5 ms·

Note: I believe "un-fork" in this context means the Tor browser being able to use the latest version of Firefox (instead of an old fork), by Mozilla merging-in

Note: I believe "un-fork" in this context means the Tor browser being able to use the latest version of Firefox (instead of an old fork), by Mozilla merging-in some of the privacy enhancements made in the Tor Browser, for ordinary clearnet use (likely as default-off options). It does not mean making Firefox into the Tor Browser. It's a great way to make the efforts of both teams available to both groups of users. I'm very glad this effort is happening!

dao- 10y ago
See also this comment further up in the bug: "Mozilla leadership has already decided to help Tor move toward being able to build off a Release Firefox rather than an ESR--it's safer for our users. I don't know if we'll get to the point where they can just ship a re-packaged bundle with some pref flips and add-ons, but the more of their patches we incorporate into mozilla-central the easier it will be for them to apply their remaining patches each release." (https://bugzilla.mozilla.org/show_bug.cgi?id=1173199#c16 https://bugzilla.mozilla.org/show_bug.cgi?id=1173199#c16)
- technomancy 10y ago
  It's worrying to me that they imply ESR is less secure; isn't the whole point that it gets security fixes applied to it? Less churn should make it more secure.
  - tedmiston 10y ago
    > Maintenance of each ESR, through point releases, is limited to high-risk/high-impact security vulnerabilities and in rare cases may also include off-schedule releases that address live security vulnerabilities. Backports of any functional enhancements and/or stability fixes are not in scope. https://www.mozilla.org/en-US/firefox/organizations/faq/ https://www.mozilla.org/en-US/firefox/organizations/faq/
    - technomancy 10y ago
      Damn; I assumed since it was shipped in Debian Stable it had all the same guarantees as the rest of the distro, but I guess the browser codebases tend to be such security disasters that they can't necessarily keep up.
      - mgbmtl 10y ago
        Projects release new versions of software not just for new features, but (one would hope) constant improvements to the underlying architecture. Firefox in particular has been evolving quickly, with many of under-the-hood improvements that may not fix "high-risk" security issues, but constantly improve security directly or indirectly (e10s?). You can't expect maintainers of an ESR to backport all those things. There's always a risk in adopting the latest version of a program, but there's also a risk with keeping the old, less actively maintained version. I get burned all the time with Debian Stable, running into bugs fixed in the latest version but not backported. (nonetheless, I do prefer Debian Stable to most other solutions) A project I'm involved in even has an automatic "toxic code" warning for PRs on known functions/classes that need to be refactored, and where monkey-patching will likely cause other security issues one way or another.
  - rictic 10y ago
    Speculating but some new features are security features, like support for additional CSP directives, cipher suites, that sort of thing.
  - yuhong 10y ago
    An example is "Slaughterhouse" (see https://bugzilla.mozilla.org/show_bug.cgi?id=929539 https://bugzilla.mozilla.org/show_bug.cgi?id=929539 and http://bholley.net/blog/2016/the-right-fix.html http://bholley.net/blog/2016/the-right-fix.html). This is not the only incident where Mozilla people have suggested hiding bugs until an old ESR goes end of life BTW.
conradev 10y ago
Tor browser uses the latest version of Firefox that they can verify their patches on. The developers need to verify the correctness of all patches and that there are no new ones needed. "Un-fork" in this context means "upstream", or get the patches that Tor browser uses into mainstream Firefox. The developers of Tor Browser will still always need to check that Firefox isn't doing anything improper and that privacy is maintained – but upstreaming the patches will make it a lot easier.
netcan 10y ago
It will be very interesting to see how much Tor uses increases if FF just has "Tor Mode" available as a convenient option.
- sleepychu 10y ago
  Definitely, if it's in a mainstream browser it suddenly seems a lot less clandestine. Just like a VPN. I wonder if this will create a load on exit nodes as the new users are unlikely to bring proportional exit nodes?
  - netcan 10y ago
    This is really nothing to do with Tor specifically, but it's a good fit for a question that I think is curious about optional payment systems. If your browser counted how much resources you've consumed in browsing and asked you to retroactively & optionally "pay your bill," could this generate the cash to keep the service running?
    - etatoby 10y ago
      This is a nice idea. It could keep running totals for other free resources as well, such as Wikipedia. I bet it would increase donations to useful projects like these.
    - Cpoll 10y ago
      This isn't altogether uncommon in free software, and is sometimes referred to as 'beggarware'. I've been guilted into donating by some of these, but if it's too annoying it can have the opposite effect and cause you to drop the software. One that comes to mind is a download site that tracked your download count and put a rainbow-colored '(maybe you should donate)' link next to it. Not very detrimental to the UX, but gets the message across.

dao- 10y ago

See also this comment further up in the bug: "Mozilla leadership has already decided to help Tor move toward being able to build off a Release Firefox rather than an ESR--it's safer for our users. I don't know if we'll get to the point where they can just ship a re-packaged bundle with some pref flips and add-ons, but the more of their patches we incorporate into mozilla-central the easier it will be for them to apply their remaining patches each release." (https://bugzilla.mozilla.org/show_bug.cgi?id=1173199#c16 https://bugzilla.mozilla.org/show_bug.cgi?id=1173199#c16)

technomancy 10y ago
It's worrying to me that they imply ESR is less secure; isn't the whole point that it gets security fixes applied to it? Less churn should make it more secure.
- tedmiston 10y ago
  > Maintenance of each ESR, through point releases, is limited to high-risk/high-impact security vulnerabilities and in rare cases may also include off-schedule releases that address live security vulnerabilities. Backports of any functional enhancements and/or stability fixes are not in scope. https://www.mozilla.org/en-US/firefox/organizations/faq/ https://www.mozilla.org/en-US/firefox/organizations/faq/
  - technomancy 10y ago
    Damn; I assumed since it was shipped in Debian Stable it had all the same guarantees as the rest of the distro, but I guess the browser codebases tend to be such security disasters that they can't necessarily keep up.
    - mgbmtl 10y ago
      Projects release new versions of software not just for new features, but (one would hope) constant improvements to the underlying architecture. Firefox in particular has been evolving quickly, with many of under-the-hood improvements that may not fix "high-risk" security issues, but constantly improve security directly or indirectly (e10s?). You can't expect maintainers of an ESR to backport all those things. There's always a risk in adopting the latest version of a program, but there's also a risk with keeping the old, less actively maintained version. I get burned all the time with Debian Stable, running into bugs fixed in the latest version but not backported. (nonetheless, I do prefer Debian Stable to most other solutions) A project I'm involved in even has an automatic "toxic code" warning for PRs on known functions/classes that need to be refactored, and where monkey-patching will likely cause other security issues one way or another.
- rictic 10y ago
  Speculating but some new features are security features, like support for additional CSP directives, cipher suites, that sort of thing.
- yuhong 10y ago
  An example is "Slaughterhouse" (see https://bugzilla.mozilla.org/show_bug.cgi?id=929539 https://bugzilla.mozilla.org/show_bug.cgi?id=929539 and http://bholley.net/blog/2016/the-right-fix.html http://bholley.net/blog/2016/the-right-fix.html). This is not the only incident where Mozilla people have suggested hiding bugs until an old ESR goes end of life BTW.

conradev 10y ago

Tor browser uses the latest version of Firefox that they can verify their patches on. The developers need to verify the correctness of all patches and that there are no new ones needed. "Un-fork" in this context means "upstream", or get the patches that Tor browser uses into mainstream Firefox. The developers of Tor Browser will still always need to check that Firefox isn't doing anything improper and that privacy is maintained – but upstreaming the patches will make it a lot easier.

netcan 10y ago

It will be very interesting to see how much Tor uses increases if FF just has "Tor Mode" available as a convenient option.

sleepychu 10y ago
Definitely, if it's in a mainstream browser it suddenly seems a lot less clandestine. Just like a VPN. I wonder if this will create a load on exit nodes as the new users are unlikely to bring proportional exit nodes?
- netcan 10y ago
  This is really nothing to do with Tor specifically, but it's a good fit for a question that I think is curious about optional payment systems. If your browser counted how much resources you've consumed in browsing and asked you to retroactively & optionally "pay your bill," could this generate the cash to keep the service running?
  - etatoby 10y ago
    This is a nice idea. It could keep running totals for other free resources as well, such as Wikipedia. I bet it would increase donations to useful projects like these.
  - Cpoll 10y ago
    This isn't altogether uncommon in free software, and is sometimes referred to as 'beggarware'. I've been guilted into donating by some of these, but if it's too annoying it can have the opposite effect and cause you to drop the software. One that comes to mind is a download site that tracked your download count and put a rainbow-colored '(maybe you should donate)' link next to it. Not very detrimental to the UX, but gets the message across.