all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
From: "André Batista" <nandre@riseup.net>
To: "Ludovic Courtès" <ludo@gnu.org>
Cc: Raghav Gururajan <raghavgururajan@disroot.org>,
	Xinglu Chen <public@yoctocell.xyz>,
	42380@debbugs.gnu.org, Leo Famulari <leo@famulari.name>
Subject: [bug#42380] Wow!
Date: Thu, 27 May 2021 22:45:51 -0300	[thread overview]
Message-ID: <YLBLT5y08LIuYQba@andel> (raw)
In-Reply-To: <87tumqwlqm.fsf@gnu.org>

Hi,

ter 25 mai 2021 às 23:24:01 (1621995841), ludo@gnu.org enviou:
> Leo Famulari <leo@famulari.name> skribis:
> 
> > Does this package build the Tor browser from source? Or is it just a
> > launcher, like the Debian package?
> 
> It builds from source.

Apart from noscript which Tor Browser itself does not build from source
and https-everywhere which at the time I thought I'd be able to build
from source but I got stuck on rust dependency nightmare and had to
delay. Unfortunately, this issue still remains to be solved.

> And sorry for dropping the ball, André!  If anyone’s willing to give it
> a try and report back, or to comment on the patch, that’d be great.

No problem, Ludo, it was lacking feedback and I know it's somewhat a
big and delicate piece of software to be merging without it.

> > My understanding is that the Tor people discourage anyone else from
> > distributing builds of the Tor browser.

That's also my understanding, however I do think that building from
source is: 1. the very core of software freedom, despite the relevance
other concerns such as diminishing anonymity set; 2. one of the main
strenghts and what Guix strives for.

> > If it builds from source, we should probably call it something besides
> > "Tor browser", since it will be different from the official Tor browser
> > due to the unbundling and other changes.

I've initially called the package definition "torbrowser-unbundle" and
also inserted a warning that it was _not_ official Tor Browser, but I
did not try to patch sources to rename the browser as it appears after
installed. I can both agree to another name that makes it clearly
appart from the official browser by Tor Project ("nottorbrowser?",
"onionbrowser?") and to work on a patching sources to remove the user
visible name and logo, if it's deemed necessary. (That may take a while
however).

> > Also, if it builds from source, it will be easy to identify users of
> > this package as being Guix users and since the Guix userbase is
> > relatively small, it will be much easier than usual to positively
> > identify the person using the package.

I've tested it with panopticlick.eff.org and it's user identifying bits
remain the same as the official Tor Browser. That said, panopticlick
is certainly not a silver bullet and you have grounds to be concerned.
If someone were to need/want the very best assurances on anonymity set,
I'd advise not to risk it and go with the larger crowd.

On the other hand, until not long ago and maybe currently still, guix
users were using IceCat with tor and that's a much more telling tale.

> Good points.  I think we could ask the Tor Browser folks (we met with a
> couple of them at Reproducible Builds Summits in the past and I’m
> confident we’d understand each other :-)).

That would be great :)

In the mean time, I'll take this as an invitation to send a new patch
version with the latest Tor Browser stable. I've made some minor
improvements such as using tarballs from archive.torproject.org instead
of {git|dist}.torproject.org.

Since they are planning a new stable release in the next few days, I'll
take the time to work on a reproducibility issue that have arised with
the new zip routine to package extensions inside omni.ja which affected
the timestamps, at least the way I did it.

Cheers,




  reply	other threads:[~2021-05-28  1:47 UTC|newest]

Thread overview: 56+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-15 21:15 [bug#42380] [WIP] gnu: Add torbrowser-unbundle André Batista
2020-07-25 14:49 ` [bug#42380] [PATCH] " André Batista
2020-08-03 12:55   ` André Batista
2020-09-07 14:13     ` Ludovic Courtès
2020-09-09  2:24       ` André Batista
2020-09-09  7:20         ` Ludovic Courtès
2020-09-09 10:59           ` Efraim Flashner
2020-09-15 14:21           ` [bug#42380] [PATCH 0/9] " André Batista
2020-09-15 15:01             ` [bug#42380] [PATCH 1/9] gnu: Add go-torproject-org-ptlib André Batista
2020-09-15 15:04             ` [bug#42380] [PATCH 2/9] gnu: Add go-github-com-agl-ed25519 André Batista
2020-09-15 22:50               ` [bug#42380] [PATCH 2v2/9] " André Batista
2020-09-15 15:06             ` [bug#42380] [PATCH 0/9] gnu: Add go-github-com-dchest-siphash André Batista
2020-09-15 22:53               ` [bug#42380] [PATCH 3/9] " André Batista
2020-09-15 15:08             ` [bug#42380] [PATCH 4/9] gnu: Add go-github-com-dchest-uniuri André Batista
2020-09-15 15:10             ` [bug#42380] [PATCH 5/9] gnu: Add go-github-com-dsnet-compress André Batista
2020-09-15 15:12             ` [bug#42380] [PATCH 6/9] gnu: Add go-schwanenlied-me-yawning-bsaes André Batista
2020-09-15 15:14             ` [bug#42380] [PATCH 7/9] gnu: Add go-gitlab-com-yawning-utls André Batista
2020-09-15 15:15             ` [bug#42380] [PATCH 8/9] gnu: obfs4 André Batista
2020-09-15 15:16             ` [bug#42380] [PATCH 9/9] gnu: Add torbrowser-unbundle André Batista
2020-09-24 23:18               ` [bug#42380] [PATCHv2 " André Batista
2020-10-07 15:51                 ` [bug#42380] [PATCHv3 " André Batista
2021-06-03  3:17                   ` [bug#42380] [PATCH v4 0/9] " André Batista
2021-06-03  3:17                     ` [bug#42380] [PATCH v4 1/9] gnu: Add go-torproject-org-ptlib André Batista
2021-06-03  3:17                     ` [bug#42380] [PATCH v4 2/9] gnu: Add go-github-com-agl-ed25519 André Batista
2021-06-03  3:17                     ` [bug#42380] [PATCH v4 3/9] gnu: Add go-github-com-dchest-siphash André Batista
2021-06-03  3:17                     ` [bug#42380] [PATCH v4 4/9] gnu: Add go-github-com-dchest-uniuri André Batista
2021-06-03  3:17                     ` [bug#42380] [PATCH v4 5/9] gnu: Add go-github-com-dsnet-compress André Batista
2021-06-03  3:17                     ` [bug#42380] [PATCH v4 6/9] gnu: Add go-schwanenlied-me-yawning-bsaes André Batista
2021-06-03  3:17                     ` [bug#42380] [PATCH v4 7/9] gnu: Add go-gitlab-com-yawning-utls André Batista
2021-06-03  3:17                     ` [bug#42380] [PATCH v4 8/9] gnu: Add obfs4 André Batista
2021-06-03  3:17                     ` [bug#42380] [PATCH v4 9/9] gnu: Add torbrowser-unbundle André Batista
2021-06-03  4:10                       ` [bug#42380] [PATCH v5 " André Batista
2021-06-03 21:07                         ` Maxime Devos
2021-07-10  3:10                           ` André Batista
2021-06-03 21:07                         ` Maxime Devos
2020-09-12 13:35 ` [bug#42380] Wow! Raghav Gururajan
2020-09-15 15:23   ` André Batista
2021-05-25 15:05     ` Xinglu Chen
2021-05-25 19:12       ` Leo Famulari
2021-05-25 21:24         ` Ludovic Courtès
2021-05-28  1:45           ` André Batista [this message]
2021-06-03 20:43             ` Ludovic Courtès
2023-12-12 11:21 ` [bug#42380] [PATCH] gnu: Add torbrowser Clément Lassieur
2023-12-14 21:54   ` André Batista
2023-12-15 17:04     ` André Batista
2023-12-16  3:49     ` André Batista
2023-12-19 18:19     ` Clément Lassieur
2023-12-21 15:05       ` [bug#42380] [WIP] gnu: Add torbrowser-unbundle Clément Lassieur
2023-12-22 14:54         ` André Batista
2023-12-25 15:28           ` Clément Lassieur
2023-12-27 10:03             ` André Batista
2023-12-27 11:18               ` bug#42380: " Clément Lassieur
2023-12-21 13:56   ` [bug#42380] [PATCH v2] gnu: Add torbrowser Clément Lassieur
2023-12-27 21:22 ` [bug#42380] [WIP] gnu: Add torbrowser-unbundle Anonymousemail via Guix-patches via
2023-12-28 16:03   ` Clément Lassieur
2023-12-30  0:34   ` Clément Lassieur

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YLBLT5y08LIuYQba@andel \
    --to=nandre@riseup.net \
    --cc=42380@debbugs.gnu.org \
    --cc=leo@famulari.name \
    --cc=ludo@gnu.org \
    --cc=public@yoctocell.xyz \
    --cc=raghavgururajan@disroot.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.