There are some last mysteries to solve @nurmagoz :
How is it possible, that I download from the official Torproject website TODAY the Tor Browser for Linux and install it, and the version of that and the version of the Tor Browser in Qubes-Whonix are the same, but the Noscript versions are different?
Shouldn’t Whonix (and by that I mean always Qubes-Whonix) always have the same as what the Tor Project does?
Did the Tor Project knew about this issue and rolled back the Noscript version and Whonix didn’t?
And how come, that you got at your Tor Browser on Debian the new Noscript version, if I downloaded the Tor Browser for Linux TODAY and installed it in Debian on Qubes OS and I didn’t have the newer and broken Noscript, but the somewhat older and functioning Noscript? I mean we both have Debian. How is that possible?
Whonix doesn’t ship Tor Browser ourselves (except the version bundled in our images and templates), we download Tor browser from the Tor Project dynamically as part of our build and update systems, so whatever you’re getting is whatever the Tor Project gave you or whatever we got from the Tor Project if you’re using a non-updated VM (which you probably aren’t).
I don’t think we have the info needed to answer the other questions. If you can’t get on the Tor Forums yet, you might make a Matrix account and then ask for help in the Tor Project User Support (#tor:matrix.org) room.
Well, that can’t be true, because I wrote in this thread that I got the latest version of Tor Browser for Linux TODAY from the Tor Project official website, which has the older Noscript version installed and not the newest for Linux. To be very precise, here is where I got it from: https://www.torproject.org/dist/torbrowser/15.0.17/tor-browser-linux-x86_64-15.0.17.tar.xz
So technically, it doesn’t even makes sense to report something in the Tor Project forum, if their official downloads don’t have the newer and problematic Noscript version, but only Qubes-Whonix has. Their version works like it should, yours does not. Don’t mean it in a rude way, it’s just how the facts are.
What is the URL Qubes-Whonix downloads Tor Browser from? Maybe you download it from somewhere else and there is a slightly different version of the Tor Browser?
The facts do not necessarily contradict. We don’t pay attention to how Tor gets from source code to Tor Browser binaries, we download the binaries that are available when the time comes, verify they pass signature and anti-rollback checks, and install them. It’s possible that NoScript automatically updates itself and so the NoScript version in Tor Browser works, but the version it updates to automatically breaks. Or maybe a CDN is giving different people different (but authentic) files. Or maybe the Tor Project included a buggy version of NoScript in one download, you got that through a software update, then they rolled back to an earlier version of NoScript without changing the version number, leaving you with the buggy version. Or maybe something else is the issue. (Note that this is not an attempt at diagnosing the issue or accusing NoScript or the Tor Project of doing any of the above things, it’s just to illustrate that what you’re seeing could theoretically happen despite how we develop things.)
There is no source code anywhere in Whonix that does anything to the version of NoScript in Tor Browser. As proof, here’s what I get if I search through the entire combined source code of both Kicksecure and Whonix for the string ‘noscript’ (case-insensitive):
The first file is a changelog mentioning the addition of a png file. This can’t be the cause.
The next two results are links to Whonix Forum posts.
The next block of results is for the tb-profile-i2puser.js. This file is only used by the I2P browser feature of tb-updater, and that feature isn’t advertised because it doesn’t work at the moment, so the chances of you using this are vanishingly small. Beyond that, these are settings for NoScript, not directions to download a newer NoScript, so even if you were using these settings, they couldn’t be the cause, unless one of them causes NoScript to automatically update itself in a way it wouldn’t normally, which doesn’t look like is the case to me.
The next two results are more links to the Whonix Forums.
The next result is a changelog entry mentioning a bug in NoScript.
The next three results are more Whonix Forums links. There are no further results after this.
tb-updater autodetects the URL to download from, using the Tor Project’s automatic update service for Tor Browser. It decides which kind of Tor Browser to download from several settings and builds a URL to fetch the auto-update data. The relevant block of source code is tb-updater/usr/bin/update-torbrowser at master · Kicksecure/tb-updater · GitHub. This typically results in https://aus1.torproject.org/torbrowser/update_3/release/download-linux-x86_64.json being fetched. At the time of writing, that URL directs tb-updater to download https://dist.torproject.org/torbrowser/15.0.17/tor-browser-linux-x86_64-15.0.17.tar.xz, so that is likely the version of Tor Browser you’re getting.
I re-installed Tor Browser multiple times AND AT DIFFERENT TIMES in Qubes-Whonix and always had the same problem with Noscript, so getting bad packages at different times is probably not the problem here
Conclusion: There seems to be something wrong with Qubes-Whonix, because everything coming directly from the Tor Project works like it should. So there is no reason to ask about it in the Tor Project forum, because like you should know, the Tor Project is not responsible for third party projects distributing the Tor Browser.
In my opinion there needs to be a serious investigation into this, because maybe Whonix got hacked and the hacker made the mistake to either include the wrong version of Noscript or forgot to set Noscript to not to auto-update. I mean who knows.
But not investigating this and telling users like me to ask for a Qubes-Whonix problem the Tor Project for something they don’t have any responsibility, is just wrong and diminishes the trust I have in Whonix.
Again, there needs to be a serious investigation here on your side.
I don’t know what else you expect us to do here. You’re trying to tell us to fix a problem in our code that doesn’t exist. The serious investigation is done, it’s provided above, starting at:
There is nothing more to be done to investigate. The investigation above is as exhaustive as it can reasonably be.
One interesting thing to note, I launched Tor Browser in anon-whonix just now, looked at the NoScript version, and it was 13.6.25.1984, like you listed. I also noticed that Tor Browser said it was downloading an update. I opened the “About Tor Browser” window to watch its progress while downloading the update, and about 15 MB in, I noticed the NoScript version jump to 13.6.30.1984. So it seems it is automatically updating, or at least is on my system.
Seems like my information on the auto updating of Noscript could be wrong, but anyway, Whonix moderators should know that, and Patrick also didn’t say anything.
So the good news: I can play all videos again.
The somewhat strange news: Noscript got updated, seems to be updating automatically.
Problem is, I had the information in the back of my head, that it does not auto update. Maybe I got it wrong in my head lol. But like I said, Whonix moderators should know if Noscript in Tor Browser auto updates itself.
Also strange, that it didn’t auto update in my Debian on Qubes OS.
To be fair, because I didn’t have enough time to do the research I asked AI and it “confirmend”/told me that Noscript in the Tor Browser does not auto update itself. Fucking AI, hopefully the AI bubble bursts soon.
Anyway…could someone double check if I’m correct now and Noscript in the Tor Browser does auto update itself? The only thing I found is from 2020, where the release notes say “Update: Noscript 11.0.17 should solve this issue. Automatic updates of Noscript are enabled by default, so you should get this fix automatically.” , see here: New Release: Tor Browser 9.0.6 | The Tor Project
But that’s 6 years ago, they could have changed it back.
Could anyone double check his sources/use his research skills or do I need to ask in the Tor Project forum? Like I said, in my opinion a moderator or a Developer should know that without needing to do any research.
Edit: Also strange is that like I said, I re-installed the Tor Browser multiple times in Qubes-Whonix and tested it immediately on some videos and it didn’t work, meaning it must have been auto-updating in the first seconds I started the Tor Browser in Qubes Whonix to the problematic version of Noscript while my Debian Tor Browser didn’t update automatically even after 24 hours.
I asked in the #tor:matrix.org Matrix room whether extension auto-updating was enabled. This was the reply I got:
Do you mean to ask whether Tor Browser will periodically reach out (anonymously and via Tor, of course) to a NoScript distributor to update NoScript even if Tor Browser is not being updated?
I believe the answer is yes. There is a tag in about:config called extensions.update.autoUpdateDefault that is set to “true” (you can change it but probably should not) as well as a radio button in the NoScript entry in about:addons for “Allow automatic updates”.
Checking about:config in Tor Browser on an anon-whonix qube, extensions.update.autoUpdateDefault is set to true on my end. If I look at about:addons and click on NoScript, I see “Allow automatic updates” is set to “Default”.
TL;DR: Yes, NoScript is automatically updated by Tor Browser, independently from Tor Browser releases.
As for the strangeness with the extension auto-updating on some machines and not on others, there are a lot of reasons this might happen, it all depends on your network connection, the NoScript distributor’s network connection, and how extension updates are implemented in Firefox and Tor Browser. One would likely have to have at least semi-deep understanding of how the browser works internally to say for sure, and to my awareness none of the Whonix developers are browser internals experts. We focus on making the underlying OS work right, and let the Tor Project handle making the browser work right.
I wouldn’t be surprised if Firefox addon updates are also behind cloudflare or a cloudflare-alike service leading to geo-blocking, leading to an inconsistent update experience (over Tor). (Heisenbug - Wikipedia)
At the time of writing, Tor Browser is using addons.mozilla.com. Source: See Tor Browser, open about:config and search for addons.mozilla.com. Given the history of Firefox and NoScript, I do consider this a Tor Browser bug.
I just want to state that I’ve had the exact same behavior (whonix 17 on Qubes 4.2):
right-click open video in a new tab
video starts loading without any intervention by me
video never actually loads
or audio somehow starts playing
I “fixed” it by right clicking on the element (video), selecting No Script and manually setting it to temp trusted. But sometimes it still doesn’t work. I’m finding No Script to be unreliable these days. On the bright side, I don’t have to watch so many videos.
I’ve recently upgraded to Whonix 18 on Qubes 4.3, so maybe the problem will be fixed.
