I am hoping maybe someone a little "deeper" in the TOR system can verify/confirm something for us. I have been following the development of the TBB system updater. We have had a few posts running around discussing the merit of simply pulling down the entire TBB fresh and clean, and then using gpg to verify file integrity. Clearly that is a sure fire way to handle security, but lets evolve here and expand on something they have been working hard on. Namely; to make it easy for users to safely update TBB without the complete process as we have been doing. I want to print a comment from the TOR blog attached with release 4.5a3: Tor Browser 4.5a3 is based on Firefox ESR 31.4.0, which features important security updates to Firefox. Its updater now contains the code for verifying signed update files and does not accept unsigned ones anymore https://blog.torproject.org/blog/tor-browser-45a3-released That would seem to be confirming that NOW the updater works just like Linux system updates ---- meaning only signed files will be allowed. Super if its true. My question arises because this note is attached to a TOR ALPHA release. So, does the TBB now use this code universally in the final releases or was this an Alfa test? Sorry but I am not expert enough coder to take this apart and confirm this for everyone here.
