konform

I'm maintaining a minority browser[0] and as of a couple of weeks this is affecting several of our users[1]. While I'm currently not considering this a browser bug (one could be involved, of course), more eyes are better and any help or ideas on improving or mitigating the situation would be appreciated.

[0]: https://konform-browser.codeberg.page/

[1]: Most? All? Without any telemetry, relying on user reports and our own testing here.

If you are this motivated (I am!), how about joining forces on Konform Browser? Radio silence and remote third-party integrations disabled by default and generally sane and conservative defaults respecting old-fashioned notions like individual consent and data-protection regulations.

Aside from general dev, could use a hand in bringing it to more platforms (mobile and flatpak are frequently asked) and taking a closer look at fingerprinting protections and what's currently tripping up the turnstile.

https://codeberg.org/konform-browser/source

I think your comment is also making plenty assumptions..

Official Firefox can be leaky unless you build it yourself with some build-time changes or use a fork with such[0]. Am I guessing right that you still have Webcompat, RemoteSettings, and Nimbus enabled still? How do you know a compatibility intervention isn't causing your browser to open the kimono just enough to "unbreak the page"?

> My guess is that OP's browser is getting banned because his WebKitGTK has a weird fingerprint, not because of webgl or whatever.

My guess is a different flavor of the same: Not matching an expected fingerprint (simplified: whitelist vs blacklist approach) combined with other factors.

[0]: I'm currently aware of Tor Browser, Konform Browser (am dev), Mullvad Browser, and to a certain extent Waterfox, LibreWolf, and r3df0x doing that.

It's enabled by default in Tor Browser and I'm not sure it can even be disabled?

Also enabled by default for Konform Browser and Mullvad Browser, which borrow many of the privacy- and security-related patches from Tor Browser.

No source code? Was it "you alone" or "you alone (with Claude)"?

You and me both, BTW... Trust is at an all-time low these days, it seems.

> I need swipe typing though, and I haven't found anything even close to gboard glide.

https://f-droid.org/packages/helium314.keyboard/

HeliBoard is currently asking people to volunteer swipe data so they can further improve on free and open alternative for swipe keyboard. Please consider helping out!

https://github.com/Helium314/HeliBoard/wiki/Tutorial:-How-to...

https://makertube.net/w/cQECfDkuLGR9eUQquUEo4K

I had similar frustrations and been maintaining a Firefox fork trying to fill a gap there. The result is Konform Browser and I think it might be relevant to you; please check it out!

https://codeberg.org/konform-browser/source/releases

https://techhub.social/@konform

Shared today on Show HN but seems to be drowning in deluge of LLMs...

https://news.ycombinator.com/item?id=47227369

> every single extension provides 100% access to my websites to whoever controls the extension

That feels a like a bit of overstatement and depends on what addons you use and how you install them... CSPs at least make it possible to restrict such things by policy (assuming user has been exposed to it and parsed it...). https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... MV3 introduced further restrictions and controls regarding addon capabilities. While I agree the UI and UX around this could be much better, it's not all hopeless. The underlying pieces are mostly there.

While the fundamental addon execution security model in Konform Browser is inherited from upstream, for core addons like uBO you can improve the supply-chain security situation by loading it under "system scope" and disable addon updates in the browser itself. So while we don't (yet) improve on the runtime aspects you speak of, at least for now we can tighten up the supply-chain side to minimize risk of bad code running in the first place.

Literally `apt-get install webext-ublock-origin-firefox`.

"Enterprise policy files" can be used to change Firefox behavior and tweak security model around addon loading. A little explanation and reference of how it works if you want to do the same in other FF build or for other addons: https://codeberg.org/konform-browser/source#bundled-extensio...

Any particular addon you think is missing from the list there and should also be packaged and easily available? Maybe will be able to improve some of the security-UI/UX here too down the line. I'd be keen to hear your take on how this should be done better!

Regarding what addons can and do leak about you to the outside... I think you may also take interest in FF Bug 1405971. We ship a patch for that which can hopefully be upstreamed Soon (tm).

A web browser. Well, a Firefox fork. Check it out!

https://codeberg.org/konform-browser

This week added a simple onboarding screen - I don't think a single default config can ever be ideal for even most situations. Intranet admin web UIs and browsing the tubes call for very different default configuration so it makes sense to have more than one and making switching easy.

Konform Browser is free software developed and maintained by 100% organic free-range humans and does not seek revenue. There's no business model beyond this hopefully turning into a neat line on the resume or a lead for gigs down the line. Considering the project "GA" and actively supporting public users as of last month. Contributions are most welcome.

Currently only shipping for Linux and hoping to do Android one day. We do package binaries (transparently in codeberg ci) and provide repos but for those who prefer, building from source is supported and something I hope to make more accessible for those who want to bring their own patches.

Happy to reply to questions and feedback!

Actually intercepting the cleartext data is less trivial (not inherently - the browsers just make it more obscure than it could be) but it can be done.

https://news.ycombinator.com/item?id=46820977