Query on TBB updater

Discussion in 'privacy technology' started by Palancar, Apr 4, 2015.

  1. Palancar

    Palancar Registered Member

    Joined:
    Oct 26, 2011
    Posts:
    1,591
    I am hoping maybe someone a little "deeper" in the TOR system can verify/confirm something for us. I have been following the development of the TBB system updater. We have had a few posts running around discussing the merit of simply pulling down the entire TBB fresh and clean, and then using gpg to verify file integrity. Clearly that is a sure fire way to handle security, but lets evolve here and expand on something they have been working hard on. Namely; to make it easy for users to safely update TBB without the complete process as we have been doing.

    I want to print a comment from the TOR blog attached with release 4.5a3:

    Tor Browser 4.5a3 is based on Firefox ESR 31.4.0, which features important security updates to Firefox. Its updater now contains the code for verifying signed update files and does not accept unsigned ones anymore

    https://blog.torproject.org/blog/tor-browser-45a3-released

    That would seem to be confirming that NOW the updater works just like Linux system updates ---- meaning only signed files will be allowed. Super if its true.

    My question arises because this note is attached to a TOR ALPHA release. So, does the TBB now use this code universally in the final releases or was this an Alfa test?

    Sorry but I am not expert enough coder to take this apart and confirm this for everyone here.
     
  2. mirimir

    mirimir Registered Member

    Joined:
    Oct 1, 2011
    Posts:
    6,028
    Unless there's language like that for the mainline, it's just for alpha.
     
Loading...