-inputs.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index b423b48..da487f4 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -100,7 +100,7 @@ update_git() { fi if [ -n "$tag" ]; then - (cd "$dir" && git checkout "$tag") + (cd "$dir" && git checkout -f "$tag") fi # If we're not verifying tags, then some of the tags

1 0