[tor-bugs] #26401 [Applications/Tor Browser]: Rebase Orfox patches onto Tor Browser 8.0 for TBA

[Tor Bug Tracker & Wiki]

#26401: Rebase Orfox patches onto Tor Browser 8.0 for TBA
-----------------------------------------------+---------------------------
 Reporter:  sysrqb                             |          Owner:  tbb-team
     Type:  task                               |         Status:
                                               |  needs_review
 Priority:  Very High                          |      Milestone:
Component:  Applications/Tor Browser           |        Version:
 Severity:  Normal                             |     Resolution:
 Keywords:  tbb-mobile, TorBrowserTeam201807R  |  Actual Points:
Parent ID:  #26531                             |         Points:
 Reviewer:                                     |        Sponsor:
-----------------------------------------------+---------------------------

Comment (by sysrqb):

 Replying to [comment:5 igt0]:
 > I will review in batches:
 >

 Thanks!

 >
 > ''97ca08c7c8bc Bug 25741 - TBA: Add mobile-override of 000-tor-browser
 prefs''
 >
 > 1. Do we want to disable the app.update.enabled (I am asking because of
 the #26242)?
 >

 My plan was disabling this pref for now. We can add a URL when have a plan
 for #26242.

 > 2. About the user agent, I think it would be rv: 60.0, Gecko/60.0 and
 Firefox/60.0. Do we need to specify the android version?

 I was following Mozilla's new UAS format. This is the format Tor Browser
 is using on desktop now, too - but this may change with #26146. I chose
 that Android version because it is the oldest version of Android we
 support and the oldest version of Android that Google report 1%+ users.

 https://developer.android.com/about/dashboards/
 https://dxr.mozilla.org/mozilla-
 central/source/mobile/android/base/AppConstants.java.in#140 (you probably
 saw this already)

 >
 > 3. I think we should disable all the sensors. (device.sensors.*)

 Yes. I was thinking we can enumerate the other fingerprinting prefs we
 want disabled/changed in #25703. I only concentrated on the defenses Orfox
 provided in this patch.

 >
 > ''6d7a72d3e95b Bug 25741 - TBA: Add an AppConstant for
 TOR_BROWSER_VERSION''
 > I think we need to add something in the .mozconfigure specifying the
 current browser version, right?
 >

 We can provide it on the command line when running ./mach configure (this
 is how tor-browser-build provides it). I was using
 {{{
 ./mach configure --with-tor-browser-version=8.0 --with-distribution-
 id=org.torproject --enable-update-channel=alpha --enable-bundled-fonts
 }}}

 When the environment variable `TB_BUILD_WITH_UPDATER` is not set, then the
 updater is excluded at compile-time.

 > ''66ecd900c106 Bug 25741 - TBA: Add mozconfig for Android and pertinent
 branding files.''
 > Are we going to use Orfox assets? if yes, **LGTM**
 >

 I think yes, until we have replacements.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/26401#comment:11>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online