Why does torbrowser-launcher need tor package on ubuntu?

[crocket]

torbrowser-launcher depends on tor, and tor package sets up a tor service that starts during boot.
As far as I know, torbrowser-launcher works without a tor systemd service.
I don't like tor to run as a system service.

Is there a reason that tor package is needed by torbrowser-launcher on ubuntu?

[micahflee]

torbrowser-launcher downloads TBB over tor, and it needs a system tor to be able to do that. This is optional and can be disabled, if you'd rather download TBB over the normal internet. Whether or not it's using Tor it still certificate pins and verifies the sig.

[intrigeri]

Suggested my team-mates to change this: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=795240

[micahflee]

@intrigeri I'm totally open to that. The real issue here is the default setting. If you run torbrowser-launcher --settings you can see the "Download updates over Tor (recommended)" is checked by default.

If that box is checked but Tor isn't running, it throws an error message telling you to confirm that you're connected to the internet. I think perhaps instead it should say that it failed connecting using Tor, and ask if you want to update your settings to not use Tor. Of course, this might make a sort of downgrade attack (by blocking access to Tor) possible, but it's a very minor one.

[micahflee]

Because of #198, Tor Browser Launcher won't be in charge of updating anymore, just downloading for the first time. Because for the most part this will be a one-time thing, I'm fine with removing the tor dependency and making it merely recommended, and changing the default option to not download over Tor.