Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Browser disabled NoScript, but can't update

lists.torproject.org

Post reply on HN
Print view View original

21–30 of 125 posts

Re: Tor Browser disabled NoScript, but can't update

#21

Post by deogeo »

rightbyte wrote: post #20
javagram wrote: post #16

Earlier quoted context omitted.

FWIW, since the original intent of the change to block unsigned plugins was to prevent third party software installers from adding malicious plugins without user consent, leaving a preference to toggle it back would have been pretty pointless as the third party installers could have just toggled the preference themselves (about:config is just some sort of easily modifiable data format on disk). TBH it’s not hard for…

If the malicious plugin or executable can write to disk it's probably to late anyway?

Yeah, it could replace Firefox with the developer edition that allows unsigned plugins.

Re: Tor Browser disabled NoScript, but can't update

#22

Post by Jonnax »

rightbyte wrote: post #20
javagram wrote: post #16

Earlier quoted context omitted.

FWIW, since the original intent of the change to block unsigned plugins was to prevent third party software installers from adding malicious plugins without user consent, leaving a preference to toggle it back would have been pretty pointless as the third party installers could have just toggled the preference themselves (about:config is just some sort of easily modifiable data format on disk). TBH it’s not hard for…

If the malicious plugin or executable can write to disk it's probably to late anyway?

It was a significant issue for years. Mostly adware and things that replaced your default search engine.

Re: Tor Browser disabled NoScript, but can't update

#23

Post by tgtweak »

Waterluvian wrote: post #5

Somewhat related to this ongoing Mozilla plugin saga, are there any infamous stories I should look up that involve huge mistakes leading to unfixable clients? Ie. Imagine bricking your customer's devices with an irreversible buggy update. In Mozilla's case they were able to deploy a hotfix for many, and an update for others. But I imagine there's got to be some great stories about completely bricking countless device…

It's one of my favorite interview questions. I only know the answer because it happened to us once with 5M users on the affected version before it was discovered. It's a very good question to see how people react in a mostly hopeless situation. The only candidate out of 100s to logically get to the solution (or essentially it) was one of the best engineesr I've hired and worked with.

"So you and your team just released a tested and reviewed build, did gradual rollout and numbers looked good - so out to general public it goes. All clients update over the following days. QA discovers, upon testing the next release, a latent bug that prevents the current version from connecting to the update service and running the updater. How do you resolve this?"

Re: Tor Browser disabled NoScript, but can't update

#24

Post by Jonnax »

Causality1 wrote: post #6

I can't improve upon this comment: "Hey Mozilla - this is why people said that forcing addons to be signed with no way to disable was a bad idea. You didn't even make it a year without screwing it up. Who could have seen this coming? Oh wait, pretty much everyone who argued against this policy."

It's a dumb comment. There was a ton of malware being distributed as add-ons that came packaged with other installers.

This solved that issue.

Re: Tor Browser disabled NoScript, but can't update

#25

Post by super_mario »

Svperstar wrote: post #8

I don't buy for 5 minutes that Tor Browser is secure regardless of configuration. TAILS maybe but Tor Browser you may as well let an FBI agent into your house. A few years back the government starts busting all these dark web sites/users and will pull out of court cases rather then explain how. Gee I wonder.

Tor project is US government op, true. It's good at hiding government employees using untrusted networks from hostile third parties. It is also good for foreign whistleblowers releasing data to US government.

Tor is NOT good at keeping you private from government. It is good at keeping you private from your ISP or employer however.

Don't do anything illegal using tor and thinking you are safe.

Re: Tor Browser disabled NoScript, but can't update

#26

Post by willj »

tgtweak wrote: post #23
Waterluvian wrote: post #5

Somewhat related to this ongoing Mozilla plugin saga, are there any infamous stories I should look up that involve huge mistakes leading to unfixable clients? Ie. Imagine bricking your customer's devices with an irreversible buggy update. In Mozilla's case they were able to deploy a hotfix for many, and an update for others. But I imagine there's got to be some great stories about completely bricking countless device…

It's one of my favorite interview questions. I only know the answer because it happened to us once with 5M users on the affected version before it was discovered. It's a very good question to see how people react in a mostly hopeless situation. The only candidate out of 100s to logically get to the solution (or essentially it) was one of the best engineesr I've hired and worked with. "So you and your team just releas…

I'm super interested to know the answer to this question. I imagine it's more interesting than just uninstall/reinstall.

Re: Tor Browser disabled NoScript, but can't update

#27

Post by ishitatsuyuki »

javagram wrote: post #17
baku-fr wrote: post #12

Earlier quoted context omitted.

I did exactly that, it worked on Debian however not on Windows: 1. Type about:config in URL bar 2. Change xpinstall.signatures.required from true to false 3. Restart Firefox

Debian modifies Firefox builds to set a build flag to allow this preference to work, I believe? The default Windows and Mac builds of Firefox ignore this preference.

It's the opposite: builds compiled from the source allows changing the flag, those builds from Mozilla have the option disabled.

Re: Tor Browser disabled NoScript, but can't update

#28

Post by xfitm3 »

tgtweak wrote: post #23
Waterluvian wrote: post #5

Somewhat related to this ongoing Mozilla plugin saga, are there any infamous stories I should look up that involve huge mistakes leading to unfixable clients? Ie. Imagine bricking your customer's devices with an irreversible buggy update. In Mozilla's case they were able to deploy a hotfix for many, and an update for others. But I imagine there's got to be some great stories about completely bricking countless device…

It's one of my favorite interview questions. I only know the answer because it happened to us once with 5M users on the affected version before it was discovered. It's a very good question to see how people react in a mostly hopeless situation. The only candidate out of 100s to logically get to the solution (or essentially it) was one of the best engineesr I've hired and worked with. "So you and your team just releas…

I’d love to hear how this was resolved.

Re: Tor Browser disabled NoScript, but can't update

#29

Post by tass »

Waterluvian wrote: post #5

Somewhat related to this ongoing Mozilla plugin saga, are there any infamous stories I should look up that involve huge mistakes leading to unfixable clients? Ie. Imagine bricking your customer's devices with an irreversible buggy update. In Mozilla's case they were able to deploy a hotfix for many, and an update for others. But I imagine there's got to be some great stories about completely bricking countless device…

Not an update, but expired certificate on Wink hubs:

http://status.winkapp.com/incidents/4c47cdvgl6b4

Re: Tor Browser disabled NoScript, but can't update

#30

Post by antt »

Jonnax wrote: post #24
Causality1 wrote: post #6

I can't improve upon this comment: "Hey Mozilla - this is why people said that forcing addons to be signed with no way to disable was a bad idea. You didn't even make it a year without screwing it up. Who could have seen this coming? Oh wait, pretty much everyone who argued against this policy."

It's a dumb comment. There was a ton of malware being distributed as add-ons that came packaged with other installers. This solved that issue.

Burning down London stopped the plague too.
Post reply on HN