Make sure safebrowsing is still disabled in ESR 52

Safebrowsing prefs got renamed and features got added. We should make sure Safebrowsing is still disablled in ESR 52, though. For starters we could set

browser.safebrowsing.downloads.enabled = false browser.safebrowsing.downloads.remote.enabled = false browser.safebrowsing.malware.enabled = false browser.safebrowsing.phishing.enabled = false browser.safebrowsing.blockedURIs.enabled = false

added TorBrowserTeam201705R component::applications/tor browser ff52-esr owner::tbb-team priority::high resolution::fixed severity::major sponsor::4 status::closed tbb-7.0-must-alpha tbb-proxy-bypass type::task labels

enabled? o_0

No, I meant "disabled", thanks.

Trac:
Description: Safebrowsing prefs got renamed and features got added. We should make sure Safebrowsing is still enabled in ESR 52, though. For starters we could set

browser.safebrowsing.downloads.enabled = false browser.safebrowsing.downloads.remote.enabled = false browser.safebrowsing.malware.enabled = false browser.safebrowsing.phishing.enabled = false browser.safebrowsing.blockedURIs.enabled = false

to

Safebrowsing prefs got renamed and features got added. We should make sure Safebrowsing is still disablled in ESR 52, though. For starters we could set

browser.safebrowsing.downloads.enabled = false browser.safebrowsing.downloads.remote.enabled = false browser.safebrowsing.malware.enabled = false browser.safebrowsing.phishing.enabled = false browser.safebrowsing.blockedURIs.enabled = false
Summary: Make sure safebrowsing is still enabled in ESR 52 to Make sure safebrowsing is still disabled in ESR 52

Trac:
Username: tokotoko
Cc: N/A to fdsfgs@krutt.org

Here is what violates proxy obedience! See ticket:11254#comment:8

browser.safebrowsing.downloads.enabled: enables application reputation checks for downloaded files browser.safebrowsing.downloads.remote.enabled: enables remote lookups (requires the previous pref) https://wiki.mozilla.org/Security/Download_Protection

Trac:
Keywords: N/A deleted, tbb-proxy-bypass added

https://bugzilla.mozilla.org/show_bug.cgi?id=134105#c154 Is that a joke or what?! Lamers from Mozilla say they can't reproduce DNS leaks anymore. So they are waiting for TTP to explain them what else needs to be fixed to resolve that 15 years old bug!

Trac:
Status: new to needs_information
Priority: Medium to High
Severity: Normal to Major

More tickets for 7.0.

Trac:
Keywords: N/A deleted, tbb-7.0-must added

Getting more tickets on our alpha radar.

Trac:
Keywords: tbb-7.0-must deleted, tbb-7.0-must-alpha added

F*ck! This crap makes local DNS requests even if all prefs are disabled!

The value of browser.safebrowsing.provider.mozilla.updateURL is visible in my logs.

bug_21683 (https://gitweb.torproject.org/user/gk/tor-browser.git/commit/?h=bug_21683&id=92aaa8dfa72ddafc2a83e28863ecab3204b3a913) has a patch for review. I set the URLs to "" as a defense in depth.

Trac:
Status: needs_information to needs_review
Keywords: N/A deleted, TorBrowserTeam201705R added

r=brade, r=mcs Looks good to us. We also saw the following URL-based prefs but maybe they are only used for secondary queries?

browser.safebrowsing.provider.google.gethashURL
browser.safebrowsing.provider.google4.gethashURL
browser.safebrowsing.provider.mozilla.gethashURL

Replying to mcs:

r=brade, r=mcs Looks good to us. We also saw the following URL-based prefs but maybe they are only used for secondary queries? {{{ browser.safebrowsing.provider.google.gethashURL browser.safebrowsing.provider.google4.gethashURL browser.safebrowsing.provider.mozilla.gethashURL }}} I think so. But, however, I set them to "" as well in commit e6b28367e061f9b6912c3b150383255bdff0ef5c tor-browser-52.1.0esr-7.0-2 as this makes things more clear and doesn't hurt.

Trac:
Resolution: N/A to fixed
Status: needs_review to closed

closed

moved to tpo/applications/tor-browser#21683 (closed)