[tor-talk] Tor Browser disabled NoScript, but can't update

[Joe]

Thanks to all & for the link.

A slight change this morning.  - that I didn't see last night (Fri
5/3/2019).
Last night I changed the about:config pref,
"xpinstall.signatures.required" to false - before I saw the post on Tor
Project's blog
https://blog.torproject.org/noscript-temporarily-disabled-tor-browser#comment-form.

Last night, the pref change & restarting TBB made no difference in NS
being disabled or in the addons manager message that the unverified
addon was disabled.

This morning - on TBB's 1st start, the addons manager allowed *NS to
load* normally & the message now says: "NoScript could not be verified
for use in Tor Browser.  Proceed with caution."

Guessing Mozilla made a change so when Firefox contacts their addons
server, it doesn't disable addons - just shows a different warning?

The newest "Proceed with Caution" warning will likely confuse or concern
many.
If it's a hard coded message, there may be no alternative. Otherwise,
"better" wording could be used.

Would it be possible when TBB automatically or manually checks for a
newer TBB version, to temporarily show a short explanation & a link to a
Tor Project page for some explanation?

Is HTTPS Everywhere (in TBB) not signed by Mozilla - rather by Tor
Project, thus no warning about it in the addons manager?

On 5/4/19 8:30 AM, Georg Koppen wrote:
> Mirimir:
>> On 05/04/2019 12:21 AM, Joe wrote:
>>> I've used the latest stable TBB 8.0.8 (Linux) since released with the
>>> latest NoScript (at that time).
>>> Today is the 1st day I saw that NoScript was disabled by TBB.
>>>
>>> I see now that it's not a TBB only issue, but also Firefox.
>>> A comment on Reddit said, "They [Mozilla] let their add-on signing
>>> certificate expire and it invalidated a shitload of add-ons."
>>>
>>> I assume it expired today?  When TBB & Fx checked for addon versions, it
>>> saw the expired signing certificate.
>>> There is a script listed on Reddit that supposedly will re-enable the
>>> addons, but until Mozilla fixes the signing certificate bug, they said
>>> the script would need running every 24 hrs.
>> See https://trac.torproject.org/projects/tor/ticket/30388 for temporary fix.
> In addition to that: We plan to ship an updated Tor Browser as soon as
> Mozilla has fixed the bug on their side. I expect Mozilla to be ready
> later today so that we might be able to get a new Tor Browser out
> tomorrow, or latest, Monday morning EU time. Sorry for the inconvenience.
>
> Georg
>
>