Tor Browser 4.5a5 is ready for testing
Tor Browser 4.5a5 is available at: https://people.torproject.org/~mikeperry/builds/4.5a5-build6/ This release will be the last alpha in the 4.5 series. We hope to release 4.5-stable in mid-April. Primarily, this release features improvements to the security slider to provide descriptions of the security levels and to make use of our new prefs to disable SVG and MathML. The release also features a new launcher for Linux that allows users to launch TBB from the desktop/file manager as well as from the shell (#13375), and it creates shortcuts to the desktop and start menu on Windows (#14688). It also contains code to cause all window resizes to become rounded to 200x100 multiples (#14429), and has fixes for the circuit display UI. Finally, it has code to try to avoid suddenly changing the circuit while a site is actively in use (#15482). That code in particular is in need of testing. Here is the complete changelog: * All Platforms * Update Firefox to 31.6.0esr * Update OpenSSL to 1.0.1m * Update Tor to 0.2.6.6 * Update NoScript to 2.6.9.19 * Update HTTPS-Everywhere to 5.0 * Update meek to 0.16 * Update Tor Launcher to 0.2.7.3 * Bug 13983: Directory search path fix for Tor Messanger+TorBirdy * Update Torbutton to 1.9.1.0 * Bug 9387: "Security Slider 1.0" * Include descriptions and tooltip hints for security levels * Notify users that the security slider exists * Flip slider so that "low" is on the bottom * Make use of new SVG and MathML prefs * Bug 13766: Set a 10 minute circuit lifespan for non-content requests * Bug 15460: Ensure FTP urls use content-window circuit isolation * Bug 13650: Clip initial window height to 1000px * Bug 14429: Ensure windows can only be resized to 200x100px multiples * Bug 15334: Display Cookie Protections menu if disk records are enabled * Bug 14324: Show HS circuit in Tor circuit display * Bug 15086: Handle RTL text in Tor circuit display * Bug 15085: Fix about:tor RTL text alignment problems * Bug 10216: Add a pref to disable the local tor control port test * Bug 14937: Show meek and flashproxy bridges in tor circuit display * Bugs 13891+15207: Fix exceptions/errors in circuit display with bridges * Bug 13019: Change locale hiding pref to boolean * Bug 7255: Warn users about maximizing windows * Bug 14631: Improve profile access error msgs (strings). * Pluggable Transport Dependency Updates: * Bug 15448: Use golang 1.4.2 for meek and obs4proxy * Bug 15265: Switch go.net repo to golang.org/x/net * Bug 14937: Hard-code meek and flashproxy node fingerprints * Bug 13019: Prevent Javascript from leaking system locale * Bug 10280: Improved fix to prevent loading plugins into address space * Bug 15406: Only include addons in incremental updates if they actually update * Bug 15029: Don't prompt to include missing plugins * Bug 12827: Create preference to disable SVG images (for security slider) * Bug 13548: Create preference to disable MathML (for security slider) * Bug 14631: Improve startup error messages for filesystem permissions issues * Bug 15482: Don't allow circuits to change while a site is in use * Linux * Bug 13375: Create a hybrid GUI/desktop/shell launcher wrapper * Bug 12468: Only print/write log messages if launched with --debug * Windows * Bug 3861: Begin signing Tor Browser for Windows the Windows way * Bug 15201: Disable 'runas Administrator' codepaths in updater * Bug 14688: Create shortcuts to desktop and start menu by default (optional) -- Mike Perry
Mike Perry:
Tor Browser 4.5a5 is available at: https://people.torproject.org/~mikeperry/builds/4.5a5-build6/
This release will be the last alpha in the 4.5 series. We hope to release 4.5-stable in mid-April.
This is my first look at the 4.5 series ...
Primarily, this release features improvements to the security slider to provide descriptions of the security levels and to make use of our new prefs to disable SVG and MathML.
I like the slider, but what's the rationale behind blocking JAR files? If it is to stop execution by the browser (but Java is already blocked, right?) then I would make this a default setting. I like the "new circuit for site" and "network settings" options from the onion icon.
The release also features a new launcher for Linux that allows users to launch TBB from the desktop/file manager as well as from the shell (#13375), and it creates shortcuts to the desktop and start menu on Windows (#14688).
It also contains code to cause all window resizes to become rounded to 200x100 multiples (#14429), and has fixes for the circuit display UI.
I find this somewhat annoying as I have a small screen. Is it possible to report a different size? (I think I remember a discussion that it's not simple, but though it is worth asking.)
Finally, it has code to try to avoid suddenly changing the circuit while a site is actively in use (#15482). That code in particular is in need of testing.
This is a nice feature!
* Bug 14324: Show HS circuit in Tor circuit display * Bug 15086: Handle RTL text in Tor circuit display * Bug 14937: Show meek and flashproxy bridges in tor circuit display * Bugs 13891+15207: Fix exceptions/errors in circuit display with bridges
This circuit display is excellent! I still use Vidalia from time to time, but this may be a good replacement.
* Bug 12468: Only print/write log messages if launched with --debug * Windows
--debug works well! Other regular tests all seem OK and it works with Torsocks. Nice job! -- kat
Katya Titov:
Mike Perry:
Tor Browser 4.5a5 is available at: https://people.torproject.org/~mikeperry/builds/4.5a5-build6/
This release will be the last alpha in the 4.5 series. We hope to release 4.5-stable in mid-April.
This is my first look at the 4.5 series ...
[...]
Other regular tests all seem OK and it works with Torsocks. Nice job!
Hmmm. Firefox seems to be using quite a bit of CPU. CPU usage is consistently 10-20% and there are about 100-200 more context switches per second than when using TBB 4.0.6. vmstat output attached. FF version is 31.6.0 in both, OS is Debian 7.8, processor is Intel(R) Pentium(R) CPU B950 @ 2.10GHz, system has 4GB of RAM and generally doesn't swap. Nothing else was happening on the box at the time, and stats were generated a few minutes after TBB had started in each case. I haven't used earlier versions in the 4.5 series so I can't compare this to older releases. Please let me know what other information would be helpful. -- kat
Katya Titov:
Katya Titov:
Mike Perry:
Tor Browser 4.5a5 is available at: https://people.torproject.org/~mikeperry/builds/4.5a5-build6/
This release will be the last alpha in the 4.5 series. We hope to release 4.5-stable in mid-April.
This is my first look at the 4.5 series ...
[...]
Other regular tests all seem OK and it works with Torsocks. Nice job!
Hmmm.
Firefox seems to be using quite a bit of CPU. CPU usage is consistently 10-20% and there are about 100-200 more context switches per second than when using TBB 4.0.6. vmstat output attached. FF version is 31.6.0 in both, OS is Debian 7.8, processor is Intel(R) Pentium(R) CPU B950 @ 2.10GHz, system has 4GB of RAM and generally doesn't swap.
Nothing else was happening on the box at the time, and stats were generated a few minutes after TBB had started in each case. I haven't used earlier versions in the 4.5 series so I can't compare this to older releases.
Please let me know what other information would be helpful.
This was consistently reproducible for most of the last 24 hours but has now stopped. When it stopped I noted that HTTPS-Everywhere and NoScript had been updated, and a restart confirmed the new versions (5.0.1 and 2.6.9.20 respectively). Maybe the update was the cause of the activity? Is this auto-updating of add-ons expected? -- kat
Katya Titov:
Katya Titov:
Katya Titov:
Mike Perry:
Tor Browser 4.5a5 is available at: https://people.torproject.org/~mikeperry/builds/4.5a5-build6/
This release will be the last alpha in the 4.5 series. We hope to release 4.5-stable in mid-April.
This is my first look at the 4.5 series ...
[...]
Other regular tests all seem OK and it works with Torsocks. Nice job!
Hmmm.
Firefox seems to be using quite a bit of CPU. CPU usage is consistently 10-20% and there are about 100-200 more context switches per second than when using TBB 4.0.6. vmstat output attached. FF version is 31.6.0 in both, OS is Debian 7.8, processor is Intel(R) Pentium(R) CPU B950 @ 2.10GHz, system has 4GB of RAM and generally doesn't swap.
Nothing else was happening on the box at the time, and stats were generated a few minutes after TBB had started in each case. I haven't used earlier versions in the 4.5 series so I can't compare this to older releases.
Please let me know what other information would be helpful.
This was consistently reproducible for most of the last 24 hours but has now stopped. When it stopped I noted that HTTPS-Everywhere and NoScript had been updated, and a restart confirmed the new versions (5.0.1 and 2.6.9.20 respectively). Maybe the update was the cause of the activity? Is this auto-updating of add-ons expected?
Still trying to narrow this down ... doesn't appear to be related to updates (although I'm still interested in knowing whether automatic updates are expected behaviour). When the elevated CPU usage occurs the bottom of the FF window is 'pulsing'. I can't think of another way to describe it. The effect is similar to the change in window display when the window comes into or goes out of focus, but only affects the bottom of the window and not the other sides. It is currently reproducible for me by attempting to maximise the window. It happens at other times as well, although I cannot find a consistent way to reproduce it. The effect can be stopped by changing the focus of the FF window; however, if I switch to another workspace and then back then this does not work: I then need to stop/start TBB or attempt to maximise again and change focus. I use Xfce for my Window manager (stock Debian 7.8) and typically use 'focus follows mouse'. I have changed to 'click to focus' with no change in result. I can't find any relevant logs which may indicate what the issue is. -- kat
Katya Titov:
Katya Titov:
Katya Titov:
Katya Titov:
Mike Perry:
Tor Browser 4.5a5 is available at: https://people.torproject.org/~mikeperry/builds/4.5a5-build6/
This release will be the last alpha in the 4.5 series. We hope to release 4.5-stable in mid-April.
This is my first look at the 4.5 series ...
[...]
Other regular tests all seem OK and it works with Torsocks. Nice job!
Hmmm.
Firefox seems to be using quite a bit of CPU. CPU usage is consistently 10-20% and there are about 100-200 more context switches per second than when using TBB 4.0.6. vmstat output attached. FF version is 31.6.0 in both, OS is Debian 7.8, processor is Intel(R) Pentium(R) CPU B950 @ 2.10GHz, system has 4GB of RAM and generally doesn't swap.
Thanks for the data points.
Nothing else was happening on the box at the time, and stats were generated a few minutes after TBB had started in each case. I haven't used earlier versions in the 4.5 series so I can't compare this to older releases.
Please let me know what other information would be helpful.
This was consistently reproducible for most of the last 24 hours but has now stopped. When it stopped I noted that HTTPS-Everywhere and NoScript had been updated, and a restart confirmed the new versions (5.0.1 and 2.6.9.20 respectively). Maybe the update was the cause of the activity? Is this auto-updating of add-ons expected?
Still trying to narrow this down ... doesn't appear to be related to updates (although I'm still interested in knowing whether automatic updates are expected behaviour).
Automatic updates of NoScript and HTTPS-Everywhere are still allowed, yes.
When the elevated CPU usage occurs the bottom of the FF window is 'pulsing'. I can't think of another way to describe it. The effect is similar to the change in window display when the window comes into or goes out of focus, but only affects the bottom of the window and not the other sides. It is currently reproducible for me by attempting to maximise the window. It happens at other times as well, although I cannot find a consistent way to reproduce it.
The effect can be stopped by changing the focus of the FF window; however, if I switch to another workspace and then back then this does not work: I then need to stop/start TBB or attempt to maximise again and change focus.
I use Xfce for my Window manager (stock Debian 7.8) and typically use 'focus follows mouse'. I have changed to 'click to focus' with no change in result.
I can't find any relevant logs which may indicate what the issue is.
Thanks, that's pretty helpful. The problem is the solution for bug 14429 we currently ship in 4.5a5. What you see are symptoms of the things witnessed/explained in comment 45ff. Georg
Georg Koppen:
Automatic updates of NoScript and HTTPS-Everywhere are still allowed, yes.
Good to know, thanks.
Thanks, that's pretty helpful. The problem is the solution for bug 14429 we currently ship in 4.5a5. What you see are symptoms of the things witnessed/explained in comment 45ff.
Ah yes, that matches nicely. Thanks for the pointer. -- kat
participants (3)
-
Georg Koppen -
Katya Titov -
Mike Perry