3 ms·

As jusob noted, "They are merging all relevant security issues quickly, as well as bug fixes." So why does "12 versions out of date" matter? The advantage of W

As jusob noted, "They are merging all relevant security issues quickly, as well as bug fixes." So why does "12 versions out of date" matter? The advantage of Waterfox is more freedom to use extensions that increase privacy and security. And sure, also extensions that totally pwn you. But that's just how it is, when you have autonomy. I'm not arguing, however, that the Waterfox approach is best. Tor browser adds lots of great stuff to increase privacy and security, and they stay ~up to date with Firefox releases.

jcranmer 7y ago
> As jusob noted, "They are merging all relevant security issues quickly, as well as bug fixes." So why does "12 versions out of date" matter? If you're retaining code that has since been ripped out upstream, that means that there are no security fixes for you to uptake, but you still contain the same potential for security issues. This isn't an idle concern--the NSA used an exploit in code that was ripped out of Firefox to attack the Tor Browser, which was (at the time) stuck on an older version that retained code generally known to be much more poorly secured (E4X, specifically). Security is also orthogonal to privacy concerns. For privacy, what matters most is how similar or dissimilar you are to the normal crowd. Using an unorthodox web browser that is observably different from the mainstream browsers is going to reduce your privacy more than any actual benefit you get from extra features.
- mirimir 7y ago
  That's a good point. So Tor Project's approach, starting from the latest release, is overall better. I still miss some old extensions, though. Especially RefControl, which let me supply a site's root as referer to it. Smart Referer just drops referer, with some whitelist exceptions where sites break. RefControl never broke sites.

3 ms·

As jusob noted, "They are merging all relevant security issues quickly, as well as bug fixes." So why does "12 versions out of date" matter? The advantage of W

by mirimir 7y ago

jcranmer 7y ago
> As jusob noted, "They are merging all relevant security issues quickly, as well as bug fixes." So why does "12 versions out of date" matter? If you're retaining code that has since been ripped out upstream, that means that there are no security fixes for you to uptake, but you still contain the same potential for security issues. This isn't an idle concern--the NSA used an exploit in code that was ripped out of Firefox to attack the Tor Browser, which was (at the time) stuck on an older version that retained code generally known to be much more poorly secured (E4X, specifically). Security is also orthogonal to privacy concerns. For privacy, what matters most is how similar or dissimilar you are to the normal crowd. Using an unorthodox web browser that is observably different from the mainstream browsers is going to reduce your privacy more than any actual benefit you get from extra features.
- mirimir 7y ago
  That's a good point. So Tor Project's approach, starting from the latest release, is overall better. I still miss some old extensions, though. Especially RefControl, which let me supply a site's root as referer to it. Smart Referer just drops referer, with some whitelist exceptions where sites break. RefControl never broke sites.