On Sep 25, 2014, at 10:25 AM, Georg Koppen gk@torproject.org wrote:

Hi, Tor Browser 3.6.6 and 4.0a3 are up:

https://people.torproject.org/~mikeperry/builds/3.6.6/ https://people.torproject.org/~mikeperry/builds/4.0-alpha-3/

This release contains above all an update to Firefox ESR 24.8.1esr which fixes a critical bug in NSS. Moreover, the new Tor Browser versions contain an updated tor (0.2.4.24 and 0.2.5.8-rc respectively), other updated components and a workaround for a nasty hang on start-up reported by many users (https://bugs.torproject.org/10804). The latter is not well tested yet. If you encounter any weird behavior especially during the start-up process we'd like to hear about it.

Here are the full changelogs:

Tor Browser 4.0-alpha-3 -- Sep 24 2014

• All Platforms
• Update Tor to 0.2.5.8-rc
• Update Firefox to 24.8.1esr
• Update meek to 0.11
• Update NoScript to 2.6.8.42
• Update Torbutton to 1.6.12.3
• Bug 13091: Use "Tor Browser" everywhere
• Bug 10804: Workaround fix for some cases of startup hang
• Bug 13091: Use "Tor Browser" everywhere
• Bug 13049: Browser update failure (self.update is undefined)
• Bug 13047: Updater should not send Kernel and GTK version
• Bug 12998: Prevent intermediate certs from being written to disk
• Linux:
• Bug 9150: Make RPATH unavailable on Tor binary.
• Bug 13031: Add full RELRO protection.

Testing: TorBrowser-4.0-alpha-3-osx32_ar.dmg System: OS X 10.9.5

[Components included] Firefox: 24.8.1 (Tor Browser 4.0-alpha-3) TorButton: 1.6.12.3 NoScript: 2.6.8.42 Tor: 0.2.4.24 (git-a8a38e5dd1fbb67a) Default search engine: Startpage

[Tests] Added a bridge - OK Socks5 - OK HTML5 video playback - OK http/https/onion websites - OK Clears history/cookies/session on “New Identity” - OK Localization files present - OK

Tor Browser Bundle 3.6.6 -- Sep 24 2014

• All Platforms
• Update Tor to tor-0.2.4.24
• Update Firefox to 24.8.1esr
• Update NoScript to 2.6.8.42
• Update HTTPS Everywhere to 4.0.1
• Bug 12998: Prevent intermediate certs from being written to disk
• Update Torbutton to 1.6.12.3
• Bug 13091: Use "Tor Browser" everywhere
• Bug 10804: Workaround fix for some cases of startup hang
• Linux
• Bug 9150: Make RPATH unavailable on Tor binary.
• Bug 13031: Add full RELRO protection.

Testing: TorBrowser-3.6.6-osx32_ar.dmg System: OS X 10.9.5

[Components included] Firefox: 24.8.1 TorButton: 1.6.12.3 NoScript: 2.6.8.42 Tor: 0.2.4.24 (git-a8a38e5dd1fbb67a) Default search engine: Startpage

[Tests] Added a bridge - OK Socks5 - OK HTML5 video playback - OK http/https/onion websites - OK Clears history/cookies/session on “New Identity” - OK Localization files present - OK

I’ve noticed that there are two bridges from the provided obfs3 bridges that stopped working, maybe we should remove them instead of showing the scary yellow warning?