tbb-dev

tbb-dev@lists.torproject.org

447 discussions

Tor Browser release schedule in July
by anonym 19 Jun '24

19 Jun '24

Hi! As you know the Tails releases are timed according to the Tor Browser release schedule, so we are unsure what's gonna happen in July (and later) since there are no more releases listed in the release schedule [0]. There is the Firefox 128/115.13esr/128.0esr release on July 9 [1], which I normally would assume is when you too would release, but I wonder if you perhaps will postpone due to the project-wide early July vacation? What are your plans? Cheers! [0] https://nc.torproject.net/apps/calendar/p/Dy5spytzmYoJPieT [1] https://calendar.google.com/calendar/embed?src=mozilla.com_2d37383433353432…

1 0

I2P Request Supply Statement
by Supply Account 22 Apr '24

22 Apr '24

It is requested that the relevant facts in the following web link be added to Tor Browser. https://geti2p.net/en/about/browser-config#firefox Preferences => Network Proxy => Settings => Connection Settings => Manual proxy configuration about:config => media.peerConnection.ice.proxy_only

2 1

Tor Browser mistakes clearnet web addresses for localhost or Hidden services
by Richard 13 Jul '23

13 Jul '23

Hello, I want to report this bug. My OS - Kicksecure, based on Debian. https://www.kicksecure.com/ Tor Browser version - 12.0.1 Security level - safer Steps for reproduction - copy and paste any websearch request to search bar, click on Startpage icon in the search bar menu, then https://localhost/ appears in the search bar as if Tor Browser tried to contact localhost instead of startpage. The issue may not be readily reproduced 100% of all the times, it comes up very rarely when I do some web search. This all can happen if I use either a custom search engine for a single websearch request or with default search engine. This is metager onion link for me. Note that Tor Browser may sometimes mistake clearnet link for a hidden service instead of localhost. In such case it would only display a standard built-in page that says hidden service with such name is not found. Logs: TorSettings: loadFromPrefs() TorSettings.jsm:329:15 TorConnect: init() TorConnect.jsm:836:15 TorConnect: Entering Initial state TorConnect.jsm:204:13 TorConnect: Observing topic 'TorProcessExited' TorConnect.jsm:845:19 TorConnect: Observing topic 'TorLogHasWarnOrErr' TorConnect.jsm:845:19 TorConnect: Observing topic 'torsettings:ready' TorConnect.jsm:845:19 TorConnect: Will load after bootstrap => [about:tor] TorConnect.jsm:1070:15 TorSettings: Observed TorProcessIsReady TorSettings.jsm:309:15 TorSettings: applySettings() TorSettings.jsm:512:15 TorSettings: Ready TorSettings.jsm:315:17 TorConnect: Observed torsettings:ready TorConnect.jsm:856:15 TorConnect: Try transitioning from Initial to Bootstrapping TorConnect.jsm:805:15 TorConnect: Exited Initial state TorConnect.jsm:209:15 TorConnect: Entering Bootstrapping state TorConnect.jsm:204:13 TorConnect: Bootstrapping 0% complete (Starting) TorConnect.jsm:821:15 TorConnect: Bootstrapping 1% complete (Connecting to bridge) TorConnect.jsm:821:15 TorConnect: Bootstrapping 2% complete (Connected to bridge) TorConnect.jsm:821:15 TorConnect: Bootstrapping 10% complete (Connected to a Tor relay) TorConnect.jsm:821:15 TorConnect: Bootstrapping 14% complete (Negotiating with a Tor relay) TorConnect.jsm:821:15 TorConnect: Bootstrapping 15% complete (Finished negotiating with a Tor relay) TorConnect.jsm:821:15 TorConnect: Bootstrapping 75% complete (Finished loading relay information) TorConnect.jsm:821:15 TorConnect: Bootstrapping 95% complete (Building circuits: Establishing a Tor circuit) TorConnect.jsm:821:15 TorConnect: Bootstrapping 100% complete (Connected to the Tor network!) TorConnect.jsm:821:15 TorConnect: Try transitioning from Bootstrapping to Bootstrapped TorConnect.jsm:805:15 TorConnect: Exited Bootstrapping state TorConnect.jsm:209:15 TorConnect: Entering Bootstrapped state TorConnect.jsm:204:13 TorConnect: Observed TorLogHasWarnOrErr TorConnect.jsm:856:15 [01-05 12:04:57] Torbutton NOTE: no SOCKS credentials found for current document. [01-05 12:07:36] Torbutton NOTE: no SOCKS credentials found for current document. TorConnect: Observed TorLogHasWarnOrErr TorConnect.jsm:856:15 [01-05 12:08:03] Torbutton NOTE: no SOCKS credentials found for current document. [01-05 12:08:38] Torbutton NOTE: no SOCKS credentials found for current document. [01-05 12:08:39] Torbutton NOTE: no SOCKS credentials found for current document. 2 [01-05 12:08:41] Torbutton NOTE: no SOCKS credentials found for current document. [01-05 12:08:43] Torbutton NOTE: no SOCKS credentials found for current document. 2 [01-05 12:08:47] Torbutton NOTE: no SOCKS credentials found for current document. 3 [01-05 12:09:12] Torbutton NOTE: no SOCKS credentials found for current document. [01-05 12:09:18] Torbutton NOTE: no SOCKS credentials found for current document. 2 [01-05 12:09:27] Torbutton NOTE: no SOCKS credentials found for current document. 2 [01-05 12:09:33] Torbutton NOTE: no SOCKS credentials found for current document. 2 [01-05 12:10:37] Torbutton NOTE: no SOCKS credentials found for current document. Screenshot is attached to this message

1 0

Establishing RFP behavior norms
by Tom Ritter 26 May '23

26 May '23

While reviewing a patch today I came across the exact situation that I sketched out https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/wikis/RFP… for, and I'd like to try to establish a consensus around it as we start landing more RFPTarget patches. This way I'm not going off an affecting the behavior of Tor Browser without getting input from you =) Below follows a summary of the wiki page. Several of these are not how things are implemented today (usually things are implemented to be more conservative, and I am proposing relaxing things in some instances.) Most of these are independent of each other, so hopefully they can be individually LGTM-ed or debated. 1) RFP does not override granted Site Permissions. A user has proactively granted a permission, through the browser UI to do something. Respect it. In TBB these don't persist anyway. 2) RFP does NOT override a per-site setting (other than a permission) that the user has set. (e.g. Zoom Level) I can only think of Zoom level for this one - but if there's some other per-site setting the user can set, proactively, respect it. Again, in TBB these don't persist. (Right now I think we do override site specific zoom...) 3) RFP _does_ override changes in the Browser Settings page. We probably won't go through and meticulously try to address every one of these, but when the situation comes up, we will override these settings. For example, a default zoom level for all pages. Although I have to say, the more I think about this one... I'm not so convinced. There are a medium amount of these (I counted: Default Zoom, DNT, Colors, Fonts, Font Size, Language, Smooth Scrolling, Autoscrolling (not even sure what that is), pop-up blocking) and most of those are accessibility related. Maybe we shouldn't override them. (Or in an ideal world, we warn the user before they change them, but allow them to do so.) 4) RFP does NOT override prefs on about:config Practically, we'll never find and address all of these. So should we try to do any? The User Agent override one is something that users have asked for for the longest time and we always said no. Are there some we want to override because they're so much more common; but not override by default? 5) If you've enabled RFP, using the ETP toggle will NOT exempt you from RFP. (Only from FPP) Maybe someday it will, but for now, while this is being developed, this feels like a footgun. So I've implemented it as not applying to RFP. (Although it hasn't landed.) In Tor Browser, the ETP toggle isn't even available/visible so it doesn't matter too much... X) The ETP toggle that exempts you from FPP propagates to all subframes. Sorry, this one is how Firefox intends to implement it. I'm putting it here to contrast with... 6) The exemptedDomains pref (aka the other exemption technique besides the ETP toggle) does NOT propagate to subframes This is the more conservative behavior. So that's how I've designed and implemented it. Maybe we don't want to do that in the long run, but for now, I think it's better to be conservative. 7) An individual RFP behavior (like timer precision) can typically be exempted on a page. The exceptions are behaviors that affect the user's interaction with the entire browser. For example in Bug 1832598 we discuss smooth scrolling, and apply the behavior globally so users have a consistent scrolling experience. 8) We're punting on DevTools Sometimes its exempted, sometimes its not, sometimes its System Principal, sometimes its not. Untangling this mess isn't a priority right now. -tom

1 0

Last changes pushed to tor-browser-build.git will require rebuilding everything
by Nicolas Vigier 09 Dec '22

09 Dec '22

Hello, The MR tor-browser-build!579 has just been merged to main and maint-12.0. It includes some changes that will cause everything to be rebuilt, so if you have been building tor-browser before and are not planning to rebuild old versions (or branches based on old commits), it is a good time to remove the `out` directory as most files in there are not going to be used for new builds. Nicolas

1 0

Data Leak: Disable old, unencrypted OCSP verification in TBB.
by elise.toradin＠web.de 23 Aug '22

23 Aug '22

2 3

Re: [tbb-dev] [tor-qa] Tor Browser 11.5.1 (Windows/macOS/Linux) is ready for testing
by intrigeri 26 Jul '22

26 Jul '22

Hi, Pier Angelo Vendrame (2022-07-22): > Tor Browser 11.5.1 candidate packages are available here: Wow, already, thanks! This is quite early compared to what I understand in the Tor Browser release calendar, where the rebase is scheduled for August 2, so I'm wondering: is the 11.5.1 desktop release still planned for August 9? Thanks in advance, cheers!

3 5

11.0.14 release timing
by intrigeri 30 May '22

30 May '22

Hi, Do you have a rough ETA for 11.0.14 x86_64 tarballs that we could start integrating into Tails? Why I'm asking: - tpo/applications/tor-browser-build#40505 and the tor-browser-build Git repo suggest to me that the release prep' work was not started yet. Correct? - I know that today is a holiday at Tor project. Enjoy :) Cheers!

2 2

new tor-browser development IRC channel
by Richard Pospesel 11 Apr '22

11 Apr '22

Hey Everyone, We've created a new channel ( #tor-browser-dev ) on OFTC. We basically intend this channel to be a spillover/containment zone for the browser devs so we don't fill up #tor-dev with browser chat and not let anyone else get a word in about all the other cool stuff going on. Feel free to swing by! best, -Richard

1 0

Documenting best practices for P2P Sybil avoidance over Tor
by Jeremy Rand 28 Feb '22

28 Feb '22

Hi Applications Team! I would like to propose the following addendum to the SOCKS username section of the Tor-Friendly Applications Best Practices: "If your application needs to open a small number of connections (e.g. 10 long-lived connections) to a P2P network, and you want to prevent Sybil attacks, you should seriously consider using a unique SOCKS5 username per connection (e.g. by including a new randomly generated string in the username each time a connection is opened), which will minimize the chance of a malicious exit relay interfering with your view of the P2P network. For example, Bitcoin Core does this. On the other hand, if your application intends to open a very large number of connections, you should probably not do this, as it will put too much load on the Tor network. For example, Bitcoin DNS seeders should not do this while spidering P2P nodes." I think this is probably uncontroversial advice within the Tor community (I think the Tor devs are aware of Bitcoin Core's behavior and haven't asked the Bitcoin Core team to change it), but it is not necessarily obvious to application developers who may be unfamiliar with Tor, so I think it's worth documenting. Please let me know if this text is okay to add (or if there's anything that can be improved); I don't want to step on toes by adding this without consulting anyone. Cheers, -- -Jeremy Rand Lead Application Engineer at Namecoin Mobile email: jeremyrandmobile(a)airmail.cc Mobile OpenPGP: 2158 0643 C13B B40F B0FD 5854 B007 A32D AB44 3D9C Send non-security-critical things to my Mobile with OpenPGP. Please don't send me unencrypted messages. My business email jeremy(a)veclabs.net is having technical issues at the moment.

2 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

tbb-dev