Fwd: [guardian-dev] Orfox: New Firefox-based Android Private/Secure Browser
Nice outcome from GSoC! I think the primary discussion here is whether Tor Browser's existing build system can be extended for Android, and whether "Orfox" should exist at all as separate app/project. -------- Forwarded Message -------- Subject: [guardian-dev] Orfox: New Firefox-based Android Private/Secure Browser Date: Wed, 20 Aug 2014 12:49:33 -0400 From: Nathan of Guardian <nathan@guardianproject.info> Organization: The Guardian Project To: guardian-dev <guardian-dev@lists.mayfirst.org> Based on work done this summer by Amogh Pradeep during his Google Summer of Code stint with me, we now have a real working version of Firefox/Fennec for Android with all the necessary defaults changed to match Tor Browser's defaults as closely as possible. We also remove the Android permissions for things like camera, mic, GPS and turn off webrtc. You can see the primary commits we've made here (many by me, but started successfully by Amogh): https://github.com/guardianproject/gecko-dev/commits/adaa37949dbba690ed0392c... We still need to figure out which preferences and features map between the desktop mobile browser and the Android version, so there is quite a bit of work to do. For instance, even though the preference from Tor Browser is set to start in private browsing mode, it doesn't work at all in the Android app. Also, we haven't applied any of the lower level source patches to the gecko engine yet, or included any of the default extensions like HTTPS Everywhere or NoScript. Sorting out and resolving these differences is what is on deck for this fall, and everyone is welcome to join in. In addition, the recent audit work from iSec (https://blog.torproject.org/blog/isec-partners-conducts-tor-browser-hardenin...) is also on our minds, and figuring out how we can live up to the goals of that study on a mobile device is also very important. The current build successfully passes the DNSLeakTest.com tests and passed the HTML5 video leak issue here: http://xordern.net/why-you-really-shouldn't-use-orweb-anymore.html ip-check.info still doesn't see the browser as being Tor Browser, so there are some differences yet to resolve there. The whole project is automatically building on our jenkins server, and you'll find all the links to APKs and our test build repo below. Over the next few months we hope to launch this as our new official browser for Orbot, and deprecate Orweb as quickly as possible. *** Main project repo: https://github.com/guardianproject/OrfoxFennec Our fork of Mozilla's Gecko-Dev: https://github.com/guardianproject/gecko-dev/tree/adaa37949dbba690ed0392c1fd... (which we can rebase on the original as needed) Nightly/dev builds direct APK download here: https://guardianproject.info/builds/OrfoxFennec/ OR our fdroid test build repo: https://dev.guardianproject.info/fdroid/repo?fingerprint=F8ED4C73C125E7A67F9... *** +n _______________________________________________ Guardian-dev mailing list Post: Guardian-dev@lists.mayfirst.org List info: https://lists.mayfirst.org/mailman/listinfo/guardian-dev To Unsubscribe Send email to: Guardian-dev-unsubscribe@lists.mayfirst.org Or visit: https://lists.mayfirst.org/mailman/options/guardian-dev/nathan%40guardianpro... You are subscribed as: nathan@guardianproject.info
Nathan, Great idea creating a new browser. I, for one, can't use Firefox, though I'd love to. FF eats up too much memory on my device to the point where my device becomes unusable. I'm not sure if anyone else has that experience. As an aside, I've had in mind to add features to Orweb (like very simple tabbing, bookmarks, etc.) to make it more user-friendly. On Wednesday, August 20, 2014 12:52:09 PM Nathan Freitas wrote:
Nice outcome from GSoC! I think the primary discussion here is whether Tor Browser's existing build system can be extended for Android, and whether "Orfox" should exist at all as separate app/project.
-------- Forwarded Message -------- Subject: [guardian-dev] Orfox: New Firefox-based Android Private/Secure Browser Date: Wed, 20 Aug 2014 12:49:33 -0400 From: Nathan of Guardian <nathan@guardianproject.info> Organization: The Guardian Project To: guardian-dev <guardian-dev@lists.mayfirst.org>
Based on work done this summer by Amogh Pradeep during his Google Summer of Code stint with me, we now have a real working version of Firefox/Fennec for Android with all the necessary defaults changed to match Tor Browser's defaults as closely as possible. We also remove the Android permissions for things like camera, mic, GPS and turn off webrtc.
You can see the primary commits we've made here (many by me, but started successfully by Amogh): https://github.com/guardianproject/gecko-dev/commits/adaa37949dbba690ed0392c 1fd004b006e73bfdf
We still need to figure out which preferences and features map between the desktop mobile browser and the Android version, so there is quite a bit of work to do. For instance, even though the preference from Tor Browser is set to start in private browsing mode, it doesn't work at all in the Android app. Also, we haven't applied any of the lower level source patches to the gecko engine yet, or included any of the default extensions like HTTPS Everywhere or NoScript. Sorting out and resolving these differences is what is on deck for this fall, and everyone is welcome to join in. In addition, the recent audit work from iSec (https://blog.torproject.org/blog/isec-partners-conducts-tor-browser-hardeni ng-study) is also on our minds, and figuring out how we can live up to the goals of that study on a mobile device is also very important.
The current build successfully passes the DNSLeakTest.com tests and passed the HTML5 video leak issue here: http://xordern.net/why-you-really-shouldn't-use-orweb-anymore.html ip-check.info still doesn't see the browser as being Tor Browser, so there are some differences yet to resolve there.
The whole project is automatically building on our jenkins server, and you'll find all the links to APKs and our test build repo below.
Over the next few months we hope to launch this as our new official browser for Orbot, and deprecate Orweb as quickly as possible.
*** Main project repo: https://github.com/guardianproject/OrfoxFennec
Our fork of Mozilla's Gecko-Dev: https://github.com/guardianproject/gecko-dev/tree/adaa37949dbba690ed0392c1fd 004b006e73bfdf (which we can rebase on the original as needed)
Nightly/dev builds direct APK download here: https://guardianproject.info/builds/OrfoxFennec/
OR our fdroid test build repo: https://dev.guardianproject.info/fdroid/repo?fingerprint=F8ED4C73C125E7A67F9 9DB269480DAF50BE1758952E07EE5ABF116FE4B2DB1E8
***
+n _______________________________________________ Guardian-dev mailing list
Post: Guardian-dev@lists.mayfirst.org List info: https://lists.mayfirst.org/mailman/listinfo/guardian-dev
To Unsubscribe Send email to: Guardian-dev-unsubscribe@lists.mayfirst.org Or visit: https://lists.mayfirst.org/mailman/options/guardian-dev/nathan%40guardianpro ject.info
You are subscribed as: nathan@guardianproject.info
_______________________________________________ tor-dev mailing list tor-dev@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev
On 08/20/2014 01:58 PM, Jordan wrote:
I, for one, can't use Firefox, though I'd love to. FF eats up too much memory on my device to the point where my device becomes unusable. I'm not sure if anyone else has that experience.
It is a big app, and since it doesn't rely on the built-in WebView components in Android, does take up a lot of memory. I do use it as my primary browser on my Nexus 7 and Moto E, and it seems to work fine without much hassle.
As an aside, I've had in mind to add features to Orweb (like very simple tabbing, bookmarks, etc.) to make it more user-friendly.
Ultimately, we decided that building our own browser from scratch was too much work. If you want a nice, full featured Android browser app that incorporates built-in support for Orbot and proxying, you should try Lightning: https://github.com/anthonycr/Lightning-Browser We will be deprecating Orweb in favor of Orfox and Lightning this fall. +n
Nathan, Okay, thanks. :-) I usually don't provide my input on things like this; figured that people with slow devices like mine would feel unheard. Hope I didn't sound like too much of a Negative Nancy. On Wednesday, August 20, 2014 02:06:34 PM Nathan Freitas wrote:
On 08/20/2014 01:58 PM, Jordan wrote:
I, for one, can't use Firefox, though I'd love to. FF eats up too much memory on my device to the point where my device becomes unusable. I'm not sure if anyone else has that experience.
It is a big app, and since it doesn't rely on the built-in WebView components in Android, does take up a lot of memory. I do use it as my primary browser on my Nexus 7 and Moto E, and it seems to work fine without much hassle.
As an aside, I've had in mind to add features to Orweb (like very simple tabbing, bookmarks, etc.) to make it more user-friendly.
Ultimately, we decided that building our own browser from scratch was too much work.
If you want a nice, full featured Android browser app that incorporates built-in support for Orbot and proxying, you should try Lightning: https://github.com/anthonycr/Lightning-Browser
We will be deprecating Orweb in favor of Orfox and Lightning this fall.
+n _______________________________________________ tor-dev mailing list tor-dev@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev
Nathan Freitas transcribed 3.5K bytes:
Nice outcome from GSoC! I think the primary discussion here is whether Tor Browser's existing build system can be extended for Android, and whether "Orfox" should exist at all as separate app/project.
Is there somewhere where Tor developers might track the translation between the patches on your fork of the mobile Firefox and the Tor Browser fork of Firefox? I.e. Guardian Project commits abcdef01 and abcdef02 correspond to TPO bug #1234 which maps to Mozilla bug #11223344, etc. It's a tiny bit hard to track what's going on between your merges of upstream, your student's code, your code, and what you are purporting to fix relative to what we've already fixed. I apologise for all the extra trouble this would place on you, but I think in the long run that it would make collaboration between the TB team and Guardian Project's Gecko fork easier for everyone involved.
-------- Forwarded Message -------- Subject: [guardian-dev] Orfox: New Firefox-based Android Private/Secure Browser Date: Wed, 20 Aug 2014 12:49:33 -0400 From: Nathan of Guardian <nathan@guardianproject.info> Organization: The Guardian Project To: guardian-dev <guardian-dev@lists.mayfirst.org>
Based on work done this summer by Amogh Pradeep during his Google Summer of Code stint with me, we now have a real working version of Firefox/Fennec for Android with all the necessary defaults changed to match Tor Browser's defaults as closely as possible. We also remove the Android permissions for things like camera, mic, GPS and turn off webrtc.
You can see the primary commits we've made here (many by me, but started successfully by Amogh): https://github.com/guardianproject/gecko-dev/commits/adaa37949dbba690ed0392c...
We still need to figure out which preferences and features map between the desktop mobile browser and the Android version, so there is quite a bit of work to do. For instance, even though the preference from Tor Browser is set to start in private browsing mode, it doesn't work at all in the Android app. Also, we haven't applied any of the lower level source patches to the gecko engine yet, or included any of the default extensions like HTTPS Everywhere or NoScript. Sorting out and resolving these differences is what is on deck for this fall, and everyone is welcome to join in. In addition, the recent audit work from iSec (https://blog.torproject.org/blog/isec-partners-conducts-tor-browser-hardenin...) is also on our minds, and figuring out how we can live up to the goals of that study on a mobile device is also very important.
The current build successfully passes the DNSLeakTest.com tests and passed the HTML5 video leak issue here: http://xordern.net/why-you-really-shouldn't-use-orweb-anymore.html ip-check.info still doesn't see the browser as being Tor Browser, so there are some differences yet to resolve there.
The whole project is automatically building on our jenkins server, and you'll find all the links to APKs and our test build repo below.
Over the next few months we hope to launch this as our new official browser for Orbot, and deprecate Orweb as quickly as possible.
*** Main project repo: https://github.com/guardianproject/OrfoxFennec
Our fork of Mozilla's Gecko-Dev: https://github.com/guardianproject/gecko-dev/tree/adaa37949dbba690ed0392c1fd... (which we can rebase on the original as needed)
Nightly/dev builds direct APK download here: https://guardianproject.info/builds/OrfoxFennec/
OR our fdroid test build repo: https://dev.guardianproject.info/fdroid/repo?fingerprint=F8ED4C73C125E7A67F9...
***
+n _______________________________________________ Guardian-dev mailing list
Post: Guardian-dev@lists.mayfirst.org List info: https://lists.mayfirst.org/mailman/listinfo/guardian-dev
To Unsubscribe Send email to: Guardian-dev-unsubscribe@lists.mayfirst.org Or visit: https://lists.mayfirst.org/mailman/options/guardian-dev/nathan%40guardianpro...
You are subscribed as: nathan@guardianproject.info
_______________________________________________ tor-dev mailing list tor-dev@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev
-- ♥Ⓐ isis agora lovecruft _________________________________________________________ GPG: 4096R/A3ADB67A2CDB8B35 Current Keys: https://blog.patternsinthevoid.net/isis.txt
On 08/21/2014 06:18 AM, isis wrote:
Nathan Freitas transcribed 3.5K bytes:
Nice outcome from GSoC! I think the primary discussion here is whether Tor Browser's existing build system can be extended for Android, and whether "Orfox" should exist at all as separate app/project.
Is there somewhere where Tor developers might track the translation between the patches on your fork of the mobile Firefox and the Tor Browser fork of Firefox? I.e. Guardian Project commits abcdef01 and abcdef02 correspond to TPO bug #1234 which maps to Mozilla bug #11223344, etc.
There are tickets, but not mentioned in the commits. I will backtrack and work through them and make that more clear moving forward. For now, all of our commits on the gecko-dev repo itself are in the Android Java code, and no changes have been made to any of the underlying Firefox core.
It's a tiny bit hard to track what's going on between your merges of upstream, your student's code, your code, and what you are purporting to fix relative to what we've already fixed. I apologise for all the extra trouble this would place on you, but I think in the long run that it would make collaboration between the TB team and Guardian Project's Gecko fork easier for everyone involved.
It is exactly what we need to do, and not any trouble. We quickly got to "it works!" state, but now need to transition to the long term, careful, audited approach. Thanks for the feedback.
-------- Forwarded Message -------- Subject: [guardian-dev] Orfox: New Firefox-based Android Private/Secure Browser Date: Wed, 20 Aug 2014 12:49:33 -0400 From: Nathan of Guardian <nathan@guardianproject.info> Organization: The Guardian Project To: guardian-dev <guardian-dev@lists.mayfirst.org>
Based on work done this summer by Amogh Pradeep during his Google Summer of Code stint with me, we now have a real working version of Firefox/Fennec for Android with all the necessary defaults changed to match Tor Browser's defaults as closely as possible. We also remove the Android permissions for things like camera, mic, GPS and turn off webrtc.
You can see the primary commits we've made here (many by me, but started successfully by Amogh): https://github.com/guardianproject/gecko-dev/commits/adaa37949dbba690ed0392c...
We still need to figure out which preferences and features map between the desktop mobile browser and the Android version, so there is quite a bit of work to do. For instance, even though the preference from Tor Browser is set to start in private browsing mode, it doesn't work at all in the Android app. Also, we haven't applied any of the lower level source patches to the gecko engine yet, or included any of the default extensions like HTTPS Everywhere or NoScript. Sorting out and resolving these differences is what is on deck for this fall, and everyone is welcome to join in. In addition, the recent audit work from iSec (https://blog.torproject.org/blog/isec-partners-conducts-tor-browser-hardenin...) is also on our minds, and figuring out how we can live up to the goals of that study on a mobile device is also very important.
The current build successfully passes the DNSLeakTest.com tests and passed the HTML5 video leak issue here: http://xordern.net/why-you-really-shouldn't-use-orweb-anymore.html ip-check.info still doesn't see the browser as being Tor Browser, so there are some differences yet to resolve there.
The whole project is automatically building on our jenkins server, and you'll find all the links to APKs and our test build repo below.
Over the next few months we hope to launch this as our new official browser for Orbot, and deprecate Orweb as quickly as possible.
*** Main project repo: https://github.com/guardianproject/OrfoxFennec
Our fork of Mozilla's Gecko-Dev: https://github.com/guardianproject/gecko-dev/tree/adaa37949dbba690ed0392c1fd... (which we can rebase on the original as needed)
Nightly/dev builds direct APK download here: https://guardianproject.info/builds/OrfoxFennec/
OR our fdroid test build repo: https://dev.guardianproject.info/fdroid/repo?fingerprint=F8ED4C73C125E7A67F9...
***
+n _______________________________________________ Guardian-dev mailing list
Post: Guardian-dev@lists.mayfirst.org List info: https://lists.mayfirst.org/mailman/listinfo/guardian-dev
To Unsubscribe Send email to: Guardian-dev-unsubscribe@lists.mayfirst.org Or visit: https://lists.mayfirst.org/mailman/options/guardian-dev/nathan%40guardianpro...
You are subscribed as: nathan@guardianproject.info
_______________________________________________ tor-dev mailing list tor-dev@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev
_______________________________________________ tor-dev mailing list tor-dev@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev
participants (3)
-
isis -
Jordan -
Nathan Freitas