6 ms·

LibreWolf is mostly a bunch of policies. If you go into the preferences pane, you should see a note: 'Your browser is being managed by your organization'. When

LibreWolf is mostly a bunch of policies. If you go into the preferences pane, you should see a note: 'Your browser is being managed by your organization'. When you click the link, there's a bunch of 'features' disabled like telemetry, auto-updates etc. It also has the about:config section heavily tweaked and modified. Doing all that on stock Firefox is a lot of work which is why I prefer the developers of LibreWolf to do it for me. Call me lazy if you want. There is the added benefit of new Firefox features getting stripped in later releases of LibreWolf that otherwise would have gone un-noticed by me. Also: Trimming down the browser traffic and stopping it from being really chatty with Mozilla servers is great (if you don't like Mozilla for whatever reason).

duskwuff 5y ago
> there's a bunch of 'features' disabled like […] auto-updates YIKES. Automatic updates are incredibly important for security. Disabling them by default is highly concerning. Does the browser support (manual) self-updates at all, or has that functionality been disabled entirely?
- dont__panic 5y ago
  Some of us are responsible software owners who prefer to update on our own terms. I understand the argument that my grandmother should probably enable auto-updates, because otherwise she could easily end up months behind on releases. But I care deeply about my personal computing environment. I notice every minuscule change because I'm on my computer for hours and hours each day. Sometimes I'm in the middle of some important projects and I don't want anything to automatically update. Sometimes I'm really productive during an afternoon and I don't want to waste time and lose momentum on an update (or some bug, or UI change, as a result of that update). Sometimes I've heard about some problem coming down the pipe in the next update and I'd rather wait until there's mitigations to make that change work better with my specific setup. Automatic updates basically assume that I have the computing proficiency of my grandmother. But I actually manage my computer in a very conscious, thoughtful way. All software should provide the ability to disable automatic updates (and update nagging) out of respect for power users. It's OK to hide it in a developer or advanced menu. Just give me the option. That being said: automatic updates are a sensible default for the same reason. But let me opt out, and (Mozilla, are you listening?) for the love of god please don't override my preferences back to automatic updates when you decide to change the UI of preferences.
  - md8z 5y ago
    I'm not a security engineer but I have attended a lot of talks by security people. And the feeling I get from them is: don't opt-out of security updates. You don't want that option, it is a lose-lose for everyone involved, including your grandmother who is very likely to be a target of all kinds of scams and phishing attempts.
  - todoslostacos 5y ago
    (Disclaimer: I work on the Firefox Application Update system) > But let me opt out It seems to me that you can opt out. You can use the "Check for updates but let you choose to install them" setting in `about:preferences`. Or you can use the exact policy currently under discussion: `DisableAppUpdate`. Or there is another policy called `ManualAppUpdateOnly` [0]. > (Mozilla, are you listening?) Why yes, we are listening. We have heard many people request the ability to disable automatic updates, which is why we have the options that I mentioned above. If you feel that these options don't meet your needs, we would really appreciate you filing a bug [1]. We will get to it fastest if you put it in the correct component (which for this issue is `Toolkit::Application Update`). > for the love of god please don't override my preferences back to automatic updates when you decide to change the UI of preferences. I'm guessing that you are referring to when we removed the "Never install updates" setting [2]? This wasn't fundamentally a UI change. We had several good reasons to remove the underlying pref. Naturally, that meant that the UI for that pref went away as well. I won't spend a lot of time getting into our reasoning here, but we would be happy to discuss it with you if you want to chat with us about it. You can find us in the `#install-update:mozilla.org` channel on https://chat.mozilla.org https://chat.mozilla.org [0] https://github.com/mozilla/policy-templates/#manualappupdateonly https://github.com/mozilla/policy-templates/#manualappupdate... [1] https://bugzilla.mozilla.org/home https://bugzilla.mozilla.org/home [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1420514 https://bugzilla.mozilla.org/show_bug.cgi?id=1420514
- legrande 5y ago
  > Does the browser support (manual) self-updates at all, or has that functionality been disabled entirely? It has been disabled, as per the policy. It looks something like this in the policies.json file: { "policies": { "DisableAppUpdate": true } } This is why when mainline Firefox increments to the next major version, you have to manually download the corresponding LibreWolf version as LibreWolf closely watches the new mainline updates. In terms of security, it kind of sucks having to manually do this, but it's a small price to pay for a hardened stripped down Firefox with all the Mozilla crap (Pocket, Telemetry etc) stripped out.
- bityard 5y ago
  I have been burned often enough by software that auto-updates itself that I am positive I don't want it enabled by default on _my_ systems. Anywhere from between "this feature I really liked is gone" to "now it crashes every five minutes." Perhaps more importantly, companies that offer software that can auto-update itself, can also make it so that the software uninstalls itself. Or worse, installs something you don't want. It also makes for an especially juicy target for supply chain attackers. So you have quite a bit of a double-edged sword there, from a security standpoint. I wonder when we're going to stop pretending that there shouldn't be at least a fuzzy divide between software and systems intended for technical users and software for non-technical users. (And we should not be afraid to label them as such.) I fully agree with auto-updates for mass-market software but as a technical user, I don't want the system that I rely upon to make a living to constantly be changing out from underneath me.
  - duskwuff 5y ago
    > I have been burned often enough by software that auto-updates itself that I am positive I don't want it enabled by default on _my_ systems. Even then, there's a difference between "automatic updates aren't enabled by default" and "the application cannot update itself at all, even if you ask it to, so you'll have to download the new version yourself" -- and it sounds like this developer has chosen the latter.
  - kaba0 5y ago
    I’m sorry but if you think that disabling auto-updates on goddamn browsers, then you may not be as technical a user as you think of yourself. Browsers run untrusted code 0-24, which get JIT compiled to machine code through a very complex and bug-prone process. Add to that that desktop OSs are quite lacking when it comes to sandboxes, so even with browser sandboxes, the potential for serious damage is quire hard. So, staying ahead of bugs is a must.
    - LargoLasskhyfv 5y ago
      Junkies snort, sniff, drink, eat, inject untested stuff all the times, which get's metabolized to hot shit, frying their neurons, trying their livers, trough a very complex and bug-prone process with the occassional OD. Add to that that rational thought is quite lacking when it comes to judgement. So, stopping to be a junkie is must. edit: Blablala Didn't you get the analogy? If your'e using software equivalent to the mindstate of some longtime crackhead with shrunken brains, there isn't much you can do to get the brain repaired. You could pretend to do so, but you could also just switch off/disable the dangerous stuff, even if it locks you out from some content. Which could be seen as another addiction. So stop accessing that, too.
OrvalWintermute 5y ago
Having gone through most, if not all of the browser lockdown activities on FF, can concur completely - it is a huge time saver. I would vastly prefer to use a common approach for this, rather than my own ad hoc decisions for this. Am very interested in LibreWolf for this reason.

duskwuff 5y ago

> there's a bunch of 'features' disabled like […] auto-updates YIKES. Automatic updates are incredibly important for security. Disabling them by default is highly concerning. Does the browser support (manual) self-updates at all, or has that functionality been disabled entirely?

dont__panic 5y ago
Some of us are responsible software owners who prefer to update on our own terms. I understand the argument that my grandmother should probably enable auto-updates, because otherwise she could easily end up months behind on releases. But I care deeply about my personal computing environment. I notice every minuscule change because I'm on my computer for hours and hours each day. Sometimes I'm in the middle of some important projects and I don't want anything to automatically update. Sometimes I'm really productive during an afternoon and I don't want to waste time and lose momentum on an update (or some bug, or UI change, as a result of that update). Sometimes I've heard about some problem coming down the pipe in the next update and I'd rather wait until there's mitigations to make that change work better with my specific setup. Automatic updates basically assume that I have the computing proficiency of my grandmother. But I actually manage my computer in a very conscious, thoughtful way. All software should provide the ability to disable automatic updates (and update nagging) out of respect for power users. It's OK to hide it in a developer or advanced menu. Just give me the option. That being said: automatic updates are a sensible default for the same reason. But let me opt out, and (Mozilla, are you listening?) for the love of god please don't override my preferences back to automatic updates when you decide to change the UI of preferences.
- md8z 5y ago
  I'm not a security engineer but I have attended a lot of talks by security people. And the feeling I get from them is: don't opt-out of security updates. You don't want that option, it is a lose-lose for everyone involved, including your grandmother who is very likely to be a target of all kinds of scams and phishing attempts.
- todoslostacos 5y ago
  (Disclaimer: I work on the Firefox Application Update system) > But let me opt out It seems to me that you can opt out. You can use the "Check for updates but let you choose to install them" setting in `about:preferences`. Or you can use the exact policy currently under discussion: `DisableAppUpdate`. Or there is another policy called `ManualAppUpdateOnly` [0]. > (Mozilla, are you listening?) Why yes, we are listening. We have heard many people request the ability to disable automatic updates, which is why we have the options that I mentioned above. If you feel that these options don't meet your needs, we would really appreciate you filing a bug [1]. We will get to it fastest if you put it in the correct component (which for this issue is `Toolkit::Application Update`). > for the love of god please don't override my preferences back to automatic updates when you decide to change the UI of preferences. I'm guessing that you are referring to when we removed the "Never install updates" setting [2]? This wasn't fundamentally a UI change. We had several good reasons to remove the underlying pref. Naturally, that meant that the UI for that pref went away as well. I won't spend a lot of time getting into our reasoning here, but we would be happy to discuss it with you if you want to chat with us about it. You can find us in the `#install-update:mozilla.org` channel on https://chat.mozilla.org https://chat.mozilla.org [0] https://github.com/mozilla/policy-templates/#manualappupdateonly https://github.com/mozilla/policy-templates/#manualappupdate... [1] https://bugzilla.mozilla.org/home https://bugzilla.mozilla.org/home [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1420514 https://bugzilla.mozilla.org/show_bug.cgi?id=1420514
legrande 5y ago
> Does the browser support (manual) self-updates at all, or has that functionality been disabled entirely? It has been disabled, as per the policy. It looks something like this in the policies.json file: { "policies": { "DisableAppUpdate": true } } This is why when mainline Firefox increments to the next major version, you have to manually download the corresponding LibreWolf version as LibreWolf closely watches the new mainline updates. In terms of security, it kind of sucks having to manually do this, but it's a small price to pay for a hardened stripped down Firefox with all the Mozilla crap (Pocket, Telemetry etc) stripped out.
bityard 5y ago
I have been burned often enough by software that auto-updates itself that I am positive I don't want it enabled by default on _my_ systems. Anywhere from between "this feature I really liked is gone" to "now it crashes every five minutes." Perhaps more importantly, companies that offer software that can auto-update itself, can also make it so that the software uninstalls itself. Or worse, installs something you don't want. It also makes for an especially juicy target for supply chain attackers. So you have quite a bit of a double-edged sword there, from a security standpoint. I wonder when we're going to stop pretending that there shouldn't be at least a fuzzy divide between software and systems intended for technical users and software for non-technical users. (And we should not be afraid to label them as such.) I fully agree with auto-updates for mass-market software but as a technical user, I don't want the system that I rely upon to make a living to constantly be changing out from underneath me.
- duskwuff 5y ago
  > I have been burned often enough by software that auto-updates itself that I am positive I don't want it enabled by default on _my_ systems. Even then, there's a difference between "automatic updates aren't enabled by default" and "the application cannot update itself at all, even if you ask it to, so you'll have to download the new version yourself" -- and it sounds like this developer has chosen the latter.
- kaba0 5y ago
  I’m sorry but if you think that disabling auto-updates on goddamn browsers, then you may not be as technical a user as you think of yourself. Browsers run untrusted code 0-24, which get JIT compiled to machine code through a very complex and bug-prone process. Add to that that desktop OSs are quite lacking when it comes to sandboxes, so even with browser sandboxes, the potential for serious damage is quire hard. So, staying ahead of bugs is a must.
  - LargoLasskhyfv 5y ago
    Junkies snort, sniff, drink, eat, inject untested stuff all the times, which get's metabolized to hot shit, frying their neurons, trying their livers, trough a very complex and bug-prone process with the occassional OD. Add to that that rational thought is quite lacking when it comes to judgement. So, stopping to be a junkie is must. edit: Blablala Didn't you get the analogy? If your'e using software equivalent to the mindstate of some longtime crackhead with shrunken brains, there isn't much you can do to get the brain repaired. You could pretend to do so, but you could also just switch off/disable the dangerous stuff, even if it locks you out from some content. Which could be seen as another addiction. So stop accessing that, too.

OrvalWintermute 5y ago

Having gone through most, if not all of the browser lockdown activities on FF, can concur completely - it is a huge time saver. I would vastly prefer to use a common approach for this, rather than my own ad hoc decisions for this. Am very interested in LibreWolf for this reason.