750654 - Blocklist TorButton extension for Firefox 12 upwards

Status: RESOLVED WONTFIX

(Toolkit :: Blocklist Policy Requests, defect)

Description

[[:philipp]]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20120430 Firefox/14.0a2
Build ID: 20120430042007

Steps to reproduce:

you should consider blocklisting the TorButton extension, based on the "Severe bugs that unintentionally affect core Firefox features" condition.
when TorButton is installed in firefox 12, all drag & drop behaviour in the browser is broken (in content, bookmarks, tabbar, customize...) - the developers state on their website that the extension is no longer actively developed & advice their users to switch to the tor browser bundle https://www.torproject.org/torbutton/

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

Breaking drag and drop is not a sufficient reason for blocklisting.

Comment 2

[[:philipp]]

ok, i didn't know the exact prerequisites - just wanted to bring it to your attention because it is showing up in a few support questions & has quite a nasty impact when you try it out yourself...

Comment 3

[Jorge Villalobos [:jorgev] (he/him)]

We can mark it as incompatible if this is a major problem. Andrew, can you check TorButton and see if we should add it to the override list?

Comment 4

[Andrew Williamson [:eviljeff]]

I can confirm the issue with completely broken drag & drop.  From a quick look at their bugtracker it seems the issue is known but the responses unfortunately range between 'its a security feature' and 'works for me' so I don't see any immediate chance of it being addressed (its not clear if the issue is as bad with the browser bundle).

Given its a non-security breakage and the addon is officially discontinued in that form I'd say it doesn't strictly meet the criteria.  Though if it has a significant number of users I could see a case for an exception.

Comment 5

[[:philipp]]

the tor browser bundle isn't affected - it's a portable firefox version with - among other tweaks - proxy settings that route browser traffic through the tor network - it doesn't ship with the defective extension in question.
i don't know how widespread the installbase of the torbutton addon is - it's not hosted on AMO. its install.rdf manifest does specify em:maxVersion as '10000.0', would the override list step in in this case too?

Comment 6

[Jorge Villalobos [:jorgev] (he/him)]

I'm OK with making an exception. I added all existing versions to the override list, starting with Firefox 12.