[tor-bugs] #3994 [Tor bundles/installation]: Get TorBrowser in Debian

[Tor Bug Tracker & Wiki]

#3994: Get TorBrowser in Debian
--------------------------------------+-------------------------------------
 Reporter:  lunar                     |          Owner:          
     Type:  task                      |         Status:  assigned
 Priority:  normal                    |      Milestone:          
Component:  Tor bundles/installation  |        Version:          
 Keywords:                            |         Parent:          
   Points:                            |   Actualpoints:          
--------------------------------------+-------------------------------------

Comment(by tux):

 Replying to [comment:13 proper]:
 > Why so complicated? Why do you want to go through the hassle, getting
 Tor Browser into Debian?
 >

 Because of the same reasons you'd usually want to use the native
 repository and bug tracker of a distro for most applications.

 > Getting Tor Browser into the Tor repository, should be an easier, more
 realistic task, which could be done in near future? I think it's also
 required preparation for Thandy. Tor/Vidalia/etc. are already in the Tor
 repository. I don't understand, why you want to go a special way for Tor
 Browser.
 >
 > Leaving the distro packaging to the distros. They can pick it up, once
 it's in the Tor repository. If Debian wants it, they have to get
 interested themselves.
 >
 > I also believe, that the following statement is true.
 >
 > Replying to [comment:6 cypherpunks]:
 > > One problem I can foresee with the idea of packaging TorBrowser for
 Debian is that the packaging of Firefox/Iceweasel usually lags behind
 upstream by several version numbers. This is particularly true of Debian
 stable. [snip, see above...]

 Hmm, maybe because of that it might make sense to try to get the patches
 of the TorBrowser upstream (I count 26 patches in src/current-patches/)?
 So that an 'iceweasel-tor' package could actually just provide a wrapper
 script, with no need for a modified Firefox/Iceweasel binary (which is
 probably easier said than done :), I obviously have no clue of the
 TorBrowser internals). This should greatly reduce long term maintance
 costs for an iceweasel-tor Debian package, shouldn't it?

 Also another stupid question: I'm one of the Debian users who'd run a
 Debian iceweasel-tor next to a non-tor iceweasel. For the use-cases I'd
 have for the iceweasel-tor, I think I could live with an immutable,
 default profile. Actually, I think I'd feel much safer on a non-live-CD
 OS, if the Iceweasel profile for the Tor version were immutable (don't
 know if that makes sense). An immutable default profile should postpone
 the problems mentioned by lunar for now, right? It should postpone the
 need for a 'configuration-update tool for Firefox profiles' as rransom
 mentioned, shouldn't it?

 Hmm, for the javascript/css/html support probing attack mentioned by
 cypherpunks, I guess an option to disable some of them in iceweasel would
 be needed, to unify iceweasel-tor fingerprint?

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/3994#comment:14>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online