[tor-talk] To Toggle, or not to Toggle: The End of Torbutton

[Mike Perry]

Thus spake intrigeri (intrigeri at boum.org):

> Mike Perry wrote (11 Apr 2011 23:33:08 GMT) :
> > So can anyone bring up any specific issues that may be caused by the
> > change?
> 
> Context: Tails currently ships Debian's Iceweasel (Firefox renamed for
> trademark reasons) and Torbutton. We don't care for the toggle feature
> that is unsupported in Tails and generally confusing for Tails users.
> 
> Debian has put great efforts [0] to avoid shipping embedded code
> copies, and I quite like it from a sysadmin point-of-view, but this is
> mostly irrelevant to the current discussion *in the context of Tails*,
> so I'll try to put aside my usual rants: if there's a serious security
> bug in, say, the FreeType library, we need to release updated Tails
> images regardless of the actual technical reason (in case we go on
> shipping Debian's Iceweasel with no embedded code copies + Torbutton,
> we want to get the updated FreeType Debian package; in case we ship
> the TBB, we want to get the new binary statically linked against its
> own FreeType copy... I guess).
> 
>   [0] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=392362

I believe Erinn is making a dependency graph and intends on updating
TBB whenever one of the built-in dependencies updates in debian. I
think she even has dreams of a machine doing this for her, and kicking
off automated builds. (I hope she doesn't despise me for revealing the
secrets of her dreams.)

> If we migrate to shipping TBB, can we go on maintaining our Tails
> specific Firefox configuration delta as described above? Will the
> TBB's Firefox use the standard ways to fetch system-wide
> configuration? (I guess this should be a opt-in option, probably not
> toggle-able from the GUI, as the TBB usually wants to be as much
> independent from the host OS as possible.)

I would prefer it if we can unify our prefs.js use, but I guess you
guys may want to support more things. I think with effort you can even
get flash running safely under a default configuration...

What do you anticipate being the other substantial feature differences
that prevent you from just providing a stock TBB?

> Is it imaginable to see the new TBB make use of extensions that are
> installed system-wide? (probably opt-in as well)

Hrmm.. I don't think this will be the case... System extensions seem a
bad idea to source by default.. In fact, we should ensure we do not do
this, due to the potential to source distro branding extensions that
damage anonymity...

Can we figure out a way to come close to a common set of extensions
and configs, so the set of extensions you must add to TBB is minimal?

Do you have a list of your extensions anywhere?

> > We are collecting these issues as child tickets of this bug:
> > https://trac.torproject.org/projects/tor/ticket/2880
> 
> I'll summarize the discussion results there. In the meantime, I prefer
> using email if you don't mind.

Yeah, it may be some round trips before we figure out new tickets.

-- 
Mike Perry
Mad Computer Scientist
fscked.org evil labs
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-talk/attachments/20110412/d2f5912e/attachment.pgp>