Opened 7 months ago

Closed 5 months ago

#33864 closed defect (fixed)

Nightly Tor Browser updates are broken since at least 4/6/2020

Reported by: gk Owned by: tbb-team
Priority: High Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: TorBrowserTeam202006R
Cc: boklm Actual Points:
Parent ID: Points:
Reviewer: gk Sponsor:

Description

I tried to update my Tor Browser nightly on 04/06/2020 that is still using the version from 04/02/2020. It said my Tor Browser is up-to-date. However, newer nightly binaries were available, e.g. from 04/06/2020.

Child Tickets

Change History (4)

comment:1 Changed 7 months ago by gk

Component: - Select a componentApplications/Tor Browser
Owner: set to tbb-team

comment:2 Changed 7 months ago by boklm

So it seems the issue was caused by downloads from http://f4amtbsowhix7rrf.onion/ being extremely slow (less than 10 KB/s). After looking at the web server logs, I noticed that something (maybe a web crawler) was trying to download every files, starting downloading a new every one or two seconds, which I though might be causing the issue.

To avoid web crawlers trying to download everything, I added some http authentication, with username and password tor-guest:
https://gitweb.torproject.org/user/boklm/tor-browser-build.git/commit/?h=bug_25102_v10&id=0201edc70f003ed7ffcee0098f752453a87980ba
https://gitweb.torproject.org/user/boklm/tor-browser-build.git/commit/?h=bug_25102_v10&id=1e1b5600fbdcc510692231905881e18deebba1be

This removed the many requests in the log. However download was still very slow, so this did not solve the issue. I removed /var/lib/tor/state and restarted tor (changing guards), and now it seems the downloads are back to previous speed.

comment:3 Changed 6 months ago by boklm

Keywords: TorBrowserTeam202004R added; TorBrowserTeam202004 removed
Status: newneeds_review

So it seems It was not the main issue, but I think adding authentication to download nightly builds (with tor-guest/tor-guest as username and password) helps saving bandwidth by avoiding bots which try to download everything. This is done with this commit:
https://gitweb.torproject.org/user/boklm/tor-browser-build.git/commit/?h=bug_33864&id=efe93411c75b8f2c0ba80164b9af7ab914614b9f

It can be disabled by setting nightly_build_nginx_auth_basic_enable to false.

comment:4 Changed 5 months ago by gk

Keywords: TorBrowserTeam202006R added; TorBrowserTeam202004R removed
Resolution: fixed
Reviewer: gk
Status: needs_reviewclosed

Looks good. Merged to master with commit dead06d60f62a8042fbf8a1d67a7f7835b7d5fce.

Note: See TracTickets for help on using tickets.