Skip to content
This repository has been archived by the owner on Nov 6, 2023. It is now read-only.

Update channels ux #16306

Merged
merged 4 commits into from
Aug 16, 2018
Merged

Update channels ux #16306

merged 4 commits into from
Aug 16, 2018

Conversation

Hainish
Copy link
Member

@Hainish Hainish commented Aug 16, 2018

Adding a UX to update channels, as well as functionality to add, remove, or edit update channels.

@Hainish Hainish merged commit 53c18b6 into EFForg:master Aug 16, 2018
@Hainish Hainish deleted the update-channels-ux branch August 16, 2018 20:19
@Hainish
Copy link
Member Author

Hainish commented Aug 16, 2018

If anyone wants to test this functionality, you can use the following to add a SecureDrop update channel to Tor Browser:

JWK:

{"kty":"RSA","n":"zv4NkDYgBL5n1LY_Pl2WWmiHV_IApqtXTXUL6STgUS3G_ZFORA5Qx_7x5TMA9OWeKsN9kgDkpiZWs_cUZCfWLkYeP6MRmtOe-50Wzca99qb8hQfBT81Pnir-hadlISgcuosZFWfEmaEPXHLI47ZgnelDvBcVD8XyOH5qc4umNCZIeFl_cQApv_t7KDo0HRr4fvWqWWhLwfJJU3HPNUr7VHAyEdU6whllOUl3uSEt7zXEfODnxFxUFILUmIXfqFS8c8VcI20l-8QXBijbHRXGTKpAj2Sdu9v5pGL0-5hh3iXISlC3rRpNjwBhdlQSWK9V30Cfp163bOP4WekSt51J5w","e":"AQAB"}

Path Prefix:
https://inputoutput.io/non-wp/securedrop/

This will make it so that in any instance of Tor Browser, navigating to theintercept.com.securedrop (or a similar URL for any other SecureDrop) will redirect you to the SecureDrop instance. This is a proof of concept and shouldn't be used yet for SecureDrop instances if privacy is required.

You can use test/tor-browser.sh to test this in Tor Browser.

@Hainish
Copy link
Member Author

Hainish commented Aug 16, 2018

You can also publish rulesets of your own by placing them in rules/, running python3.6 utils/merge-rulesets.py, generating an RSA key and using the pem-jwk npm package to get the JWK from it, and using the scripts in utils/sign-rulesets/ to throw it up on an endpoint. Though that may be a lot of work.

@Hainish
Copy link
Member Author

Hainish commented Aug 16, 2018

cc @redshiftzero

Copy link
Collaborator

@cschanaj cschanaj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a few suggestions and questions, would be great if they are addressed. The new option page looks nice!

P.S. I didn't dig very deep into the code but the basic functionalities look good to me. Thanks.

<div id="update-channels-list"></div>
<div id="add-update-channel-wrapper">
<button id="add-update-channel" data-i18n="options_addUpdateChannel"></button>
<input type="text" id="update-channel-name" />
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Currently, an empty channel name works, but it will cause the form rendered oddly. I guess this should be a required field, since it is showed on the popup and used to help the user identify an update channel

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point. This is fixed in a0bec3d

update_channel_row_path_prefix.appendChild(update_channel_path_prefix_column_right);
const update_channel_path_prefix = document.createElement('input');
update_channel_path_prefix.setAttribute("type", "text");
update_channel_path_prefix.className = "update-channel-path-prefix";
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know that the rulesets are signed, but it might be a good idea to encourage the endpoints to use HTTPS by hard coding the https protocol here.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can envision http update channels over onion services, or network administrators who wish to mirror update channels locally by DNS redirection (as is sometimes done with apt). I'd like to allow update channel operators to choose their own transport layer.

@@ -170,7 +187,9 @@ async function applyStoredRulesets(rulesets_obj){
const rulesets_jsons = await Promise.all(rulesets_promises);
if(rulesets_jsons.join("").length > 0){
for(let rulesets_json of rulesets_jsons){
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems to me that EFF's update channels will always have the top priority in rewriting URLs, while other channels are prioritize by insertion order. If the coverage of different channels overlaps, it might not works as the users expected, e.g. some channels might never apply. If this is the case, it might be good to have a way to prioritize the channels (possibly in later PR/ release). Please correct me if I am wrong.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes I think prioritization of update channels makes sense, but this will require some re-engineering. This would be a good task for a future PR.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants