Opened 5 years ago

Closed 5 years ago

Last modified 5 years ago

#13406 closed enhancement (fixed)

Tor Browser 4.0 make use of the updater and stop directing users to download-easy.html.en

Reported by: Sherief Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Keywords: tbb-usability, tbb-usability-stoppoint-app, TorBrowserTeam201502
Cc: mcs, brade, gk, arthuredelstein Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description (last modified by Sherief)

While testing Tor Browser 4.0 I noticed that about:tor still points at TorButton to warn the user that this isn't a recommended (up-to-date) version. This shouldn't happen at all because now TB includes an updater and TorButton should make use of it.

TorButton should just update TB when "Download Tor Browser Bundle Update" when it's clicked. If it fails to get updates, suggest using mirrors or emailing the help desk or even better, gettor when it's up.

Child Tickets

Attachments (1)

software-update-13406.png (65.0 KB) - added by mcs 5 years ago.
Software Update Window

Download all attachments as: .zip

Change History (19)

comment:1 Changed 5 years ago by gk

Cc: mcs brade gk added

comment:2 Changed 5 years ago by Sherief

Description: modified (diff)

comment:3 Changed 5 years ago by brade

For 4.0, my assumption was that we should keep both update mechanisms in place (hedging our bets a little on the new updater). I do agree that it is a little strange to not even mention the built-in updater on about:tor, but I think it is too late to change strings, etc. for the 4.0 release. Mike, do you agree?

Also, we need to think about where we are headed in the long run. After we make the built-in updater more secure (for example, see #13379), then in my opinion we should not point users to a manual download process at all.

In the interim period before the built-in updater is checking signatures, etc. we should probably offer two options (perhaps two buttons?) on the about:tor page:

         [Update to Tor Browser 4.5]      [Manually Download Tor Browser]

What do other people think? Having two buttons seems a little silly and potentially confusing, but may be necessary for now to satisfy our diverse community.

Also, to be able to display the version number (as in "Update to Tor Browser 4.5") we would need to ensure that the built-in updater performs a check often (as is done by the older "this browser is out of date" mechanism).

We will also need to decide what changes to make to the Torbutton menu.

comment:4 Changed 5 years ago by mrphs

Keywords: usability added

comment:5 Changed 5 years ago by gk

Keywords: tbb-usability added; usability removed

comment:6 in reply to:  3 Changed 5 years ago by Sherief

Replying to brade:

For 4.0, my assumption was that we should keep both update mechanisms in place (hedging our bets a little on the new updater). I do agree that it is a little strange to not even mention the built-in updater on about:tor, but I think it is too late to change strings, etc. for the 4.0 release. Mike, do you agree?

Also, we need to think about where we are headed in the long run. After we make the built-in updater more secure (for example, see #13379), then in my opinion we should not point users to a manual download process at all.

In the interim period before the built-in updater is checking signatures, etc. we should probably offer two options (perhaps two buttons?) on the about:tor page:

         [Update to Tor Browser 4.5]      [Manually Download Tor Browser]

What do other people think? Having two buttons seems a little silly and potentially confusing, but may be necessary for now to satisfy our diverse community.

What if we can avoid buttons and make a select menu [Update] -> a) Check for updates b) Manual update within TorButton?

comment:7 Changed 5 years ago by Sherief

Description: modified (diff)
Summary: Tor Browser 4.0 should not warn users their version is outdated unless it can't fetch updatesTor Browser 4.0 make use of the updater and stop directing users to download-easy.html.en

comment:8 Changed 5 years ago by arthuredelstein

Cc: arthuredelstein added

comment:9 Changed 5 years ago by mikeperry

Keywords: TorBrowserTeam201501 added

comment:10 Changed 5 years ago by mikeperry

Keywords: tbb-usability-stoppoint-app added

comment:11 Changed 5 years ago by mikeperry

Keywords: TorBrowserTeam201502 added; TorBrowserTeam201501 removed

comment:12 Changed 5 years ago by mcs

A related ticket: #10238.

comment:13 in reply to:  3 ; Changed 5 years ago by mikeperry

Replying to brade:

For 4.0, my assumption was that we should keep both update mechanisms in place (hedging our bets a little on the new updater). I do agree that it is a little strange to not even mention the built-in updater on about:tor, but I think it is too late to change strings, etc. for the 4.0 release. Mike, do you agree?

I agree. This change should only be done on 4.5-alpha.

Also, we need to think about where we are headed in the long run. After we make the built-in updater more secure (for example, see #13379), then in my opinion we should not point users to a manual download process at all.

Correct. In fact, I think the 4.5 series is now secure enough to update automatically for everyone.

In the interim period before the built-in updater is checking signatures, etc. we should probably offer two options (perhaps two buttons?) on the about:tor page:

         [Update to Tor Browser 4.5]      [Manually Download Tor Browser]

What do other people think? Having two buttons seems a little silly and potentially confusing, but may be necessary for now to satisfy our diverse community.

Also, to be able to display the version number (as in "Update to Tor Browser 4.5") we would need to ensure that the built-in updater performs a check often (as is done by the older "this browser is out of date" mechanism).

We will also need to decide what changes to make to the Torbutton menu.

I think the about:tor page should remain the same, but the Torbutton menu link should perform the MAR-based update for 4.5+.

comment:14 in reply to:  13 ; Changed 5 years ago by mcs

Replying to mikeperry:

...
I think the about:tor page should remain the same, but the Torbutton menu link should perform the MAR-based update for 4.5+.

Thank you for your feedback and clarifications. Should we change Torbutton to stop retrieving
https://www.torproject.org/projects/torbrowser/RecommendedTBBVersions ?

If we do stop checking RecommendedTBBVersions, we may want to increase the frequency of the checks done by the updater and/or possibly trigger a check when about:tor is loaded. Our check interval is currently the same as Firefox's (twice per day, governed by app.update.interval).

comment:15 in reply to:  14 Changed 5 years ago by mikeperry

Replying to mcs:

Replying to mikeperry:

...
I think the about:tor page should remain the same, but the Torbutton menu link should perform the MAR-based update for 4.5+.

Thank you for your feedback and clarifications. Should we change Torbutton to stop retrieving
https://www.torproject.org/projects/torbrowser/RecommendedTBBVersions ?

If we do stop checking RecommendedTBBVersions, we may want to increase the frequency of the checks done by the updater and/or possibly trigger a check when about:tor is loaded. Our check interval is currently the same as Firefox's (twice per day, governed by app.update.interval).

I think in the interest of keeping this change as simple as possible, we should leave the RecommendedTBBVersions check in place, and simply fix the menu item to use the Firefox "Check for updates" functionality.

However, if it is simpler to make everything based on the update manifests, that is also fine.

Changed 5 years ago by mcs

Attachment: software-update-13406.png added

Software Update Window

comment:16 Changed 5 years ago by mcs

Keywords: TorBrowserTeam201502R added; TorBrowserTeam201502 removed
Status: newneeds_review

Please review the following proposed fix:

https://gitweb.torproject.org/user/brade/torbutton.git/commit/?h=bug13406-01&id=2ccb9cb66415e4f5de5fc4b496272921cac6614f

This change will make it so that:

  • A "Check for Tor Browser Updates" menu item is always included in the Torbutton menu.
  • The menu item label is bold if the RecommendedTBBVersions check has indicated that an update is available.
  • When that menu item is chosen, the Update Service's prompt window is opened to perform an update check. If an update is found, that window will look like this:

Software Update Window

comment:17 Changed 5 years ago by mikeperry

Resolution: fixed
Status: needs_reviewclosed

Ok, this is merged. Should appear in 4.5a4. Nice work.

comment:18 Changed 5 years ago by mcs

Keywords: TorBrowserTeam201502 added; TorBrowserTeam201502R removed
Note: See TracTickets for help on using tickets.