Tor Browser 6.5a6-hardened is released

by gk | December 14, 2016

A new hardened Tor Browser release is available. It can be found in the 6.5a6-hardened distribution directory and on the download page for hardened builds.

This release features important security updates to Firefox. Other components got an update as well: Tor to and HTTPS-Everywhere to 5.2.8.

With this release the broken preferences pane in non-en-US locales is fixed and we moved to pt-BR for Portuguese as it turns out that all our translations for Portuguese are containing Brazilian language strings. We added links to the Tor Browser Manual, an effort led by the community team to make help easier available for our users in case of problems.

Here is the full changelog since 6.5a5-hardened:

  • All Platforms
    • Update Firefox to 45.6.0esr
    • Update Tor to tor-
    • Update Torbutton to
      • Bug 16622: Timezone spoofing moved to tor-browser.git
      • Bug 20701: Allow the directory listing stylesheet in the content policy
      • Bug 20556: Use pt-BR strings from now on
      • Bug 20614: Add links to Tor Browser User Manual
      • Bug 20414: Fix non-rendering arrow on OS X
      • Bug 20728: Fix bad preferences.xul dimensions
      • Bug 20318: Remove helpdesk link from about:tor
      • Bug 20753: Remove obsolete StartPage locale strings
      • Bug 20947: Donation banner improvements
      • Translation updates
    • Update HTTPS-Everywhere to 5.2.8
    • Bug 16622: Spoof timezone with Firefox patch
    • Bug 20707: Fix broken preferences tab in non-en-US alpha bundles
    • Bug 20709: Fix wrong update URL in alpha bundles
    • Bug 20556: Start using pt-BR instead of pt-PT for Portuguese
    • Bug 20809: Use non-/html search engine URL for DuckDuckGo search plugins
    • Bug 20837: Activate iat-mode for certain obfs4 bridges
    • Bug 20838: Uncomment NX01 default obfs4 bridge
    • Bug 20840: Rotate ports a third time for default obfs4 bridges


Please note that the comment area below has been archived.

December 16, 2016

In reply to gk


commenting out line 273 of ~/tor-browser/Browser/start-tor-browser eliminates the observed behavior.

That line reads: export SELFRANDO_write_layout_file=


There are many references to that label.

grep -r -i 'SELFRANDO_write_layout_file' *

~/tor-browser/Browser/ is the invocation that puts the most data in it.

December 14, 2016


Is the sandboxing work integrated into this version? Or is that only for the 6.5a6 (non-hardened) series?

The sandboxing stuff is a separate component and will work with any one of "release", "alpha" or "hardened", because the first time you run the sandboxing app, it will ask you which one you want to use.

That said, sandboxed + "hardened" is the least tested combination, because running the hardened bundle involves using a VM or a reboot for me, but it should work.

December 15, 2016


I still get the same enormous VM size associated with the browser process and eventual crash.
6.5a* or 6.0* don't have such a problem.
Is running a VPN related I wonder.

December 17, 2016

In reply to gk


The size of the VM that shows on the tasks list is in the supercomputer neighborhood and they don't make them like they use to.

It may be the issue and the old cpu TC and 4gb ram is not enough.
I can't find the rec.hw specs. Maybe you can do some tests on older machines and come up with some tighter recommendations.

The problem initially does not show, it runs normally. Eventually it gets irresponsive and then crashes. It must be compounding more virtual memory as it goes. An other perceived theory is that it is not show on download traffic but it builts up in minute amounts of upload, like editing this note.

December 24, 2016


The page isn't redirecting properly

Firefox has detected that the server is redirecting the request for this address in a way that will never complete.

This problem can sometimes be caused by disabling or refusing to accept cookies.

Try Again

December 26, 2016


17:04:13.089 TypeError: this.controlListeners is undefined videocontrols.xml:701:30