March 2020 - tor-commits - lists.torproject.org

[torbutton/maint-9.0] Bug 33613 - Disable javascript on Safest security level
by sysrqb＠torproject.org 18 Mar '20

18 Mar '20

commit 690704a9bc3bd3a146db9689bc59d3b9e8702b15 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Mar 13 21:12:16 2020 +0000 Bug 33613 - Disable javascript on Safest security level --- modules/security-prefs.js | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/security-prefs.js b/modules/security-prefs.js index f61f24aa..947520fb 100644 --- a/modules/security-prefs.js +++ b/modules/security-prefs.js @@ -33,6 +33,7 @@ const kSecuritySettings = { "gfx.font_rendering.opentype_svg.enabled" : [, false, false, false, true ], "svg.disabled" : [, true, false, false, false], "javascript.options.asmjs" : [, false, false, false, true ], + "javascript.enabled" : [, false, true, true, true ], }; // The Security Settings prefs in question.

1 0

[translation/tbmanual-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=tbmanual-contentspot
by translation＠torproject.org 18 Mar '20

18 Mar '20

commit f535972838c337a86dc29dddb2670d75dca878a7 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Mar 18 15:50:43 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tbmanual-contentspot --- contents+fr.po | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/contents+fr.po b/contents+fr.po index d00c6fc557..326ce3eda8 100644 --- a/contents+fr.po +++ b/contents+fr.po @@ -928,6 +928,9 @@ msgid "" " fact that you are using Tor, but may slow down the connection compared to " "using ordinary Tor relays." msgstr "" +"L’utilisation de ponts combinés aux transports enfichables vous aide à " +"occulter le fait que vous utilisez Tor, mais peut ralentir la connexion par " +"rapport aux relais Tor ordinaires." #: https//tb-manual.torproject.org/bridges/ #: (content/bridges/contents+en.lrtopic.body) @@ -993,14 +996,16 @@ msgid "" "Otherwise, click on 'Preferences' in the hamburger menu (main menu) and then" " on 'Tor' in the sidebar." msgstr "" -"Sinon, cliquez sur « Préférences » dans le menu hamburger (menu principal), " -"puis sur « Tor » dans la barre latérale." +"Sinon, cliquez sur « Préférences » dans le menu ≡ (menu principal), puis sur" +" « Tor » dans la barre latérale." #: https//tb-manual.torproject.org/bridges/ #: (content/bridges/contents+en.lrtopic.body) msgid "" "In the Tor Network Settings window, select 'Tor is censored in my country.'" msgstr "" +"Dans la fenêtre Paramètres du réseau Tor, sélectionnez « Tor est censuré " +"dans mon pays »." #: https//tb-manual.torproject.org/bridges/ #: (content/bridges/contents+en.lrtopic.body) @@ -1008,6 +1013,8 @@ msgid "" "Then, select 'Request a bridge from torproject.org' and click 'Request a " "bridge...'" msgstr "" +"Sélectionnez ensuite « Demander un pont à torproject.org » et cliquez sur « " +"Demander un pont… »" #: https//tb-manual.torproject.org/bridges/ #: (content/bridges/contents+en.lrtopic.body) @@ -1047,8 +1054,8 @@ msgid "" msgstr "" "Si vous démarrez le Navigateur Tor pour la première fois, cliquez sur « " "Configurer » pour ouvrir la fenêtre des paramètres du réseau Tor. Sinon, " -"cliquez sur « Préférences » dans le menu hamburger (menu principal), puis " -"sur « Tor » dans la barre latérale pour accéder à ces options." +"cliquez sur « Préférences » dans le menu ≡ (menu principal), puis sur « Tor " +"» dans la barre latérale pour accéder à ces options." #: https//tb-manual.torproject.org/bridges/ #: (content/bridges/contents+en.lrtopic.body) @@ -1275,6 +1282,8 @@ msgid "" "Tor Browser features “New Identity” and “New Tor Circuit for this Site” " "options. There are also located in the main menu (hamburger menu)." msgstr "" +"Le Navigateur Tor propose les options « Nouvelle identité » et « Nouveau " +"circuit Tor pour ce site ». Elles sont situées dans le menu principal ≡." #: https//tb-manual.torproject.org/managing-identities/ #: (content/managing-identities/contents+en.lrtopic.body) @@ -1469,6 +1478,9 @@ msgid "" "You can also ensure that you're able to access other onion services by " "connecting to [DuckDuckGo's Onion Service](http://3g2upl4pq6kufc4m.onion/)." msgstr "" +"Vous pouvez aussi vous assurer que vous arrivez à accéder à d’autres " +"services onion en vous connectant au [service onion de " +"DuckDuckGo](http://3g2upl4pq6kufc4m.onion/)." #: https//tb-manual.torproject.org/secure-connections/ #: (content/secure-connections/contents+en.lrtopic.title) @@ -1535,6 +1547,8 @@ msgid "" "You can do this by increasing Tor Browser's Security Levels in the shield " "menu." msgstr "" +"À partir du menu du bouclier, vous pouvez le faire en augmentant le niveau " +"de sécurité du Navigateur Tor dans les Paramètres de sécurité avancés." #: https//tb-manual.torproject.org/security-settings/ #: (content/security-settings/contents+en.lrtopic.body) @@ -1646,6 +1660,9 @@ msgid "" " fonts and math symbols are disabled; audio and video (HTML5 media) are " "click-to-play." msgstr "" +"* JavaScript est désactivé sur tous les sites non [HTTPS](/fr/secure-" +"connections) ; certaines polices et certains symboles mathématiques sont " +"désactivés ; le son et la vidéo (médias HTML5) sont « cliquer pour lire »." #: https//tb-manual.torproject.org/security-settings/ #: (content/security-settings/contents+en.lrtopic.body)

1 0

[translation/support-portal] https://gitweb.torproject.org/translation.git/commit/?h=support-portal
by translation＠torproject.org 18 Mar '20

18 Mar '20

commit c66cfb17862745d7a2e32e13aaf602fe7e88e158 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Mar 18 14:25:00 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=support-portal --- contents+it.po | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/contents+it.po b/contents+it.po index d97ef3fbc7..0e033e3a4a 100644 --- a/contents+it.po +++ b/contents+it.po @@ -418,6 +418,10 @@ msgid "" "[Linux](https://www.torproject.org/download/) and " "[macOS](https://www.torproject.org/download/)." msgstr "" +"Tor Browser attualmente è disponibile su " +"[Windows](https://www.torproject.org/download/), " +"[Linux](https://www.torproject.org/download/) e " +"[macOS](https://www.torproject.org/download/)." #: https//support.torproject.org/faq/faq-4/ #: (content/faq/faq-4/contents+en.lrquestion.description) @@ -430,6 +434,11 @@ msgid "" "app](https://play.google.com/store/apps/details?id=org.torproject.android) " "to route other apps on your Android device over the Tor network." msgstr "" +"C'è una versione di Tor Browser per " +"[Android](https://www.torproject.org/download/#android), inoltre [The " +"Guardian Project](https://guardianproject.info) fornisce l'[app " +"Orbot](https://play.google.com/store/apps/details?id=org.torproject.android)" +" per instradare le altre app del tuo dispositivo Android verso la rete Tor." #: https//support.torproject.org/faq/faq-4/ #: (content/faq/faq-4/contents+en.lrquestion.description) @@ -516,11 +525,13 @@ msgid "" "If we ever put a deliberate backdoor in our security software, it would ruin" " our professional reputation." msgstr "" +"Se inserissimo deliberatamente una backdoor nel nostro software di " +"sicurezza, la nostra reputazione professionale verrebbe distrutta." #: https//support.torproject.org/about/backdoor/ #: (content/about/backdoor/contents+en.lrquestion.description) msgid "Nobody would trust our software ever again - for excellent reasons!" -msgstr "" +msgstr "Nessuno si fiderebbe più del nostro software - per ovvi motivi!" #: https//support.torproject.org/about/backdoor/ #: (content/about/backdoor/contents+en.lrquestion.description) @@ -553,6 +564,8 @@ msgid "" "If we (or the distributors that gave you Tor) don't give you access to the " "source code, that's a sure sign something funny might be going on." msgstr "" +"Se noi (o i fornitori che ti hanno dato Tor) non ti diamo accesso al codice " +"sorgente, è un chiaro sengnale che sta succedendo qualcosa di strano." #: https//support.torproject.org/about/backdoor/ #: (content/about/backdoor/contents+en.lrquestion.description) @@ -612,7 +625,7 @@ msgstr "" #: https//support.torproject.org/about/can-i-use-tor-with/ #: (content/about/can-i-use-tor-with/contents+en.lrquestion.description) msgid "Please add to this list and help us keep it accurate!" -msgstr "" +msgstr "Per favore aggiungi a questa lista e aiutaci a mantenerla accurata!" #: https//support.torproject.org/about/can-i-use-tor-with/ #: (content/about/can-i-use-tor-with/contents+en.lrquestion.description) @@ -1062,7 +1075,7 @@ msgstr "Perchè è chiamato Tor?" #: https//support.torproject.org/about/why-is-it-called-tor/ #: (content/about/why-is-it-called-tor/contents+en.lrquestion.description) msgid "Tor is the onion routing network." -msgstr "" +msgstr "Tor è la rete di instradamento onion." #: https//support.torproject.org/about/why-is-it-called-tor/ #: (content/about/why-is-it-called-tor/contents+en.lrquestion.description) @@ -1089,7 +1102,7 @@ msgstr "" #: https//support.torproject.org/about/why-is-it-called-tor/ #: (content/about/why-is-it-called-tor/contents+en.lrquestion.description) msgid "(It's also got a fine meaning in German and Turkish.)" -msgstr "" +msgstr "(ha anche un bel significato in tedesco e in turco.)" #: https//support.torproject.org/about/why-is-it-called-tor/ #: (content/about/why-is-it-called-tor/contents+en.lrquestion.description)

1 0

[translation/https_everywhere] https://gitweb.torproject.org/translation.git/commit/?h=https_everywhere
by translation＠torproject.org 18 Mar '20

18 Mar '20

commit 8b8df990b9eeb9b455f4d060629ce770b866aa4f Author: Translation commit bot <translation(a)torproject.org> Date: Wed Mar 18 14:16:12 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=https_everywhere --- it/https-everywhere.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/it/https-everywhere.dtd b/it/https-everywhere.dtd index 0f84aa10e2..1c213cba66 100644 --- a/it/https-everywhere.dtd +++ b/it/https-everywhere.dtd @@ -50,7 +50,7 @@ <!ENTITY https-everywhere.cancel.http_once "Apri pagina insicura solo per questa sessione"> <!ENTITY https-everywhere.onboarding.intro "Cripta il Web! Usa HTTPS automaticamente su numerosi siti."> -<!ENTITY https-everywhere.onboarding.header "HTTPS Everywhere has been updated!"> +<!ENTITY https-everywhere.onboarding.header "HTTPS Everywhere è stato aggiornato!"> <!ENTITY https-everywhere.onboarding.details_one "Ottimizzata modalità EASE"> <!ENTITY https-everywhere.onboarding.details_two "Ora puoi mettere in whitelist siti da disattivare in HTTPS Everywhere"> <!ENTITY https-everywhere.onboarding.footer "HTTPS Everywhere è un progetto di EFF">

1 0

[translation/support-portal] https://gitweb.torproject.org/translation.git/commit/?h=support-portal
by translation＠torproject.org 18 Mar '20

18 Mar '20

commit 2bcb0e44bc5f0fce21fa2bf34d3a50f4334f67f5 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Mar 18 13:53:43 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=support-portal --- contents+it.po | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/contents+it.po b/contents+it.po index da8a12f429..d97ef3fbc7 100644 --- a/contents+it.po +++ b/contents+it.po @@ -4,7 +4,6 @@ # francesco ercolani <erco99(a)live.it>, 2019 # Hiro 7 <hiro(a)torproject.org>, 2019 # Gabriele <gabboxl0(a)gmail.com>, 2019 -# Random_R, 2019 # Fabio Ottone, 2019 # mattia_b89 <mattia.b89(a)gmail.com>, 2019 # erinm, 2019 @@ -17,6 +16,7 @@ # Emma Peel, 2020 # Davide Sant <spuuu(a)outlook.it>, 2020 # giulio marino <iulio.marino(a)gmail.com>, 2020 +# Random_R, 2020 # msgid "" msgstr "" @@ -24,7 +24,7 @@ msgstr "" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2020-02-27 18:30+CET\n" "PO-Revision-Date: 2018-10-02 22:41+0000\n" -"Last-Translator: giulio marino <iulio.marino(a)gmail.com>, 2020\n" +"Last-Translator: Random_R, 2020\n" "Language-Team: Italian (https://www.transifex.com/otf/teams/1519/it/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -133,7 +133,7 @@ msgstr "Repository Debian" #: https//support.torproject.org/rpm/ (content/rpm/contents+en.lrtopic.title) msgid "Tor rpm packages" -msgstr "" +msgstr "Pacchetti rpm di Tor" #: https//support.torproject.org/misc/glossary/ #: (content/misc/glossary/contents+en.lrquestion.description) @@ -327,6 +327,8 @@ msgid "" "Tor Browser is specifically engineered to have a nearly identical (we're not" " perfect!) fingerprint across its users." msgstr "" +"Tor Browser è progettato specificatamente per avere un'impronta quasi " +"identica (non siamo perfetti!) per tutti i suoi utenti." #: https//support.torproject.org/faq/faq-3/ #: (content/faq/faq-3/contents+en.lrquestion.description) @@ -395,6 +397,9 @@ msgid "" "[article](https://blog.torproject.org/browser-fingerprinting-introduction-" "and-challenges-ahead) on The Tor Blog all about it." msgstr "" +"Vuoi maggiori informazioni sulle impronte dei browser? Ecco un " +"[articolo](https://blog.torproject.org/browser-fingerprinting-introduction-" +"and-challenges-ahead) sul Blog di Tor dove ne parliamo." #: https//support.torproject.org/faq/faq-4/ #: (content/faq/faq-4/contents+en.lrquestion.title)

1 0

[translation/https_everywhere] https://gitweb.torproject.org/translation.git/commit/?h=https_everywhere
by translation＠torproject.org 18 Mar '20

18 Mar '20

commit b48fcb69fce3acc948b22b25119f66b67a819fca Author: Translation commit bot <translation(a)torproject.org> Date: Wed Mar 18 13:45:56 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=https_everywhere --- he/https-everywhere.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/he/https-everywhere.dtd b/he/https-everywhere.dtd index 456493777f..9750d9448b 100644 --- a/he/https-everywhere.dtd +++ b/he/https-everywhere.dtd @@ -50,7 +50,7 @@ <!ENTITY https-everywhere.cancel.http_once "פתח דף אי־מאובטח עבור שיח זה בלבד"> <!ENTITY https-everywhere.onboarding.intro "הצפן את הרשת! השתמש באבטחת HTTPS באופן אוטומטי באתרים רבים."> -<!ENTITY https-everywhere.onboarding.header "HTTPS Everywhere has been updated!"> +<!ENTITY https-everywhere.onboarding.header "HTTPS Everywhere עודכן!"> <!ENTITY https-everywhere.onboarding.details_one "מצב EASE ממוטב"> <!ENTITY https-everywhere.onboarding.details_two "אתה יכול לשים ברשימה לבנה אתרים כדי להשבית בהם את HTTPS Everywhere"> <!ENTITY https-everywhere.onboarding.footer "HTTPS Everywhere הוא מיזם של EFF">

1 0

[tor/release-0.4.2] Revise TROVE-2020-002 fix to work on older OpenSSL versions.
by nickm＠torproject.org 18 Mar '20

18 Mar '20

commit be064f77b93bda370e4165e6ad6da17324835c9e Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Mar 14 13:38:53 2020 -0400 Revise TROVE-2020-002 fix to work on older OpenSSL versions. Although OpenSSL before 1.1.1 is no longer supported, it's possible that somebody is still using it with 0.3.5, so we probably shouldn't break it with this fix. --- src/lib/crypt_ops/crypto_rsa_openssl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/lib/crypt_ops/crypto_rsa_openssl.c b/src/lib/crypt_ops/crypto_rsa_openssl.c index 022a0dc09..39b7aaf0c 100644 --- a/src/lib/crypt_ops/crypto_rsa_openssl.c +++ b/src/lib/crypt_ops/crypto_rsa_openssl.c @@ -584,7 +584,11 @@ crypto_pk_asn1_decode_private(const char *str, size_t len, int max_bits) crypto_openssl_log_errors(LOG_WARN,"decoding private key"); return NULL; } +#ifdef OPENSSL_1_1_API if (max_bits >= 0 && RSA_bits(rsa) > max_bits) { +#else + if (max_bits >= 0 && rsa->n && BN_num_bits(rsa->n) > max_bits) { +#endif log_info(LD_CRYPTO, "Private key longer than expected."); return NULL; }

1 0

[tor/release-0.4.1] Merge branch 'maint-0.4.1' into release-0.4.1
by nickm＠torproject.org 18 Mar '20

18 Mar '20

commit 9bbf8c368f0f327281322f3a070bed1e1ca77604 Merge: 1b0322bb4 4ad3f17c2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 18 08:20:16 2020 -0400 Merge branch 'maint-0.4.1' into release-0.4.1 src/lib/crypt_ops/crypto_rsa_openssl.c | 7 +++++++ 1 file changed, 7 insertions(+)

1 0

[tor/release-0.4.1] Merge branch 'maint-0.3.5' into maint-0.4.1
by nickm＠torproject.org 18 Mar '20

18 Mar '20

commit 4ad3f17c26166b898cd768a6e1835fad2ef67005 Merge: 57b1d0848 0526801ed Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 18 08:20:16 2020 -0400 Merge branch 'maint-0.3.5' into maint-0.4.1 src/lib/crypt_ops/crypto_rsa_openssl.c | 7 +++++++ 1 file changed, 7 insertions(+)

1 0

[tor/release-0.4.2] changes file for 33119 aka TROVE-2020-002
by nickm＠torproject.org 18 Mar '20

18 Mar '20

commit d0bce65ce2426793a975e691204c3fb2ac667f66 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 5 12:02:32 2020 -0500 changes file for 33119 aka TROVE-2020-002 --- changes/ticket33119 | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/changes/ticket33119 b/changes/ticket33119 new file mode 100644 index 000000000..11c20bc7a --- /dev/null +++ b/changes/ticket33119 @@ -0,0 +1,8 @@ + o Major bugfixes (security, denial-of-service): + - Fix a denial-of-service bug that could be used by anyone to consume a + bunch of CPU on any Tor relay or authority, or by directories to + consume a bunch of CPU on clients or hidden services. Because + of the potential for CPU consumption to introduce observable + timing patterns, we are treating this as a high-severity security + issue. Fixes bug 33119; bugfix on 0.2.1.5-alpha. We are also tracking + this issue as TROVE-2020-002.

1 0