25 ms·
LibreWolf – A fork of Firefox, focused on privacy, security and freedom
- bjarneh 5y ago> [ Debian-based ] > This is for Debian Unstable only - do not try to install this package on any other branch of Debian or Ubuntu/Mint.. When I see a "Debian based" installer, I would expect it to work on at least some type of OS apart from Debian. That header should really say - Debian Unstable installer, not a "Debian based" installer.
- jl6 5y agoSo my choice is to trust one of either: 1. The Mozilla developers who are capturing telemetry, but probably just using it to push ads (at worst, and possibly not even that). 2. Some new devs who may have good intentions, but who are unknown to me, who are not capturing telemetry, but nevertheless have control over my browser.
- hezag 5y agoIt's just a custom build of the latest Firefox version with some patches applied. Everything is very well documented and you can build it by yourself, there is no need to trust "some new devs who may have good intentions"
- nsonha 5y ago> there is no need to trust Providing you actually review the code and not just trust it because the code is there. Reviewing (a fork of) Firefox sounds like a big job, if can be done at all. Being a Firefox fanatic does not magically make you a rust programmer
- jl6 5y agoSure, I could review the source code. And then review it again next week when a change is released. I don’t want to have to though. Trust matters. I don’t trust Mozilla not to push ads, but I do trust them not to build in intentional backdoors and steal my personal data, because there’s a whole public organization there, with a reputation and responsibilities and heads that will roll if they are caught doing nefarious things. You might ask why I trust thousands of other open source community led projects? Largely because they have built rep and get at least a minimal vetting via distro package management. I’m not saying this fork is malware. But I don’t know it isn’t, and the browser is the #1 critical component that handles all my most sensitive data.
- GhettoComputers 5y agoOr just trace it’s network activity without a code audit.
- jl6 5y agoDoesn’t help if the exfiltration only occurs monthly and you only monitored for a week, or if there’s something locally malicious, or if side channels are involved, or if it’s manipulating data sent to legitimate sites (e.g. instructions to your bank, while logged in as you).
- GhettoComputers 5y agoKeep it on, you can keep a firewall on, locally malicious files can be seen on your machine and if they aren't transmitted what is the worry? If its manipulating data sent to legitimate sites you'd notice while you used it. These concerns aren't absent in other official browsers either.
- jl6 5y agoQuite right that these concerns apply to any software, but they are significantly mitigated by sourcing software from organizations you trust. There’s no way I would be able to spot the operation of malware-masquerading-as-browser without committing totally to a forensic examination of every system call it makes. Imagine how much attention you’d have to pay to stop it capturing your bank credentials and then making transactions in an invisible tab (the browser doesn’t have to render a site in order to interact with it).
- GhettoComputers 5y agoBut trust is just assumed and not a real security measure, trust just means you are not going to audit it.
- toofy 5y agoTo echo a sibling comment, I think you may be discounting the time and effort it would take to monitor every change made and the ripple effects of each change. One of the key pieces of open source is the larger a project, the more people will be incentivized to monitor the code for malicious changes. This distributes the burden to a much much larger pool therefore minimizing the burden to single nodes across the board. Is it perfect? No, absolutely not. Do malicious or unintentional bugs slip through? Sure. But when it comes to scaled out projects, nothing is perfect and never will be. I certainly trust a large open project with years of reputation built up and a large user base significantly more than a large closed source project or large and open with no reputation. There are of course valid criticisms of this model but I’ve yet to see an alternative put forward that isn’t fraught with its own issues. I do find it strange how over the past few years we’ve seen a number of people who engage in a whiplash type behavior where they see minor problems with a model so they whiplash away into a far worse model with far more serious problems.
- GhettoComputers 5y agoIt’s easy without a code review, just trace it’s network activity and see what connections it makes.
- jfk13 5y ago> probably just using it to push ads Telemetry isn't about "pushing ads". https://support.mozilla.org/en-US/kb/telemetry-clientid https://support.mozilla.org/en-US/kb/telemetry-clientid
- yosito 5y agoWhy are there not more successful forks of Firefox? While it's still my browser of choice, I think it's safe to say there are a significant number of developers who are not happy with the leadership of Mozilla. What's preventing other forks from taking off?
- throw63738 5y agoLook at the code
- stapled_socks 5y agoOk thanks I'll read Chrome's and Firefox source code over the weekend.
- hyproxia 5y agoMoney.
- revolvingocelot 5y agoCan you elaborate? Is Mozilla paying off people who try to start FF forks? Because I could use a bailout. More seriously, is the suggestion that FF is too complex to properly fork without full time devs?
- fsflover 5y agoGenuine questions. Aren't such forks harming the actual Firefox developers by decreasing the Firefox user base? Doesn't it help the Google monopoly on the web?
- tokai 5y agoIf a fork like this would decrease ff's user base, Mozilla can change ff or have their lunch eaten by said fork. Hard to see a down side.
- maccard 5y agoIs this fork going to actively develop Firefox if Mozilla's lunch is eaten? Are they going to continue implementing the ever moving standards? That's the down side.
- vladvasiliu 5y agoI'd say if there's any harm, it would rather be related to money, as in Mozilla has less to bargain for their deals with their sponsors. However, seeing how these forks are just "cosmetic", they still use the same rendering engine, which doesn't increase Google's relative user base. As far as this monopoly is concerned, all these forks are still Firefox.
- fsflover 5y ago> As far as this monopoly is concerned, all these forks are still Firefox. Not in the website statistics I guess, unless the forks present themselves as Firefox, which I doubt.
- account-5 5y agoHow does this compare with IceCat and Fennic?
- December_Stars 5y agoIt's a lot more up to date than IceCat, which rarely has binary packages for distributions and hasn't seen an official binary release from the FSF since version 60.7.0 a few years ago.
- gostsamo 5y agoIt might make more sense to have no ads and for telemetry to be opt in. I actually want FF having my telemetric data as far as it is used for improving the product only. Ready to pay if they were into it.
- w6rpv3om 5y agoFor improving they said.
- diegocg 5y agoHow is this any different from a standard Firefox install with telemetry turned off
- puyoxyz 5y agoIt also comes preconfigured with a lot of good settings for privacy, like resist fingerprinting, 3rd party cookie stuff, etc... I know you can turn this stuff on manually but it's convenient to have a fork that does it for you and turns off Mozilla's telemetry completely
- user3939382 5y agoHopefully it's a lot different. If you proxy Firefox you'll see that even with everything turned off that you possibly can through the UI, Firefox phones home many times, especially during launch and exit.
- mgbmtl 5y agoIt would be nice to back that up a bit more. I'm genuinely curious. For what it's worth, some of the startup checks are to see whether the user is on a public wifi with a captive portal, and talk to a Mozilla service rather than Google. Other checks are for upgrades, or Firefox Sync, if enabled.
- user3939382 5y agoThere’s a great macOS app called Charles Proxy that you can use to inspect this sort of thing which is a little quicker to get going and use than the CLI equivalent (mitmproxy I think it’s called).
- EE84M3i 5y agoI would be really surprised if the Firefox developers refused a patch adding a new about:config setting for whatever you're talking about.
- sundarurfriend 5y ago
- ameminator 5y agoWhen I heard about all these shenanigans over at Firefox, I switched to Vivaldi, and I am enjoying the experience so far
- tokai 5y agoIts not free or open software, so using it is a step back.
- taneq 5y agoDepends which way you're facing, really.
- tokai 5y agoA step back is always a step back no matter your facing. Try it out yourself. You see, your front and back stay towards your front and back respectively regardless how much you spin and turn. Weird ikr
- kovac 5y agoThis indeed is true and I truly wish they made Vivaldi open source. However, free and open software is an ideal. Like any ideal, it can be used as a front and abused inna way that defeats its purpose. In its original form, free and open is noble. But since then, corporations have figured out how to monetise it. So, IMHO, we need to be very careful about anything free and open coming from corporations because their core objectives are very much orthogonal to the core objectives of the original free and open software movement. Those execs aren't the hackers who built the gnu/Linux tools in the early days.
- GhettoComputers 5y agoWe need to be careful about free and open software and your solution is to use non free and closed source software because they can make money off open source software? This makes no logical sense.
- Tepix 5y agoThis brings up the questions: How can i disable as much telemetry as possible when using the standard Firefox? What am i missing if i go to <about:config>, search for "telemetry" and set everything to false? Are there drawbacks to blocking the hostname incoming.telemetry.mozilla.org in Pi-hole?
- freddref 5y agoSurely there's a way of scripting this... Something like this: https://github.com/shawnanastasio/firefox-privacy-restorer https://github.com/shawnanastasio/firefox-privacy-restorer
- toastercat 5y agohttps://github.com/arkenfox/user.js https://github.com/arkenfox/user.js
- johnisgood 5y agoThere is https://gist.github.com/MrYar/751e0e5f3f1430db7ec5a8c8aa237b72 https://gist.github.com/MrYar/751e0e5f3f1430db7ec5a8c8aa237b... as well (check out the comments, too). Or https://gist.github.com/davinian/1991bb3486cbf6005b5320e93b3f94d2 https://gist.github.com/davinian/1991bb3486cbf6005b5320e93b3... but it is quite old I think. In any case, make sure you know what you are disabling, because in the latter it suggests disabling WebSockets which you may not want to do.
- Communitivity 5y agoSupposedly this will opt you out: https://support.mozilla.org/en-US/kb/telemetry-clientid https://support.mozilla.org/en-US/kb/telemetry-clientid One way is to use your firewall to block anything going to mozilla.org or firefox.com, or the subdomains. That probably gets most of it, but possibly not all. For example, Google has a number of non-Google.com subdomains, some of which seem to be used only for telemetry. Another more involved way is to start WireShark or tcpdump and capture the traffic, then start Firefox and browse some, and then close Firefox and stop the capture. Now you have a list of all the traffic it tries to send, normal and telemetry. Sift out anything that looks suspicious and block the ip/domain via your firewall.
- programmarchy 5y agoMaybe I’m missing something but it looks like there aren’t actually code changes, rather a repackage with a strict policy file: https://gitlab.com/librewolf-community/settings/-/blob/master/distribution/policies.json https://gitlab.com/librewolf-community/settings/-/blob/maste... I was wondering how they could instantly patch nightly builds and this seems to be the approach. Good idea and nice to have a build pipeline that allows tweaking Firefox to this degree.
- ahtaarra 5y agoTheir patches can be found here: https://gitlab.com/librewolf-community/browser/common/-/tree/master/patches https://gitlab.com/librewolf-community/browser/common/-/tree...
- programmarchy 5y agoThanks for linking that. Seems like the patches are 95% UI-related. There doesn’t seem to be any significant change related to improving privacy. While I’m grateful to this project for calling attention to the privacy issues with Firefox, most of the effort spent on this seems like replacing the brand. People could get nearly all of the benefit by copying the policy.json file.
- solarkraft 5y agoI’ve tried all the Firefox forks I could find, including LibreWolf. It’s not your no-brainer “Non-Mozilla Firefox” you can just switch to. Basic browsing may work, but nothing remotely close to “web-app” will, because they disabled all modern APIs due to privacy concerns.
- ojosilva 5y agoI'm currently using Iceraven on my Android phone and it's mostly a great experience! It gives access to all sorts of add-ons to block ads, cookies and other internet annoyances, some of which are not yet available on the official FF Android app since Fennec was abandoned. Even if speed were not 100% that of certain mobile browsers (I have not benchmarked them nor noticed any major differences), having no banners show up make up for it. I have no concerns with telemetry, but the Iceraven folks have cut down on some of the telemetry. In fact I use Iceraven as my default YouTube mobile app, instead of the official app. With the right add-ons, it makes for a quite nice YT experience! https://github.com/fork-maintainers/iceraven-browser https://github.com/fork-maintainers/iceraven-browser
- _rdvw 5y agoIceraven is currently two major versions behind. https://divestos.org/misc/ffa-dates.txt https://divestos.org/misc/ffa-dates.txt I maintain a hardened fork called Mull. I also help maintain Fennec F-Droid. Both are available on F-Droid! Of extra note, both Iceraven, Mull, and Fennec F-Droid are based on Fenix, not Fennec. Fennec is any Firefox for Android before version 68 and is not secure.
- GhettoComputers 5y agoNo web apps is a feature not a bug. I’m not unhappy it won’t run bloated web apps.
- musicale 5y ago> they disabled all modern APIs due to privacy concerns Interesting - perhaps some of those APIs were not designed with privacy in mind.
- rubyist5eva 5y agoNo way in hell I'm using a Firefox fork maintained by what..1 person? lmfao no way
- mg 5y agoOne factor that is important to me when comparing browsers is resource consumption. I don't like it when my fans spin. I wonder if the "time" tool that comes with Linux is a good way to quantify it? When I do "time firefox reddit.com", wait until the page is fully rendered (including the ads) and close the browser, I get: time firefox reddit.com real 0m13,089s user 0m9,411s sys 0m2,882s Does that mean that Firefox used about 12s of CPU time to render the frontpage of Reddit? (I guess user+sys is the amount that counts) "time firefox news.ycombinator.com" gives me about 7 seconds.
- nsonha 5y agoyou are counting bootstraping/closing the browser. Check firefox devtools timeline for a detailed breakdown.
- mg 5y agoYes, that is what I want to look at. The real resource impact of starting the browser, looking at a website and closing the browser. Using an in-browser tool to measure that would be like asking a robber how much they stole.
- cmeacham98 5y agoMost people don't close and open their browser between page visits, so time spend opening/closing the browser is a magnitude of importance less than time spent loading the page. I'd rather have a browser that takes 10secs to start and 0.1secs to render a page than 2sec to start and 1sec for each page render. Additionally, timing externally like this ends up indirectly measuring unrelated metrics like the speed of your DNS server and internet download speed. I've seen people with particularly shoddy ISP DNS experience a 0.5-1sec swing in page load times after the DNS entry gets cached.
- mg 5y agoI think DNS speed will not impact the "user" and "sys" values of time. Only the "real" value. I think user+sys give the amount of CPU time used, not impacted by wait time.
- longstation 5y agoWould it be better if the project includes a native ad blocker?
- brightly-salty 5y agoThe reasoning given is that maintaining a native version of uBlock Origin would be very costly, and so not worth the focus right now, especially considering that many of their users are already familiar with the extension.
- longstation 5y agoI see. Is there any chance that we could use Brave's adblock? (probably not trivial because it's for Chromium)
- brightly-salty 5y agoI don't think it's trivial, as it is built on Chromium instead of Firefox. However, if you or we as a community wanted to experiment with adding a similar native adblock using the Brave version as a model, I don't think the maintainers would be opposed.
- xbdm 5y agoLibreWolf is a pretty good firefox fork, But i would always use firefox with tweaks and user.js. Don't trust forks much, As i rather put my data with firefox plus mullvad vpn works with them on their vpn service. And mullvad is a really good privacy vpn...
- GhettoComputers 5y agoWhy not just audit the network activity? It’s all the evidence I need.
- tristor 5y agoI examined this and it appears that you can get the same effect yourself by enabling ETP strict mode, disabling telemetry and suggestions, and installing uBlock Origin in Firefox, which is a pretty common configuration for a lot of people. I suppose it's easier to just install this and have that already set up, but it's not exactly hard to do this in Firefox for the average HN reader and you most likely /already have/, so this gives you nothing except lagging security updates from an unknown developer.
- hnarn 5y agoIf anything, these types of projects should come as some sort of external wrapper to help you compile or configure the software to give you the wanted behavior. I don’t know a lot about how Arch’s AUR works but this seems like something that could be made an AUR package for example with special configuration while still using “base” Firefox to put it together, rather than profiling it as a new product.
- hutrdvnj 5y agoIt depends on how they plan to diverge from upstream firefox. Given enough source code changes a fork might be justifiable.
- kaba0 5y agoI don’t think “hard forking” a browser of all things is manageable, even for largish companies, let alone a few developer team. Backporting all the security patches is a very expensive process.
- chrisjc 5y agoForgive my ignorance, but couldn't this be done as an extension? (Maybe even withing uBlock Origin itself, if they were to add an option?) Or do extensions not have access to these settings?
- yosamino 5y ago
- alexmcc81 5y agoOnce I would have used this, but I can't just can't bring myself to trust forks by small or unknown teams. We trust browsers with passwords to everything in our lives, like our bank details. The FAQ doesn't even cover who created LibreWolf. Why should I trust them? Even if I do trust the developers, are they really capable of keeping a modern complex browser secure in the hostile environment of todays internet? It has millions of lines of code in multiple languages with a history going back 2 decades. I can't find: - who is responsible for the project security - their CVE policies - policies for back porting Firefox patches etc - update schedules They also removed the auto-updater which is critical to ensuring browsers get the latest patches. I'm really skeptical about the (undocumented) "hundreds of privacy/security/performance settings and patches" they claim to have implemented. What exactly cannot be achieved through settings and addons?
- rumpelstilz18 5y ago"We trust browsers with passwords to everything in our lives, like our bank details." No we don't. I use C&P from my PW Manager (Enpass). For your Bank you should have your own Browser (I use a vanilla Chrome). Firefox with a ton of privacy plug-ins. And Chromium for Facebook. I use other browsers too.
- Isthatablackgsd 5y agoI feel the same as you. It is great that there is another variants at the same time, we already have more than 6 FF variants and they are behind with security patches and updates. I recalled that WaterFox and Pale Moon are quite of versions behind Firefox. Would be nice to have a FF variant that are capable to be equal as Firefox like Chrome, Brave & Vivaldi. For Firefox variant, I couldn't think of variant that could have an equal footing.
- deviaan 5y agoSomething like Vivaldi but using FF as a base would be _wonderful_.
- geofft 5y agoWhat I'd like to see is a Firefox (and Chromium) fork with - automatic builds and uploads via GitHub/GitLab CI (or similar) from a well-commented build script - all the knobs for reproducible builds set up, so anyone can fork the repo, run the CI themselves, and see that it's bit-for-bit the same thing - an automatic merge or rebase of the latest stable release tag, and the result of that merge being plugged into automatic updates - an automatic merge or rebase of the latest beta tag (or even nightly), and some form of alerting if the build fails - perhaps some Selenium + Wireshark automation to see what requests happen and make sure there are no unexpected ones And, actually, it seems like LibreWolf is on the way there. https://gitlab.com/librewolf-community/browser/common https://gitlab.com/librewolf-community/browser/common has a decently-well-commented build script that grabs the latest tarball from Mozilla and builds on top of it and even supports building on nightly, and their documentation (https://librewolf-community.gitlab.io/docs/ https://librewolf-community.gitlab.io/docs/) mentions that as well. But I don't see where it is run / who runs it, and what they do if the build fails. (Honestly it seems like setting up the release automation and alerting is a substantial project in itself.)
- djbusby 5y agoI made a fork, of Firefox, just to remove Pocket. That part was easy-ish. Maintaining it is difficult, cause code changes a lot. Building FF doesn't take long (Gentoo, 8 cores, 64G RAM). I wish I knew more about code so I could fix the rendering issues. I'd love to see FF the core of some apps, like Chromium. I tried that with Servo but, I don't know enough (and it keeps freezing up)
- tarasglek 5y agoAuthor of Mozilla telemetry here. You can accomplish this with official firefox by blacklisting incoming.telemetry.mozilla.org domain, per https://searchfox.org/mozilla-central/search?q=telemetry.mozilla&path=cpp&case=false®exp=false https://searchfox.org/mozilla-central/search?q=telemetry.moz...
- criddell 5y agoHow valuable is the telemetry data to Mozilla?
- Scharkenberg 5y agoBased on their recent design changes (deprecation of compact mode, for example), they are either not collecting enough telemetry about the affected parts of the UI/UX, or they are ignoring what they have collected for whatever reason. Of course, there is a chance that telemetry confirms their vision, but based on the explicit feedback I've been seeing online, I doubt the rationality of their decision-making at least part of the time.
- st3fan 5y agoHow do you compare strong voices of a few on a site like HackerNews or Reddit against many many many millions of data points of users around the world. Should written feedback overrule a bigger data set?
- Jansen312 5y agoSome vocal voices are superusers that can affect others to use or not. Think of them as like current social media influencers. FF userbase has been in decline for sometime now during which those vocal feedbacks had been largely ignore. Perhaps, that give some proof indication "should written feedback overrule a bigger data set"?
- InTheArena 5y agoTypically on the web more virulent, extreme content should always win against the quiet majority.
- proactivesvcs 5y agoI recently looked at the changes they make to the default preferences and so many are nothing to do with privacy, and some of those that are also reduce the user's safety (e.g. disabling Google Safebrowsing). I'd advise any prospective users to comb over the changes very carefully before using it.
- bityard 5y agoThere are those of us who would choose privacy over safety every time...
- GhettoComputers 5y agoHow does google safe browsing make me safer? It’s just sending all my network data to google for them to tell me if it’s safe or not. If you don’t see the issue with sending every website you use to google for them to tell you if it’s safe I don’t know what to tell you. Sending your browsing history to a database has everything to do with privacy.
- LargoLasskhyfv 5y agoIt's not even the privacy aspect alone. There have been repeated cases of absolutely legit, not even controversial sites landing on blacklists, for reasons of technical errors maintaining those, or some jurisdictions DMCAing some other site(s), hosted behind the same IP-range in the same data-center. Boom. Suddenly the site is gone, or at least you have to click around endless warnings about impending doom if you proceed. For nothing. This is the same shit like antivirus ware on Windows. Utter non-sense. Meanwhile, for instance on often visited sites(like weather), the Ads happily delivering malicious payloads. This also happened many times, but can't blacklist large sites for delivering malware, can we? Would cost too much ad-value. No-Go!
- kaba0 5y agoHow often does a non-controversial site gets added to it vs the genuine threats/phishing websites it protects grannies from? I think it has an absolutely good tradeoff based on the relative percentages of the former categories.
- legrande 5y agoLibreWolf is mostly a bunch of policies. If you go into the preferences pane, you should see a note: 'Your browser is being managed by your organization'. When you click the link, there's a bunch of 'features' disabled like telemetry, auto-updates etc. It also has the about:config section heavily tweaked and modified. Doing all that on stock Firefox is a lot of work which is why I prefer the developers of LibreWolf to do it for me. Call me lazy if you want. There is the added benefit of new Firefox features getting stripped in later releases of LibreWolf that otherwise would have gone un-noticed by me. Also: Trimming down the browser traffic and stopping it from being really chatty with Mozilla servers is great (if you don't like Mozilla for whatever reason).
- duskwuff 5y ago> there's a bunch of 'features' disabled like […] auto-updates YIKES. Automatic updates are incredibly important for security. Disabling them by default is highly concerning. Does the browser support (manual) self-updates at all, or has that functionality been disabled entirely?
- dont__panic 5y agoSome of us are responsible software owners who prefer to update on our own terms. I understand the argument that my grandmother should probably enable auto-updates, because otherwise she could easily end up months behind on releases. But I care deeply about my personal computing environment. I notice every minuscule change because I'm on my computer for hours and hours each day. Sometimes I'm in the middle of some important projects and I don't want anything to automatically update. Sometimes I'm really productive during an afternoon and I don't want to waste time and lose momentum on an update (or some bug, or UI change, as a result of that update). Sometimes I've heard about some problem coming down the pipe in the next update and I'd rather wait until there's mitigations to make that change work better with my specific setup. Automatic updates basically assume that I have the computing proficiency of my grandmother. But I actually manage my computer in a very conscious, thoughtful way. All software should provide the ability to disable automatic updates (and update nagging) out of respect for power users. It's OK to hide it in a developer or advanced menu. Just give me the option. That being said: automatic updates are a sensible default for the same reason. But let me opt out, and (Mozilla, are you listening?) for the love of god please don't override my preferences back to automatic updates when you decide to change the UI of preferences.
- ChrisArchitect 5y agoanything new here? it's not new Some discussion about it maybe a year ago and it dwindled off as barely any changes to Firefox except branding....
- gnufx 5y agoConcerning Firefox-type forks, https://cliqz.com/ https://cliqz.com/ (RIP) seems relevant. At least Brave has taken on the search engine.
- st3fan 5y agoFunny, those are all the things that Firefox also focuses on. Seems like a duplication of effort.
- shmerl 5y agoI think telemetry is useful for improving the UI.
- some1randomname 5y agoIcecat > Librewolf > ... > Firefox