Re: Missing Tor Button

[Mark H Weaver]

Hi Mike,

Mike Gerwitz <address@hidden> writes:

> On Tue, Oct 29, 2019 at 16:12:50 -0400, Mark H Weaver wrote:
>> It was not intentional.  I cannot speak for the IceCat project, but I
>> think it's safe to say that they intend to continue including the Tor
>> button in IceCat.
>
> I have serious concerns about this addon, which I raised previously:
>
>   https://lists.gnu.org/archive/html/bug-gnuzilla/2019-01/msg00002.html
>
> I will want to look into what's needed to resolve those,

Thank you for raising this issue; I had forgotten about it.  I agree
that it's an extremely severe problem.

One possible solution would be to enable DNS-over-HTTPS, which I believe
is supported by IceCat-68 although it's disabled by default.  See:

  https://support.mozilla.org/en-US/kb/firefox-dns-over-https

Incidentally, I think that a case can be made that enabling this is a
sensible default for most users, even when not using Tor, because it
prevents the user's ISP from snooping on and hijacking DNS lookups.
Whereas most users have little or no choice about their ISP, we can
choose a default DNS-over-HTTPS provider that commits to a strong
privacy policy.  Also, the provider is user-configurable.  However,
I acknowledge that any such decision would be controversial.

> otherwise I'd still recommend against it being included in IceCat.
> But I'd want to discuss it with the other IceCat maintainers before
> removing it.

I agree that it would be much better to remove it outright than to
provide a broken Tor Button that doesn't actually work.  However, if we
can fix it, I think that we should.

What do you think?

      Thanks!
        Mark