Tor Browser disabled NoScript, but can't update

Post by [deleted] » Sun, May 05, 2019, 3:00 PM UTC

javagram wrote: post #16

deogeo wrote: post #2

If Mozilla hadn't locked down Firefox so much, the fix could have been as simple as going into about:config and flipping a switch to allow unsigned plugins.

FWIW, since the original intent of the change to block unsigned plugins was to prevent third party software installers from adding malicious plugins without user consent, leaving a preference to toggle it back would have been pretty pointless as the third party installers could have just toggled the preference themselves (about:config is just some sort of easily modifiable data format on disk). TBH it’s not hard for…

Post by dev_dull » Sun, May 05, 2019, 3:02 PM UTC

celrod wrote: post #41

Waterluvian wrote: post #5

Somewhat related to this ongoing Mozilla plugin saga, are there any infamous stories I should look up that involve huge mistakes leading to unfixable clients? Ie. Imagine bricking your customer's devices with an irreversible buggy update. In Mozilla's case they were able to deploy a hotfix for many, and an update for others. But I imagine there's got to be some great stories about completely bricking countless device…

BLU phones released an update that made it impossible to unlock the phones. I factory reset mine rather than muck with downloading another update for the sd card. https://www.pcmag.com/news/357649/blu-phone-update-is-bricki...

Post by oil25 » Sun, May 05, 2019, 3:04 PM UTC

AnaniasAnanas wrote: post #37

One of the weird things here is that javascript is not disabled by default in the Tor Browser and instead an addon is needed. This whole thing is also yet another reason to use something like Tails or Whonix which are much safer to use with JS enabled.

Post by bouncycastle » Sun, May 05, 2019, 3:04 PM UTC

tgtweak wrote: post #23

Waterluvian wrote: post #5

Somewhat related to this ongoing Mozilla plugin saga, are there any infamous stories I should look up that involve huge mistakes leading to unfixable clients? Ie. Imagine bricking your customer's devices with an irreversible buggy update. In Mozilla's case they were able to deploy a hotfix for many, and an update for others. But I imagine there's got to be some great stories about completely bricking countless device…

It's one of my favorite interview questions. I only know the answer because it happened to us once with 5M users on the affected version before it was discovered. It's a very good question to see how people react in a mostly hopeless situation. The only candidate out of 100s to logically get to the solution (or essentially it) was one of the best engineesr I've hired and worked with. "So you and your team just releas…

Post by AnaniasAnanas » Sun, May 05, 2019, 3:06 PM UTC

super_mario wrote: post #25

Svperstar wrote: post #8

I don't buy for 5 minutes that Tor Browser is secure regardless of configuration. TAILS maybe but Tor Browser you may as well let an FBI agent into your house. A few years back the government starts busting all these dark web sites/users and will pull out of court cases rather then explain how. Gee I wonder.

Tor project is US government op, true. It's good at hiding government employees using untrusted networks from hostile third parties. It is also good for foreign whistleblowers releasing data to US government. Tor is NOT good at keeping you private from government. It is good at keeping you private from your ISP or employer however. Don't do anything illegal using tor and thinking you are safe.