LibreWolf – A fork of Firefox, focused on privacy, security and freedom
librewolf.net
librewolf.net
The librewolf AUR package is a great starting point to make custom builds of firefox; between two json files in the settings repo you can tweak basically any relevant setting, bundle extensions (e.g. use custom forked ones without needing to either sign through Mozilla or disable security), search engines, use your own fxa/syncserver, handlers, branding, etc.
All in a git repo and you won't have to redo things next time you reinstall the browser or get a new machine (anyone else ever scratched their heads trying to recall that one about:config setting?)
Building and tweaking vanilla firefox yourself is quite an exercise. Librewolf makes it a breeze. The sane privacy-by-default standards is just the cherry on the top.
Huh, is this tractable?
My opinion is "yes" - the source is available and runs as a docker container, the client setup is pretty trivial (on Android you'll need Fennec or another alternate build of Firefox to get at the settings). I'm aware of one user group running a shared instance and it seems to work as advertised.
So I click your link, but the repo says
> Note that this repository is no longer being maintained. Use this at your own risk, and with the understanding that it is not being maintained, work is being done on its replacement, and that no support or assistance will be offered.
So I guess I'll have to wait a little more...
So basically they stopped running the older version themselves but don't consider the newer version production-ready yet. What a mess.
Though when I log in on a mobile device I don't even have to enter the password so I kinda doubt it passes the mud puddle test.
But at least the info is not just stored in the clear ready for datamining like Chrome or Edge do. Though Chrome has very recently added e2e for its passwords but not for the bookmarks.
I didn't look into it personally but a few years ago I tasked an employee with setting up local instance of this for a very privacy conscious small business and after a few days of looking at it he said that it would be too much work to get the released material into a state that end users could make use of.
This could have changed since then however.
Yes. See my comment above. Nothing that a persistent admin can't pull off. I wouldn't blame your coworker for giving up, though.
For the syncserver itself, where all the data is synced and stored, you just need tokenserver+syncstorage, plus a database backend of choice. Easy-peasy, you can set it up trivially in minutes if you're used to spin up docker containers and have a database server. Loads of people do this.
However, you still need a way to authenticate. Most people just piggyback on Mozilla's servers for this. This means some metadata (not the synced data itself, mind you, but still) will be shared with Mozilla and a surprising number of third-parties.
To get the last meter and be fully self-reliant you need to go down quite the rabbit hole and set up the fxa stack. It involves several interconnected microservices and a handful of separate mysql databases. I managed to but it took a couple of days to dig through the sources and figure out exactly what is necessary and disable all the third-party integrations. The pieces are all there and it's all done in the open but it's clearly built with the mindset of a cloud-based startup.
https://github.com/mozilla/fxa
Once up and running it has been hands off, not much maintenance at all. Happy I did it but unless you like doing this kind of stuff as a challenge, I'd probably recommend using some alternative extension, until it becomes more approachable.
If you take it on, there are helpful people in the #fxa:mozilla.org Matrix room. More activity there, and self-hosting related discussion/issues/PRs in the fxa github repo, might push them to put in more effort to make it easier to self-host the stack and bring/keep docs up to date.
Hoping to do a proper write-up soon to make it more approachable for others, once things cool down a bit at work.
#fxa is almost a ghost town as of now. The few GH issues relating to this are not getting any interactions.
We can't expect them to prioritize something nobody's asking for or using. I think there're more of us than they realize.
You aren't kidding: https://firefox-source-docs.mozilla.org/setup/macos_build.ht...
I was responsible for including uBO as default, among other things.
Great to see that the project was brought back to life as LibreWolf - Mozilla lawyers had threatened us with legal action because the name was too close to their brand. They expected us to drop the "Fox" part of the name.
Everytime I see LibreWolf on HN I feel proud that the spirit of Librefox is still alive.
The biggest issue with LibreWolf and what's stopping it's further adoption is lack of auto-updates (especially on Windows) and lack of usability - it should work out of the box for everyone. Currently the security settings are too strict in default mode. There should be different levels of pre-configured security levels users can chose in the settings (i.e. "standard", "strict", "very strict").
(I don't use HN for commenting, which is why I created a throwaway account)
Guess what stands out like a sore thumb? Someone with a timezone many hours off from everyone else in their country/state/region.
Fucking idiots.
Just let people install the update when they want (so they can make their own decisions on the risks) and provide ways to get feeback to you if there are problems. No need for telemetry at all or even an explicit incremental rollout when you don't force users to update.
Overall, it's a pretty good implementation of "Firefox By Mozilla-the-Foundation not Mozilla-the-Corporation." I've been using Firefox at least in part because I think a mono- or even duo-polistic internet is a Bad thing, but Mozilla's been indifferent-bordering-on-hostile to me as a user class, so I appreciate LibreWolf as a kind of "Chromium for Firefox."
https://help.getpocket.com/article/1142-firefox-new-tab-reco...
It's not quite as bad as Microsoft "We really think you should try to use edge so we'll set it as default for you with every major update! And bug you with popups everywhere we can!" But not as clear as the desktop version either.
In fact the mobile one has so many settings and add-ons blocked that sometimes it feels as if it's made by a different company. It completely lacks the things that make Firefox great :(
I still use it because of sync and uBlock origin which at least works now.. But it's pretty mediocre imo. And most of this is intentional design.
Warning: puns
… Yes, in the sense that it's not open source and therefore you can't make a pull request on it.
Seriously, the server part of Pocket is closed-source, and that's why I'm suspicious of it. I don't trust that it's operating in my interests.
Teach a man to fish and he'll thank you. Hang around all the time offering him some fish you caught that's totally free to you but don't worry it's really good fish and you'll love it why don't you try it, and he'll start to think you're a bit fishy.
And I don't understand why Mozilla would buy a closed-source service in order to compete with the open-source Wallabag.
It's emblematic of Mozilla turning into “just another digital lifestyle brand” and losing the ideology that made Mozilla what it was, radically user-empowering. It's pathetic, in the classical sense that I pity Mozilla for how faint a shadow of its former self it's become.
I've been looking to put words to what's going wrong at Mozilla recently but you captured this perfectly.
The intention is still there and they have continuously made more and more parts of the backend public, as can be seen on their GH profile.
There's little in terms of docs but step by step they seem to be getting there.
What's the issue? It's not open source?
https://github.com/arkenfox/user.js
Contrary to what LibreWolf claims you do have to sacrifice usability though, including WebGL, DRM, Firefox Sync, autofill, history, and the occasional breakage. With arkenfox there is also letterboxing, and even more breakage. If you set uBlock Origin to the recommended medium mode you usually still have to whitelist third-party scripts to make websites work.
My general assumption is that, if I let Firefox autofill my address, it will insert portions of my address into various fields at random, biased somewhat but not very strongly toward getting them in the right place.
These considerations rely __HEAVILY__ on your browsing habits.
I've been using librewolf for quite a bit and only two sites required webgl (to use them I simply had to toggle webgl.disabled in about:config which I find acceptable since I've never had the need to use them after that occasion).
I do not visit sites that use DRM (I used to use Netflix but their service sucks so much I'd rather pirate stuff)
There are extensions to sync browser data with e2e encryption.
I find password managers are more usable than the builtin manager of the browser.
History has always been an annoyance more than a feature and I'd disable it either way
This is just my opinion, try it yourself for a couple of months and see by yourself if it's something you'd consider daily driving.
Replacing a core functionality with an extension is not obviously beneficial either when it comes to privacy or security.
I now prefer a browser without any history and cache and make heavily use of the bookmarks and adding exceptions for specific sites that should keep cockies between sessions. I can use the address bar to quickly find a site that i have bookmarked without having the results cluttered by search suggestions and years of history.
I wonder how tedious would it be to set up a buildserver and audit all the patches and their updates with each release.
The only way to achieve meaningful fingerprint resistance is either blending in (practically impossible because all browser users are too unique) or enforcing a good baseline which is also impossible because the current market leader, who is in dire need of an antitrust action, is interested in keeping up the status quo.
I haven't seen one in other Firefox forks and I hope this one does better. Please don't get into online flamewars with people or other projects (including Firefox), try to contribute upstream, accumulate good developers. You can change your priorities, but never change your values. They're foundational, so when they shift, it ripples throughout the product, making the entire thing erratic and undependable. People have enough in their lives to worry about.
Is there anything in the browser code this fork actually changes?
I guess that's about it and I would not want it do anything more than that.
Because you're afraid they'll get hacked.
I feel like you felt this was some kind of slamdunk gotcha, but I really can't see what you are trying to say. As if Ukrainian combattans have some special bookmarks that reveal some military secrects.
>You can think of many real life risks when other people have your data.
Yet you can't name one
Not to mention I use safari on the iphone. I don't want work or personal mixed either.
Even if did want some of these, companies are not trustworthy any longer.
As for mixing work and personal. You can setup multiple accounts and switch between them. And I don't see what the amount of bookmarks has to do with anything, it just brings up relative things faster if you have them bookmarked.
Feels almost like you are just trying to come up with reasons to dismiss useful feature.
I don't need to switch between accounts, but screens, my client work is on a separate laptop.
Try navigating even hundreds of objects on a mobile device, it's not practical. Most of the stuff is not needed there either, for example (at random) I never use stack-exchange from a mobile device.
yeah, so it is not for you.
> No, they don't have info about me, at least that part. That's the point.
is that really THE point? If so can you please clarify why.
The fact that organizations are starving for data means they will correlate and profile on anything they are allowed to gather. Once gathered, never deleted, bought and sold. More ethical employees replaced as needed.
You're in a librewolf thread, maybe wondering why it exists? For a primer I recommend the Frontline doc, "The United States of Secrets." It is on Kanopy, maybe PBS app for free. Worth paying for. Their more recent Facebook doc was interesting as well.
In themselves, bookmarks are not important. But they'd be pretty valuable (combined with other things) to use as an input to an advertising algorithm, no?
This reads like some conspiracytheory B.S.
To anyone that is reading, I also recommend the "Social Dilemma" on Netflix, although it comes in from a slightly different angle, encouraging addiction that feeds back into this one.
One is that Mozilla broke all the extensions on Android except a few ones so there are very few extensions that I can sync from Ubuntu to Android. And I only have a laptop plus a number of phones and tablets.
Two, I don't sync my data through somebody's else servers. I fancied to setup my sync server but that would be limited to Firefox. Instead I use KDEConnect and GSConnect to send tabs and files across devices (and Syncthing too.) I don't bookmark much. I pin a few sites to the new tab page.
That seems like schizo blanket statement. Now instead of using built in, tested solution, you spend time setting up and maintaining custom solution and for what gain?
I gain that it's not Mozilla's or anybody's else business to deal with my links. Everything stays inside my devices.
Do you use it in some way to sync browser stuff?
This is the feature I'm desperately wanting from apps and desktop applications (like browser): let me sync between desktop and mobile by syncing small state/settings files (of the apps) via syncthing.
You mean a full feature-complete devtools like what you'd find in the desktop version of firefox?!
If so, then it's a life saver. The only other browser that I'm aware of that offers full devtools on android is kiwi, but that browser force-disables ublock origin and other extensions on some sites.
I just installed fennec and for the life of me I cannot find these developer tools anywhere.
But they only have themselves to blame. I'm using Fennec F-droid on my phone because someone at Mozilla decided to castrate extension support in their main branch (and nightly keeps breaking every few weeks so that's not an option).
As of my understanding, firefox, contrary of chrome and Edge, is really commited on privacy.
Why would you be downloading a network installer only to move it with USB to another supposedly "secure" machine just so THAT machine can then do the downloading part instead of just downloading the binary on that machine in the first place?
Secondly who is downloading Firefox binaries off of Mozzilla website for a "secure" machine? That only happens if you are running Windows and at that point your pants are already soiled.
Most plausible is that some IT department would have same installer on all the machines and then Mozzilla would know that all these machines belong to same organization, but if your IT department is running network installer for every instance for Firefox they install then please fire your IT department.
Literally all this info does is to tell Mozzilla that you installed a Firefox or if you are some kind of weirdo who moves some 10kb web installer from friend to friend to install Firefox they might know that all these people at some level know each other, but again this only applies to Windows users.
I just don't understand why HN is making this out to be some Firefox killer.
apt-get install firefox apt install firefox-esrThat's only minimally possible with a whole lot of plugins that should be added there by default, plus removing the fingerprint function.
It does have a "Send usage data" option that is enabled by default.
There is also a "Studies" option which I had not seen before.
https://support.mozilla.org/en-US/kb/how-opt-out-studies-fir...
Yup. This sort of behavior, of where stuff like this just creeps in with an update, is why I would never consider donating to mozilla at its current shape.
(along with the fact, that they continue to reduce engineers, but increase the CEO salary, despite marketshare is falling)
Mozilla does only their bullshit outreachy and woke bullshit instead of focusing on their only product that matter. I don't really care if their engineers are women, trans, non-binary, black, hispanic, indian etc. All I wanted a top notch browser that's not based on chromium, but that was too much to ask.
I miss the old Mozilla when they made the New York Times ad with their donors names on there.
Mozilla lost another user...I guess is time to increase their CEOs salary!
Yes, I'm sure the author does their best, but I doubt this is their day job. Meaning if there is an update during working hours he might not get to update his fork until several hours later or if he is on vacation it might be days or weeks. What happens when he abandons the project? Usually the fork projects wind down after some time and there is no indication for the users that they are using abandonware with God knows how many missing security patches.
Of course there is ideal world where we wouldn't have to make these choices, but at least I am going to stick with Firefox until something actually bad happens.
Secondly there is a reason why nightly channel exists. It is because it is not stable. Yeah, back in the day I ran nightly for years without seeing an issue, but also I'm not really sure if there was any benefits.
As far as I am aware the dev channel is just main Firefox with better webdev console/tools. So I don't know if that has anything going for it security wise compared to the main.
For example, on this site : https://appdb.to/ if you click on any app, it'll always open the same app (I think the 'first' one) instead of the one clicked, you can try on Firefox and it'll work correctly.
I actually don't know what cause this issue right now.
Thanks to someone here, I found why some links open in a new tab instead of a popup. Just need to set browser.link.open_newwindow.restriction to 2 (like in firefox), instead of 0.
Does anybody know if there's a similar de-Mozilla'd Firefox for desktop? I currently use Firefox Developer Edition, but I'd love to get away from Mozilla's crappy "experiments" and constant configuration-breaking updates.
I had never heard of dFPI. I've been using an extension, Temporary Containers, to basically do the same thing. I'm definitely going to check this out!
Isn't that how all browsers work these days?
> Site Isolation is now enabled for all Firefox 95 users
Doesn't site isolation launch a new process per site? I'm inclined to believe so
https://hacks.mozilla.org/2021/05/introducing-firefox-new-si...
> Site Isolation builds upon a new security architecture that extends current protection mechanisms by separating (web) content and loading each site in its own operating system process.
Is there an inventory of their security program? Or is it just 'we take up patches from Mozilla?
> This project is an independent fork of Firefox [...]
> LibreWolf is always based on the latest version of Firefox
So it is a dependent fork of Firefox
This is my assumption/observation that the owner or the members of this forked project is majority ESL. I would understand why they said independent fork because it made sense to them, however it implies different than "fork" alone.
Sorry, it does not. Fork just means that it's based on the same code, that's all.
Why bother ever writing to a file system? Seems like an obvious misstep.
Does it integrate with Firefox on mobile?
Instead of ensuring their engine is easily modular and usable they are more concerned about others making competing browsers and thus let greed drive their design decisions to make a clunky and poorly architected product that just lags in development.
Fire the greed driven management of Mozilla, and bring a team more concerned about developing a good product than letting money drive the design decisions, and Firefox will be back on track.
We're lucky to have an alternative to the WebKit oligopoly. If you don't like Firefox, just stick with the other browsers and let the rest of us that are trying to prevent a monoculture continue our work.
I don't work for Mozilla or have ever done work on Firefox other than bugfixing, but I'll gladly run an alternative browser so the web doesn't end up stagnating like it did before.
I switched to Mozilla Gecko after Opera Presto was sold to a chinese firm and they switched engines to Chromium. After that, I have been using various Firefox forks since Firefox started bundling useless software and made really questionable decisions sacrificing user privacy for their greed. I am really glad that forks that respect the user, like LibreWolf and Tor browser, exists.
> The comments like this from people who will complain about everything are completely valueless.
I have given specifics. Your comment though is less useful.
> We're lucky to have an alternative to the WebKit oligopoly.
We are unlucky that the current management of Mozilla is slowly selling out on this, under the influence of Google and their own greed - 100's of millions of dollars and yet, making a modular browser engine is not a priority for them as that means more competition and innovation from other open and closed source developers that will threaten their cash cow.
I disagree. You list a number of random topics that are exaggerated and overblown, then attack the leadership of the organization personally and ascribe motivations that you have invented. Your comments are not useful for setting future direction of a browser, and you are contributing to a browser monoculture.
When we lose the only viable competitor to WebKit because you and other commenters hold Firefox to your unreachable standards, it will be a sad day.
I used to be happy with their output, many years ago. So yes, of course.
I haven't liked FF in a very long time. But I used to love it.
> I'll gladly run an alternative browser so the web doesn't end up stagnating like it did before.
The only thing actually stopping Google from completely owning the Web is Apple's mandating Safari's engine for all browsers on iOS. Firefox has been floundering for too long (a decade? More?) and no longer matters much, aside from providing some kind of value to Google. Microsoft's probably maneuvering to open a second front on that, despite using Google's engine now, unless they decide to team up with Google to go after Apple. FF has been an also-ran for years.
I for one was happy with the Firefox Mozilla produced years ago, yes.
I'm unfamiliar with these last two things. What code do they run? And what adware?
- Firefox’s address bar has ads now: https://www.theverge.com/2021/10/7/22715179/firefox-suggest-...
From the top of HN literally yesterday. They can match user downloads to multiple installs across systems now. The "solution" is to select "opt out of telemetry" in the settings, which you can't get to until after you've installed the browser and it's already happened.
Edit: It appears to be for the new-profile ping not the install pings.
Not making including a plugin required for a top 50 site would be user hostile, and I will die on this hill.
This is exactly the thing everyone else in the thread is pointing out as the issue, complaints from FOSS-or-nothing folks expecting to be catered to at the expense of the other (probably) 99% of potential users. The fact that it's even a plugin at all (that you can disable!), rather than an integrated part of the browser, is them already catering to that. Firefox already caters to this niche a ton, and nothing is good enough.
FF has historically been concerned with privacy and transparency. When they move contrary to that, people "hold them accountable" by issuing public critiques.
In comparison, I'm not sure that the Chromium project ever intended to have privacy as one of their forefront values.
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
Except marketing-driven products, which get really overhyped here.
In reality, there are two categories of users – one group (the vast majority) is perfectly happy with the status quo regardless of privacy issues or anything else, and the other is simply looking to endlessly nitpick and complain about everything in pursuit of some hypothetical perfection that can never be reached. There's no wonder then that new products will mostly cater to the first group than the second.
It has built-in adblock, and DNS-over-HTTPs in the setup menus.
I understand that stock Chromium can do DoH with options on the command line; I have been meaning to set this up in a few places.
Supporting the management status quo is the opposite of supporting the product status quo; Firefox now is an absolutely unrecognizable product compared to Firefox 5 years ago. Not coincidentally, Chrome isn't unrecognizable, it's dependable. I wonder why it's successful? Is it because google isn't playing fairly, or because anyone who has ever been satisfied with Chrome has never been given any good reason to leave, while every change in firefox seems tuned to peel off 2% of the userbase?
If there's an effective way Google isn't playing fair, it's probably that they have some indirect but strong influence in directing Firefox development.
Ah yeah, that seems like a completely reasonable interpretation of Mozilla's actions.
> The comments like this from people who will complain about everything are completely valueless.
> We're lucky to have an alternative to the WebKit oligopoly. If you don't like Firefox, just stick with the other browsers and let the rest of us that are trying to prevent a monoculture continue our work.
Looks like you're doing the job just fine by yourself.
That's not an accurate number.
Especially at the higher level, Mozilla was complicit in accepting money from a competitor.
Make no mistake, that absolutely distorted how they ran the company over the next decade. That's why Firefox is so "meh" right now, why Servo got killed, why Mozilla is being seriously mismanaged.
In my opinion, it's pretty easy to spot this pattern, because when you've read HN long enough, you know what sorts of posts are likely to elicit reactions from a particular group. But that's not to say any given group is representative of HN as a whole, which I think is still largely dominated by lurkers.
Big claim. Add the keywords "Rust", "Webasm" or "Burnout" to your title and your chances of making it to the frontpage increase significantly.
* that MBAs and VCs are useless leeches
* but rich tech founders are folk heros and visionaries
* that all regulations are just market capture by entrenched players
* Europe's government health plans work great and America's private one is an embarrassment
* but that also government cannot possibly be an efficient provider of services and the only true answer is pure libertarianism
Also: given such sorts of posts, once one seeming/presumed group acquires dominance in a thread of comments, that "others" may self-select out of commenting on that particular article.
Had they kept using it, well that would have certainly been another dead Firefox-based browser fork.
Luke Skywalker: Is the dark side stronger?
Master Yoda: No, no. Quicker, easier, more seductive
I try to stay far away from Google.