[tor-reports] November 2014 Report for the Tor Browser Team

[Mike Perry]

In November, the Tor Browser team released 4.5-alpha-1[1].

This release features a circuit status reporting UI[2] (visible on the
green Tor onion button menu), as well as isolation for circuit use[3].
All content elements for a website will use a single circuit, and
different websites should use different circuits, even when viewed at
the same time. The Security Slider[4] is also present in this release,
and can be configured from the green Tor onion's Preferences menu, under
the Privacy and Security settings tab. It also features HTTPS
certificate pinning for selected sites (including our updater), which
was backported from Firefox 32[5].

This release also features a rewrite of the obfs3 pluggable transport,
and the introduction of the new obfs4 transport[6]. We also fixed a
locale fingerprinting issues[7], a couple compilation-related Windows
crash bugs[8,9], a Windows XP updater failure[10], a third party cache
isolation regression[11], and updated the included Tor client to
0.2.6.1-alpha.

As part of our planned end-of-life for supporting 32 bit Macs[12], the
Mac edition of this release is 64 bit only, which also means that the
updater will not work for Mac users on the alpha series release channel
for this release.  Once you transition to this 64 bit release, the
updater should function correctly after that.

We briefly investigated an auto-rebase script to attempt to
automatically re-apply our patches on to the latest Firefox so that we
might keep up with running our unit tests on new code[13,14], but this
ended up generating a large number of broken patches[15].

Towards the end of the month, we prepared 4.0.2 based on the latest
point release in the Firefox 31 ESR series. We also made some progress
on more work for 4.5-alpha, including improving the circuit UI[16,17],
and implementing update signing[18]. We hope that most of these fixes
will make it into 4.5-alpha-2 in early December. And if not, then
4.5-alpha-3.

The full list of tickets closed by the Tor Browser team in September can
be seen using the TorBrowserTeam201411 tag on our bug tracker[19]. This
list is a bit sparse because of the large volume of patches waiting for
review to be merged in the next 4.5-alpha series.


Next month, we will continue to stabilize 4.5-alpha. We're already aware
of a the previously mentioned issues with the Circuit Status UI, and
with the Security Slider, and we're very excited to get fully signed MAR
updates supported, too. There probably will be a few more surprises
along the way.

The full list of tickets that the Tor Browser team plans to work on in
December can be seen using the TorBrowserTeam201412 tag on our bug
tracker[20].


1. https://blog.torproject.org/blog/tor-browser-45-alpha-1-released
2. https://trac.torproject.org/projects/tor/ticket/8641
3. https://trac.torproject.org/projects/tor/ticket/5752
4. https://trac.torproject.org/projects/tor/ticket/9387
5. https://trac.torproject.org/projects/tor/ticket/11955
6. https://trac.torproject.org/projects/tor/ticket/12903
7. https://trac.torproject.org/projects/tor/ticket/13019
8. https://trac.torproject.org/projects/tor/ticket/13443
9. https://trac.torproject.org/projects/tor/ticket/13558
10. https://trac.torproject.org/projects/tor/ticket/13594
11. https://trac.torproject.org/projects/tor/ticket/13742
12. https://blog.torproject.org/blog/end-life-plan-tor-browser-32-bit-macs
13. https://trac.torproject.org/projects/tor/ticket/13675
14. https://lists.torproject.org/pipermail/tbb-dev/2014-November/000169.html
15. https://people.torproject.org/~boklm/tmp/tests/r/S2kNQApISx/browser-rebase.html
16. https://trac.torproject.org/projects/tor/ticket/13671
17. https://trac.torproject.org/projects/tor/ticket/13672
18. https://trac.torproject.org/projects/tor/ticket/13379
19. https://trac.torproject.org/projects/tor/query?status=closed&keywords=~TorBrowserTeam201411
20. https://trac.torproject.org/projects/tor/query?keywords=~TorBrowserTeam201412

-- 
Mike Perry
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: Digital signature
URL: <http://lists.torproject.org/pipermail/tor-reports/attachments/20141202/db72f4f5/attachment.sig>