4 ms·

If I'm to avoid Firefox, I'd like to avoid its forks as well - they don't really improve upon anything meaningful both of those have had more issues than Firefo

If I'm to avoid Firefox, I'd like to avoid its forks as well - they don't really improve upon anything meaningful both of those have had more issues than Firefox in the past. I'm thinking smaller than Firefox.

app4soft 7y ago
> they don't really improve upon anything meaningful both of those have had more issues than Firefox in the past. Please, prove it.
- jcranmer 7y ago
  From looking at the commit history of Pale Moon, it is maintained by essentially three people. Their maintenance strategy is to freeze at an old version of Firefox, and randomly backport patches purely to try to keep somewhat up-to-date on JS or DOM features. Given the sheer size of the codebase, its inherent complexity (a JIT compiler is going to be very ripe for potential security vulnerabilities), and the utter lack of any sign of trying to mitigate these problems (e.g., fuzzing, or even merely attempting to identify security fixes in Firefox that may warrant backporting), if you are worried about any security issues in Firefox, moving to such a fork should only worry you more.
  - app4soft 7y ago
    I not see any proofs here. Only your personal opinion.
    - jcranmer 7y ago
      Read https://github.com/MoonchildProductions/UXP/commits/master https://github.com/MoonchildProductions/UXP/commits/master for yourself.
  - superkuh 7y ago
    >utter lack of any sign of trying to mitigate these problems (e.g., fuzzing, or even merely attempting to identify security fixes in Firefox that may warrant backporting), And here's where you show you're making it up and haven't even looked at a Pale Moon release notes, http://www.palemoon.org/releasenotes.shtml http://www.palemoon.org/releasenotes.shtml
    - jcranmer 7y ago
      I don't read release notes, I read the commits and the patches themselves. Actually, I did check after posting, and they appear to do the bare minimum--port the posted CVEs, which won't even account for all the security bugs. There are definitely several commits I've seen them do where they specifically revert changes that rewrite functionality to be safer, but don't actually fix any specific known security flaw. If I really wanted to scare you, I'd tell you about such security-friendly-sounding commits as "we don't want the newest release of the [crypto] library, let's freeze at an older version" or "re-enable support for RC4 in TLS." But that would be unfair, because you'd actually have to read the commit to judge for yourself if I'm quoting them in good context.
      - useragent86 7y ago
        It's hard for me to make sense of what you're saying. 1. You don't seem to think the Pale Moon has value, nor that it should be used. 2. You say you don't read their release notes--which makes sense if you don't think it's worthy. However: 3. You say you do spend time reading their patches--which doesn't make sense if you don't think it's worthy. 4. Their release notes frequently mention "defense-in-depth" patches which are their own work, not, as you put it, to "randomly backport patches purely to try to keep somewhat up-to-date"--which conflicts with your claims about their work. So you say you read their patches, yet you don't appear to read all of them. And you say you don't read their release notes, yet you speak as if you have comprehensive knowledge of their work. Then you say something that's supposed to be scary, but then you say that it might not actually be scary, and you won't tell us whether it actually is. So, regardless of whether Pale Moon is valuable or useful or secure to any degree, isn't your comment a textbook example of FUD? What's your purpose here?
  - samantohermes 7y ago
    > randomly backport patches purely to try to keep somewhat up-to-date on JS or DOM features It's not "random", inform yourself: https://www.palemoon.org/roadmap.shtml https://www.palemoon.org/roadmap.shtml
samantohermes 7y ago
Firefox has been turned into a Chrome copycat with built-in blocklists and Tor Browser Bundle features. 1. https://www.palemoon.org/technical.shtml https://www.palemoon.org/technical.shtml 2. https://wiki.hyperbola.info/doku.php?id=en:project:iceweasel-uxp https://wiki.hyperbola.info/doku.php?id=en:project:iceweasel...

app4soft 7y ago

> they don't really improve upon anything meaningful both of those have had more issues than Firefox in the past. Please, prove it.

jcranmer 7y ago
From looking at the commit history of Pale Moon, it is maintained by essentially three people. Their maintenance strategy is to freeze at an old version of Firefox, and randomly backport patches purely to try to keep somewhat up-to-date on JS or DOM features. Given the sheer size of the codebase, its inherent complexity (a JIT compiler is going to be very ripe for potential security vulnerabilities), and the utter lack of any sign of trying to mitigate these problems (e.g., fuzzing, or even merely attempting to identify security fixes in Firefox that may warrant backporting), if you are worried about any security issues in Firefox, moving to such a fork should only worry you more.
- app4soft 7y ago
  I not see any proofs here. Only your personal opinion.
  - jcranmer 7y ago
    Read https://github.com/MoonchildProductions/UXP/commits/master https://github.com/MoonchildProductions/UXP/commits/master for yourself.
- superkuh 7y ago
  >utter lack of any sign of trying to mitigate these problems (e.g., fuzzing, or even merely attempting to identify security fixes in Firefox that may warrant backporting), And here's where you show you're making it up and haven't even looked at a Pale Moon release notes, http://www.palemoon.org/releasenotes.shtml http://www.palemoon.org/releasenotes.shtml
  - jcranmer 7y ago
    I don't read release notes, I read the commits and the patches themselves. Actually, I did check after posting, and they appear to do the bare minimum--port the posted CVEs, which won't even account for all the security bugs. There are definitely several commits I've seen them do where they specifically revert changes that rewrite functionality to be safer, but don't actually fix any specific known security flaw. If I really wanted to scare you, I'd tell you about such security-friendly-sounding commits as "we don't want the newest release of the [crypto] library, let's freeze at an older version" or "re-enable support for RC4 in TLS." But that would be unfair, because you'd actually have to read the commit to judge for yourself if I'm quoting them in good context.
    - useragent86 7y ago
      It's hard for me to make sense of what you're saying. 1. You don't seem to think the Pale Moon has value, nor that it should be used. 2. You say you don't read their release notes--which makes sense if you don't think it's worthy. However: 3. You say you do spend time reading their patches--which doesn't make sense if you don't think it's worthy. 4. Their release notes frequently mention "defense-in-depth" patches which are their own work, not, as you put it, to "randomly backport patches purely to try to keep somewhat up-to-date"--which conflicts with your claims about their work. So you say you read their patches, yet you don't appear to read all of them. And you say you don't read their release notes, yet you speak as if you have comprehensive knowledge of their work. Then you say something that's supposed to be scary, but then you say that it might not actually be scary, and you won't tell us whether it actually is. So, regardless of whether Pale Moon is valuable or useful or secure to any degree, isn't your comment a textbook example of FUD? What's your purpose here?
- samantohermes 7y ago
  > randomly backport patches purely to try to keep somewhat up-to-date on JS or DOM features It's not "random", inform yourself: https://www.palemoon.org/roadmap.shtml https://www.palemoon.org/roadmap.shtml

samantohermes 7y ago

Firefox has been turned into a Chrome copycat with built-in blocklists and Tor Browser Bundle features. 1. https://www.palemoon.org/technical.shtml https://www.palemoon.org/technical.shtml 2. https://wiki.hyperbola.info/doku.php?id=en:project:iceweasel-uxp https://wiki.hyperbola.info/doku.php?id=en:project:iceweasel...