Opened 3 years ago

Closed 3 years ago

#19014 closed defect (wontfix)

torbrowser 5.5.4 updates itself without permission

Reported by: Ilya_SpongeBob Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: ui?
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

version : torbrowser-install-5.5.4_en-US.exe md5=b9526c169b5b80ac18b97aafd32404d4

I set radiobutton Tools - Options - Advanced - Update - Never check for updates (not recommended: security risk).

But browser in few minutes inform me that new update downloaded and applies it next start. I have temporary set read-only attribute on "I:\Tor Browser\Browser\TorBrowser\Data\Browser\Caches\firefox", but I don't want to do such things.

Child Tickets

Change History (9)

comment:1 Changed 3 years ago by Ilya_SpongeBob

How to block updates downloads and checking ? If I disconnect LAN cable Tor Browser doesn't start.

What other activities of doubtful necessity Browser does? How to turn off them?

I pay much money for every byte, so please turn off all not necessary activities in next release.

comment:2 Changed 3 years ago by teor

Component: - Select a componentApplications/Tor Browser
Keywords: ui? added
Owner: set to tbb-team
Priority: Very HighMedium
Severity: CriticalNormal

comment:3 Changed 3 years ago by cypherpunks

I don't know what that UI is supposed to do in Tor Browser, but there's a way to accomplish this by directly changing some preference(s).

If you think you know what you're doing, read the release announcement for Tor Browser 5.0.

comment:4 Changed 3 years ago by Ilya_SpongeBob

I've read release announcement "Tor Browser 5.0 is released" https://blog.torproject.org/category/tags/tbb?page=3 . According it I installed clean browser from box ( https://dist.torproject.org/torbrowser/5.5.4/torbrowser-install-5.5.4_en-US.exe ) , started, opened about:config page and changed app.update.auto = false. But update was downloaded and successfully applied next start. Useless advice.

Last edited 3 years ago by Ilya_SpongeBob (previous) (diff)

comment:5 Changed 3 years ago by mcs

Setting app.update.enabled = false will disable update checks and prevent future downloads (and choosing the "Never Check for Updates" radio button will also set that pref to false). But, unfortunately, if Tor Browser has already started to download an update when you switch that pref to false, the download will not be stopped.

As far as I know, Firefox (and therefore Tor Browser) does not provide a way to stop an update that has already started. A workaround would be to exit the browser, find the UpdatesInfo directory, and remove the active-update.xml file as well as the updates directory.

The best way to avoid this situation is to install the current stable version of Tor Browser (which will not need to update itself) and then set app.update.enabled = false. Note that generally it is not safe to use an old version of Tor Browser since nearly all of our releases include important security fixes.

comment:6 Changed 3 years ago by Ilya_SpongeBob

When I don't start browser after instalation and create file "I:\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js" manually and writedown line

user_pref("app.update.auto", false);

it looks like updates are not downloaded anymore, but annoying nag appears every 5 minutes, that update is available.

In 'Tools - Options - Advanced - Update' I see "Check for updates, but let me choose whether to install them" radiobutton switched on.

Last edited 3 years ago by Ilya_SpongeBob (previous) (diff)

comment:7 in reply to:  6 Changed 3 years ago by brade

Replying to Ilya_SpongeBob:

...
it looks like updates are not downloaded anymore, but annoying nag appears every 5 minutes, that update is available.

Setting app.update.auto to false does not disable the checks.
You need to set app.update.enabled to false.

...

comment:8 Changed 3 years ago by Ilya_SpongeBob

Experts suggested in addition to add to "I:\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js"

user_pref("app.update.enabled", false);

and in file "..\Browser\defaults\pref\channel-prefs.js"
pref("app.update.channel", "release");
to replace by
pref("app.update.channel", "no");

As I can see app.update.enabled disables nag.

comment:9 Changed 3 years ago by gk

Resolution: wontfix
Status: newclosed

Seems you find a workaround? Good. I don't think we plan working on this.

Note: See TracTickets for help on using tickets.