Tor Browser >= 9.0 superficially incompatible with ZeroNet (and most other darknets)

tl;dr

If you recently upgraded to Tor Browser 9.0 and are no longer able to connect to ZeroNet, browse to about:config and change the value of the network.proxy.no_proxies_on setting to 127.0.0.1.

Read on for ugly and terrifying details.

Step 1: Please describe your environment

• ZeroNet version: 7.1
• Operating system: Gentoo Linux
• Web browser: Tor Browser 9.0
• Tor status: always
• Opened port: no
• Special configuration: N/A

Step 2: Describe the problem:

Tor Browser 9.0 (released two days ago) superficially breaks ZeroNet – and all other localhost-based darknets including I2P. Previously, the detailed instructions under the FAQ question "How to use ZeroNet with the Tor browser?" sufficed to render ZeroNet usable with Tor Browser. Tragicomically, Tor Browser 9.0 fundamentally broke us by removing the "Use custom proxy settings" subsection from the "Preferences..." dialog. This includes the "No proxy for:" field required to enable ZeroNet usage. Yup.

The forced removal of custom proxy settings from Tor Browser 9.0 doesn't simply effect new users; it also effects all existing users who previously listed 127.0.0.1 under the "No proxy for:" field. Why? Because Tor Browser 9.0 didn't simply remove these front-facing GUI elements; it also removed all of the underlying implementation logic associated with these front-facing GUI elements.

We begin to see the problem, I trust. Attempting to browse to any localhost port in Tor Browser 9.0 now yields the following thoroughly useless error message:

Unable to connect

Firefox can’t establish a connection to the server at 127.0.0.1:43110.

• The site could be temporarily unavailable or too busy. Try again in a few moments.
• If you are unable to load any pages, check your computer’s network connection.
• If your computer or network is protected by a firewall or proxy, make sure that Tor Browser is permitted to access the Web.

Perusing the Tor logs (e.g., via "Preferences...", "Tor", "View Logs...") yields a slightly more informative view:

10/25/19, 02:33:28.443 [NOTICE] New control connection opened from 127.0.0.1. 10/25/19, 02:33:28.788 [WARN] Rejecting SOCKS request for anonymous connection to private address [scrubbed]. [10 similar message(s) suppressed in last 300 seconds]

This is bad. Since Tor Browser defaults to auto-updating itself, most Tor Browsers users will now find ZeroNet (and most other darknets) inexplicably unresponsive. There's no visual indication during either the Tor Browser update process or from within Tor Browser itself once restarted that localhost connections are now silently and unconditionally denied.

This is appalling user experience (UX) design. This is also disappointing behaviour from Tor Browser developers, who absolutely should know better than to fundamentally break previously working functionality for no demonstrably good reason. Clearly, they think they know better. Clearly, they don't.

I am darknet-based anger incarnate.

I'm afraid I couldn't find a recent ticket on the Tor bug tracker that publicizes this, but several ancient tickets appear to relate: ticket/10419, ticket/10165, and ticket/11493. Please repeatedly pester, flame, and shame developers on the Tor bug tracker until they relent – which they won't, of course. They've only gotten worse and worse and ever more authoritarian "vigilant" about prohibiting localhost access. Expect to be ignored, in other words.

But wait! There's more. As any good Mozilla devotee knows, Firefox's public-facing UI is also overly authoritarian, unnecessarily minimalist, and frankly useless... but trivially circumvented by the One True Preferences dialog: about:config. Long live about:config! Without that, Firefox and now Tor Browser would be literally unusable for most sane purposes.

Does about:config help us here? It absolutely does. Well, until Tor Browser developers realize that users can restore access to localhost by defining a single setting in about:config. At that point, they'll probably attempt to prohibit that, too. When they do, we'll need to get imaginatively creative. Until then, the following alternative instructions to those listed at "How to use ZeroNet with the Tor browser?" suffice to restore worky:

1. Start Tor Browser.
2. Browse to about:config.
3. Enter network.proxy.no_proxies_on into the "Search:" box.
4. Double-click the network.proxy.no_proxies_on line that appears.
5. Enter 127.0.0.1 as the value of this preference.
6. Click "OK".

Changes take effect immediately. Restarting Tor Browser is unnecessary. No thanks for small favours!

Needless to say, we'll need to revise our FAQ instructions to note this. It would be nice [read: it'll never happen] if someone who is not me would also create a Tor Browser Add-on or Extension for ZeroNet that automates this and other mundane chores (e.g., installing a ZeroNet-specific .pac file for domain resolution).

Until then, we're stuck with low-level manual kludges. Why, developers... Y U break worky!?!?

Steps to reproduce:

1. Update Tor Browser.
2. Note that ZeroNet is dead.
3. Repeatedly smash forehead against keyboard until lapsing into blissful unconsciousness.

Observed Results:

• What happened? This could be a screenshot, a description, log output (you can send log/debug.log file to hello@zeronet.io if necessary), etc.

ZeroNet dead.

Expected Results:

• What did you expect to happen?

ZeroNet not to be dead.