[tor-talk] Security in Tor Browser related to Firefox ESR

[Patrick Schleizer]

Moritz Bartl:
> On 02/12/2014 02:30 AM, Soul Plane wrote:
>> Ok thanks. I checked the blog today and saw that 3.5.2 was released. I
>> didn't get any announcement. Why not announce the releases through
>> tor-announce? I'm subscribed to that but I didn't get any notice. Is there
>> a list or RSS feed where just releases are announced? I don't want a lot of
>> emails. I don't plan to stay subscribed to tor-talk (there are lots of
>> things that just don't concern me) but for now I am and I didn't get a
>> notice of the new release on this list either.
> 
> +1 for using tor-announce to announce TBB releases.
> 
> At the moment what you can do is parse
> https://check.torproject.org/RecommendedTBBVersions . This could be
> turned into a very simple RSS feed. The document is used by the TBB
> update notifier, among others, so it should stay around (and updated)
> for a while.

https://check.torproject.org/RecommendedTBBVersions works as is. Please
consider documenting and finalizing the version format. TorButton uses
it, torbrowser-launcher uses it, Whonix's Tor Browser updater uses it.
Perhaps other scripts are using it as well, such as Fedora's TBB
packaging? Please don't break it! I guess these projects are better off
not implementing an rss parser.

Also RecommendedTBBVersions has a feature to mark multiple versions as
still valid. For example, revently it included "3.5.0-Linux" and
"3.5.1-Linux" at the same time for a while.

Why not better implement and rss feed for
https://blog.torproject.org/category/tags/tbb
? New versions are announced there anyway. And use of the "tbb" tag is
constant. Maybe there already is an rss link and I don't see it?