Tor Browser 7.0.11 is released
The full changelog since Tor Browser 7.0.10 is:
Thank you, I just checked and you are correct. This is a serious security issue. Always these problems with browsers built by companies allied to or working with the security agencies. People have said before TOR should be built from scratch not using anything from those in the pocket of the security agencies. Now developers how about an answer of how to get rid of this testpilot as it is not in about:config and you have to remove it every time the browser is started.
Could you elaborate a bit about what you mean? What exactly is the issue? How can I reproduce it?
>What exactly is the issue?
See the post above by Donald T. Rump… (not verified)
Go to the options settings- privacy-exceptions and you will see that the sites if deleted regenerate when the browser is restarted. This version seems so buggy it should not have been release without more trials.
about:preferences#security and click on the "Exceptions" button next to the line "Warn me when sites try to install add-ons". A window with title "Allowed Sites - Add-ons Installation" pops up, with
<a href="https://addons.mozilla.org>[/geshifilter-code" rel="nofollow">https://addons.mozilla.org>[/geshifilter-code</a>] and [geshifilter-code]<a href="https://testpilot.firefox.com[/geshifilter-code" rel="nofollow">https://testpilot.firefox.com[/geshifilter-code</a>] listed as sites that are allowed to install add-ons. Clicking "Remove all Sites" and "Save Changes" removes the entries only for the current session - the sites are whitelisted again after the next browser start! Apparently, there is no [geshifilter-code]about:config preference controlling the whitelist.
Thanks. That behavior might be due to Tor Browser being in Private Browsing Mode (PBM) and your choice is not saved to disk. Does that change if you get out of PBM on
That said I guess there is no reason to allow testpilot.firefox.com to be on the whitelist in the first place? I've opened https://trac.torproject.org/projects/tor/ticket/24655. However, we do get NoScript updates via
addons.mozilla.org, thus it seems to me we can't remove this by default.
The deleted exception list does not return if PBM is disabled.