1. The last time we audited TorBirdy was when we released v0.0.3 one
year ago. We should do this again and preferably after every release to
make sure that we are safe from any sketchy features Thunderbird
introduces with every new release.
- Review overall security, check existing and new preferences.
1. Review some popular add-ons (such as Lightning, see #6319) to make
sure they are safe to use.
- As "some add-ons" is a broad term, starting with #6319 is a good
idea...
- After that, we should have a system where we are open to
reviewing new add-ons if someone requests them.
4. HTTP Proxy
1. GPG has no SOCKS5 support, so we need a HTTP proxy for
TorBirdy for the Enigmail traffic. See #6974.
- There are two possible solutions:
- ship a HTTP proxy with TorBirdy,
- use a JavaScript HTTP proxy. See #6958.
5. Integrating Tor
1. Right now, we are assuming the user has Tor installed before running TorBirdy, and if not, we ask the user to install it separately. We should start shipping Tor with TorBirdy as a single package, for each platform that we support. See #8936.
- [https://gitweb.torproject.org/tor-launcher.git tor-launcher] (the Vidalia replacement) is under active development and will be used to launch Tor for the TBB. We should use that for TorBirdy by either contributing to its development so that it supports Thunderbird out of the box, or just hack it to make it work for us.
- For the Tor binaries, we should either just get them from TBB, or start compiling them ourselves. This is open for debate.
6. Miscellaneous Tasks
1. Finish packaging TorBirdy for Debian. See #8030.
1. Design a simple webpage that points to the relevant documentation. See #6017.