[tor-dev] Tor Browser Launcher

[Jacob Appelbaum]

Micah Lee:
> In my spare time I've been working on a way to make the Tor Browser
> Bundle easier to use for GNU/Linux users. I've mostly been talking about
> it with other people on tor-talk and in this bug:
> https://trac.torproject.org/projects/tor/ticket/5236

Thanks for documenting so much on that bug!

> 
> I decided to write Tor Browser Launcher, a completely separate program
> that's in charge or adding a "Tor Browser" .desktop file (so you can
> open it from your desktop environment's menu), downloads the latest
> version for you, verifies it's signature (making it more secure than how
> much GNU/Linux users get TBB), and installs it in your home directory. I
> think that Tor Browser Launcher can get in Debian and Ubuntu.
> 

Do you plan to download TBB over Tor that is provided by the system, say
by adding a dependency on a system Tor?

> I just finished a first version of it. The code is here:
> https://github.com/micahflee/torbrowser-launcher
> 

Awesome, I've forked it and if I see anything, I'll send you a pull request.

> And there are screenshots here:
> http://imgur.com/a/Mvpwl
> 

These look pretty great. I'd say the wording needs a bit of work but
generally, it seems reasonable. I'd suggest that if signatures don't
work, I'd add a 'report' button rather than an exit button. I'd also
suggest that you might want to ensure that version numbers are always
increasing and other things that are outlined in the. A MITM may be able
to replay an old valid signature for a package, does your code handle
that case? You may enjoy the paper and code on theupdateframework.com to
look into those kinds of issues...

Do you pin SSL certs? Or fetch from known mirrors? Or...? :)

> You can read details about how it works on my latest comment on that
> bug: https://trac.torproject.org/projects/tor/ticket/5236#comment:32
> 

Seems straight forward.

> Before trying to get it in Debian I'd like to make it so it doesn't need
> to be updated each time TBB is updated. There are more details in the
> ticket, but this would require Tor to maintain a file on
> https://www.torproject.org/ that has the current version number of TBB
> in it and a timestamp, and possibly digital signature of this file too.
> 

TBB has a version check built into it - have you seen how it works?

> Do you think this is doable?
> 

I think it is reasonable - I wonder though, can't you just fetch
https://www.torproject.org/dist/torbrowser/ and parse it to look for
files that match a given file pattern? As an example,
https://www.torproject.org/dist/torbrowser/?C=M;O=D will sort by latest
date, as will https://www.torproject.org/dist/torbrowser/linux/?C=M;O=D
for GNU/Linux and so on for Mac OS X:
https://www.torproject.org/dist/torbrowser/osx/?C=M;O=A

> I also want to get it localized into all the languages TBB is localized
> into. Any thoughts or suggestions?
> 

Once the program is structured in a way that the strings are pretty much
fixed, I'd suggest Transifex: https://www.transifex.com/ as it is what
Tor uses for most every translation need.

I'm off to read the code and try it out! Thanks!

All the best,
Jake