Re: [tor-bugs] #27016 [Applications/Tor Browser]: TBA: Audit thirdparty picasso

[Tor Bug Tracker & Wiki]

#27016: TBA: Audit thirdparty picasso
-+-
 Reporter:  sysrqb   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:  closed
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:  fixed
 Keywords:  tbb-mobile, tbb-proxy-bypass,|  Actual Points:
  TorBrowserTeam201808R  |
Parent ID:  #25851   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * status:  needs_review => closed
 * resolution:   => fixed


Comment:

 Looks good to me. It's commit dda3c7d44a12cc2d9ff5e071605c8f36670ac956 on
 `tor-browser-60.1.0esr-8.0-1`.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #27016 [Applications/Tor Browser]: TBA: Audit thirdparty picasso

[Tor Bug Tracker & Wiki]

#27016: TBA: Audit thirdparty picasso
-+-
 Reporter:  sysrqb   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-mobile, tbb-proxy-bypass,|  Actual Points:
  TorBrowserTeam201808R  |
Parent ID:  #25851   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by sysrqb):

 * keywords:  tbb-mobile, tbb-proxy-bypass => tbb-mobile, tbb-proxy-bypass,
 TorBrowserTeam201808R


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #27016 [Applications/Tor Browser]: TBA: Audit thirdparty picasso

[Tor Bug Tracker & Wiki]

#27016: TBA: Audit thirdparty picasso
--+--
 Reporter:  sysrqb|  Owner:  tbb-team
 Type:  defect| Status:  needs_review
 Priority:  Very High |  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-mobile, tbb-proxy-bypass  |  Actual Points:
Parent ID:  #25851| Points:
 Reviewer:|Sponsor:
--+--

Comment (by sysrqb):

 Replying to [comment:2 sysrqb]:
 > Replying to [comment:1 sysrqb]:
 > > This library using the `NetworkInfo` via the `ConnectivityManager` for
 deciding how many background threads it should create for processing.
 Higher bandwidth connections result in more threads. The default is 3, so
 this shouldn't be a problem. The library also registers for network change
 events. We'll probably need to change it so we don't require these Android
 permissions.
 > >
 >
 > This doesn't seem like it'll be a problem. Picasso catches missing
 permissions, so that shouldn't be cause a crash.

 I should note here, Picasso watches when "airplane mode" is enabled and
 disabled so it knows when it should retry downloading a file or failing
 (fail if airplane mode is enabled). I'm assuming we can safely keep this,
 for now.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #27016 [Applications/Tor Browser]: TBA: Audit thirdparty picasso

[Tor Bug Tracker & Wiki]

#27016: TBA: Audit thirdparty picasso
--+--
 Reporter:  sysrqb|  Owner:  tbb-team
 Type:  defect| Status:  needs_review
 Priority:  Very High |  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-mobile, tbb-proxy-bypass  |  Actual Points:
Parent ID:  #25851| Points:
 Reviewer:|Sponsor:
--+--
Changes (by sysrqb):

 * status:  new => needs_review


Comment:

 Replying to [comment:1 sysrqb]:
 > This library using the `NetworkInfo` via the `ConnectivityManager` for
 deciding how many background threads it should create for processing.
 Higher bandwidth connections result in more threads. The default is 3, so
 this shouldn't be a problem. The library also registers for network change
 events. We'll probably need to change it so we don't require these Android
 permissions.
 >

 This doesn't seem like it'll be a problem. Picasso catches missing
 permissions, so that shouldn't be cause a crash.

 > `UrlConnectionDownloader` is the only class that bypasses the proxy, so
 we'll need a patch for that, as well.

 I have a patch for this, branch `27016`, on my repo.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #27016 [Applications/Tor Browser]: TBA: Audit thirdparty picasso

[Tor Bug Tracker & Wiki]

#27016: TBA: Audit thirdparty picasso
--+--
 Reporter:  sysrqb|  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Very High |  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-mobile, tbb-proxy-bypass  |  Actual Points:
Parent ID:  #25851| Points:
 Reviewer:|Sponsor:
--+--

Comment (by sysrqb):

 This library using the `NetworkInfo` via the `ConnectivityManager` for
 deciding how many background threads it should create for processing.
 Higher bandwidth connections result in more threads. The default is 3, so
 this shouldn't be a problem. The library also registers for network change
 events. We'll probably need to change it so we don't require these Android
 permissions.

 `UrlConnectionDownloader` is the only class that bypasses the proxy, so
 we'll need a patch for that, as well.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

[tor-bugs] #27016 [Applications/Tor Browser]: TBA: Audit thirdparty picasso

[Tor Bug Tracker & Wiki]

#27016: TBA: Audit thirdparty picasso
-+-
 Reporter:  sysrqb   |  Owner:  tbb-team
 Type:  defect   | Status:  new
 Priority:  Very High|  Milestone:
Component:  Applications/Tor |Version:
  Browser|   Keywords:  tbb-mobile, tbb-proxy-
 Severity:  Normal   |  bypass
Actual Points:   |  Parent ID:  #25851
   Points:   |   Reviewer:
  Sponsor:   |
-+-
 Proxy-safe?
 {{{
 $ ls mobile/android/thirdparty/com/squareup/picasso/
 Action.java ContentStreamBitmapHunter.java
 GetAction.java  PicassoDrawable.javaStats.java
 Utils.java
 AssetBitmapHunter.java  DeferredRequestCreator.java
 ImageViewAction.javaPicassoExecutorService.java
 StatsSnapshot.java
 BitmapHunter.java   Dispatcher.java
 LruCache.java   Picasso.java
 TargetAction.java
 Cache.java  Downloader.java
 MarkableInputStream.javaRequestCreator.java
 Target.java
 Callback.java   FetchAction.java
 MediaStoreBitmapHunter.java Request.java
 Transformation.java
 ContactsPhotoBitmapHunter.java  FileBitmapHunter.java
 NetworkBitmapHunter.javaResourceBitmapHunter.java
 UrlConnectionDownloader.java
 }}}

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs