Comment by kajika91 | Hacker News Reader

Comment by kajika91 | Hacker News Reader

I am surprise there is no mention of Librewolf here. The differences of Librewolf and Waterfox is pretty hard to grasp, I am digging a little bit but so far I guess I would say using any of them is still way better than the main alternatives.

Librewolf is, to me, the way better alternative as this is really in the FOSS mindset : a tool for everyone to use and by anyone to contribute. Seeing their plateform alone (Lemmy/Matrix/Codeberg, they also have a reddit community it seems) you can already see this is an other world than Waterwolf's bluesky/reddit/github. To be fair I can understand the SNS part but the github is a big redflag to me.

As usual I can see people that are very probably sincere in their goals not realizing the way they are going will lead to the usual enshitification: company focus, brave dependency, etc.

I note that Waterfox seems to legally originate from UK and it is refreshing to have an ecosystem that is not centralized in 1 country : for the sake of everyone it is better not to rely to much on 1 legislator (see age verification for instance).

Librewolf and Waterfox have always had different goals. Waterfox has always had a more opinionated take on defaults and privacy. Essentially the goal has been keep the web as private as possible without breaking it (I know Librewolf is more aggressive there and that sometimes leads to website breakages) and I think I've managed that well, especially with the implementation of Oblivious DNS by default.

The upside of Librewolf being a community project is also IMO its downside - there isn't any accountability and with the current climate around the world becoming more hostile to online services, I think governance is hugely important, which is why I've tried to collate everything as much as I can: https://www.waterfox.com/docs/policies/company-information/

At the end of the day, if something goes wrong, at least with Waterfox I can be held accountable.

There was a recent comment: "if you don't know: any browser extension can read input/password fields across all site(s) you gave it access to (yeah, it's crazy but unfortunately true)."

https://news.ycombinator.com/item?id=47553048

Would either WF or LW fix that? Is it true?

Nothing to "fix" per se - webextensions need to interact with website data, otherwise they wouldn't be much use. Any extension with content script access can read page content including form fields.

The only real mitigation is being selective about which extensions you install and what permissions you grant them (even then, ownership of extensions change hands, updates can change what they do... it's a never ending battle really).

My naive fix would be to disable extensions from accessing form field data without explicit approval. Hell, add different approval boxes for read, write, and hidden-text.

What am I missing?

Say you have an ad-blocker and you don't allow it to touch your forms. Five years later, the ads have moved all into form fields.

Never mind the technical challenge to allow doing anything with the DOM but disallow reading the forms. Like, prevent the forms leaking its text when you do funny things like testing character width via line breaking or font changes.

Sounds like the answer is just not to install any extensions. But there are a few browsers out there including DDG and Midori v9.0 & older (Classic) that disable them altogether. Maybe GNOME web is the answer. Thanks.

> The differences of Librewolf and Waterfox is pretty hard to grasp

I use Waterfox on Linux and one of the things I like the most is that it works with the global menu bar in Unity, Xfce and so on. LibreWolf, in my testing, does not. My experiment with it ended there, TBH. (Neither did Floorp.)

Hopping between Waterfox and Firefox is easy because Waterfox works with Mozilla Sync. I think LibreWolf might not, and I have read somewhere that it disables the Mozilla password manager.

I find Waterfox UI and interop better, so I use it.

Librewolf may be even more private, but the poor UI was a deal-breaker for me. YMMV.

LibreWolf can work with Mozilla Sync, they just disable it by default.

Reply on news.ycombinator.com