Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Browser disabled NoScript, but can't update

lists.torproject.org

Post reply on HN
Print view View original

31–40 of 125 posts

Re: Tor Browser disabled NoScript, but can't update

#31

Post by dhimes »

tgtweak wrote: post #23
Waterluvian wrote: post #5

Somewhat related to this ongoing Mozilla plugin saga, are there any infamous stories I should look up that involve huge mistakes leading to unfixable clients? Ie. Imagine bricking your customer's devices with an irreversible buggy update. In Mozilla's case they were able to deploy a hotfix for many, and an update for others. But I imagine there's got to be some great stories about completely bricking countless device…

It's one of my favorite interview questions. I only know the answer because it happened to us once with 5M users on the affected version before it was discovered. It's a very good question to see how people react in a mostly hopeless situation. The only candidate out of 100s to logically get to the solution (or essentially it) was one of the best engineesr I've hired and worked with. "So you and your team just releas…

My first thought is to email a link to a fix, including a reason and an apology.

Re: Tor Browser disabled NoScript, but can't update

#32

Post by oil25 »

TheSpiceIsLife wrote: post #4

Conspiracy theory time: Mozilla received a National Security Letter, or equivalent, requiring them to all this cert to expire in an effort to weaken Tor.

Don't attribute malice where incompetence may serve as a valid explanation. This is a fundamental tenet of information security practice. Besides, it's silly to think an outage of massive proportions would be the most effective means of owning software.

Re: Tor Browser disabled NoScript, but can't update

#34

Post by oil25 »

Svperstar wrote: post #8

I don't buy for 5 minutes that Tor Browser is secure regardless of configuration. TAILS maybe but Tor Browser you may as well let an FBI agent into your house. A few years back the government starts busting all these dark web sites/users and will pull out of court cases rather then explain how. Gee I wonder.

> I don't buy for 5 minutes that Tor Browser is secure regardless of configuration.

You don't need to "buy" this idea - we're talking about free and open source software. If you passionately believe it's insecure, you would do everyone a great service by explicitly pointing out how it is so in the source code, rather than peddle FUD.

Re: Tor Browser disabled NoScript, but can't update

#35

Post by [deleted] »

Jonnax wrote: post #24
Causality1 wrote: post #6

I can't improve upon this comment: "Hey Mozilla - this is why people said that forcing addons to be signed with no way to disable was a bad idea. You didn't even make it a year without screwing it up. Who could have seen this coming? Oh wait, pretty much everyone who argued against this policy."

It's a dumb comment. There was a ton of malware being distributed as add-ons that came packaged with other installers. This solved that issue.

[deleted]

Re: Tor Browser disabled NoScript, but can't update

#36

Post by cf498 »

johnnydoe9 wrote: post #33

Every single one of my Firefox extensions stopped working with an error message that says "could not be verified for use in Firefox and has been disabled" re-downloading doesn't work either. I'm assuming it's happening to everyone?

yes https://blog.mozilla.org/addons/2019/05/04/update-regarding-...

Re: Tor Browser disabled NoScript, but can't update

#38

Post by dannyw »

tgtweak wrote: post #23
Waterluvian wrote: post #5

Somewhat related to this ongoing Mozilla plugin saga, are there any infamous stories I should look up that involve huge mistakes leading to unfixable clients? Ie. Imagine bricking your customer's devices with an irreversible buggy update. In Mozilla's case they were able to deploy a hotfix for many, and an update for others. But I imagine there's got to be some great stories about completely bricking countless device…

It's one of my favorite interview questions. I only know the answer because it happened to us once with 5M users on the affected version before it was discovered. It's a very good question to see how people react in a mostly hopeless situation. The only candidate out of 100s to logically get to the solution (or essentially it) was one of the best engineesr I've hired and worked with. "So you and your team just releas…

I would find any source of displaying a message to the end user.

Most applications have some data that comes from a remote server, whether it's on the home screen, any kind of announcements screen, server-sourced error messages, etc.

I would use that to communicate an update is available, with a handy link.

Re: Tor Browser disabled NoScript, but can't update

#39

Post by jopsen »

deogeo wrote: post #2

If Mozilla hadn't locked down Firefox so much, the fix could have been as simple as going into about:config and flipping a switch to allow unsigned plugins.

> If Mozilla hadn't locked down Firefox so much..

Ordinary users would have 5 levels of toolbars!!! Installed by anti-virus apps, etc.

Locking down can back fire, but think not that this wasn't done in the interest of most users.

Re: Tor Browser disabled NoScript, but can't update

#40

Post by d0bby »

> Turns out an unrelated 3rd party can suddenly remotely disable Tor anonymity protections at their whim, and possibly endanger TBB users (or deliberately help in deanonymizing them).

> remotely disable Tor anonymity protections [!]

Maybe a 'certificate is expiring soon' warning on the browser side?

Users would know and Mozilla would be forced to keep certs valid.

Post reply on HN