Security/Fusion/Esr140: Difference between revisions

Jump to navigation Jump to search

Security/Fusion/Esr140 (view source)

Revision as of 09:59, 5 April 2025

13 bytes removed ,  5 April
→‎P2: need help from upstream!: fix formatting
Line 23: Line 23:
* [https://bugzilla.mozilla.org/show_bug.cgi?id=1676104 '''Bug 1676104''']: this is not a P1 only because it should affect UI and/or AC requests (e.g., addons?). Our current patch is ''BB 40171: Make WebRequest and GeckoWebExecutor First-Party aware'' ([https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/5240a3b51428d50626a385976e7da78d121b8ee4 5240a3b5]); see also [https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40171 #40171 (closed)] (still open for uplift).  
* [https://bugzilla.mozilla.org/show_bug.cgi?id=1676104 '''Bug 1676104''']: this is not a P1 only because it should affect UI and/or AC requests (e.g., addons?). Our current patch is ''BB 40171: Make WebRequest and GeckoWebExecutor First-Party aware'' ([https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/5240a3b51428d50626a385976e7da78d121b8ee4 5240a3b5]); see also [https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40171 #40171 (closed)] (still open for uplift).  
* [https://bugzilla.mozilla.org/show_bug.cgi?id=1869821 '''Bug 1869821''']: ''intl.accept_languages'' is very dangerous. P2 only because Firefox has localized builds rather than multi-lingual like us and because we might want to talk about our patches first (''BB 42084: Ensure English spoofing works even if preferences are set out of order.'' + ''BB 41930: Remove the UI to customize accept_languages.'', [https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/2d23c333201787af1ea5fbef2b9cf2426fc0c0e3 2d23c333] and [https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/79f3e7cd3ba260e7a43aba21ce99f2ddf5cda7b9 79f3e7cd]). Good analysis in [https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41930 #41930 (closed)].  
* [https://bugzilla.mozilla.org/show_bug.cgi?id=1869821 '''Bug 1869821''']: ''intl.accept_languages'' is very dangerous. P2 only because Firefox has localized builds rather than multi-lingual like us and because we might want to talk about our patches first (''BB 42084: Ensure English spoofing works even if preferences are set out of order.'' + ''BB 41930: Remove the UI to customize accept_languages.'', [https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/2d23c333201787af1ea5fbef2b9cf2426fc0c0e3 2d23c333] and [https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/79f3e7cd3ba260e7a43aba21ce99f2ddf5cda7b9 79f3e7cd]). Good analysis in [https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41930 #41930 (closed)].  
* ''''''''BB 30605: Honor privacy.spoof_english in Android'''''''' ([https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/160f0b8a68bf41abfa797a51df813743c188bfa0 160f0b8a]), no Bug yet, as far as I know. We'll need some help from upstream because it needs also an additional part for the UI (''TB 40087 [android]: Implement a switch for spoof English.'', [https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/7e749377ceefee0424efb640c84a1fd4c41b6ed6 7e749377], for us), and I think we've never uplifted something user-exposed.  
* '''''BB 30605: Honor privacy.spoof_english in Android''''' ([https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/160f0b8a68bf41abfa797a51df813743c188bfa0 160f0b8a]), no Bug yet, as far as I know. We'll need some help from upstream because it needs also an additional part for the UI (''TB 40087 [android]: Implement a switch for spoof English.'', [https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/7e749377ceefee0424efb640c84a1fd4c41b6ed6 7e749377], for us), and I think we've never uplifted something user-exposed.  
* ''''''''BB 42562: Normalized the Accepted Languages on Android.'''''''' ([https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/299ae962bed521da68c408b2184593a5d02deae1 299ae962]): this goes probably with spoof English. In any case, locale protection is pretty weak on Firefox, especially on Android (even though Android has a lot of other problems)  
* '''''BB 42562: Normalized the Accepted Languages on Android.''''' ([https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/299ae962bed521da68c408b2184593a5d02deae1 299ae962]): this goes probably with spoof English. In any case, locale protection is pretty weak on Firefox, especially on Android (even though Android has a lot of other problems)  
* [https://bugzilla.mozilla.org/show_bug.cgi?id=1594455 Bug 1594455]: LB styling/cosmetics. Our UX team investigated a lot and we think our LB is really good looking, but Moz UX team will probably want to check it first. We could also do it in multiple steps (e.g., rounded corner and vertical center first, custom background in another bug)  
* [https://bugzilla.mozilla.org/show_bug.cgi?id=1594455 Bug 1594455]: LB styling/cosmetics. Our UX team investigated a lot and we think our LB is really good looking, but Moz UX team will probably want to check it first. We could also do it in multiple steps (e.g., rounded corner and vertical center first, custom background in another bug)  
* [https://bugzilla.mozilla.org/show_bug.cgi?id=1923368 Bug 1923368]: disk leak, I'd like to force-inline more file types, not only PDFs (partially implemented downstream as BB 42220, [https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/b784ed282ccbb79dca76e0bb3a290e94f6538054 b784ed28])  
* [https://bugzilla.mozilla.org/show_bug.cgi?id=1923368 Bug 1923368]: disk leak, I'd like to force-inline more file types, not only PDFs (partially implemented downstream as BB 42220, [https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/b784ed282ccbb79dca76e0bb3a290e94f6538054 b784ed28])  
Line 38: Line 38:
* [https://bugzilla.mozilla.org/show_bug.cgi?id=1393901 '''Bug 1393901''']: WebRTC on mingw (various commits, [https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41021 #41021 (closed)], [https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41459 #41459 (closed)], [https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42758 #42758 (moved)]). Our patches work, at least in ESR 128, but vendoring these 3rd party libs isn't trivial in Firefox, we might need help to prepare the patches as you like.  
* [https://bugzilla.mozilla.org/show_bug.cgi?id=1393901 '''Bug 1393901''']: WebRTC on mingw (various commits, [https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41021 #41021 (closed)], [https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41459 #41459 (closed)], [https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42758 #42758 (moved)]). Our patches work, at least in ESR 128, but vendoring these 3rd party libs isn't trivial in Firefox, we might need help to prepare the patches as you like.  
* [https://bugzilla.mozilla.org/show_bug.cgi?id=1115874 '''Bug 1115874''']: make openh264 reproducible. We have the knowledge to do it, but we need to check how upstream wants to do it ([https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/15910 #15910]).  
* [https://bugzilla.mozilla.org/show_bug.cgi?id=1115874 '''Bug 1115874''']: make openh264 reproducible. We have the knowledge to do it, but we need to check how upstream wants to do it ([https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/15910 #15910]).  
* [https://bugzilla.mozilla.org/show_bug.cgi?id=1902067 '''Bug 1902067''']: official support for the gnullvm Rust target. We've been using it for almost a year now, with success ([https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/29320 tor-browser-build#29320 (closed)])  
* [https://bugzilla.mozilla.org/show_bug.cgi?id=1902067 '''Bug 1902067''']: official support for the gnullvm Rust target. We've been using it for almost a year now, with success ([https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/29320 tor-browser-build#29320 (closed)])


=== P3 ===
=== P3 ===
Manuel Bucher
Confirmed users
427

edits

Retrieved from "https://wiki.mozilla.org/Special:MobileDiff/1253759"

Navigation menu