Pre-install FoxyProxy from Debian & Add Custom Configuration

[phabricator-migrator]

Information

ID: 479
PHID: PHID-TASK-rf36dqc2ifjbgdw6jja6
Author: HulaHoop
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

Problems with current setup:

• At the moment too many steps are required to customize TBB to work with alternative proxies. Many rules need to be added manually after FoxyProxy is installed.

• The FoxyProxy addon is still unsigned by Mozilla and so downloading it from their site incurs unacceptable risk.

---

This ticket suggests simplifying the process by:

• Pre-installing the FoxyProxy package from the Debian repo.

• Supplying a configuration file to the addon for a variety of services (written by KillYourTV) [1]

• Since it has to be optional and still done from the command line there is no point in scripting the symlinking/ config file moving part. These will be documented on the wiki.

---

The way it would work:

1. Run a script to enable this functionality by creating a symlink (making the addon available to TBB) + copy the custom config to the Tor Browser folder.

ln -s /usr/share/xul-ext/foxyproxy-standard/ /home/user/.tb/tor-browser/Browser/TorBrowser/Data/Browser/profile.default/extensions/foxyproxy@eric.h.jung

cp /some/package/location/foxyproxy.xml /home/user/.tb/tor-browser/Browser/TorBrowser/Data/Browser/profile.default/

2. Also included is another script to reverse step 1 to make the addon unavailable in TBB to restore TBB’s default fingerprint. This is done by simply deleting the symlink:

rm /home/user/.tb/tor-browser/Browser/TorBrowser/Data/Browser/profile.default/extensions/foxyproxy@eric.h.jung

3. Optionally block any access to FoxyProxy by the default installed Iceweasel and IceDove by blacklisting the addon folder path in Apparmor

4. TODO (assigned to HulaHoop) : Extend the config to cover access for Syncthing and Zeronet localhost pages. Update documentation for FoxyProxy to cover this feature when implemented.

---

Resources:

[1] http://qza32xuddl3guikc.onion/tutorials/darknets/foxyproxy.xml

Comments

---

HulaHoop

2016-03-22 14:58:03 UTC

I am working on packaging. Should the packaged foxyproxy xml path be: /usr/share/ ? something else?

---

Patrick

2016-03-22 15:54:58 UTC

HulaHoop (HulaHoop):

I am working on packaging. Should the packaged foxyproxy xml path be: /usr/share/ ? something else?

Yes.

Which package? → #usability-misc ?

---

HulaHoop

2016-03-23 12:57:49 UTC

Good idea. I don’t think an entire new package is needed for this.

Where do I put the xul-ext-foxyproxy-standard dependency?

---

Patrick

2016-03-23 13:26:02 UTC

What is the licensing of foxyproxy.xml?

Where do I put the xul-ext-foxyproxy-standard dependency?

I don’t think there is a great place for that.

---

HulaHoop

2016-03-23 15:38:01 UTC

There wasn’t one specified but KYTV licenses everything under MIT. I assumed this would be covered. He is unavailable so a conversation with him is unlikely.

To be safe you can put this on hold - though likely it will never happen.

---

HulaHoop

2016-03-25 13:02:33 UTC

Copyright protects expression, not ideas or data. Configuration files are’t copyrightable because they contain data. Data that can only be expressed in a single and certain way because of the underlying software which reads it:

Licensing of configuration files? | Drupal Groups

---

Patrick

2016-03-26 17:11:01 UTC

Ok, I am not concerned by the copyright.

---

HulaHoop

2016-03-27 17:16:07 UTC

Will adding xul-ext-foxyproxy-standard to debian/control be enough to have it preinstalled during a Whonix build?

---

Patrick

2016-03-28 12:23:46 UTC

Yes.

---

HulaHoop

2016-03-29 14:38:42 UTC

I want to block the getfoxyproxy ad from loading. Can this be done by adding a blacklisted entry in /etc/hosts?

This page runs once after install but we don’t want any outside connections from Iceweasel:

How to Use Your Proxy Service with Firefox and the FoxyProxy Extension

---

Patrick

2016-03-29 15:00:09 UTC

Tor Browser doesn’t use /etc/hosts. Rightly so, since system specific and fingerprintable.

---

https://www.whonix.org/wiki/Template:FoxyProxy

To reverse this action and restore Tor Browser’s default fingerprint run:

I have reason to doubt it restores the fingerprint. Because…

Template:Tor Browser Remove Proxy Settings - Whonix

Undo
Undoing this setting is undocumented. Simply no longer setting that environment variable will not do the trick. This is because of limitations of Tor Browser. The easiest way to undo these instructions would be to start over with a fresh installation of Tor Browser. Please contribute these instructions.

To find that out…

1. Start with a fresh Tor Browser.

2. make a copy of /.tb/tor-browser/Browser/TorBrowser/Data/Browser/profile.default/prefs.js (or add it to a version management system such as git) [*]

3. make the (proxy) changes

4. see if/how prefs.js changed (to make sure we know settings are changed there)

5. undo the (proxy) changes

6. see if the settings file is back to normal like in step 2.

---

[*] Would be a lot better to add the whole Tor Browser folder to a version management system such as git observe files change back and forth.

---

HulaHoop

2016-03-29 21:55:59 UTC

Good catch. There are two changes that remain between the first version and the one after removing the symlink:

+user_pref(“extensions.foxyproxy.firstrun”, false);
+user_pref(“extensions.foxyproxy.last-version”, “3.4”);

Can content running in the browser fingerprint/read these changes in the pref.js? I think that’s probably true since you pointed out and will change recommendations.

---

Patrick

2016-03-29 22:07:00 UTC

HulaHoop (HulaHoop):

Good catch. There are two changes that remain between the first version and the one after removing the symlink:

+user_pref(“extensions.foxyproxy.firstrun”, false);
+user_pref(“extensions.foxyproxy.last-version”, “3.4”);

The remaining two prefs are probably harmless cruft wrt to proxy settings.

Can content running in the browser fingerprint/read these changes in the pref.js?

Other add-ons can likely. [But that would not matter as they could other
bad stuff also.]

I haven’t heard that remote websites can read arbitrary settings from
pref.js. Does pref.js include private data not to be shared? If so, such
a feature would be pretty outrageous. Unlikely. Worth researching.

---

HulaHoop

2016-03-29 22:14:55 UTC

So I rollback documentation to removing the symlink?

---

Patrick

2016-03-29 22:32:45 UTC

HulaHoop (HulaHoop):

So I rollback documentation to removing the symlink?

Yes. Perhaps leave a footnote to this discussion.

---

HulaHoop

2016-03-30 21:39:55 UTC

All done. Closing this.

---

Patrick

2016-04-02 14:45:51 UTC

Moved the file to adhere the convention (or stronger?) that it’s /usr/share/package-name/…

renamed: usr/share/tbb-foxyproxy/foxyproxy.xml -> usr/share/usabil… · Kicksecure/usability-misc@9312d64 · GitHub

---

Patrick

2016-04-14 19:41:23 UTC

Adding xul-ext-foxyproxy-standard as a dependency to #usability-misc was a mistake. Too intrusive. It causes too many issues. (plain Debian) I was starting icedove, and then it run some compatibility test that failed. Also having it installed it in iceweasel by default causes issues. It is confusing for Whonix users who happen to look into iceweasel wondering what it is good for or if that is a recommendation. And the foxyproxy homepage gets opened to each time the add-on is updated.

So on balance it creates more usability issues than it fixes (saving local proxy users a step). I think it would be more justified if local proxy users would be recommended to manually install it.

---

HulaHoop

2016-04-15 19:30:33 UTC

OK. I’ll add the apt-get install step for the instructions.

Can this problematic behavior be stopped by Apparmor rules? (Depends on whether the profiles are enabled by default)

---

Patrick

2016-04-16 02:58:33 UTC

Can this problematic behavior be stopped by Apparmor rules? (Depends on whether the profiles are enabled by default)

It might. Dunno. Would certainly be a problematic hack leading to other
issues.

---

HulaHoop

2016-04-16 03:15:35 UTC

OK lets forget about default installation. One more command to go thru won’t make a difference.

---

Patrick

2016-04-18 13:42:47 UTC

Done.

Revert "Update control" · Kicksecure/usability-misc@ab042e1 · GitHub

---

Patrick

2016-06-04 13:05:58 UTC

Can you please try to upstream https://github.com/Whonix/usability-misc/blob/master/usr/share/usability-misc/tbb-foxyproxy/foxyproxy.xml to foxyproxy?

---

HulaHoop

2016-06-04 21:53:50 UTC

The Foxyproxy Debian package or upstream?

---

Patrick

2016-06-04 21:55:32 UTC

Upstream, I guess. Having a default config shipped by upstream with examples for common use cases seems useful to me.

---

HulaHoop

2016-06-06 12:09:25 UTC

https://forums.getfoxyproxy.org/viewtopic.php?f=1&t=1825

---

Patrick

2016-06-06 12:31:57 UTC

Awesome! Are you subscribed to the thread to proxy any reactions?

---

HulaHoop

2016-06-08 22:19:46 UTC

Yeah

---

Patrick

2016-06-08 22:35:58 UTC

Reason for upstreaming is also reduced documentation steps a user must
take and less maintenance work for us.

---

HulaHoop

2016-06-10 12:45:09 UTC

I guess they are not convinced. Was worth trying anyhow.