Micah Lee:
In my spare time I've been working on a way to make the Tor Browser Bundle easier to use for GNU/Linux users. I've mostly been talking about it with other people on tor-talk and in this bug: https://trac.torproject.org/projects/tor/ticket/5236
Thanks for documenting so much on that bug!
I decided to write Tor Browser Launcher, a completely separate program that's in charge or adding a "Tor Browser" .desktop file (so you can open it from your desktop environment's menu), downloads the latest version for you, verifies it's signature (making it more secure than how much GNU/Linux users get TBB), and installs it in your home directory. I think that Tor Browser Launcher can get in Debian and Ubuntu.
Do you plan to download TBB over Tor that is provided by the system, say by adding a dependency on a system Tor?
I just finished a first version of it. The code is here: https://github.com/micahflee/torbrowser-launcher
Awesome, I've forked it and if I see anything, I'll send you a pull request.
And there are screenshots here: http://imgur.com/a/Mvpwl
These look pretty great. I'd say the wording needs a bit of work but generally, it seems reasonable. I'd suggest that if signatures don't work, I'd add a 'report' button rather than an exit button. I'd also suggest that you might want to ensure that version numbers are always increasing and other things that are outlined in the. A MITM may be able to replay an old valid signature for a package, does your code handle that case? You may enjoy the paper and code on theupdateframework.com to look into those kinds of issues...
Do you pin SSL certs? Or fetch from known mirrors? Or...? :)
You can read details about how it works on my latest comment on that bug: https://trac.torproject.org/projects/tor/ticket/5236#comment:32
Seems straight forward.
Before trying to get it in Debian I'd like to make it so it doesn't need to be updated each time TBB is updated. There are more details in the ticket, but this would require Tor to maintain a file on https://www.torproject.org/ that has the current version number of TBB in it and a timestamp, and possibly digital signature of this file too.
TBB has a version check built into it - have you seen how it works?
Do you think this is doable?
I think it is reasonable - I wonder though, can't you just fetch https://www.torproject.org/dist/torbrowser/ and parse it to look for files that match a given file pattern? As an example, https://www.torproject.org/dist/torbrowser/?C=M;O=D will sort by latest date, as will https://www.torproject.org/dist/torbrowser/linux/?C=M;O=D for GNU/Linux and so on for Mac OS X: https://www.torproject.org/dist/torbrowser/osx/?C=M;O=A
I also want to get it localized into all the languages TBB is localized into. Any thoughts or suggestions?
Once the program is structured in a way that the strings are pretty much fixed, I'd suggest Transifex: https://www.transifex.com/ as it is what Tor uses for most every translation need.
I'm off to read the code and try it out! Thanks!
All the best, Jake