4 ms·

Yet again, TOR gets blamed for a Firefox vulnerability. Surprise, surprise...

eli 10y ago
To be fair it's the Firefox that comes as part of the popular official Tor bundle.
mtgx 10y ago
The fact that Mozilla is so slow in implementing real per-process sandboxing in Firefox and that it doesn't even plan to rewrite most of the browser in Rust over the next few years, makes me think that maybe Tor should just bite the bullet and rebuild on top of Chromium, while vigilantly watching out for anti-privacy features in it that they can remove.
- indolering 10y ago
  They can't use Chromium because the Chrome team refuses to maintain certain features required by Tor, such as routing all traffic through the SOCKS proxy [0]. They would have to literally create a new browser. 0: https://bugs.chromium.org/p/chromium/issues/detail?id=80722#c33 https://bugs.chromium.org/p/chromium/issues/detail?id=80722#...
  - nilved 10y ago
    They're targeting the wrong level of abstraction. I think people should use Whonix or Tails instead of Tor Browser.
    - tribby 10y ago
      >I think people should use Whonix or Tails instead of Tor Browser. I'm not sure I follow. Tor Browser is the default browser of both operating systems.
      - haser_au 10y ago
        Whonix and Tails are OSes, meaning they could override what the browser tries to do in terms of network access. If Chromium prevents a plugin from directing all traffic to SOCKS, just take controls of Chromium's network settings from the underlying OS (Whonix, Tails). Note: This just answers the question about browsers or other pieces of software that don't allow control of their network components. It doesn't address a vulnerability in that software.
      - nilved 10y ago
        If it is, it's for their anti-fingerprinting features and not for Tor. What I'm saying is that running Tor on a machine that also connects to the public Internet is a bad idea. Use full-system Tor through iptables at the very least, and ideally use Tor on the router or host machine so it's transparent to the guest.

eli 10y ago

To be fair it's the Firefox that comes as part of the popular official Tor bundle.

mtgx 10y ago

The fact that Mozilla is so slow in implementing real per-process sandboxing in Firefox and that it doesn't even plan to rewrite most of the browser in Rust over the next few years, makes me think that maybe Tor should just bite the bullet and rebuild on top of Chromium, while vigilantly watching out for anti-privacy features in it that they can remove.

indolering 10y ago
They can't use Chromium because the Chrome team refuses to maintain certain features required by Tor, such as routing all traffic through the SOCKS proxy [0]. They would have to literally create a new browser. 0: https://bugs.chromium.org/p/chromium/issues/detail?id=80722#c33 https://bugs.chromium.org/p/chromium/issues/detail?id=80722#...
- nilved 10y ago
  They're targeting the wrong level of abstraction. I think people should use Whonix or Tails instead of Tor Browser.
  - tribby 10y ago
    >I think people should use Whonix or Tails instead of Tor Browser. I'm not sure I follow. Tor Browser is the default browser of both operating systems.
    - haser_au 10y ago
      Whonix and Tails are OSes, meaning they could override what the browser tries to do in terms of network access. If Chromium prevents a plugin from directing all traffic to SOCKS, just take controls of Chromium's network settings from the underlying OS (Whonix, Tails). Note: This just answers the question about browsers or other pieces of software that don't allow control of their network components. It doesn't address a vulnerability in that software.
    - nilved 10y ago
      If it is, it's for their anti-fingerprinting features and not for Tor. What I'm saying is that running Tor on a machine that also connects to the public Internet is a bad idea. Use full-system Tor through iptables at the very least, and ideally use Tor on the router or host machine so it's transparent to the guest.