Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Browser disabled NoScript, but can't update

lists.torproject.org

Post reply on HN
Print view View original

51–60 of 125 posts

Re: Tor Browser disabled NoScript, but can't update

#51

Post by throwawayfuuu »

Waterluvian wrote: post #5

Somewhat related to this ongoing Mozilla plugin saga, are there any infamous stories I should look up that involve huge mistakes leading to unfixable clients? Ie. Imagine bricking your customer's devices with an irreversible buggy update. In Mozilla's case they were able to deploy a hotfix for many, and an update for others. But I imagine there's got to be some great stories about completely bricking countless device…

Mobile apps broadly fall under this, because update cycles of apps can be very long.

Storytime: App devs built their app with the debug flag on. (Why would anyone use CI anyways?) The debug flag is used for the local developer builds. All API endpoints were pointing to dev/stagings. In order to make this fuckup go unnoticed(otherwise customer retention would be awful + possible media coverage), the dev/staging endpoints were redirected to production, so that they would take the real orders from the broken builds. But we could only do this for our own APIs, not for our payment providers. So we had to ship product without getting paid. :|

Re: Tor Browser disabled NoScript, but can't update

#52

Post by kristianc »

Waterluvian wrote: post #5

Somewhat related to this ongoing Mozilla plugin saga, are there any infamous stories I should look up that involve huge mistakes leading to unfixable clients? Ie. Imagine bricking your customer's devices with an irreversible buggy update. In Mozilla's case they were able to deploy a hotfix for many, and an update for others. But I imagine there's got to be some great stories about completely bricking countless device…

Pretty much this with some versions of Samsung's One Connect Mini box - the box (which is the only way to connect HDMI to many Samsung sets) connects to an update service, but during the process triggers a reboot which cuts the update short, which then starts the update again, which then triggers a reboot and... There appears to be no way to get the box back to a working state without replacing it entirely.

I will never buy another Samsung set again. Shipping a TV where HDMI access depends on a proprietary box is unconscionable.

Re: Tor Browser disabled NoScript, but can't update

#53

Post by m-p-3 »

Waterluvian wrote: post #5

Somewhat related to this ongoing Mozilla plugin saga, are there any infamous stories I should look up that involve huge mistakes leading to unfixable clients? Ie. Imagine bricking your customer's devices with an irreversible buggy update. In Mozilla's case they were able to deploy a hotfix for many, and an update for others. But I imagine there's got to be some great stories about completely bricking countless device…

Imagine if this affected something like FirefoxOS devices and the lack of working certificate was making it unable to fix remotely? I know I'd be annoyed.

Re: Tor Browser disabled NoScript, but can't update

#54

Post by jszymborski »

rightbyte wrote: post #20
javagram wrote: post #16

Earlier quoted context omitted.

FWIW, since the original intent of the change to block unsigned plugins was to prevent third party software installers from adding malicious plugins without user consent, leaving a preference to toggle it back would have been pretty pointless as the third party installers could have just toggled the preference themselves (about:config is just some sort of easily modifiable data format on disk). TBH it’s not hard for…

If the malicious plugin or executable can write to disk it's probably to late anyway?

You're right, I think it just makes it less "gray". If Oracle bundles crapware with a Java installer that installs an unsigned plugin in Firefox, you can write a PR release to smooth things over.

If the crapware uninstall Firefox, install Firefox Dev Edition, and installs the unsigned plugin, there's not much of a "gray" defence there.

Re: Tor Browser disabled NoScript, but can't update

#55

Post by the8472 »

Jonnax wrote: post #22
rightbyte wrote: post #20

Earlier quoted context omitted.

If the malicious plugin or executable can write to disk it's probably to late anyway?

It was a significant issue for years. Mostly adware and things that replaced your default search engine.

the solution is to help users remove the adware, not centralize control over addons

Re: Tor Browser disabled NoScript, but can't update

#56

Post by cjbprime »

AnaniasAnanas wrote: post #50
super_mario wrote: post #25

Earlier quoted context omitted.

Tor project is US government op, true. It's good at hiding government employees using untrusted networks from hostile third parties. It is also good for foreign whistleblowers releasing data to US government. Tor is NOT good at keeping you private from government. It is good at keeping you private from your ISP or employer however. Don't do anything illegal using tor and thinking you are safe.

> Tor is NOT good at keeping you private from government This is a bold claim. Would you mind backing it up?

I wouldn't agree with the claim, but it might be referring to Tor's weaknesses against country or global passive adversaries -- timing attacks correlating your requests with the site's responses. If you can log everyone's bandwidth and can get ISPs to tell you which human is using Tor, metadata anonymity goes away.

Re: Tor Browser disabled NoScript, but can't update

#57

Post by shmel »

Jonnax wrote: post #24
Causality1 wrote: post #6

I can't improve upon this comment: "Hey Mozilla - this is why people said that forcing addons to be signed with no way to disable was a bad idea. You didn't even make it a year without screwing it up. Who could have seen this coming? Oh wait, pretty much everyone who argued against this policy."

It's a dumb comment. There was a ton of malware being distributed as add-ons that came packaged with other installers. This solved that issue.

I don't get why this flag was disabled on Linux though. Nobody uses "installers" on Linux, come on. I am not sure if malware of this kind even exists on Linux.

Re: Tor Browser disabled NoScript, but can't update

#58

Post by TheRealPomax »

bouncycastle wrote: post #48
tgtweak wrote: post #23

Earlier quoted context omitted.

It's one of my favorite interview questions. I only know the answer because it happened to us once with 5M users on the affected version before it was discovered. It's a very good question to see how people react in a mostly hopeless situation. The only candidate out of 100s to logically get to the solution (or essentially it) was one of the best engineesr I've hired and worked with. "So you and your team just releas…

Need more info, why it couldn't connect? Eg, if it was just a typo in the domain name, just register the domain new name or adjust the DNS record ;-)

Yep, that's how interview questions work. If someone immediately recommends a solution, that's someone who probably needs to grow in their field a little before being given a position where this is a potentially real situation.

Re: Tor Browser disabled NoScript, but can't update

#59

Post by judge2020 »

Faark wrote: post #49

> Turns out an unrelated 3rd party can suddenly remotely disable Tor anonymity protections at their whim Am I the only one annoyed by people pushing this "they flicked a switch" narrative? No. They provided shitty software that didn't work under certain conditions (in this case date related) and thus broke your shitty software. A third party having remote control capability is something entirely different.

If I'm not mistaken, then very well could revoke the intermediate certificate if they wanted. This wasn't a case of that, but it seems it could happen.

Re: Tor Browser disabled NoScript, but can't update

#60

Post by Waterluvian »

TheRealPomax wrote: post #58
bouncycastle wrote: post #48

Earlier quoted context omitted.

Need more info, why it couldn't connect? Eg, if it was just a typo in the domain name, just register the domain new name or adjust the DNS record ;-)

Yep, that's how interview questions work. If someone immediately recommends a solution, that's someone who probably needs to grow in their field a little before being given a position where this is a potentially real situation.

And as an interviewer I don't really want an answer. What I really want is to watch your brain grind away at a problem. So ask these questions, even rhetorically. Talk through all. Your angles of attack.
Post reply on HN