Re: [tor-bugs] #13047 [Tor Browser]: Updater should not send Kernel and GTK version

["Tor Bug Tracker & Wiki" <blackhole@xxxxxxxxxxxxxx>]

#13047: Updater should not send Kernel and GTK version
-----------------------------+----------------------
     Reporter:  gk           |      Owner:  tbb-team
         Type:  defect       |     Status:  new
     Priority:  normal       |  Milestone:
    Component:  Tor Browser  |    Version:
   Resolution:               |   Keywords:
Actual Points:               |  Parent ID:
       Points:               |
-----------------------------+----------------------

Comment (by gk):

 Replying to [comment:1 mcs]:
 > You are right -- we do not need the info that Mozilla calls OS_VERSION
 in order to return the correct update manifest.  But we included it in the
 update URL because if, for example, we drop support for an older OS such
 as Mac OS 10.6, having this info will allow us to return an update
 manifest that informs the user that updates are no longer available for
 their OS version.

 Good thinking.

 > But maybe it is too intrusive from a privacy / anonymity point of view
 (I also did not realize that GTK version was included on Linux).  To
 remove it, we just need to remove %OS_VERSION% from the app.update.url
 preference inside browser/app/profile/firefox.js.

 I bet there are a couple of users that are not happy to send this data to
 us. So, I would like to see it removed as it is stricly speaking not
 necessary. BUT: on the other side being able to show the user that support
 of an OS (version) got dropped seems important to me too. I think the best
 solution would be to not transmit %OS_VERSION% over the wire at all but
 rather to compute it locally and compare that locally with a notice the
 update.xml contains. Looking at it we could certainly encode something in
 the `buildID` we don't need or we could even make up a new element, say
 `<obsolete/>`, specifying the respective OS and version + architecture.
 But probably there are even better ideas on how to do this which I am
 currently missing.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13047#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs