Opened 5 years ago

Closed 5 years ago

#13432 closed defect (not a bug)

TBB on Linux just asked me if I wanted to update

Reported by: mikeperry Owned by: tbb-team
Priority: High Milestone:
Component: Applications/Tor Browser Version:
Severity: Keywords: TorBrowserTeam201410, MikePerry201410R
Cc: mcs, brade, Sherief Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

My TBB 4.0-alpha-3 just popped up a window asking me if I wanted to upgrade (I just uploaded the manifest files).

I had previously clicked on the "Help->About Tor Browser" tab, but I had closed that window several minutes prior.

This probably shouldn't have happened, and it especially shouldn't happen for our stable users. We want them to explicitly navigate to the Help window to upgrade if they want to. At least, until we get #11955 and #13379 fixed.

Child Tickets

Change History (5)

comment:1 Changed 5 years ago by mcs

This bug is due to a misunderstanding on the part of brade and myself. We did not realize that you did not want the upgrade prompt to be displayed automatically. TB 4.0 (and the alphas too) will check twice each day for updates (like Firefox does, except TB will always prompt before downloading the update). Sorry!

We will have to look at whether a patch is needed to prevent this or whether we can just change a preference (I cannot remember whether setting app.update.enabled = false will still allow manual update checks).

Note that regarding certificate pinning, we did insert pref. values to ensure that the TLS connection used to retrieve the update manifest is to torproject.org. See the app.update.certs.1.commonName and app.update.certs.1.issuerName pref. values.

comment:2 Changed 5 years ago by Sherief

Cc: Sherief added

comment:3 in reply to:  1 Changed 5 years ago by mcs

Keywords: MikePerry201410R added
Status: newneeds_review

Replying to mcs:

We will have to look at whether a patch is needed to prevent this or whether we can just change a preference (I cannot remember whether setting app.update.enabled = false will still allow manual update checks).

Our review of the code as well as some testing confirms that setting app.update.enabled to false will disable the automatic (timer-based) update checks while still allowing manual checks. Mike, do you want Kathy and/or me to create a patch for 000-tor-browser.js or do you just want to add the following line yourself?

pref("app.update.enabled", false);

comment:4 Changed 5 years ago by arma

Last I heard, Mike was thinking of leaving this enabled.

We could disable it in the next one, but the current 4.0 users will see it, and expect that it will work again the second time, and call it a bug when it doesn't.

I think if we can get #11955 and/or #13379 in real soon now, leaving this one enabled is a fine plan.

comment:5 Changed 5 years ago by mikeperry

Resolution: not a bug
Status: needs_reviewclosed

Yeah, after thinking about it, I think we should just leave this in, and make sure the pinning and MAR signing works out.

Note: See TracTickets for help on using tickets.