Is there a better alternative to Firefox? Of all the browsers it seems like the "least bad" choice (above Chromium, and other proprietary browsers) and I use it, but is there something safer, simpler, and more secure?
No.
Building a good browser is hard. Typically you can get something "safer" (from a privacy/business model perspective) and/or "simpler" (from a development perspective) relatively easily - see KHTML and other niche efforts. But when it comes to "more secure" while supporting modern web features, you need a lot of skilled eyeballs on code and a lot of people trying to break things. You achieve that either with tons of visibility, or with tons of money. Those small projects have neither. Mozilla has both.
Brave and Vivaldi are still forks of Chromium, Waterfox is a fork of Firefox. Thus you are not going to find any updated alternatives like those on the BSDs anytime soon.
Meanwhile, WebKit-based browsers doesn't seem to suffer from the overuse of dependencies and multiple languages nor does it have packaging hell unlike Chromium and Firefox.
why is that?
In comparison historically Firefox has been more aggressive about pulling in 3rd-party dependencies like cairo, ANGLE, etc.
(You could count ANGLE as a 3rd-party dependency for Blink, I suppose, but I don't because AFAIK it's a Google project originally)
I don't think there is a viable alternative to Firefox unless you accept a simple web experience and use eg w3m
My biggest problem with most browsers is tied to how they handle tab management and lacks basic features that should be there without installing an extension.
Example - stacking, auto closing, filter, finder etc. Not hiding tabs after certain number of them.
edit: more info here at https://vivaldi.com/features/tab-management/
It's basically a lightweight interface to webkit. There's only so light one can go, however; a browser basically ships an entire rendering stack and big chunks of an OS, and with all the weird features and backwards compatibility issues that have accumulated, one can only go so small.
KDE has "Falkon".
Both are quite good.
Full circle!
Blocks all trackers, fingerprinting and mining scripts by default, based on Chromium. Built-in IPFS, Webtorrent and Tor: https://brave.com/
Please, prove it.
And here's where you show you're making it up and haven't even looked at a Pale Moon release notes, http://www.palemoon.org/releasenotes.shtml
If I really wanted to scare you, I'd tell you about such security-friendly-sounding commits as "we don't want the newest release of the [crypto] library, let's freeze at an older version" or "re-enable support for RC4 in TLS." But that would be unfair, because you'd actually have to read the commit to judge for yourself if I'm quoting them in good context.
1. You don't seem to think the Pale Moon has value, nor that it should be used.
2. You say you don't read their release notes--which makes sense if you don't think it's worthy.
However:
3. You say you do spend time reading their patches--which doesn't make sense if you don't think it's worthy.
4. Their release notes frequently mention "defense-in-depth" patches which are their own work, not, as you put it, to "randomly backport patches purely to try to keep somewhat up-to-date"--which conflicts with your claims about their work.
So you say you read their patches, yet you don't appear to read all of them. And you say you don't read their release notes, yet you speak as if you have comprehensive knowledge of their work.
Then you say something that's supposed to be scary, but then you say that it might not actually be scary, and you won't tell us whether it actually is.
So, regardless of whether Pale Moon is valuable or useful or secure to any degree, isn't your comment a textbook example of FUD? What's your purpose here?
If you actually read the release notes, you wouldn't say this.
It's not "random", inform yourself: https://www.palemoon.org/roadmap.shtml
1. https://www.palemoon.org/technical.shtml
2. https://wiki.hyperbola.info/doku.php?id=en:project:iceweasel...
Pale Moon and the like aren't just ancient Firefox code. And without all the 'features' Firefox keeps adding in that are irrelevant to a browser that renders html and executes JS they're just as secure.
The up shot is Pale Moon's maintainers decided they don't trust Let's Encrypt for spurious reasons. But if you use Pale Moon you've probably never noticed this because Let's Encrypt is cross-signed, and so even though Pale Moon claims not to trust them, the cross-signature makes everything still work because they didn't intervene.
So that's a bad decision, combined with total incompetence to produce the appearance where everything looks fine.
That's exactly the sort of thing in a browser that should make people run away screaming.
In the years that followed Pale Moon wanted to keep StartSSL (the outfit which straight up lied to us about issuing clearly bogus certificates for money, Pale Moon's maintainers apparently feel that this shows "integrity") and described Mozilla's distrust decision as a "foot gun". How did that work out? Oh right, it turns out that everybody else doesn't trust liars either and so Pale Moon eventually went along with this because as others explained in practice they're mostly just applying patches blind to core Firefox subsystems like NSS.
1. https://www.palemoon.org/releasenotes.shtml