9 ms·

“Our primary goal is to un-fork the Tor Browser”

420 points by dao- 10y ago

Achshar 10y ago
I think using Tor as it is intended to be used requires some change in user's browsing habits as well. So pulling in all the Tor specific settings into firefox won't be much help if the user then goes and signs into facebook and gmail.
- tn13 10y ago
  What if the incognito mode makes Firefox something much closer to Tor ?
- andrewstuart2 10y ago
  I think it'd be a pretty darn powerful addition to Private Browsing, though. Perhaps "Off the Grid" mode or some additional third level of privacy that comes with a warning about never logging into services, etc, if you truly don't want to be tracked.
- Teever 10y ago
  Let's take this one step at a time. Before the user habits can be an issue we need to have the framework in which they can be a problem. I'm sure that we can develop prompts and warnings to aid users if they attempt to visit these sites in a fashion analogous to unsecure site warnings.
- Manishearth 10y ago
  I'm not sure how this is relevant to the post? They're not talking about giving Firefox a "tor mode". The Tor browser uses Firefox under the hood with a few add-on and flipped default settings. Currently, it uses a fork of Firefox with slight modifications (like the ability to disable mathml). They intend to make it so that this fork is unnecessary. The Tor browser will probably continue to be something you need to install to use.
  - yohui 10y ago
    I think some people read the title (Mozilla: “Our primary goal is to un-fork the Tor Browser”) and assumed Mozilla wants to incorporate all the Tor Browser's features. A closer look at the link should make it clear that the changes being discussed are more specific. It's almost clickbait.
    - int_19h 10y ago
      I've interpreted the title that way, too, but partly because it might actually make sense. Consider this. Firefox peaked a while ago; since then, Chrome ate every other browser's lunch, and the only browser that had user share declining faster than Firefox was IE (but even so, IE still has more users). Google has the brand recognition on their side, and on top of that, they have actually made a browser that "just works" for 99% of people out there, the way Firefox never quite did. Since contesting Chrome's market share is rather pointless, Firefox needs a niche of its own now. Integrating Tor in a seamless way would be a great opportunity to create one.
      - RubyPinch 10y ago
        eh, the final pieces are kind of all being worked on multiprocessing to stop freezing issues and increase response speed a permissioned API for extensions, easier and saner full themes system (faster/easier development time for updates, and a wider range of extensions/themes as a result) and switching critical components to a safer language) which imo are more important for users than doing something an existing firefox fork does (like, if there was demand for firefox with seamless tor, then they would get the firefox with seamless tor today, because it already exists)
- Spivak 10y ago
  This could actually be solved by Firefox's new contextual identity project by having the Tor identity isolated.
Uptrenda 10y ago
It would be really cool if Tor became like an open web standard that every browser supported. We would be able to freely host services with incredibly strong privacy guarantees and then work them into existing web infrastructure so that normal users can benefit from strong privacy without having any special knowledge. Doing the same thing with Bitcoin wallets would also be a good idea, though I'd want for there to be a much better security model before that's considered ... otherwise every new browser zero-day will be the equivalent of being able to mass hack bank accounts.
- 2bitencryption 10y ago
  > It would be really cool if Tor became like an open web standard that every browser supported. Isn't it already? My understanding is that nothing is stopping you from using the Tor service as a proxy for all your traffic. They just offer the Browser Bundle to make it dead simple for users. You could download their so-called "expert bundle" and use that to route any traffic you want. https://www.torproject.org/download/download.html.en https://www.torproject.org/download/download.html.en
  - scrollaway 10y ago
    I think parent means natively supporting tor as a protocol in the browser. Eg another "incognito mode", and native support for the onion tld. It would indeed be cool.
    - colejohnson66 10y ago
      That's what I thought. The closest you can get to viewing onion URLs outside of Tor is a website like Tor2web[0]. The downside of these solutions is that you don't get the benefit of onion routing. [0]: https://www.tor2web.org/ https://www.tor2web.org/
- rincebrain 10y ago
  The only problem with that is limited levels of trust - e.g. if you have Tor support baked into your browser, you have to trust that the magic "Tor on" button isn't compromised. This isn't a problem that just using Tor in an existing browser install is supposed to solve/be any better at, but it suddenly becomes an incredible target for any state actors/other large-scale entities who know they're going to want to suppress communication shortly.
r-w 10y ago
* squee *
- anonbanker 10y ago
  agreed. this is the biggest news a privacy advocate could ever want. How do Google and Microsoft compete? They've pretty much set on a path of VPN'ing everyone over Tor by default. Perhaps it's too much to ask if they'd do the same for i2pbrowser?
Fej 10y ago
This would be a miracle for privacy advocates. However, I'm worried that Mozilla could become irrelevant in the meantime. I say this as a die-hard Firefox user (I even refuse to use any of the forks that remove the branding). Mozilla needs to be making moves that keep them relevant. This move is great for some privacy-minded folks who don't know that the Tor Browser Bundle exists, but unfortunately... most people don't care about their privacy online. Does Mozilla even have a path they can take that keeps Firefox from dying a slow death? I say this because I love what they do - they're the only major browser developer that is interested in protecting their users instead of their profits. They need to start acting like the situation is getting dire.
- Paul-ish 10y ago
  We see that % share is going down for Firefox, but is there any indication that total number of users is dropping for Firefox? I suspect that as more people have been getting on the internet, the absolute number of FF users is actually going up. It stands to reason that Firefox isn't dieing at all.
  - martinvol 10y ago
    I broke my Chrome instance and decided to give Firefox a try, and I must say it has A LOT of usability problems compared to Google's. I'd say Mozilla has a lot to work on to avoid losing users, if they aren't already.
    - cdmckay 10y ago
      What usability problems did you experience vs Chrome?
      - neoncontrails 10y ago
        Most notably, for me, I'm stuck using Yahoo as the default search engine. I can change the default to Google, but the preference resets when the window closes. Edit: It appears only browser instances launched with Selenium are affected. Instances launched the usual way default to Google as expected.
FungalRaincloud 10y ago
I mean, I think it's a cool idea, but I kind of hope not. Firefox is the only browser that seems to consistently be able to play video at my work, because of aggressive firewalls. If they enable tor by default, it's pretty much guaranteed that it'll be uninstalled from all company machines.
- halestock 10y ago
  This is not to bring Tor into Firefox. Tor has been using an older, forked version of Firefox. This would go back to using the mainline version of Firefox.
- Aldo_MX 10y ago
  You're misunderstanding, the intention is to integrate any privacy-related change made by the Tor Browser, but in a configurable way via `about:config` under the `privacy.*` namespace. Firefox should allow you to disable any privacy-concerning feature out-of-the-box, it shouldn't be needed to maintain a separate fork to achieve better privacy.
yusee 10y ago
Who really thinks that the NSA, Palantir, Mossad, Russia, etc. aren't surveilling the dark net? Privacy is dead.
- cdmckay 10y ago
  So just stop trying?
- yeukhon 10y ago
  I wouldn't even need to use nation state in this context. If there's an actual human in the dark net, someone is monitoring something there, for example, the price of an exploit.
- Sylos 10y ago
  Of course, they are surveilling the dark net. The idea is that you're anonymized in such a way that you don't have to care about the surveillance.
  - dredmorbius 10y ago
    And/or that the surveilling costs (against you, against others) are raised.
TempleOSV409 10y ago
I walk in the front door of the CIA and say "This is a stick-up. Surrender to God, nigger and suck my cock."
sprin 10y ago
This is not about integrating Tor into Firefox, rather it is about incorporating switches into Firefox for the security/privacy improvements that have been made in Tor Browser. You can think of Tor Browser as a better Firefox that just happens to include built-in support for the Tor network. Tor Browser is security-hardened and makes numerous changes to improve privacy, such as reducing fingerprinting opportunities and attempting to isolate browser state by URL bar domain. The Design and Implementation of the Tor Browser doc [1] is an excellent read on the approach taken. Since it is trivial to configure Tor Browser to run on the "normal internet" (not on the Tor network), there may not be much reason to run Firefox instead of Tor Browser. There is one possible reason: not all security fixes may be backported to Firefox Extended Support Releases (ESR). According to the ESR FAQ [2], only "high-risk/high-impact security vulnerabilities" will be backported to ESRs. So clearly some security vulnerabilties that are not considered by Mozilla to be high-risk/high-impact may be left unfixed in ESRs. Additionally, it seems likely that not all bugs that are security vulnerabilities will be correctly identified as such. Many exploitable bugs that can lead to code execution are often published as only stability or denial of service bugs by project maintainers - so-called "Denial of Reality" vulnerabilities [3]. I think this is what Daniel Veditz is alluding to when he says "Mozilla leadership has already decided to help Tor move toward being able to build off a Release Firefox rather than an ESR--it's safer for our users." So in that sense, it is great news that Mozilla is working to make it easier for Tor Browser to be based on top of Release Firefox instead of an ESR. Even if all Tor Browser patches make it in to Firefox, I imagine it will be a good deal of work to get out-of-the-box Firefox to behave like Tor Browser. And given that every six weeks, Firefox may have new features that present new attack surface, or enables new fingerprinting opportunities, it still seems like a safer bet to have Tor Browser devs vet each release, rather than constantly try to stay on top of what switches need to be flipped. Personally I will continue to trust Tor Project to ship a browser that is configured for strong security and privacy out-of-the-box. [1] https://www.torproject.org/projects/torbrowser/design/ https://www.torproject.org/projects/torbrowser/design/ [2] https://www.mozilla.org/en-US/firefox/organizations/faq/ https://www.mozilla.org/en-US/firefox/organizations/faq/ [3] https://lwn.net/Articles/191080/ https://lwn.net/Articles/191080/
intherdfield 10y ago
What is meant here IS NOT that every Firefox user would be browsing using Tor. The idea is that the Tor Browser would be standard Firefox with certain strong privacy settings enabled. i.e., the Tor project wouldn't have to patch Firefox source and recompile because their patches would already be in Firefox, just run-time disabled. They wouldn't have to maintain their own set of patches that could be broken by Firefox development. For Tor, stock Firefox would be launched with those (strong privacy) settings enabled. Tor might have to rework their patches to live in Firefox in this way, but it would simplify their work because Firefox development wouldn't cause upstream breakage of the Tor browser.
- mtgx 10y ago
  Why couldn't Firefox use Tor in the "private mode"? Wouldn't that be the ultimate private mode? It would also greatly help the Tor community, as it would "mainstream Tor" so it wouldn't have as much stigma as it does today.
  - SolarNet 10y ago
    Speed for starters (Tor is an order of magnitude slower) and many things, like advanced JavaScript (websockets for example), flash and Java, simply can't traverse it reliably. Also it's not what people expect. Many people expect private mode to make it so their active session's browsing doesn't effect their browsing history or they tracked history, not to anonymize them entirely.
    - lucb1e 10y ago
      > Tor is an order of magnitude slower This claim is frequently made but I think I can objectively say (it's not the Tor fan speaking) that it's wrong. Can you back this up with numbers? Like, real world user's numbers. That means WiFi or 3g, or at best a 100mbps wire to an old WRT54G; not a professional, cabled desktop setup with FTTH or 802.11ac that many of us might use (as professionals or hobbyists). Depending on some luck in the Tor circuit, it should be as good as a good public wifi hotspot. Or in a bad case it might be as bad as an overloaded and far away public hotspot, but circuits rotate now and then anyway. I'd be genuinely interested to see some user testing in this area, especially if the users know the privacy difference it makes and can toggle it at will.
confounded 10y ago
Note: I believe "un-fork" in this context means the Tor browser being able to use the latest version of Firefox (instead of an old fork), by Mozilla merging-in some of the privacy enhancements made in the Tor Browser, for ordinary clearnet use (likely as default-off options). It does not mean making Firefox into the Tor Browser. It's a great way to make the efforts of both teams available to both groups of users. I'm very glad this effort is happening!
- dao- 10y ago
  See also this comment further up in the bug: "Mozilla leadership has already decided to help Tor move toward being able to build off a Release Firefox rather than an ESR--it's safer for our users. I don't know if we'll get to the point where they can just ship a re-packaged bundle with some pref flips and add-ons, but the more of their patches we incorporate into mozilla-central the easier it will be for them to apply their remaining patches each release." (https://bugzilla.mozilla.org/show_bug.cgi?id=1173199#c16 https://bugzilla.mozilla.org/show_bug.cgi?id=1173199#c16)
  - technomancy 10y ago
    It's worrying to me that they imply ESR is less secure; isn't the whole point that it gets security fixes applied to it? Less churn should make it more secure.
    - tedmiston 10y ago
      > Maintenance of each ESR, through point releases, is limited to high-risk/high-impact security vulnerabilities and in rare cases may also include off-schedule releases that address live security vulnerabilities. Backports of any functional enhancements and/or stability fixes are not in scope. https://www.mozilla.org/en-US/firefox/organizations/faq/ https://www.mozilla.org/en-US/firefox/organizations/faq/
      - technomancy 10y ago
        Damn; I assumed since it was shipped in Debian Stable it had all the same guarantees as the rest of the distro, but I guess the browser codebases tend to be such security disasters that they can't necessarily keep up.
dredmorbius 10y ago
This is awesome. No, backfitting a stock browser isn't going to give you high-level security. An Uber-Incognito mode, however, would be a real plus. Far more useful: making Tor so available and ubiquitous that site operators and infrastructure providers have to address Tor usability issues. Yes, I'm looking at you specifically, Cloudflare and Craigslist. On the site ops side, this is going to play major havok with methods typically used for mitigating site abuse (and other problems), specifically IP-based tracking. If I find a specific issue and can note that a single address or block of addresses which likely represents a single user or user-class is problematic, I can take action. If "the Internet" becomes a Tor-undifferentiated request cloud, as we've been diagramming it on zero-content slidedecks for 20 years, then that really useful tool will end its useful life (or more likely: be less useful in more cases). But that's a hell of a good reason for coming up with other ways of establishing and enforcing good user behavior through ad-hoc, anonymous, systems-based reputation systems.
deleted 10y ago
[deleted]
nxzero 10y ago
Anyone able to provide commentary on who's who in the comment linked to. Seems like if this was an official effort one of the two parties would have posted an announcement.
MichaelMoser123 10y ago
will we also get enough onion routers to keep the system running under high demand?

420 points by dao- 10y ago

I think using Tor as it is intended to be used requires some change in user's browsing habits as well. So pulling in all the Tor specific settings into firefox won't be much help if the user then goes and signs into facebook and gmail.

tn13 10y ago
What if the incognito mode makes Firefox something much closer to Tor ?
andrewstuart2 10y ago
I think it'd be a pretty darn powerful addition to Private Browsing, though. Perhaps "Off the Grid" mode or some additional third level of privacy that comes with a warning about never logging into services, etc, if you truly don't want to be tracked.
Teever 10y ago
Let's take this one step at a time. Before the user habits can be an issue we need to have the framework in which they can be a problem. I'm sure that we can develop prompts and warnings to aid users if they attempt to visit these sites in a fashion analogous to unsecure site warnings.
Manishearth 10y ago
I'm not sure how this is relevant to the post? They're not talking about giving Firefox a "tor mode". The Tor browser uses Firefox under the hood with a few add-on and flipped default settings. Currently, it uses a fork of Firefox with slight modifications (like the ability to disable mathml). They intend to make it so that this fork is unnecessary. The Tor browser will probably continue to be something you need to install to use.
- yohui 10y ago
  I think some people read the title (Mozilla: “Our primary goal is to un-fork the Tor Browser”) and assumed Mozilla wants to incorporate all the Tor Browser's features. A closer look at the link should make it clear that the changes being discussed are more specific. It's almost clickbait.
  - int_19h 10y ago
    I've interpreted the title that way, too, but partly because it might actually make sense. Consider this. Firefox peaked a while ago; since then, Chrome ate every other browser's lunch, and the only browser that had user share declining faster than Firefox was IE (but even so, IE still has more users). Google has the brand recognition on their side, and on top of that, they have actually made a browser that "just works" for 99% of people out there, the way Firefox never quite did. Since contesting Chrome's market share is rather pointless, Firefox needs a niche of its own now. Integrating Tor in a seamless way would be a great opportunity to create one.
    - RubyPinch 10y ago
      eh, the final pieces are kind of all being worked on multiprocessing to stop freezing issues and increase response speed a permissioned API for extensions, easier and saner full themes system (faster/easier development time for updates, and a wider range of extensions/themes as a result) and switching critical components to a safer language) which imo are more important for users than doing something an existing firefox fork does (like, if there was demand for firefox with seamless tor, then they would get the firefox with seamless tor today, because it already exists)
Spivak 10y ago
This could actually be solved by Firefox's new contextual identity project by having the Tor identity isolated.

Uptrenda 10y ago

It would be really cool if Tor became like an open web standard that every browser supported. We would be able to freely host services with incredibly strong privacy guarantees and then work them into existing web infrastructure so that normal users can benefit from strong privacy without having any special knowledge. Doing the same thing with Bitcoin wallets would also be a good idea, though I'd want for there to be a much better security model before that's considered ... otherwise every new browser zero-day will be the equivalent of being able to mass hack bank accounts.

2bitencryption 10y ago
> It would be really cool if Tor became like an open web standard that every browser supported. Isn't it already? My understanding is that nothing is stopping you from using the Tor service as a proxy for all your traffic. They just offer the Browser Bundle to make it dead simple for users. You could download their so-called "expert bundle" and use that to route any traffic you want. https://www.torproject.org/download/download.html.en https://www.torproject.org/download/download.html.en
- scrollaway 10y ago
  I think parent means natively supporting tor as a protocol in the browser. Eg another "incognito mode", and native support for the onion tld. It would indeed be cool.
  - colejohnson66 10y ago
    That's what I thought. The closest you can get to viewing onion URLs outside of Tor is a website like Tor2web[0]. The downside of these solutions is that you don't get the benefit of onion routing. [0]: https://www.tor2web.org/ https://www.tor2web.org/
rincebrain 10y ago
The only problem with that is limited levels of trust - e.g. if you have Tor support baked into your browser, you have to trust that the magic "Tor on" button isn't compromised. This isn't a problem that just using Tor in an existing browser install is supposed to solve/be any better at, but it suddenly becomes an incredible target for any state actors/other large-scale entities who know they're going to want to suppress communication shortly.

r-w 10y ago

* squee *

anonbanker 10y ago
agreed. this is the biggest news a privacy advocate could ever want. How do Google and Microsoft compete? They've pretty much set on a path of VPN'ing everyone over Tor by default. Perhaps it's too much to ask if they'd do the same for i2pbrowser?

Fej 10y ago

This would be a miracle for privacy advocates. However, I'm worried that Mozilla could become irrelevant in the meantime. I say this as a die-hard Firefox user (I even refuse to use any of the forks that remove the branding). Mozilla needs to be making moves that keep them relevant. This move is great for some privacy-minded folks who don't know that the Tor Browser Bundle exists, but unfortunately... most people don't care about their privacy online. Does Mozilla even have a path they can take that keeps Firefox from dying a slow death? I say this because I love what they do - they're the only major browser developer that is interested in protecting their users instead of their profits. They need to start acting like the situation is getting dire.

Paul-ish 10y ago
We see that % share is going down for Firefox, but is there any indication that total number of users is dropping for Firefox? I suspect that as more people have been getting on the internet, the absolute number of FF users is actually going up. It stands to reason that Firefox isn't dieing at all.
- martinvol 10y ago
  I broke my Chrome instance and decided to give Firefox a try, and I must say it has A LOT of usability problems compared to Google's. I'd say Mozilla has a lot to work on to avoid losing users, if they aren't already.
  - cdmckay 10y ago
    What usability problems did you experience vs Chrome?
    - neoncontrails 10y ago
      Most notably, for me, I'm stuck using Yahoo as the default search engine. I can change the default to Google, but the preference resets when the window closes. Edit: It appears only browser instances launched with Selenium are affected. Instances launched the usual way default to Google as expected.

FungalRaincloud 10y ago

I mean, I think it's a cool idea, but I kind of hope not. Firefox is the only browser that seems to consistently be able to play video at my work, because of aggressive firewalls. If they enable tor by default, it's pretty much guaranteed that it'll be uninstalled from all company machines.

halestock 10y ago
This is not to bring Tor into Firefox. Tor has been using an older, forked version of Firefox. This would go back to using the mainline version of Firefox.
Aldo_MX 10y ago
You're misunderstanding, the intention is to integrate any privacy-related change made by the Tor Browser, but in a configurable way via `about:config` under the `privacy.*` namespace. Firefox should allow you to disable any privacy-concerning feature out-of-the-box, it shouldn't be needed to maintain a separate fork to achieve better privacy.

yusee 10y ago

Who really thinks that the NSA, Palantir, Mossad, Russia, etc. aren't surveilling the dark net? Privacy is dead.

cdmckay 10y ago
So just stop trying?
yeukhon 10y ago
I wouldn't even need to use nation state in this context. If there's an actual human in the dark net, someone is monitoring something there, for example, the price of an exploit.
Sylos 10y ago
Of course, they are surveilling the dark net. The idea is that you're anonymized in such a way that you don't have to care about the surveillance.
- dredmorbius 10y ago
  And/or that the surveilling costs (against you, against others) are raised.

TempleOSV409 10y ago

I walk in the front door of the CIA and say "This is a stick-up. Surrender to God, nigger and suck my cock."

sprin 10y ago

This is not about integrating Tor into Firefox, rather it is about incorporating switches into Firefox for the security/privacy improvements that have been made in Tor Browser. You can think of Tor Browser as a better Firefox that just happens to include built-in support for the Tor network. Tor Browser is security-hardened and makes numerous changes to improve privacy, such as reducing fingerprinting opportunities and attempting to isolate browser state by URL bar domain. The Design and Implementation of the Tor Browser doc [1] is an excellent read on the approach taken. Since it is trivial to configure Tor Browser to run on the "normal internet" (not on the Tor network), there may not be much reason to run Firefox instead of Tor Browser. There is one possible reason: not all security fixes may be backported to Firefox Extended Support Releases (ESR). According to the ESR FAQ [2], only "high-risk/high-impact security vulnerabilities" will be backported to ESRs. So clearly some security vulnerabilties that are not considered by Mozilla to be high-risk/high-impact may be left unfixed in ESRs. Additionally, it seems likely that not all bugs that are security vulnerabilities will be correctly identified as such. Many exploitable bugs that can lead to code execution are often published as only stability or denial of service bugs by project maintainers - so-called "Denial of Reality" vulnerabilities [3]. I think this is what Daniel Veditz is alluding to when he says "Mozilla leadership has already decided to help Tor move toward being able to build off a Release Firefox rather than an ESR--it's safer for our users." So in that sense, it is great news that Mozilla is working to make it easier for Tor Browser to be based on top of Release Firefox instead of an ESR. Even if all Tor Browser patches make it in to Firefox, I imagine it will be a good deal of work to get out-of-the-box Firefox to behave like Tor Browser. And given that every six weeks, Firefox may have new features that present new attack surface, or enables new fingerprinting opportunities, it still seems like a safer bet to have Tor Browser devs vet each release, rather than constantly try to stay on top of what switches need to be flipped. Personally I will continue to trust Tor Project to ship a browser that is configured for strong security and privacy out-of-the-box. [1] https://www.torproject.org/projects/torbrowser/design/ https://www.torproject.org/projects/torbrowser/design/ [2] https://www.mozilla.org/en-US/firefox/organizations/faq/ https://www.mozilla.org/en-US/firefox/organizations/faq/ [3] https://lwn.net/Articles/191080/ https://lwn.net/Articles/191080/

intherdfield 10y ago

What is meant here IS NOT that every Firefox user would be browsing using Tor. The idea is that the Tor Browser would be standard Firefox with certain strong privacy settings enabled. i.e., the Tor project wouldn't have to patch Firefox source and recompile because their patches would already be in Firefox, just run-time disabled. They wouldn't have to maintain their own set of patches that could be broken by Firefox development. For Tor, stock Firefox would be launched with those (strong privacy) settings enabled. Tor might have to rework their patches to live in Firefox in this way, but it would simplify their work because Firefox development wouldn't cause upstream breakage of the Tor browser.

mtgx 10y ago
Why couldn't Firefox use Tor in the "private mode"? Wouldn't that be the ultimate private mode? It would also greatly help the Tor community, as it would "mainstream Tor" so it wouldn't have as much stigma as it does today.
- SolarNet 10y ago
  Speed for starters (Tor is an order of magnitude slower) and many things, like advanced JavaScript (websockets for example), flash and Java, simply can't traverse it reliably. Also it's not what people expect. Many people expect private mode to make it so their active session's browsing doesn't effect their browsing history or they tracked history, not to anonymize them entirely.
  - lucb1e 10y ago
    > Tor is an order of magnitude slower This claim is frequently made but I think I can objectively say (it's not the Tor fan speaking) that it's wrong. Can you back this up with numbers? Like, real world user's numbers. That means WiFi or 3g, or at best a 100mbps wire to an old WRT54G; not a professional, cabled desktop setup with FTTH or 802.11ac that many of us might use (as professionals or hobbyists). Depending on some luck in the Tor circuit, it should be as good as a good public wifi hotspot. Or in a bad case it might be as bad as an overloaded and far away public hotspot, but circuits rotate now and then anyway. I'd be genuinely interested to see some user testing in this area, especially if the users know the privacy difference it makes and can toggle it at will.

confounded 10y ago

Note: I believe "un-fork" in this context means the Tor browser being able to use the latest version of Firefox (instead of an old fork), by Mozilla merging-in some of the privacy enhancements made in the Tor Browser, for ordinary clearnet use (likely as default-off options). It does not mean making Firefox into the Tor Browser. It's a great way to make the efforts of both teams available to both groups of users. I'm very glad this effort is happening!

dao- 10y ago
See also this comment further up in the bug: "Mozilla leadership has already decided to help Tor move toward being able to build off a Release Firefox rather than an ESR--it's safer for our users. I don't know if we'll get to the point where they can just ship a re-packaged bundle with some pref flips and add-ons, but the more of their patches we incorporate into mozilla-central the easier it will be for them to apply their remaining patches each release." (https://bugzilla.mozilla.org/show_bug.cgi?id=1173199#c16 https://bugzilla.mozilla.org/show_bug.cgi?id=1173199#c16)
- technomancy 10y ago
  It's worrying to me that they imply ESR is less secure; isn't the whole point that it gets security fixes applied to it? Less churn should make it more secure.
  - tedmiston 10y ago
    > Maintenance of each ESR, through point releases, is limited to high-risk/high-impact security vulnerabilities and in rare cases may also include off-schedule releases that address live security vulnerabilities. Backports of any functional enhancements and/or stability fixes are not in scope. https://www.mozilla.org/en-US/firefox/organizations/faq/ https://www.mozilla.org/en-US/firefox/organizations/faq/
    - technomancy 10y ago
      Damn; I assumed since it was shipped in Debian Stable it had all the same guarantees as the rest of the distro, but I guess the browser codebases tend to be such security disasters that they can't necessarily keep up.

dredmorbius 10y ago

This is awesome. No, backfitting a stock browser isn't going to give you high-level security. An Uber-Incognito mode, however, would be a real plus. Far more useful: making Tor so available and ubiquitous that site operators and infrastructure providers have to address Tor usability issues. Yes, I'm looking at you specifically, Cloudflare and Craigslist. On the site ops side, this is going to play major havok with methods typically used for mitigating site abuse (and other problems), specifically IP-based tracking. If I find a specific issue and can note that a single address or block of addresses which likely represents a single user or user-class is problematic, I can take action. If "the Internet" becomes a Tor-undifferentiated request cloud, as we've been diagramming it on zero-content slidedecks for 20 years, then that really useful tool will end its useful life (or more likely: be less useful in more cases). But that's a hell of a good reason for coming up with other ways of establishing and enforcing good user behavior through ad-hoc, anonymous, systems-based reputation systems.

deleted 10y ago

[deleted]

nxzero 10y ago

Anyone able to provide commentary on who's who in the comment linked to. Seems like if this was an official effort one of the two parties would have posted an announcement.

MichaelMoser123 10y ago

will we also get enough onion routers to keep the system running under high demand?