LibreWolf – A fork of Firefox, focused on privacy, security and freedom

Or do extensions not have access to these settings?

Did anything of the sort ever happened at all or are we only entertaining thought experiments?

I understand the argument that my grandmother should probably enable auto-updates, because otherwise she could easily end up months behind on releases.

But I care deeply about my personal computing environment. I notice every minuscule change because I'm on my computer for hours and hours each day. Sometimes I'm in the middle of some important projects and I don't want anything to automatically update. Sometimes I'm really productive during an afternoon and I don't want to waste time and lose momentum on an update (or some bug, or UI change, as a result of that update). Sometimes I've heard about some problem coming down the pipe in the next update and I'd rather wait until there's mitigations to make that change work better with my specific setup.

Automatic updates basically assume that I have the computing proficiency of my grandmother. But I actually manage my computer in a very conscious, thoughtful way. All software should provide the ability to disable automatic updates (and update nagging) out of respect for power users. It's OK to hide it in a developer or advanced menu. Just give me the option.

That being said: automatic updates are a sensible default for the same reason. But let me opt out, and (Mozilla, are you listening?) for the love of god please don't override my preferences back to automatic updates when you decide to change the UI of preferences.

It has been disabled, as per the policy. It looks something like this in the policies.json file:

    {
    "policies": {
    "DisableAppUpdate": true
      }
    }

In terms of security, it kind of sucks having to manually do this, but it's a small price to pay for a hardened stripped down Firefox with all the Mozilla crap (Pocket, Telemetry etc) stripped out.

Perhaps more importantly, companies that offer software that can auto-update itself, can also make it so that the software uninstalls itself. Or worse, installs something you don't want. It also makes for an especially juicy target for supply chain attackers. So you have quite a bit of a double-edged sword there, from a security standpoint.

I wonder when we're going to stop pretending that there shouldn't be at least a fuzzy divide between software and systems intended for technical users and software for non-technical users. (And we should not be afraid to label them as such.) I fully agree with auto-updates for mass-market software but as a technical user, I don't want the system that I rely upon to make a living to constantly be changing out from underneath me.

[1] https://brave.com/building-brave/ [2] https://github.com/brave/brave-browser/issues/5830

More seriously, is the suggestion that FF is too complex to properly fork without full time devs?

That's incredibly vague. Can you explain? How are the many forks/variants of Chromium and WebKit not affected by this "money" factor in the same way

Maybe we need more 501c3 and benefit corps providing basic stuff like an internet browser?

In general, that's true. But Firefox is an exception to this.

The most important thing to a regular user, is that their websites work. But for websites to work, the developer had to test in Firefox. So, Firefox's alienation of power users has hurt its regular userbase.

There's also the distinction between users vs customers. Most users pay nothing for Firefox. A relatively small number of free-software lovers provide donations. If they want more of those people to give more money, Mozilla would have to cater to power users. This leaves Mozilla's main customer as being Google, who doesn't really want Firefox to be good.

The other exception to this, is if the software you're making is so specialized, that you can get by on a handful of large institutional customers. Obviously this is not where Mozilla is, it's just another case where telemetry is not necessary.

I'd rather have the ability of ad-blocking and similar extensions to work on a deeper level, instead of crippling them, like on chromium-based browsers.

What about mono-culture and the risk there of?

edit: Availability of working DRM is what it all boils down to.

That said, I work on Gecko and it is indeed an old crufty codebase with numerous issues. From what I've seen of Blink, it seems surprisingly similar (overall; the specific problem areas are different). And Gecko has a surprising willingness to rewrite or revamp core aspects of the codebase -- by some metrics, it appears to be more nimble than Blink (eg, site isolation to separate processes was a massive project for both codebases, and it looks like although Gecko started and finished later, the elapsed time is a couple years less.)

On the other hand, Eich was pretty well in touch with the Gecko codebase, so his opinion should carry some weight. (Somewhat counterbalanced by his seeming enthusiasm for burning some bridges behind him, but that gets into very speculative territory.)

I tend to agree that Gecko isn't as good as Chromium as a foundation for forking, though. I think working with the Mozilla development community is actually quite a bit better than working with Chromium's, but Gecko is pretty unapologetically focused on Mozilla's product needs and Mozilla doesn't have the resources to properly support external embedders or forks.

At some point we compared gecko with a blink port on Gonk, maintaining both while we were doing performance comparison on low end mobile devices. We were looking both at memory usage and page loading speed. I was expecting to see blink way ahead of gecko, but that was not the case at all. For some content blink was a bit better, for some it was gecko, but never with a large gap either.

Maintenance of the blink product was not easy, with barely documented internals changing a lot (it's very different to build a new product on top of blink compared to just fork an existing one like chromium). I'm not blaming the blink team, that makes sense in the context of what they do, and we were not as familiar with blink code base as with gecko. Finally we stayed on gecko because this was the best choice for us (eg. including team velocity and the amount of non standard apis to rewrite).

In my opinion if you want to start on a new browser product, the main Chromium benefits for a commercial project are: - web compat, which unfortunately is self sustaining. - licensing. The MPL vs. BSD doesn't matter for open source projects, but many companies (especially VC funded) are adverse to copyleft licenses. Gecko's xpcom architecture was actually not a bad fit with the MPL, since you can ship new xpcom components without publishing their code if you don't want, but that didn't make much of difference (some chipset vendors used the capability for FirefoxOS to replace the implementation of telephony apis with closed source ones).

But you need to be comfortable being subject to the whims of google (and a little bit MS now). For instance, consider the changes to web extension resource blocking capabilities with the "manifest v3": some forks plan to keep the resource blocking api working, but it's very unclear if they will be able to do so in the long term without a growing complexity of their fork that may become too high.

If you are an open source project, please don't cement Google's dominance of the web by using chromium.

Gecko deserves to have a future - it may just not be Mozilla's corp current leadership that is the best for that to happen.

Or https://gist.github.com/davinian/1991bb3486cbf6005b5320e93b3... but it is quite old I think.

In any case, make sure you know what you are disabling, because in the latter it suggests disabling WebSockets which you may not want to do.

Trust matters.

I don’t trust Mozilla not to push ads, but I do trust them not to build in intentional backdoors and steal my personal data, because there’s a whole public organization there, with a reputation and responsibilities and heads that will roll if they are caught doing nefarious things.

You might ask why I trust thousands of other open source community led projects? Largely because they have built rep and get at least a minimal vetting via distro package management.

I’m not saying this fork is malware. But I don’t know it isn’t, and the browser is the #1 critical component that handles all my most sensitive data.

Providing you actually review the code and not just trust it because the code is there. Reviewing (a fork of) Firefox sounds like a big job, if can be done at all. Being a Firefox fanatic does not magically make you a rust programmer

One of the key pieces of open source is the larger a project, the more people will be incentivized to monitor the code for malicious changes. This distributes the burden to a much much larger pool therefore minimizing the burden to single nodes across the board.

Is it perfect? No, absolutely not. Do malicious or unintentional bugs slip through? Sure. But when it comes to scaled out projects, nothing is perfect and never will be. I certainly trust a large open project with years of reputation built up and a large user base significantly more than a large closed source project or large and open with no reputation.

There are of course valid criticisms of this model but I’ve yet to see an alternative put forward that isn’t fraught with its own issues.

I do find it strange how over the past few years we’ve seen a number of people who engage in a whiplash type behavior where they see minor problems with a model so they whiplash away into a far worse model with far more serious problems.

For what it's worth, some of the startup checks are to see whether the user is on a public wifi with a captive portal, and talk to a Mozilla service rather than Google. Other checks are for upgrades, or Firefox Sync, if enabled.

In its original form, free and open is noble. But since then, corporations have figured out how to monetise it. So, IMHO, we need to be very careful about anything free and open coming from corporations because their core objectives are very much orthogonal to the core objectives of the original free and open software movement. Those execs aren't the hackers who built the gnu/Linux tools in the early days.

While I’m grateful to this project for calling attention to the privacy issues with Firefox, most of the effort spent on this seems like replacing the brand.

People could get nearly all of the benefit by copying the policy.json file.

Not in the website statistics I guess, unless the forks present themselves as Firefox, which I doubt.

I don't think Mozilla is intentionally helping Google, but they are bleeding a ton of money with community events etc, laying off people while giving this horrible execs increased salaries. Like seriously WTH?

Mozilla need to kill the current leadership, get lean on spenting and most importantly cater to their audience. They don't have much general users. A huge portion are hardcore fans, OpenSource folks, people who value privacy or anti-chrome. Pushing ads to this audience, is only going to accelerate the downfall.

Focus on pleasing power users and devs. Market on shit that matters to power users, sys admins, devs and privacy folks, journalists! Like containers, and dev tools (some of which are already cool). Then these folks will whole heartedly embrace it in their workplaces, recommend to friends and family. Devs will write things more for FF. And don't break extensions again! This is how you got us before. Do it again. Then the general audiences will come.

Currently all these power users an others are themselves not sure about Firefox. They are stuck with it cos neither can they donate directly to Firefox development, nor are they happy with the leadership decisions. They are just waiting till the last day of FF's existence so that they can be a lil more private until they have to move to Chrome based browsers.

When their heart was at the right place their tech sucked. Their tech is better now, but their heart is not in the right place.

I will start using Firefox when it leaves Mozilla and I'd pay a subscription for it. For me, the ideal situation is a lean team (hopefully only the devs, because I'm not paying any useless middle or high level managers a penny) start developing it for a fee. Just the browser will do, no password managers, no vpns, no nonsense. I already pay for subscriptions for those.

I've seen many here on hacker news expressing willingness to pay and the only reason that they don't is because they don't want to pay for other Mozilla nonsense but Mozilla doesn't want to open a direct channel for the community to support the Firefox team. I find this outrageous. Clearly, they are using Firefox, its very talented devs and the image of their noble fight for a private internet to fill the pockets of executives who don't know shit about engineering or the ethos of opensource software.

"grab telemetery" - that data is really, really useful in making development decisions, and we are hyperparanoid about what we collect. From an armchair, it may seem like you can make the right guess about how to eg adjust garbage collection scheduling priorities, but actual data always surprises you in one way or another. It can make the difference between spending a month on a tough project that ends up making no difference for the vast majority of users, and having a month to spend on something more impactful.

I really don't like to speculate on executive pay, but I'm pretty baffled why this is seen as such a big deal. Your argument sounds valid to me. So does the argument that we're talking about the CEO of a tech company that is competing directly with multiple Big Tech competitors, and perhaps paying comparatively bargain basement prices is not the smartest idea. Which is not to say that I'm happy about the layoffs.

Mozilla has messed up on a number of things, multiple times, including at least one time when it ended up (as in, made a deal to and carried it out) sending a bunch of data to a third party. (It was more nuanced than is generally appreciated, but I won't go there.)

I sincerely apologize that Mozilla isn't up to the pristine standards of the big technology companies. /s

I'm not going to explain the MoCo/MoFo structure here. I'll just say that MoCo most definitely pays taxes, MoFo asks for donations because it's a nonprofit with its own initiatives and direction, and you can get tons of information about the finances involving both because of MoFo's nonprofit status and the resulting annual report. (MoCo = Mozilla Corporation, MoFo = Mozilla Foundation, MoFo owns MoCo.)

The Google deal is, like, how MoCo makes money and is able to exist. What's shady about it? I'd certainly like the funding to be more independent. Maybe Mozilla can try drilling for oil on the land it doesn't own or start selling off the user data it doesn't collect?

I maintain a hardened fork called Mull. I also help maintain Fennec F-Droid. Both are available on F-Droid!

Of extra note, both Iceraven, Mull, and Fennec F-Droid are based on Fenix, not Fennec. Fennec is any Firefox for Android before version 68 and is not secure.

not even controversial sites landing on blacklists, for reasons of technical errors maintaining those,

or some jurisdictions DMCAing some other site(s),

hosted behind the same IP-range in the same data-center.

Boom. Suddenly the site is gone, or at least you have to click around endless warnings about impending doom if you proceed.

For nothing. This is the same shit like antivirus ware on Windows. Utter non-sense.

Meanwhile, for instance on often visited sites(like weather), the Ads happily delivering malicious payloads.

This also happened many times, but can't blacklist large sites for delivering malware, can we?

Would cost too much ad-value. No-Go!