Project

General

Profile

Bug #15777

Feature #15023: Upgrade to Tor Browser based on Firefox ESR60

NoScript and HTTPS Everywhere icons are not shown on first start

Added by intrigeri about 1 year ago. Updated about 1 year ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
-
Target version:
Start date:
08/09/2018
Due date:
% Done:

100%

Feature Branch:
Type of work:
Code
Blueprint:
Starter:
Affected tool:
Browser


Related issues

Related to Tails - Bug #17007: JavaScript sometimes blocked on Tor Browser first start ⇒ "Watching a WebM video over HTTPS" and "Playing an Ogg audio track" scenarios are fragile: blocked by NoScript click-to-play Confirmed
Blocks Tails - Feature #15334: Core work 2018Q3: Foundations Team Resolved 02/20/2018

History

#1 Updated by intrigeri about 1 year ago

#2 Updated by intrigeri about 1 year ago

  • Status changed from Confirmed to In Progress
  • Assignee changed from intrigeri to segfault
  • % Done changed from 0 to 10
  • QA Check set to Info Needed

In a VM with a 1024px wide screen (this matters because on narrower screens, some buttons are hidden behind a ">>" one) I've tried setting user_pref("extensions.torbutton.inserted_button", true); in /home/amnesia/.tor-browser/profile.default/prefs.js and both on first and second launches:

  • the "Show sidebars", HTTPS Everywhere and NoScript, uBlock buttons are visible on the right of the URL bar
  • the back, forward, reload, home and Torbutton buttons are on the left of the URL bar
  • there's quite some empty space between the Torbutton icon and the URL bar

I believe these were the issues I was referring to in 852ce14b81c00e6bb1bf0376e2d007c4dfb4e875.

While on current feature/15023-tor-browser-8 on first launch:

  • the only button on the left of the URL bar is Torbutton
  • there's no ugly empty space between the Torbutton icon and the URL bar; same between the Search bar and the first button on its right
  • the reload, back & forward buttons are on the right of the URL bar (in that order)
  • as the upstream bug says, NoScript & HTTPS Everywhere buttons are not visible

Same with current feature/15023-tor-browser-8 on second launch except:

  • the forward button is on the left of the back one; reproduced with pristine TB, see below
  • the NoScript & HTTPS Everywhere buttons are visible

FTR with pristine 8.0a9 on first launch:

  • the only button on the left of the URL bar is Torbutton
  • there's no ugly empty space between the Torbutton icon and the URL bar
  • the back and forward buttons are on the right of the URL bar (in that order)
  • as the upstream bug says, NoScript & HTTPS Everywhere buttons are not visible

Same with pristine 8.0a9 on 2nd launch except:

  • the forward button is on the left of the back one; seems like an upstream bug, I'll check whether it's known
  • the NoScript & HTTPS Everywhere buttons are visible

So basically, we have to choose between:

  • current state:
    • no NoScript and HTTPS Everywhere icons on first launch, i.e. same bug as in upstream Tor Browser; there's hope the bug gets fixed upstream before 8.0 is released
    • apart of that, we get the intended set of buttons, in the same place as on upstream Tor Browser
  • re-adding user_pref("extensions.torbutton.inserted_button", true);:
    • quite different set of buttons and layout as upstream Tor Browser
    • a number of layout bugs (empty space) make it ugly and make the URL bar too narrow for my taste on a 1024px wide screen

I would argue that the current state is better even if https://trac.torproject.org/projects/tor/ticket/23359 does not get fixed, and vastly better if it gets fixed, because:

  • the HTTPS Everywhere icon is basically useless and upstream plans to remove it anyway; the NoScript icon is only useful in higher than default security levels, which we support poorly anyway; so I think very, very few people will miss it even if https://trac.torproject.org/projects/tor/ticket/23359 does not get fixed and there's a workaround anyway (they can still restart the browser)
  • the other option has UX problems (different from Tor Browser, ugly) which affect all users and a UX problem (too narrow URL bar) that affect users with not-so-wide screens
  • inserted_button has always been an ugly hack and I'm happy if we can get rid of it

Do you agree with my conclusion or should we ask sajolida?

Meta: I've already spent lots of time on this, both back in July and today, and would rather not spend much more given IMO it's a minor issue and this will become moot if the upstream bug gets fixed.

#3 Updated by segfault about 1 year ago

Thanks for the comprehensive analysis. I understand the problem now, and I agree that the current state is better than re-adding the preference which causes the UI issues.

But I think that users who want to activate NoScript will have a problem when the icon isn't shown, so I spent some more time on trying to fix this. And I think I found a fix in 3243e5742a4f23838e2b33cbd364de3f9041f730. I'm building an ISO now to test it.

#4 Updated by intrigeri about 1 year ago

Thanks for the comprehensive analysis. I understand the problem now, and I agree that the current state is better than re-adding the preference which causes the UI issues.

Glad we're on the same page!

But I think that users who want to activate NoScript will have a problem when the icon isn't shown, so I spent some more time on trying to fix this. And I think I found a fix in 3243e5742a4f23838e2b33cbd364de3f9041f730. I'm building an ISO now to test it.

Nice! Two comments on this draft patch:

  • I think it introduces some inconsistent indentation;
  • the "e.g. uBlock Origin's button" comment does not match current reality.

#5 Updated by segfault about 1 year ago

  • Assignee changed from segfault to intrigeri
  • QA Check changed from Info Needed to Ready for QA

intrigeri wrote:

Thanks for the comprehensive analysis. I understand the problem now, and I agree that the current state is better than re-adding the preference which causes the UI issues.

Glad we're on the same page!

But I think that users who want to activate NoScript will have a problem when the icon isn't shown, so I spent some more time on trying to fix this. And I think I found a fix in 3243e5742a4f23838e2b33cbd364de3f9041f730. I'm building an ISO now to test it.

Nice! Two comments on this draft patch:

  • I think it introduces some inconsistent indentation;

I think the file already had inconsistent indentation / mixed spaces and tabs before, which I already fixed in 4f85915b7297291b998f1780ad8317ae7f04d996.

  • the "e.g. uBlock Origin's button" comment does not match current reality.

Fixed in 166897ae844ed4e2e6f28e7137edb1b5360cc5cc.

#6 Updated by segfault about 1 year ago

  • Status changed from In Progress to Resolved
  • Assignee deleted (intrigeri)
  • QA Check deleted (Ready for QA)
  • Type of work changed from Research to Code

segfault wrote:

I'm building an ISO now to test it.

It doesn't work :(

I now spent even more time to debug this. And beside two errors in my commit (unbelievable, I changed two lines!), the cause is that in the omni.ja:default/preferences/000-tor-browser.js, the currentVersion is 4, while in .tor-browser/profile.default/prefs.js it's 14. If I set the version in 000-tor-browser.js to 14, it works, else my changes there seem to be ignored when I set the "extensions.torbutton.inserted_button" pref, i.e. the back/forward buttons are on the left again.

I don't know where this version is set, and I don't think we should hardcode it. So I guess we should indeed let upstream fix this and all the time I spent on this was wasted :(

#7 Updated by segfault about 1 year ago

  • % Done changed from 10 to 100

#8 Updated by intrigeri about 1 year ago

I don't know where this version is set, and I don't think we should hardcode it. So I guess we should indeed let upstream fix this and all the time I spent on this was wasted :(

It was worth a try! Thanks :)

#9 Updated by intrigeri about 1 month ago

  • Related to Bug #17007: JavaScript sometimes blocked on Tor Browser first start ⇒ "Watching a WebM video over HTTPS" and "Playing an Ogg audio track" scenarios are fragile: blocked by NoScript click-to-play added

Also available in: Atom PDF