Why orbot isn't updated as with the Tor for windows and why Orfox isn't updated with the latest bundle of Firefox as of the same version in windows?

Question

I want to know why android version isn't updated with the same version which is available for the windows? Android version is always lower than the tor bundle for windows.

Not only that, even Orfox isn't updated with the latest bundle version as it is available for windows version. Tor bundle including Firefox is always of newer version than android's Orfox.

Also, Tor for windows is more often updated than Orbot for android. Even, Tor Browser for windows is also more often updated than Orfox for android.

You won't believe me that I asked these same questions to their supported emails so often that i also don't remember now how many times i asked them?

So far, no luck getting any answers from them!

As a result, i came here looking for answers. I hope to get satisfying answers from any one of you that why android versions aren't updated as often as windows versions????

Answer 1

Orbot

The Orbot currently in Google's Play store appears to be based on Tor 0.2.8.9. Yes, this isn't the newest release of Tor, not even the newest version of the 0.2.8.x series (which is still supported.) The changelog tells me that Orbot is not missing any severe security issues, so you should be fine.

As to why Orbot isn't using the newest Tor version, I don't know for sure, but my guess is lack of time and resources. Take a look at the commit history and you'll see that just one person has worked on it lately.

Btw, there is a newer beta version available on github. So, work to have it updated is in progress.

Orfox

As with Orbot, Orfox appears to lack (human) resources. It would even appear that the same person that maintains Orbot also maintains Orfox. I looked at the updates and security updates for 45.6, 45.7, 45.8 and 45.9 appear to be missing. This are the security advisory for the Desktop version, Firefox does not release an Android version of the ESR channel, so some vulnerabilities may not apply to Android. Also, Orfox inherits some hardening from Tor Browser, so a few vulnerabilities are likely not applicable because of it. I would appear that Orfox has been updated due to a severe security issues before, take a look at this and this.

All in all, I'd say improvements can and should be made.

Conclusion

I guess, I can't but agree with you that both should be updated. Yet, keep in mind that Orfox, Orbot as well as Tor itself depend on funding and volunteering, so consider supporting Tor. Running relays, answering question on stackexchange, developing software, Telling your friends about Tor and monetary support are all very much appreciated.

And, Yes, Orbot and Orfox should stick to the same release schedule as Tor and Tor Browser respectively. However, I'm still very thankful to the Guardian Project and its people that they provide this tools and I'm sure they are trying their best to make improvements where ever it is needed most.

Out of curiosity, how and when did you try to contact the developers?

Answer 2

The version of Tor provided with Orbot isn't broken. Tor Browser updates are normally only to address security issues in Firefox, not to address security issues in Tor itself.

This is why Orbot is currently okay.

Orfox is currently under active development, it doesn't get updated as often as it should, it has leaks and is out of date and doesn't currently defend against fingerprinting in the same ways that Tor Browser does. It should be considered the best option out of a set of bad choices.

The mobile phone app space for Tor on both iOS and Android is, unfortunately, underdeveloped and incomplete. It also has a lot of snake oil in it that claims to do things that it doesn't.

Update: GeKo, one of the Tor Browser developers left a comment on the Tor Projects blog stating that Orfox may be replaced by an official Tor Project Tor Browser for the mobile platform and that the Guardian Project is planning an update for both:

I've heard the Guardidan Project is working on updates to both. That said we'll plan to build a Tor Browser for Mobile (Android) later this year which will supersede Orfox. It should get as regular updates as the Tor Browser for desktop (and should have feature parity as well). So, stay tuned. :)

Thanks to user139336 for pointing me to this information.