Bug #9562

Document that we advise against add-on update

Added by mercedes508 2015-06-12 07:48:59 . Updated 2015-07-07 07:22:11 .

Status:
Resolved
Priority:
Normal
Assignee:
Category:
Target version:
Tails_1.5
Start date:
2015-06-12
Due date:
% Done:

100%

Feature Branch:
Type of work:
End-user documentation
Blueprint:

Starter:
Affected tool:
Browser
Deliverable for:

Description

As far as I understood we’re against users adding others add-on to Tor Browser. I bet we’re against users manually updating included add-on as well because it doesn’t go through any audit.

We should add a FAQ entry about that if we agree on the previous point.

Subtasks

History

#1 Updated by intrigeri 2015-06-12 08:13:21

  • Status changed from New to Confirmed
  • Assignee set to mercedes508

> I bet we’re against users manually updating included add-on as well because it doesn’t go through any audit.

I think that the reasons stated in our “Should I update Tails using apt-get or Synaptic?” FAQ apply as-is here.

> We should add a FAQ entry about that if we agree on the previous point.

Yes, please.

#2 Updated by mercedes508 2015-06-12 08:38:25

  • Assignee changed from mercedes508 to sajolida
  • % Done changed from 0 to 50
  • QA Check set to Ready for QA

A draft is pending for review here:

mercedes508 doc/9562 9d5299c

#3 Updated by sajolida 2015-06-16 07:11:05

  • Assignee changed from sajolida to mercedes508
  • QA Check changed from Ready for QA to Info Needed

According to Georg Koppen from TBB, automatic updates are only prevented for Torbutton and Tor Launcher. https://lists.torproject.org/pipermail/tbb-dev/2015-April/000258.html

So right now our browser might be checking for updates of Adblock Plus, HTTPS Everywhere, NoScript, and amnesia branding automatically every day. Unless we did something specific to prevent this in Tails.

Can you check whether automatic updates are performed by TBB in Tails?

#4 Updated by intrigeri 2015-06-18 03:32:44

> So right now our browser might be checking for updates of Adblock Plus, HTTPS Everywhere, NoScript, and amnesia branding automatically every day. Unless we did something specific to prevent this in Tails.

We set this:

pref("extensions.update.enabled", false);

… but not sure what’s the exact effect in practice.

#5 Updated by sajolida 2015-06-18 07:00:30

  • Assignee changed from mercedes508 to sajolida
  • QA Check changed from Info Needed to Ready for QA

According to https://blog.mozilla.org/addons/how-to-turn-off-add-on-updates/ it makes Firefox “no longer check your add-ons for updates”. How surprinsing! :)

So I’ll mark this ticket for review again.

#6 Updated by intrigeri 2015-07-06 04:47:52

  • Target version set to Tails_1.5
  • Affected tool set to Browser

Setting next version as the milestone, as we do by default for all proposed branches.

#7 Updated by sajolida 2015-07-07 07:21:10

  • Status changed from Confirmed to Resolved
  • % Done changed from 50 to 100

Applied in changeset commit:88952da4d19779b2ec037c12792dabf70444369a.

#8 Updated by sajolida 2015-07-07 07:22:11

  • Assignee deleted (sajolida)
  • QA Check deleted (Ready for QA)

Merged, almost as is. Thanks!