So you say your current position is to be rather carefully around anything by/from Google, but you trust Internet randos to build the binary of the browser you use?
Okay.
Okay.
Unlike this project, which is very much from "internet randos"
such a well-known governance that keeps putting back telemetry and ads when users dont want them.
As for ads - where? I haven't seen any and I've been using Firefox on multiple platforms for many years.
No, crash reports are primarily data about the program, with very little if anything about you.
Even if it did, we're again back at the point of "X is a spectrum". "evil" is a spectrum which, according to you, includes anonymous crash reports and then goes on to include serial killers and war criminals. Even then, anonymised usage data used to guide development is far less evil than collecting highly personal and identifying data and using it for targeted psychological manipulation to get you to buy things.
I get it, Mozilla isn't the poster child FLOSS org that we'd like it to be, but it's still orders of magnitude better than the competition.
"Reflections on Trusting Trust": https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
And even if you go Full OpenBSD, you're still relying on some chip microcode and BIOS that you bought sight-unseen.
So, unless the Free Software Foundation staffs its own fab staffed by angels, the best we can do is minimize risk.
A more practical depth would be to bootstrap with GNU Mes, which is a source based bootstrapping path, that begins with a tiny scheme interpreter (~5000 LOC of simple C) and a C compiler written in scheme that are mutually self-hosting.
These tools can compile a slightly patched version of TinyCC that is self-hosting. Using this C compiler you can bootstrap a bunch of gnutools (glibc, binutils, gcc) and using these tools you can bootstrap a full Guix Linux distro.
stage 1: build from source using your existing compiler
stage 2: build again from source using the compiler you just built
stage 3: (just for checking): build a stage 3 compiler from the stage 2 compiler. Verify that it is byte-for-byte identical.
extra stages for the paranoid: repeat the process with a different starting compiler, as unrelated as possible. Again, verify that the output is bit-for-bit identical. You then know either that you're good, that the compiler reflects the source, or both starting compilers have the same devious hidden hack, perhaps courtesy of Ken Thompson himself.
GNU Mes achieves that paranoid step: once you verify with GNU Mes that you get the same bits, you don't really have to do this ever again, because you can certify that the compiler you get is reproducible from source and has no tricks.
How did you come to this conclusion when they stated that they'd rather use Firefox? Or are you saying Mozilla are the internet randos?
Sounds a little crazy not to trust them.
If you want chromium without Google there are several options such as Edge, Opera, Brave and probably a dozen more I've never heard of.
On the other hand, I simply don't trust internet randos, much less to install their binaries.
And it seems like a third option of Firefox w/ uBlock is less bad than either of the above.