fmaury/seirdy.one
1
0
Fork 0
mirror of https://git.sr.ht/~seirdy/seirdy.one synced 2024-11-13 01:02:10 +00:00
Code Issues Projects Releases Wiki Activity

Update tor uplift post with one-month retrospective

Browse source
This commit is contained in:
Rohan Kumar 2022-10-20 11:56:04 -07:00
parent d62ee353ee
commit 057887a0f4
No known key found for this signature in database
GPG key ID: 1E892DB2A5F84479
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
content/notes/state-of-the-tor-uplift.md
View file

@ -9,3 +9,5 @@ The [Tor Uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) is an ini
On <time datetime="2022-06-28">2022-06-28</time>, Firefox 102 ESR was released. Today, on <time datetime="2022-09-20">2022-09-20</time>, Firefox 91 ESR will lose support. That gave a window of about three months (the duration of three Firefox stable releases) to re-base Tor Browser patches. On <time datetime="2022-06-28">2022-06-28</time>, Firefox 102 ESR was released. Today, on <time datetime="2022-09-20">2022-09-20</time>, Firefox 91 ESR will lose support. That gave a window of about three months (the duration of three Firefox stable releases) to re-base Tor Browser patches.
The first stable release of the Tor Browser based on ESR 102 hasn't yet shipped (it's close; [an alpha version is available](https://blog.torproject.org/new-alpha-release-tor-browser-120a2/)). Seven years into the Tor uplift, the Tor Project isn't able to keep up with the Firefox ESR release calendar. I don't think the Tor Uplift will succeed at getting the Tor Browser to track Firefox's stable channel; at best, it's keeping the Tor Browser from falling too far behind ESR. The first stable release of the Tor Browser based on ESR 102 hasn't yet shipped (it's close; [an alpha version is available](https://blog.torproject.org/new-alpha-release-tor-browser-120a2/)). Seven years into the Tor uplift, the Tor Project isn't able to keep up with the Firefox ESR release calendar. I don't think the Tor Uplift will succeed at getting the Tor Browser to track Firefox's stable channel; at best, it's keeping the Tor Browser from falling too far behind ESR.
<ins>Update <time>2022-10-20</time>: 30 days since Firefox ESR 91 reached end-of-life, the latest stable Tor Browser release (11.5.4) is still based on v91. [Five CVEs fixes from v102 have already been backported](https://blog.torproject.org/new-release-tor-browser-1154/). It's reasonable to assume that v91 has issues of its own that won't be addressed. Until the v102-based 12.x hits stable: if you don't use "safest", you might want to re-consider that with this information in mind.</ins>