Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Browser disabled NoScript, but can't update

lists.torproject.org

Post reply on HN
Print view View original

81–90 of 125 posts

Re: Tor Browser disabled NoScript, but can't update

#81

Post by AnaniasAnanas »

sbhn wrote: post #69
AnaniasAnanas wrote: post #50

Earlier quoted context omitted.

> Tor is NOT good at keeping you private from government This is a bold claim. Would you mind backing it up?

All tor exit nodes. https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=1... Tor is a beacon

Yes, what about it? This is a list of the IP addresses of the exit nodes, it is useful if you want to start blocking tor traffic in your site (though I am against that).

This is not a list of the IP addresses of the onion sites nor of the users, in addition to that exit nodes are not used when you connect to an onion site.

Re: Tor Browser disabled NoScript, but can't update

#82

Post by jszymborski »

the8472 wrote: post #67
jszymborski wrote: post #54

Earlier quoted context omitted.

You're right, I think it just makes it less "gray". If Oracle bundles crapware with a Java installer that installs an unsigned plugin in Firefox, you can write a PR release to smooth things over. If the crapware uninstall Firefox, install Firefox Dev Edition, and installs the unsigned plugin, there's not much of a "gray" defence there.

Adware came bundled with chrome itself (for the money), i.e. installing new browsers is not out of the question here. That excuse feels really flimsy and tailored to permit only the exact choices made and no other option. But there are other options, such as helping users to get rid of adware when it's detected in the browser. It would also result in a larger benefit of improving their system instead just the browser…

I find my explanation more plausible than the implication that "Firefox went through the effort of making plugins required to be signed for any other reason so long as it's arbitrary or somehow malicious" that you and others seemingly subscribe to.

Re: Tor Browser disabled NoScript, but can't update

#83

Post by AnaniasAnanas »

cjbprime wrote: post #56
AnaniasAnanas wrote: post #50

Earlier quoted context omitted.

> Tor is NOT good at keeping you private from government This is a bold claim. Would you mind backing it up?

I wouldn't agree with the claim, but it might be referring to Tor's weaknesses against country or global passive adversaries -- timing attacks correlating your requests with the site's responses. If you can log everyone's bandwidth and can get ISPs to tell you which human is using Tor, metadata anonymity goes away.

Isn't this true for pretty much every privacy tool (i2p, freenode, gnunet, etc) though? I don't think that any of them can protect you if an adversary can monitor the whole internet.

Re: Tor Browser disabled NoScript, but can't update

#84

Post by EvilTerran »

the8472 wrote: post #80
EvilTerran wrote: post #78

Earlier quoted context omitted.

The malicious code may well have the necessary permissions to write to the profile folder, but not to modify the executable. Under the Unix security model, for example, that would be pretty likely: your profile's owned by your account, the executable & its containing folder are owned by root & go-w, so code running as you can tamper with the former but not the latter.

They explicitly argued with the windows threat model that installers run with admin privileges and thus can modify the program directory too. Now arguing with the unix model is shifting goalposts.

Who argued that, where? I don't see it in this subthread.

Regardless, as I said in my comment, I only mentioned the Unix model "for example" - not to "shift the goalposts", just because I'm more familiar with it than with whatever anti-binary-tampering measures Windows may have.

Re: Tor Browser disabled NoScript, but can't update

#85

Post by pdkl95 »

EvilTerran wrote: post #78
rightbyte wrote: post #20

Earlier quoted context omitted.

If the malicious plugin or executable can write to disk it's probably to late anyway?

The malicious code may well have the necessary permissions to write to the profile folder, but not to modify the executable. Under the Unix security model, for example, that would be pretty likely: your profile's owned by your account, the executable & its containing folder are owned by root & go-w, so code running as you can tamper with the former but not the latter.

The malicious code can simply write an executable somewhere in the profile (or /tmp, or anywhere). It is highly unlikely that the profile (usually in /home/${USER}/) is on a filesystem mounted with the "noexec" flag.

Or just inject code the browser at runtime.

Under the Unix security model, the UID is the permission boundary. Even if the binary is owned by root, it inherits the user's UID when they run it.

Re: Tor Browser disabled NoScript, but can't update

#86

Post by tknkx »

crehn wrote: post #74
tedunangst wrote: post #71

Earlier quoted context omitted.

Are we talking about Firefox extensions or something else?

Not sure of the Firefox implementation; just pointing out revocation isn't necessarily straightforward.

The way I understand it is: certificate revocation is handled by checking OCSP servers, and OCSP servers can be programmed so they give different answers depending on the IP address of whomever is asking. In other words, it should be possible to disable all addons for a selected user by targeting him by IP address.

Re: Tor Browser disabled NoScript, but can't update

#87

Post by the8472 »

jszymborski wrote: post #82
the8472 wrote: post #67

Earlier quoted context omitted.

Adware came bundled with chrome itself (for the money), i.e. installing new browsers is not out of the question here. That excuse feels really flimsy and tailored to permit only the exact choices made and no other option. But there are other options, such as helping users to get rid of adware when it's detected in the browser. It would also result in a larger benefit of improving their system instead just the browser…

I find my explanation more plausible than the implication that "Firefox went through the effort of making plugins required to be signed for any other reason so long as it's arbitrary or somehow malicious" that you and others seemingly subscribe to.

That's not what I am saying. I am saying that through a chain of choices they arrived at a specific conclusion how to solve their problem and then added justifications that admitted no alternatives when alternative solutions would have avoided the situation today.

People, including myself, were argueing against putting mozilla in a position where they are a single point of failure. That critique was countered with the specific argument that giving users an override is not acceptable because any override could also be used by adware and thus mozilla must be the sole arbiter of what addons can be installed.

Re: Tor Browser disabled NoScript, but can't update

#88

Post by Vinnl »

steingold wrote: post #70
Faark wrote: post #49

> Turns out an unrelated 3rd party can suddenly remotely disable Tor anonymity protections at their whim Am I the only one annoyed by people pushing this "they flicked a switch" narrative? No. They provided shitty software that didn't work under certain conditions (in this case date related) and thus broke your shitty software. A third party having remote control capability is something entirely different.

Letting a certificate expire is the same as flicking a switch IMO. Mozilla is a real organization with full time paid staff, things like this don't just slip through the cracks, especially when the 'fix' is to let Mozilla run spyware on your computer.

I think almost anyone who has worked at real organisations with full-time paid staff can tell you that things do slip through the cracks. At least I can.

Re: Tor Browser disabled NoScript, but can't update

#89

Post by the8472 »

EvilTerran wrote: post #84
the8472 wrote: post #80

Earlier quoted context omitted.

They explicitly argued with the windows threat model that installers run with admin privileges and thus can modify the program directory too. Now arguing with the unix model is shifting goalposts.

Who argued that, where? I don't see it in this subthread. Regardless, as I said in my comment, I only mentioned the Unix model "for example" - not to "shift the goalposts", just because I'm more familiar with it than with whatever anti-binary-tampering measures Windows may have.

https://blog.mozilla.org/addons/2015/04/15/the-case-for-exte...

Re: Tor Browser disabled NoScript, but can't update

#90

Post by DavideNL »

johnnydoe9 wrote: post #33

Every single one of my Firefox extensions stopped working with an error message that says "could not be verified for use in Firefox and has been disabled" re-downloading doesn't work either. I'm assuming it's happening to everyone?

... a method to apply a hotfix manually without enabling studies: https://news.ycombinator.com/item?id=19827302
Post reply on HN