Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Browser disabled NoScript, but can't update

lists.torproject.org

Post reply on HN
Print view View original

11–20 of 125 posts

Re: Tor Browser disabled NoScript, but can't update

#11

Post by eternalban »

quotz wrote: post #3

Has anyone read the article explaining Tor is a government honeypot? Its all funded by gov money

The user needs to keep in mind the goals for the development of this software, originally developed by US military.

It has an asymmetric architecture biased for a 'home network' infiltrating a 'hostile network'. So Tor is perfect for military intelligence officers working from a 'safe network' (one that doesn't zero in [on] Tor protocol beacons) to pop up in some other network and do their job.

Re: Tor Browser disabled NoScript, but can't update

#12

Post by baku-fr »

deogeo wrote: post #2

If Mozilla hadn't locked down Firefox so much, the fix could have been as simple as going into about:config and flipping a switch to allow unsigned plugins.

I did exactly that, it worked on Debian however not on Windows:

1. Type about:config in URL bar

2. Change xpinstall.signatures.required from true to false

3. Restart Firefox

Re: Tor Browser disabled NoScript, but can't update

#14

Post by theclaw »

Waterluvian wrote: post #5

Somewhat related to this ongoing Mozilla plugin saga, are there any infamous stories I should look up that involve huge mistakes leading to unfixable clients? Ie. Imagine bricking your customer's devices with an irreversible buggy update. In Mozilla's case they were able to deploy a hotfix for many, and an update for others. But I imagine there's got to be some great stories about completely bricking countless device…

Two immediately spring to mind, Oculus in 2018 [0] and Zune in 2008 [1]

[0] https://www.neowin.net/news/every-oculus-rift-vr-headset-bri...

[1] https://gizmodo.com/30gb-zunes-failing-everywhere-all-at-onc...

Re: Tor Browser disabled NoScript, but can't update

#15

Post by gpm »

makomk wrote: post #10
deogeo wrote: post #2

If Mozilla hadn't locked down Firefox so much, the fix could have been as simple as going into about:config and flipping a switch to allow unsigned plugins.

Apparently the switch to enable unsigned plugins does work in Tor Browser still - it just doesn't re-enable plugins that failed the signature check because the failure is cached somehow.

Set `app.update.lastUpdateTime.xpi-signature-verification` to 0 and restart the browser to refresh the cache (on normal firefox).

Re: Tor Browser disabled NoScript, but can't update

#16

Post by javagram »

deogeo wrote: post #2

If Mozilla hadn't locked down Firefox so much, the fix could have been as simple as going into about:config and flipping a switch to allow unsigned plugins.

FWIW, since the original intent of the change to block unsigned plugins was to prevent third party software installers from adding malicious plugins without user consent, leaving a preference to toggle it back would have been pretty pointless as the third party installers could have just toggled the preference themselves (about:config is just some sort of easily modifiable data format on disk).

TBH it’s not hard for me to think of ways Mozilla could have preserved user control even in the face of these constraints though. For instance, I already use a master password to encrypt/decrypt the password database in Firefox. Why not allow the master password to also protect the settings and store them encrypted so a third party can’t modify them?

Re: Tor Browser disabled NoScript, but can't update

#17

Post by javagram »

baku-fr wrote: post #12
deogeo wrote: post #2

If Mozilla hadn't locked down Firefox so much, the fix could have been as simple as going into about:config and flipping a switch to allow unsigned plugins.

I did exactly that, it worked on Debian however not on Windows: 1. Type about:config in URL bar 2. Change xpinstall.signatures.required from true to false 3. Restart Firefox

Debian modifies Firefox builds to set a build flag to allow this preference to work, I believe? The default Windows and Mac builds of Firefox ignore this preference.

Re: Tor Browser disabled NoScript, but can't update

#18

Post by [deleted] »

theclaw wrote: post #14
Waterluvian wrote: post #5

Somewhat related to this ongoing Mozilla plugin saga, are there any infamous stories I should look up that involve huge mistakes leading to unfixable clients? Ie. Imagine bricking your customer's devices with an irreversible buggy update. In Mozilla's case they were able to deploy a hotfix for many, and an update for others. But I imagine there's got to be some great stories about completely bricking countless device…

Two immediately spring to mind, Oculus in 2018 [0] and Zune in 2008 [1] [0] https://www.neowin.net/news/every-oculus-rift-vr-headset-bri... [1] https://gizmodo.com/30gb-zunes-failing-everywhere-all-at-onc...

[deleted]

Re: Tor Browser disabled NoScript, but can't update

#19

Post by mraison »

Waterluvian wrote: post #5

Somewhat related to this ongoing Mozilla plugin saga, are there any infamous stories I should look up that involve huge mistakes leading to unfixable clients? Ie. Imagine bricking your customer's devices with an irreversible buggy update. In Mozilla's case they were able to deploy a hotfix for many, and an update for others. But I imagine there's got to be some great stories about completely bricking countless device…

“My left shoe won’t even reboot”

https://arstechnica.com/gadgets/2019/02/my-left-shoe-wont-ev...

I don’t know if they found a fix in the end

Re: Tor Browser disabled NoScript, but can't update

#20

Post by rightbyte »

javagram wrote: post #16
deogeo wrote: post #2

If Mozilla hadn't locked down Firefox so much, the fix could have been as simple as going into about:config and flipping a switch to allow unsigned plugins.

FWIW, since the original intent of the change to block unsigned plugins was to prevent third party software installers from adding malicious plugins without user consent, leaving a preference to toggle it back would have been pretty pointless as the third party installers could have just toggled the preference themselves (about:config is just some sort of easily modifiable data format on disk). TBH it’s not hard for…

If the malicious plugin or executable can write to disk it's probably to late anyway?
Post reply on HN