12 ms·

Librefox: Firefox with privacy enhancements

204 points by philonoist 8y ago

capi_salazar 8y ago
If I'm getting it right, is it a customized setting to use in Firefox to make it more privacy-oriented?
kylek 8y ago
Curious if this sticks out like a sore thumb in terms of fingerprinting.
- floatingatoll 8y ago
  Quite.
tdhz77 8y ago
I was once told we shouldn’t use libre in titles. But, I don’t have any reason for this. Anybody have any idea where they got this?
- Doctor_Fegg 8y ago
  Maybe because no-one knows how to pronounce it? (Is it lee-bruh, as French, or lee-bray, as Spanish?)
  - Narishma 8y ago
    In French it would just be lee-br as the 'e' at the end of a word is silent.
    - bradknowles 8y ago
      On the page, it says: Author: Intika (from Liege/Belgium) So, I would assume that the French pronunciation is the intended one. Although I might be wrong. Of course, the author has used the name "Librefox" as a single word, so there would presumably be liaison between the "e" and the "f", and so therefore you would presumably actually hear the "e" in the French pronunciation.
- _emacsomancer_ 8y ago
  It's not really an English word, so many English speakers don't quite know how to pronounce it or exactly what it would mean.
  - boomboomsubban 8y ago
    Even now people everywhere have problems pronouncing GNU, Emacs, or Linux, and the word's connection to "liberty" should become clear if someone thinks about it for any time. Both "free" and "open" have their own problems, it seems like a fine alternative.
- AdmiralAsshat 8y ago
  It's become a common way of signaling that your app/service is "Free as in Freedom", as opposed to "Free as in beer", open source vs. FOSS, etc. I find it a little odd here, because Firefox already meets the definition of FOSS. But it's not unheard of for a popular project to go from free to proprietary, and for a fork of the last free version to somewhere work "libre" into the title.
  - floatingatoll 8y ago
    It's become a very effective way for me to detect projects that have prioritized idealism over pragmatism. (I personally fall on the pragmatism side of that spectrum, and so I find it useful to avoid the oil-water problems that causes.)
  - type0 8y ago
    I'd just like to interject for a moment. What you're referring to as FOSS, is in fact FLOSS, or as I've recently taken to calling it F/L/OS/S meaning “Free/Libre and Open Source Software”. Free is not free by itself, call if F/L/OS/S to explicitly avoid a preference between the two political camps. If you wish to be neutral, this is a good way to do it, since this makes the names of the two camps equally prominent. There really is a F/L/OS software and there are people who use it, but it is just a part of the system they use, that in fact called GNU/Linux. Anyway Libre refers to freedom, instead of calling it open source you could also start to call this type of software Libre software. “Free and Open Source Software” is misleading since it can be interpreted as free as in beer when it is Free as in Freedom. Not calling it FLOSS is an obstacle to understanding GNU philosophy, free software and open source are different political positions that are completely not the same. https://www.gnu.org/philosophy/floss-and-foss.en.html https://www.gnu.org/philosophy/floss-and-foss.en.html
  - humblebee 8y ago
    At one point I understood the distinction of `"Free as in Freedom", as opposed to "Free as in beer"`, but I have since forgot. Is there a longer form explanation I can read / bookmark?
    - 8y ago
Proven 8y ago
Useless post as there are no up to date releases. What should be shared instead is the scandalous Mozilla's blocking of this project. https://github.com/intika/Librefox/issues/119#issuecomment-475883871 https://github.com/intika/Librefox/issues/119#issuecomment-4...
brian_herman__ 8y ago
Wonder how this compares to waterfox. https://www.waterfoxproject.org/en-US/ https://www.waterfoxproject.org/en-US/
- danmg 8y ago
  waterfox is a complete browser based on an old version of the firefox engine. This project is a set of dot files that setups current mainline firefox.
- duskwuff 8y ago
  Significantly different. From what I understand, Librefox intends to follow upstream development with limited changes. Waterfox, on the other hand, is a fork of the pre-XUL, pre-Electrolysis Firefox circa 2017. As upstream development continues, it will become increasingly difficult to maintain these sorts of forks.
ChrisSD 8y ago
Why isn't it a fork? Does it make full use of the `privacy.resistFingerprinting` settings? Surely Tracking Protection should be switched on unless uBlock Origin is actually installed? Either that or bundle uBlock Origin.
- boomboomsubban 8y ago
  For ease in keeping current with Firefox/trademark issues. Seemingly yes. Tracking protection is too new to be worth competing with uBlock Origin, and I'd guess the current release format makes bundling difficult.
- ChrisSD 8y ago
  To answer one of my own questions it looks like they do intend to create a standalone installation eventually. It does turn on privacy.resistFingerprinting (although this is a somewhat experimental feature that uplifts TOR Browser changes into Firefox proper).
- notatoad 8y ago
  >Updated browser: because this project is not a fork, it is kept updated with the latest Firefox version. My pet peeve with all of these privacy-focused browsers is that they encourage people to stay at least one version behind the release version, essentially forcing a trade between security and privacy. By not being a fork, this project seems to avoid that particular pitfall.
cedex12 8y ago
Something I'd like to see instead of a modified version of ff is some sort of meta-extension that I could install on vanilla ff. It would essentially be a bundle of * add blocker (say ublock) * js disabler (noscript) * https stuff * anti tracker * url cleaner * user agent spoofer * cookie cleaner * whatever decentraleyes does * enable the right settings in about:config * …? All the extensions are there already, but it would guarantee them working well together and you wouldn't have to look for each extension and wonder if it's actually the one you want, but just install "the one".
- yjftsjthsd-h 8y ago
  Would it be sufficient to be able to bulk install add-ons from say a text file that lists them all?
  - meruru 8y ago
    That's also a feature that I want. Something like a dotfile for Firefox that I can use to set it up automatically with the rest of the system. However what bothers me about privacy add-ons is that each one that I install is giving permissions in my browser to another person. It would be better if there was a single add-on that was audited by someone trustworthy. A single all-in-one add-on could also work on making each of its users fingerprint the same, which is something that can't happen when each person is using a different combination of privacy enhancements.
    - yjftsjthsd-h 8y ago
      > Something like a dotfile for Firefox that I can use to set it up automatically with the rest of the system. I've not yet tried it, but I think user.js might be helpful for this: http://kb.mozillazine.org/User.js_file http://kb.mozillazine.org/User.js_file
      - dngray 8y ago
        That's exactly what I did. * https://github.com/dngray/ghacks-user.js/tree/fx-desktop https://github.com/dngray/ghacks-user.js/tree/fx-desktop * https://github.com/dngray/ghacks-user.js/tree/fx-android https://github.com/dngray/ghacks-user.js/tree/fx-android
amelius 8y ago
I don't get the name. How is "libre" connected to "privacy", considering that Firefox is already "libre" in many ways.
- gatherhunterer 8y ago
  I assume it is in the context of “libre software”. More generally, privacy is consisered to be essential to the concept of individual freedom.
  - hjek 8y ago
    That's what I thought, but apparently it isn't as they're recommending all sorts of proprietary extensions (like Browser Plugs Privacy Firewall). Check IceCat instead for a more free/libre Firefox.
    - jammygit 8y ago
      Icecat has issues with so many sites because it wants you to block no free JavaScript. If you use it as intended, the internet isn't the same and is it even more private since there are fewer extensions? I like how brave bakes in the settings by default
- floatboth 8y ago
  Naming is hard. This is possibly a nod to LibreSSL as a fork name :)
  - tdurden 8y ago
    Naming is indeed hard, but this name doesn't make sense.
- JoshuaRLi 8y ago
  It isn't. The naming is just unfortunate; privacy cultists typically associate free/libre software with the notion of privacy.
elagost 8y ago
This seems like an a slightly more complete version of Firefox Profilemaker (https://ffprofile.com/ https://ffprofile.com/). I personally use a fairly vanilla Firefox with a few addons and try to keep customization as default as possible. How will further differentiating yourself from the masses (especially since Firefox is already a minority browser) help with privacy, tracking, and fingerprinting? Why not at that point just change your user agent to Chrome/Win7 and run everything in a virtual machine? edit: To that end, does anyone use browser forks (like Waterfox and Palemoon, or things like unGoogled Chromium) and seriously think they're better than the mainline browser? I see a lot of fair criticism for what Mozilla has done with Firefox (deprecating old extensions, Mr. Robot addons, Cliqz, etc) but it's pretty much the most trustworthy Internet company as far as I'm aware. They seem to genuinely have good will and Open Source at their core, and these forks claiming that Mozilla is this monstrous organization looking to invade your privacy (along the lines of what Google does) seem a little silly to me.
- worble 8y ago
  >and these forks claiming that Mozilla is this monstrous organization looking to invade your privacy Do they claim that? I felt like most of the forks were made in good feeling, appreciating the work that Mozilla has done, but customising it in their own way/aligning vanilla FireFox with their views.
- OrgNet 8y ago
  I do not use a Firefox fork but customizing Firefox with add-ons can improve privacy even if it makes you more unique when looking at your fingerprint only.
- JoshuaRLi 8y ago
  Forked software is usually reasonable, but for me, the sheer complexity of the graphical, interactive web sadly begets an exception for modern browsers. Even if much of the work is offloaded to the corporations backing modern free/libre browsers (e.g. keeping up with new web standards and technologies), it certainly goes without saying that rebasing with upstream or even just applying the latest security fixes is no trivial task I would entrust any browser fork with minimal developer backing with. This problem is especially worsened with the kind of user base that firefox forks tend to attract, from what I have seen. These users tend to ask very high-level questions e.g. "is waterfox more secure than pale moon" and will usually blindly switch from one fork to the next based on poorly-backed, unsubstantial crowd opinion. No userbase means waning support + maintenance. If you ask me, I think in the very special case of browser technologies, it would be more beneficial if the developers and users of firefox forks directed their energies towards making generally desirable changes in upstream.
minitech 8y ago
Isn’t that the AppVeyor logo? (edit: yes: <a href="https://github.com/intika/Librefox/"><img width="727" src="https://img.shields.io/badge/Librefox-Browser-lightgray.svg?logo=appveyor&longCache=true&style=popout"></a>
neilv 8y ago
I haven't tried Librefox yet, but Internet privacy&security is a big interest of mine, and I'd like to suggest that another option to consider is Tor Browser. Tor Browser is generally more privacy-focused than Mozilla, and the nicely integrated Tor support gives me a bit of privacy from my infamous ISP (VPN services tend to be sketchy, too). Drawbacks to Tor Browser are that Tor itself is a bit creepy (e.g., presumably draws more attention to you from your own country's domestic surveillance), some news sites block US Tor exit nodes (whether they know it or not; Cloudflare seems to most often be the culprit), uBlock Origin is not part of the Tor Browser distribution (which means that people who add it lose some crowd anti-fingerprinting benefit), the NoScript part should really be replaced with uBlock Origin, Tor is much slower than direct, and the Tor or Tor Browser project could end/fizzle much sooner than Firefox does. How I'm using Tor Browser currently is that I use it for sites that don't require logins or otherwise identify me. For sites that identify me anyway (e.g., banking, online ordering), I use Firefox. I don't use Firefox often. Keeping them separate also discourages me from logging into sites unnecessarily. What I'd ideally like is for Mozilla to become more aggressive than Tor Browser about privacy -- not going to Tor, but doing things that would peeve much of the dotcom surveillance industry. This includes pushing privacy tweaks upstream to Web standards. Mozilla is perhaps the best positioned to play chicken with the dotcoms on this; most genuine privacy efforts would be simply broken by the sites, and lose their users. Mozilla has a lot of upper management, so presumably they could figure out how to peeve a lot of dotcoms, while still keeping the funding flowing. (I should add that I use Tor Browser for only a casual, on-principle attempt at privacy from snooping companies. I don't believe that Tor or Tor Browser is sufficiently safe for many kinds of journalists and activists, for example.)
VerbEncroacher 8y ago
what is privacy again
cadecairos 8y ago
Considering this hasn't received an update in two months, it seems unsafe to install and download it. There have been many fixed security issues in Firefox just in the past few weeks. https://www.mozilla.org/en-US/security/advisories/ https://www.mozilla.org/en-US/security/advisories/
- boomboomsubban 8y ago
  This installs on top of Firefox currently, so all of those fixes are still in place.
lelf 8y ago
See also: GNU IceCat https://www.gnu.org/software/gnuzilla/ https://www.gnu.org/software/gnuzilla/
kylek 8y ago
>> NoHTTP: Block http traffic and/or redirect it to https (Excellent replacement for the unrecommended https-everywhere) Why isnt the EFF's HTTPS Everywhere recommended? (And why is this addon, tagged "experimental", with <100 users opted for?)
- Arnavion 8y ago
  It's discussed here: https://github.com/intika/Librefox/issues/23 https://github.com/intika/Librefox/issues/23
nukemandan 8y ago
Unclear if this is going to continue: https://github.com/intika/Librefox/issues/119 https://github.com/intika/Librefox/issues/119 https://github.com/intika/Librefox/commit/45a4d3ce647b8c896e81ce3e5ac5ddc95ff045e0#commitcomment-32174421 https://github.com/intika/Librefox/commit/45a4d3ce647b8c896e... may have Terms & conditions violations.
uponcoffee 8y ago
My main concernsvwith these types of posts are management and defaults. If management isn't automous, then you'll get fragmentation which becomes a fingerprinting mechanism. If the defaults are too harsh, then you deter adoption and encourage fragmentation of those that do adopt (as they'll muck about in the config and unbreak different things). With low adoption, using this could potentially make you more identifiable (mirroring the concern of Do Not Track as of late) , [citation needed, on mobile]. I'll definitely spin up an instance of later today, but it looks like the defaults might cause a fair bit of breakage
tya99 8y ago
Honestly I wouldn't go anywhere near Palemoon. Not unless you feel like using an antiquated browser such as Firefox 28 which is where it forked. I expect their shills will be deployed to this thread shortly. It's certainly not more secure when you've got all your extensions running at highest level privileged (not WebExtensions), the sandboxing code "removed" because mattatobin a Palemoon developer says that it "doesn't work", without giving any specific use case and their non-compliance with the HSTS spec RFC6797 [0]. There's probably countless other things wrong with it, but that's what I spotted after a cursory look. Their developers are also toxic https://github.com/privacytoolsIO/privacytools.io/issues/375 https://github.com/privacytoolsIO/privacytools.io/issues/375 that's all the proof you ever needed. Many of your sentiments there are demonstrated in that very thread. One of the developers (mattatobin) repeatedly avoids answering my questions and just says "fake news" and goes all trumpian on me. Don't bother trying to ask on their forums about this they will just delete your posts and go on about "the untrue narrative" without addressing your questions. If you contact them on twitter they will block you. It seemed like their while mode of operation was very "alt-right" if that makes sense. They live in a small "social bubble" it would seem. I also found it rather lol that a so called "privacy browser" has to resort to using google advertising on their main page. 15:05:34 www.palemoon.org -- script https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js 3p 15:05:34 www.palemoon.org -- script https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js 3p 15:05:34 www.palemoon.org -- script https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js 3p [0]: https://tools.ietf.org/html/rfc6797#section-8.4 https://tools.ietf.org/html/rfc6797#section-8.4
- apostacy 8y ago
  I'm sorry for your bad experiences with the Palemoon guys. You are obviously not who this software is meant for. I don't need or want sandboxing for my extensions -- I can take care of my own sandboxing external to the browser profile instance. And I don't want it either, because it makes them less flexible and powerful. XUL based extensions turn my browser into a power tool, Chrome is a toy. I don't know why you are upset, because the vast majority of the Internet agrees with you. Most people are happy to have Google control their web browsing experience. Why do you engage with them if they make you so upset? Why are you threatened by a small group of users who want a browser their own way? As for the HSTS thing, I'm sorry nobody explained that, I'd be happy to elaborate a bit more for you. My computer belongs to me, and I get to decide what runs on it. I can choose to use Palemoon how I want to. Not implementing HSTS according to the RFC is harming nobody except potentially myself. The way HSTS is written is self serving for the powers that be. It reenforces the SSL certificate infrastructure, and takes away user choice in the name of "security". For practical reasons, being able to disable HSTS is important for development. And even without Palemoon, there are still plenty of ways to bypass HSTS. All Palemoon is doing is saving users time. Besides, Google, Apple, Facebook and Microsoft happily trample on the RFCs when it's convenient for them. Chrome itself was infamous for this when it first came out. I remember seeing Chrome users clobbering webservers and violating protocol to get slightly more speed. Of course, Chrome now sets the standards. I have to disagree with your characterization of Palemoon users as fascists. If you don't like Palemoon, then you are more than welcome to not use it and leave the community alone. The Palemoon community represents a dying breed. Soon enough, most hardware will be forced to use their browser, and will only be permitted to go to websites that they approve of. And mandatory DRM. Mozilla also loves DRM. Anyway, if you have any more questions I'd be happy to answer.
superkuh 8y ago
Does it remove the change they made in Firefox 37-42 where you can't run or edit any add-ons/extensions without approval from Mozilla?
Ultramanoid 8y ago
The same person maintains some builds of Ungoogled-Chromium for Linux : https://www.opendesktop.org/p/1265177/ https://www.opendesktop.org/p/1265177/
intopieces 8y ago
Two questions: (1) Why does the logo for Librefox look like a flatter, less colorful version of the Chrome logo? Edit: Apparently (from a sibling comment) it's actually the AppVeyor logo. https://en.wikipedia.org/wiki/AppVeyor https://en.wikipedia.org/wiki/AppVeyor. Why? (2) How can this be a valid claim: "Librefox is NOT associated with Mozilla or its products." It's obviously associated with one of Mozilla's products -- Firefox. What distinction am I missing here?

204 points by philonoist 8y ago

capi_salazar 8y ago

If I'm getting it right, is it a customized setting to use in Firefox to make it more privacy-oriented?

kylek 8y ago

Curious if this sticks out like a sore thumb in terms of fingerprinting.

floatingatoll 8y ago
Quite.

tdhz77 8y ago

I was once told we shouldn’t use libre in titles. But, I don’t have any reason for this. Anybody have any idea where they got this?

Doctor_Fegg 8y ago
Maybe because no-one knows how to pronounce it? (Is it lee-bruh, as French, or lee-bray, as Spanish?)
- Narishma 8y ago
  In French it would just be lee-br as the 'e' at the end of a word is silent.
  - bradknowles 8y ago
    On the page, it says: Author: Intika (from Liege/Belgium) So, I would assume that the French pronunciation is the intended one. Although I might be wrong. Of course, the author has used the name "Librefox" as a single word, so there would presumably be liaison between the "e" and the "f", and so therefore you would presumably actually hear the "e" in the French pronunciation.
_emacsomancer_ 8y ago
It's not really an English word, so many English speakers don't quite know how to pronounce it or exactly what it would mean.
- boomboomsubban 8y ago
  Even now people everywhere have problems pronouncing GNU, Emacs, or Linux, and the word's connection to "liberty" should become clear if someone thinks about it for any time. Both "free" and "open" have their own problems, it seems like a fine alternative.
AdmiralAsshat 8y ago
It's become a common way of signaling that your app/service is "Free as in Freedom", as opposed to "Free as in beer", open source vs. FOSS, etc. I find it a little odd here, because Firefox already meets the definition of FOSS. But it's not unheard of for a popular project to go from free to proprietary, and for a fork of the last free version to somewhere work "libre" into the title.
- floatingatoll 8y ago
  It's become a very effective way for me to detect projects that have prioritized idealism over pragmatism. (I personally fall on the pragmatism side of that spectrum, and so I find it useful to avoid the oil-water problems that causes.)
- type0 8y ago
  I'd just like to interject for a moment. What you're referring to as FOSS, is in fact FLOSS, or as I've recently taken to calling it F/L/OS/S meaning “Free/Libre and Open Source Software”. Free is not free by itself, call if F/L/OS/S to explicitly avoid a preference between the two political camps. If you wish to be neutral, this is a good way to do it, since this makes the names of the two camps equally prominent. There really is a F/L/OS software and there are people who use it, but it is just a part of the system they use, that in fact called GNU/Linux. Anyway Libre refers to freedom, instead of calling it open source you could also start to call this type of software Libre software. “Free and Open Source Software” is misleading since it can be interpreted as free as in beer when it is Free as in Freedom. Not calling it FLOSS is an obstacle to understanding GNU philosophy, free software and open source are different political positions that are completely not the same. https://www.gnu.org/philosophy/floss-and-foss.en.html https://www.gnu.org/philosophy/floss-and-foss.en.html
- humblebee 8y ago
  At one point I understood the distinction of `"Free as in Freedom", as opposed to "Free as in beer"`, but I have since forgot. Is there a longer form explanation I can read / bookmark?
  - 8y ago

Proven 8y ago

Useless post as there are no up to date releases. What should be shared instead is the scandalous Mozilla's blocking of this project. https://github.com/intika/Librefox/issues/119#issuecomment-475883871 https://github.com/intika/Librefox/issues/119#issuecomment-4...

brian_herman__ 8y ago

Wonder how this compares to waterfox. https://www.waterfoxproject.org/en-US/ https://www.waterfoxproject.org/en-US/

danmg 8y ago
waterfox is a complete browser based on an old version of the firefox engine. This project is a set of dot files that setups current mainline firefox.
duskwuff 8y ago
Significantly different. From what I understand, Librefox intends to follow upstream development with limited changes. Waterfox, on the other hand, is a fork of the pre-XUL, pre-Electrolysis Firefox circa 2017. As upstream development continues, it will become increasingly difficult to maintain these sorts of forks.

ChrisSD 8y ago

Why isn't it a fork? Does it make full use of the `privacy.resistFingerprinting` settings? Surely Tracking Protection should be switched on unless uBlock Origin is actually installed? Either that or bundle uBlock Origin.

boomboomsubban 8y ago
For ease in keeping current with Firefox/trademark issues. Seemingly yes. Tracking protection is too new to be worth competing with uBlock Origin, and I'd guess the current release format makes bundling difficult.
ChrisSD 8y ago
To answer one of my own questions it looks like they do intend to create a standalone installation eventually. It does turn on privacy.resistFingerprinting (although this is a somewhat experimental feature that uplifts TOR Browser changes into Firefox proper).
notatoad 8y ago
>Updated browser: because this project is not a fork, it is kept updated with the latest Firefox version. My pet peeve with all of these privacy-focused browsers is that they encourage people to stay at least one version behind the release version, essentially forcing a trade between security and privacy. By not being a fork, this project seems to avoid that particular pitfall.

cedex12 8y ago

Something I'd like to see instead of a modified version of ff is some sort of meta-extension that I could install on vanilla ff. It would essentially be a bundle of * add blocker (say ublock) * js disabler (noscript) * https stuff * anti tracker * url cleaner * user agent spoofer * cookie cleaner * whatever decentraleyes does * enable the right settings in about:config * …? All the extensions are there already, but it would guarantee them working well together and you wouldn't have to look for each extension and wonder if it's actually the one you want, but just install "the one".

yjftsjthsd-h 8y ago
Would it be sufficient to be able to bulk install add-ons from say a text file that lists them all?
- meruru 8y ago
  That's also a feature that I want. Something like a dotfile for Firefox that I can use to set it up automatically with the rest of the system. However what bothers me about privacy add-ons is that each one that I install is giving permissions in my browser to another person. It would be better if there was a single add-on that was audited by someone trustworthy. A single all-in-one add-on could also work on making each of its users fingerprint the same, which is something that can't happen when each person is using a different combination of privacy enhancements.
  - yjftsjthsd-h 8y ago
    > Something like a dotfile for Firefox that I can use to set it up automatically with the rest of the system. I've not yet tried it, but I think user.js might be helpful for this: http://kb.mozillazine.org/User.js_file http://kb.mozillazine.org/User.js_file
    - dngray 8y ago
      That's exactly what I did. * https://github.com/dngray/ghacks-user.js/tree/fx-desktop https://github.com/dngray/ghacks-user.js/tree/fx-desktop * https://github.com/dngray/ghacks-user.js/tree/fx-android https://github.com/dngray/ghacks-user.js/tree/fx-android

amelius 8y ago

I don't get the name. How is "libre" connected to "privacy", considering that Firefox is already "libre" in many ways.

gatherhunterer 8y ago
I assume it is in the context of “libre software”. More generally, privacy is consisered to be essential to the concept of individual freedom.
- hjek 8y ago
  That's what I thought, but apparently it isn't as they're recommending all sorts of proprietary extensions (like Browser Plugs Privacy Firewall). Check IceCat instead for a more free/libre Firefox.
  - jammygit 8y ago
    Icecat has issues with so many sites because it wants you to block no free JavaScript. If you use it as intended, the internet isn't the same and is it even more private since there are fewer extensions? I like how brave bakes in the settings by default
floatboth 8y ago
Naming is hard. This is possibly a nod to LibreSSL as a fork name :)
- tdurden 8y ago
  Naming is indeed hard, but this name doesn't make sense.
JoshuaRLi 8y ago
It isn't. The naming is just unfortunate; privacy cultists typically associate free/libre software with the notion of privacy.

elagost 8y ago

This seems like an a slightly more complete version of Firefox Profilemaker (https://ffprofile.com/ https://ffprofile.com/). I personally use a fairly vanilla Firefox with a few addons and try to keep customization as default as possible. How will further differentiating yourself from the masses (especially since Firefox is already a minority browser) help with privacy, tracking, and fingerprinting? Why not at that point just change your user agent to Chrome/Win7 and run everything in a virtual machine? edit: To that end, does anyone use browser forks (like Waterfox and Palemoon, or things like unGoogled Chromium) and seriously think they're better than the mainline browser? I see a lot of fair criticism for what Mozilla has done with Firefox (deprecating old extensions, Mr. Robot addons, Cliqz, etc) but it's pretty much the most trustworthy Internet company as far as I'm aware. They seem to genuinely have good will and Open Source at their core, and these forks claiming that Mozilla is this monstrous organization looking to invade your privacy (along the lines of what Google does) seem a little silly to me.

worble 8y ago
>and these forks claiming that Mozilla is this monstrous organization looking to invade your privacy Do they claim that? I felt like most of the forks were made in good feeling, appreciating the work that Mozilla has done, but customising it in their own way/aligning vanilla FireFox with their views.
OrgNet 8y ago
I do not use a Firefox fork but customizing Firefox with add-ons can improve privacy even if it makes you more unique when looking at your fingerprint only.
JoshuaRLi 8y ago
Forked software is usually reasonable, but for me, the sheer complexity of the graphical, interactive web sadly begets an exception for modern browsers. Even if much of the work is offloaded to the corporations backing modern free/libre browsers (e.g. keeping up with new web standards and technologies), it certainly goes without saying that rebasing with upstream or even just applying the latest security fixes is no trivial task I would entrust any browser fork with minimal developer backing with. This problem is especially worsened with the kind of user base that firefox forks tend to attract, from what I have seen. These users tend to ask very high-level questions e.g. "is waterfox more secure than pale moon" and will usually blindly switch from one fork to the next based on poorly-backed, unsubstantial crowd opinion. No userbase means waning support + maintenance. If you ask me, I think in the very special case of browser technologies, it would be more beneficial if the developers and users of firefox forks directed their energies towards making generally desirable changes in upstream.

minitech 8y ago

Isn’t that the AppVeyor logo? (edit: yes: <a href="https://github.com/intika/Librefox/"><img width="727" src="https://img.shields.io/badge/Librefox-Browser-lightgray.svg?logo=appveyor&longCache=true&style=popout"></a>

neilv 8y ago

I haven't tried Librefox yet, but Internet privacy&security is a big interest of mine, and I'd like to suggest that another option to consider is Tor Browser. Tor Browser is generally more privacy-focused than Mozilla, and the nicely integrated Tor support gives me a bit of privacy from my infamous ISP (VPN services tend to be sketchy, too). Drawbacks to Tor Browser are that Tor itself is a bit creepy (e.g., presumably draws more attention to you from your own country's domestic surveillance), some news sites block US Tor exit nodes (whether they know it or not; Cloudflare seems to most often be the culprit), uBlock Origin is not part of the Tor Browser distribution (which means that people who add it lose some crowd anti-fingerprinting benefit), the NoScript part should really be replaced with uBlock Origin, Tor is much slower than direct, and the Tor or Tor Browser project could end/fizzle much sooner than Firefox does. How I'm using Tor Browser currently is that I use it for sites that don't require logins or otherwise identify me. For sites that identify me anyway (e.g., banking, online ordering), I use Firefox. I don't use Firefox often. Keeping them separate also discourages me from logging into sites unnecessarily. What I'd ideally like is for Mozilla to become more aggressive than Tor Browser about privacy -- not going to Tor, but doing things that would peeve much of the dotcom surveillance industry. This includes pushing privacy tweaks upstream to Web standards. Mozilla is perhaps the best positioned to play chicken with the dotcoms on this; most genuine privacy efforts would be simply broken by the sites, and lose their users. Mozilla has a lot of upper management, so presumably they could figure out how to peeve a lot of dotcoms, while still keeping the funding flowing. (I should add that I use Tor Browser for only a casual, on-principle attempt at privacy from snooping companies. I don't believe that Tor or Tor Browser is sufficiently safe for many kinds of journalists and activists, for example.)

VerbEncroacher 8y ago

what is privacy again

cadecairos 8y ago

Considering this hasn't received an update in two months, it seems unsafe to install and download it. There have been many fixed security issues in Firefox just in the past few weeks. https://www.mozilla.org/en-US/security/advisories/ https://www.mozilla.org/en-US/security/advisories/

boomboomsubban 8y ago
This installs on top of Firefox currently, so all of those fixes are still in place.

lelf 8y ago

See also: GNU IceCat https://www.gnu.org/software/gnuzilla/ https://www.gnu.org/software/gnuzilla/

kylek 8y ago

>> NoHTTP: Block http traffic and/or redirect it to https (Excellent replacement for the unrecommended https-everywhere) Why isnt the EFF's HTTPS Everywhere recommended? (And why is this addon, tagged "experimental", with <100 users opted for?)

Arnavion 8y ago
It's discussed here: https://github.com/intika/Librefox/issues/23 https://github.com/intika/Librefox/issues/23

nukemandan 8y ago

Unclear if this is going to continue: https://github.com/intika/Librefox/issues/119 https://github.com/intika/Librefox/issues/119 https://github.com/intika/Librefox/commit/45a4d3ce647b8c896e81ce3e5ac5ddc95ff045e0#commitcomment-32174421 https://github.com/intika/Librefox/commit/45a4d3ce647b8c896e... may have Terms & conditions violations.

uponcoffee 8y ago

My main concernsvwith these types of posts are management and defaults. If management isn't automous, then you'll get fragmentation which becomes a fingerprinting mechanism. If the defaults are too harsh, then you deter adoption and encourage fragmentation of those that do adopt (as they'll muck about in the config and unbreak different things). With low adoption, using this could potentially make you more identifiable (mirroring the concern of Do Not Track as of late) , [citation needed, on mobile]. I'll definitely spin up an instance of later today, but it looks like the defaults might cause a fair bit of breakage

tya99 8y ago

Honestly I wouldn't go anywhere near Palemoon. Not unless you feel like using an antiquated browser such as Firefox 28 which is where it forked. I expect their shills will be deployed to this thread shortly. It's certainly not more secure when you've got all your extensions running at highest level privileged (not WebExtensions), the sandboxing code "removed" because mattatobin a Palemoon developer says that it "doesn't work", without giving any specific use case and their non-compliance with the HSTS spec RFC6797 [0]. There's probably countless other things wrong with it, but that's what I spotted after a cursory look. Their developers are also toxic https://github.com/privacytoolsIO/privacytools.io/issues/375 https://github.com/privacytoolsIO/privacytools.io/issues/375 that's all the proof you ever needed. Many of your sentiments there are demonstrated in that very thread. One of the developers (mattatobin) repeatedly avoids answering my questions and just says "fake news" and goes all trumpian on me. Don't bother trying to ask on their forums about this they will just delete your posts and go on about "the untrue narrative" without addressing your questions. If you contact them on twitter they will block you. It seemed like their while mode of operation was very "alt-right" if that makes sense. They live in a small "social bubble" it would seem. I also found it rather lol that a so called "privacy browser" has to resort to using google advertising on their main page. 15:05:34 www.palemoon.org -- script https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js 3p 15:05:34 www.palemoon.org -- script https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js 3p 15:05:34 www.palemoon.org -- script https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js 3p [0]: https://tools.ietf.org/html/rfc6797#section-8.4 https://tools.ietf.org/html/rfc6797#section-8.4

apostacy 8y ago
I'm sorry for your bad experiences with the Palemoon guys. You are obviously not who this software is meant for. I don't need or want sandboxing for my extensions -- I can take care of my own sandboxing external to the browser profile instance. And I don't want it either, because it makes them less flexible and powerful. XUL based extensions turn my browser into a power tool, Chrome is a toy. I don't know why you are upset, because the vast majority of the Internet agrees with you. Most people are happy to have Google control their web browsing experience. Why do you engage with them if they make you so upset? Why are you threatened by a small group of users who want a browser their own way? As for the HSTS thing, I'm sorry nobody explained that, I'd be happy to elaborate a bit more for you. My computer belongs to me, and I get to decide what runs on it. I can choose to use Palemoon how I want to. Not implementing HSTS according to the RFC is harming nobody except potentially myself. The way HSTS is written is self serving for the powers that be. It reenforces the SSL certificate infrastructure, and takes away user choice in the name of "security". For practical reasons, being able to disable HSTS is important for development. And even without Palemoon, there are still plenty of ways to bypass HSTS. All Palemoon is doing is saving users time. Besides, Google, Apple, Facebook and Microsoft happily trample on the RFCs when it's convenient for them. Chrome itself was infamous for this when it first came out. I remember seeing Chrome users clobbering webservers and violating protocol to get slightly more speed. Of course, Chrome now sets the standards. I have to disagree with your characterization of Palemoon users as fascists. If you don't like Palemoon, then you are more than welcome to not use it and leave the community alone. The Palemoon community represents a dying breed. Soon enough, most hardware will be forced to use their browser, and will only be permitted to go to websites that they approve of. And mandatory DRM. Mozilla also loves DRM. Anyway, if you have any more questions I'd be happy to answer.

superkuh 8y ago

Does it remove the change they made in Firefox 37-42 where you can't run or edit any add-ons/extensions without approval from Mozilla?

Ultramanoid 8y ago

The same person maintains some builds of Ungoogled-Chromium for Linux : https://www.opendesktop.org/p/1265177/ https://www.opendesktop.org/p/1265177/

intopieces 8y ago

Two questions: (1) Why does the logo for Librefox look like a flatter, less colorful version of the Chrome logo? Edit: Apparently (from a sibling comment) it's actually the AppVeyor logo. https://en.wikipedia.org/wiki/AppVeyor https://en.wikipedia.org/wiki/AppVeyor. Why? (2) How can this be a valid claim: "Librefox is NOT associated with Mozilla or its products." It's obviously associated with one of Mozilla's products -- Firefox. What distinction am I missing here?