> I think you have me confused with someone else. I have made no points except the ones in the post you are responding to. My apologies, that's what I get for

> I think you have me confused with someone else. I have made no points except the ones in the post you are responding to. My apologies, that's what I get for reading on my mobile. > In this case it looks like you're missing the fact that you can change the JS on the server with a high amount of ease and a low discoverability (it can be changed just for you and it won't show anywhere else). You raise a reasonable point. It is indeed something everyone should be aware of. It's mostly a matter of trust, not security. However, the same is equally true of someone you trust changing the binaries, source and/or hashes that are delivered to you; whether you got those from Mozilla, or somewhere else. For example, the relatively recent Handbrake release compromise - https://news.ycombinator.com/item?id=14281808 https://news.ycombinator.com/item?id=14281808