In the past these questions were asked about updating Tor Browser Bundle:
- How can I switch from one Tor Browser Bundle version to another?
- How do I keep my Tor Browser Bundle current?
For a while now we have had an updater, what I would like to know is: Is it still safer to download and verify the tarball & sig from the downloads page and copy the directory that contains your entry guards into the new Browser (once you have extracted it) than it is to just run the updater?
Not taking the convenience of the updater into account.
My main concern being that unless I am mistaken it is harder to verify that you were not the victim of a MitM attack during the update if you use the updater.
To summarize: I am unsure of how the updater verifies the integrity of updates, but how does it compare from a security perspective against the old way described in the linked questions?