Re: [tor-talk] Firefox vs. Tor Browser Bundle release cycles

2013-12-11 Thread Al Billings
You can build as soon as the tree is frozen in hg. You’ll have to watch in case an emergency build 2 or 3 happens, which does occur, but you could build six to seven days before Firefox is released, which is what we do in order to give our QA time. All that happens on release day is we push to m

Re: [tor-talk] Firefox vs. Tor Browser Bundle release cycles

2013-12-11 Thread Al Billings
?? Mozilla runs a completely open, documented, and transparent release process. The dates are published basically six months in advance (and more like a year if you count in six week increments). We’ve moved one date (the next one) in the last 18 months, I think. See https://wiki.mozilla.org/Ra

Re: [tor-talk] Firefox vs. Tor Browser Bundle release cycles

2013-12-11 Thread Erinn Clark
* Al Billings [2013:12:11 17:38 -0800]: > Anyone paying attention knows there is a delta between TBB and Mozilla > releases. I can’t comment on why that’s the case as I don’t know the TBB > build, QA, or releases processes. To help clarify this situation a bit for everyone (since I have been mak

Re: [tor-talk] BIttorrent client installed by default in Tor centric distros okay?

2013-12-11 Thread andrew
On Wed, Dec 11, 2013 at 10:41:32PM +, adrela...@riseup.net wrote 2.0K bytes in 0 lines about: : Let's forget about the technical questions whether it's possible to : route all bittorrent traffic over Tor without leaks or not on focus on : the ethical question. My opinion is if you're going to

Re: [tor-talk] Firefox vs. Tor Browser Bundle release cycles

2013-12-11 Thread Lunar
bm-2d9whbg2vekslcsgbtplgwdlqypizsq...@bitmessage.ch: > Perhaps my experience was unique or users are to blame for their own > laziness in staying up-to-date, but I hope we can agree that making it > easier for TBB users to run the latest available Firefox code 95 or 99% of > the time could still be

Re: [tor-talk] Firefox vs. Tor Browser Bundle release cycles

2013-12-11 Thread BM-2D9WhbG2VeKsLCsGBTPLGwDLQyPizSqS85
> Again, I wonder what you’re doing to fix this issue or is this really > just an informational awareness campaign? I don't have any easy solutions to offer, but was hoping to start a conversation about figuring some out. I was hoping there would be some value in raising the issue. Understanding

Re: [tor-talk] Firefox vs. Tor Browser Bundle release cycles

2013-12-11 Thread Al Billings
I’ll also add that a two or three day delta on releases (which is most of those listed) is pretty damned good. The bugs in those releases aren’t public. Diffing changes and trying to contract zero days is actually quite hard as well. If you were talking about a month long difference in dates, I

Re: [tor-talk] Firefox vs. Tor Browser Bundle release cycles

2013-12-11 Thread Al Billings
Again, I wonder what you’re doing to fix this issue or is this really just an informational awareness campaign? Anyone paying attention knows there is a delta between TBB and Mozilla releases. I can’t comment on why that’s the case as I don’t know the TBB build, QA, or releases processes. The

Re: [tor-talk] BIttorrent client installed by default in Tor centric distros okay?

2013-12-11 Thread David
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 I would agree with the bandwidth issue, as many people find the Tor network slow as it is already. I would recommend adding an i2p router if people want to torrent. I2P doesn't seem to have a problem with it, and has a torrent client packaged in by d

Re: [tor-talk] Firefox vs. Tor Browser Bundle release cycles

2013-12-11 Thread BM-2D9WhbG2VeKsLCsGBTPLGwDLQyPizSqS85
My point was that users may not be aware of the possibilities of "looking at checkins, code changes, and binary diffs" even though it can affect their anonymity quite significantly. It doesn't seem crazy for users to assume that the latest version of a piece of software based on Firefox would gener

Re: [tor-talk] Firefox vs. Tor Browser Bundle release cycles

2013-12-11 Thread Al Billings
Yes but good luck with that. Mozilla and Tor are both aware of the possibilities involving looking at checkins, code changes, and binary diffs. From: bm-2d9whbg2vekslcsgbtplgwdlqypizsq...@bitmessage.ch bm-2d9whbg2vekslcsgbtplgwdlqypizsq...@bitmessage.ch An adversary could potentially dig throug

Re: [tor-talk] Firefox vs. Tor Browser Bundle release cycles

2013-12-11 Thread BM-2D9WhbG2VeKsLCsGBTPLGwDLQyPizSqS85
> Hello, > > Firefox ESR 17.0.11 indeed turns out (somewhat confusingly) to be  > equivalent to Firefox ESR 24.1.1, and the TBB based on ESR 17.0.11 was  > released only four days after Mozilla's updates, which frankly deserves  > praise. TBB's latest code is only one release behind Mozilla's o

[tor-talk] BIttorrent client installed by default in Tor centric distros okay?

2013-12-11 Thread adrelanos
Hi! Let's forget about the technical questions whether it's possible to route all bittorrent traffic over Tor without leaks or not on focus on the ethical question. There are quite a few contradicting statements from the Tor core people [1] about that. With my Whonix hat on, would you prefer if

Re: [tor-talk] Firefox vs. Tor Browser Bundle release cycles

2013-12-11 Thread Al Billings
Hello, Firefox ESR 17.0.11 indeed turns out (somewhat confusingly) to be  equivalent to Firefox ESR 24.1.1, and the TBB based on ESR 17.0.11 was  released only four days after Mozilla's updates, which frankly deserves  praise. TBB's latest code is only one release behind Mozilla's on security  pat

Re: [tor-talk] Firefox vs. Tor Browser Bundle release cycles

2013-12-11 Thread BM-2D9WhbG2VeKsLCsGBTPLGwDLQyPizSqS85
Thanks for catching my mistake. Firefox ESR 17.0.11 still leaves TBB users vulnerable to (from https://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html): Fixed in Firefox ESR 24.2 MFSA 2013-117 Mis-issued ANSSI/DCSSI certificate MFSA 2013-116 JPEG information leak MFSA 2013-115 GetE

Re: [tor-talk] Firefox vs. Tor Browser Bundle release cycles

2013-12-11 Thread Georg Koppen
bm-2d9whbg2vekslcsgbtplgwdlqypizsq...@bitmessage.ch: > The version of Firefox incorporated into the Tor Browser Bundle (TBB) > available via torproject.org is currently multiple releases behind both > Firefox ESR and Firefox. The latest-available Tor Browser Bundles > generally include versions of

[tor-talk] Firefox vs. Tor Browser Bundle release cycles

2013-12-11 Thread BM-2D9WhbG2VeKsLCsGBTPLGwDLQyPizSqS85
The version of Firefox incorporated into the Tor Browser Bundle (TBB) available via torproject.org is currently multiple releases behind both Firefox ESR and Firefox. The latest-available Tor Browser Bundles generally include versions of Firefox ESR that do not include patches for publicly known se

[tor-talk] (no subject)

2013-12-11 Thread hassan moujdi
HI ; i am a student in networking and security system, i working in a project to make a global private navigation to web by create a distribution based in Ubuntu . the project will include more interesting tools to make a secure connection with servers like a private cloud computing ,also a secur

[tor-talk] Diffie-Hellman parameters for torproject.org

2013-12-11 Thread Ondrej Sered
Hi, the webpage www.torproject.org and git.torproject.org, lists.torproject.org support Forward secrecy using 1024-bit DH group. https://www.ssllabs.com/ssltest/analyze.html?d=www.torproject.org&s=38.229.72.16 According to ECRYPT II Recommendations (2012) and NIST Recommendations (2012) Diffie-

[tor-talk] Tor Weekly News — December 11th, 2013

2013-12-11 Thread Lunar
Tor Weekly News December 11th, 2013 Welcome to the twenty-fourth issue of Tor Weekly News, the weekly newsletter th

Re: [tor-talk] Why postfix cannot work on tor (was What are some free and private emai providers?)

2013-12-11 Thread Mike Cardwell
* on the Wed, Dec 11, 2013 at 02:01:34AM +0100, t...@lists.grepular.com wrote: >> Exim or postfix are not so hard to learn and roundcube is pretty >> easy to install :) > > Postfix does not work with tor. > > There are a few problems: > > - Postfix does not have a SOCKS4a proxy option (in fact,