[tbb-dev] [tor-dev] RFC: porting torbrowser

ng0 contact.ng0 at cryptolab.net
Tue May 2 21:21:30 UTC 2017


thanks for your reply.

Georg Koppen transcribed 7.4K bytes:
> Hi!
> ng0:
> > Hi,
> > 
> > It seems as if tbb-dev at lists.torproject.org is the list which
> > would be more appropriate.
> > If the 7 days without a reaction are simply due to the holidays in some countries,
> > it's my mistake. If you need internal discussion about this to respond
> > appropriately, let me know that you are reviewing this message at all.
> > I have no expectation for "neoliberal optimized" reply times.
> It's been taking a while but here come some comments to your mail:
> > Thanks.
> > 
> > ng0 transcribed 7.9K bytes:
> >> Hi folks,
> >>
> >> as your trademarks team / person suggested to me I get in touch with the
> >> dev team of torproject. While I'm more involved in GNUnet, I work at the
> >> intersection of projects. Currently this means I'm involved in system
> >> integration. At Guix we are interested in working closer with projects
> >> like tor, TAILS, Whonix and the like. Porting torbrowser is not only in
> >> the interest of the Guix community but also in the interest of Wonix who
> >> recently expressed interest in selectively using Guix for their work.
> >> For me as maintainer of the system (in development) pragmaOS it also
> >> means that we can decide between icecat OR torless torbrowser for
> >> proxied GNUnet connections.
> >>
> >> I'm interested in your response to the actions listed below and wether
> >> you think this will still qualify as torbrowser or what other option you
> >> propose for us at Guix to use. "Option" here means that I am not sure
> >> what other graphical theme you have for versions of the browser which do
> >> not use the trademark when they can (logically) also not use the firefox
> >> trademarks.
> >> I would reflect in the description of the package that it is not
> >> torbrowser but a reconstruction of the way torbrowser is build, tracking
> >> upstream as closely as possible while removing (list of features which
> >> were removed goes here).
> >> This can be compared to what the inoffical Gentoo maintainer does in the
> >> .ebuild file here:
> >> https://data.gpo.zugaina.org/torbrowser/www-client/torbrowser/
> Sounds good.
> >> My request here is just in the position as a contributor to Guix, not
> >> for pragmatique (the project which works on pragmaOS etc), Whonix,
> >> GNUnet or any other project I mentioned before. 
> >>
> >> Thanks in advance. Now the content I've been talking about:
> >>
> >> It looks like the changes I need to make to torbrowser are not so
> >> grave at all. Someone pointed me to the gnu-linux-libre at nongnu.org list
> >> to reach out to other FSDG systems.
> >> The thread can be reviewed here:
> >> https://lists.nongnu.org/archive/html/gnu-linux-libre/2017-03/msg00002.html
> >>
> >> Basically:
> >>
> >> I will need to discourage Mozilla leftovers:
> >> - the mozilla addon service will be overwritten, in other words:
> >>   Where you would find https://addons.mozilla.org/ at "Preferences > AddOns"
> >>   it will be replaced by the thing Icecat  points to. Longterm plan is
> >>   to offer firefox extensions native through "guix package -i
> >>   youraddonnamehere".
> >>
> >> Privacy / Tracking reasons:
> >> - Firefox "Sync" will be disabled.
> FWIW: I don't think "Sync" is working if you use Tor Browser as-is.

So it's basically a broken feature (in tor browser) and should be removed
anyway? I'm busy on other fronts currently and had no time to look into
this again. I hope to pick up work on this again in June or July depending
on how the things which keep me occupied work out.

> >> - Google will be removed from the search plugins if I understood the
> >>   procedure correctly (at least it is not in Icecat)
> >> A question directly for torbrowser team:
> >> - about:license does not list licenses the torbrowser project uses, only
> >>   firefox. Why?
> Because `about:license` is a page within the Firefox part of Tor Browser
> (originally) meant to cover exactly that part. There are other parts,
> like tor or NoScript, that come with their own licenses.
> That said there is a bug on our side to update that page
> (https://trac.torproject.org/projects/tor/ticket/14936), and we could
> think about making it the central point where we show all the licenses
> the users get with the end product.

Sounds good.

> >> DRM
> >> - Luke from parabola mentioned that drm has been enabled in recent
> >>   versions of torbrowser. This needs to be removed aswell.
> >>   https://git.parabola.nu/abslibre.git/tree/libre/iceweasel/vendor.js#n23
> >>   https://git.parabola.nu/abslibre.git/tree/libre/iceweasel/mozconfig#n39
> >>   https://gitweb.torproject.org/tor-browser.git/tree/browser/app/profile/firefox.js?h=tor-browser-45.8.0esr-7.0-1#n1511
> It seems Luke looked at the wrong file. If you are looking for
> preferences we set 000-tor-browser.js is a good starting point:
> https://gitweb.torproject.org/tor-browser.git/tree/browser/app/profile/000-tor-browser.js?h=tor-browser-45.9.0esr-6.5-1

Thanks, I'll compare with this page.

> Otherwise EME related things are disabled in our .mozconfig files in our
> tor-browser repo.
> The changes you want to make and that are outlined above should not be
> an issue for calling the thing you are working on "Tor Browser". It

That's good to know, thank you.

> would be nice if you could have a canonical URL where one can easily see
> all the changes you plan to apply (and are already applied). If there is
> such a place already could you point this list to it?

The place where the package ends up finally would be the Guix master
repository, the shared source of Guix and all system services and packages:

I will pass you the link to my work repository as soon as there as something
in a working state in the tor-browser branch in there.

Currently this non-working feature branch exists:

which is due to be converted to an mirror-only repository of:


I'll keep you in the loop.

> [snip]
> Georg

While I layed out the theory for working on a tor browser port last year,
I was asked why it wouldn't make sense to use icecat as a base. I think
with all due respects it takes to keep up with firefox/mozilla and their
speed and teamsize, they have been occasionally slow in the past.
It would be interesting to see how an alternative package of torbrowser based
on icecat works out, but so far I leave that up to my developers repository
as a would-be-could-be case to play around with (our icecat receives fast and
regular patches from upstream firefox esr, that's why it could be an option).
Your permission just was for the attempted replica of the build process of
tor browser and I only focus on that officially for Guix inclusion.

> _______________________________________________
> tbb-dev mailing list
> tbb-dev at lists.torproject.org
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tbb-dev

PGP: https://people.pragmatique.xyz/ng0/

More information about the tbb-dev mailing list