4 ms·

I was one of the two guys who came up with the original concept for Librefox. I was responsible for including uBO as default, among other things. Great to see

by throwaway19431 5y ago

I was one of the two guys who came up with the original concept for Librefox. I was responsible for including uBO as default, among other things. Great to see that the project was brought back to life as LibreWolf - Mozilla lawyers had threatened us with legal action because the name was too close to their brand. They expected us to drop the "Fox" part of the name. Everytime I see LibreWolf on HN I feel proud that the spirit of Librefox is still alive. The biggest issue with LibreWolf and what's stopping it's further adoption is lack of auto-updates (especially on Windows) and lack of usability - it should work out of the box for everyone. Currently the security settings are too strict in default mode. There should be different levels of pre-configured security levels users can chose in the settings (i.e. "standard", "strict", "very strict"). (I don't use HN for commenting, which is why I created a throwaway account)

colordrops 5y ago
Brave has some good ideas that could be adopted. Instead of completely forgoing features like DRM video, make them opt-in instead. The user can choose their level of privacy.
- fabrice_d 5y ago
  Opt-in DRM? Like in Firefox where you need to enable it for sites like Netflix or Spotify at first use?
- fotta 5y ago
  DRM is opt-in on Librewolf. It's in the pref pane.
  - colordrops 5y ago
    Oh excellent. I had read that it wad removed from librewolf.
KennyBlanken 5y ago
The browser presents your client as being in the GMT timezone to reduce fingerprinting using timezones, supposedly. Guess what stands out like a sore thumb? Someone with a timezone many hours off from everyone else in their country/state/region. Fucking idiots.
- account42 5y ago
  Unfortunately, trying to hide the fact that you are using a particular privacy-conscious browser is generally impossible. The best you can do is hide amongs all the other users of that browser.
- gkbrk 5y ago
  UTC, GMT or the +0 timezone is pretty standard when using a browser that does not leak data like a sieve. So I don't think it will stick out that much. If they picked another value though it might be problematic.
jart 5y ago
But auto-update would require not only telemetry but remote system administration capabilities too. You'd have to monitor people's browsers to make sure a change you made isn't causing everyone's browser to break. In the event that it does, you'd be able to halt the incremental rollout before it impacts too many people.
- account42 5y ago
  > You'd have to monitor people's browsers to make sure a change you made isn't causing everyone's browser to break. In the event that it does, you'd be able to halt the incremental rollout before it impacts too many people. Just let people install the update when they want (so they can make their own decisions on the risks) and provide ways to get feeback to you if there are problems. No need for telemetry at all or even an explicit incremental rollout when you don't force users to update.
  - jart 5y ago
    I agree, however there's more wisdom to that strategy if you're working with a novel technology stack like the SerenityOS browser. Chrome and Firefox are lucrative enough as targets that weaknesses are exploited in the wild rapidly enough that people are willing to make that bargain with internet leviathan on auto-updates. Something like LibreWolf has that same target painted on its back, but it's not the devil you know. On the other hand, SerenityOS is kind of like how back in 2003 when all the bad guys started targeting Windows users en masse, everyone switched to Linux, and then the whole virus issue went away. Not because the scrappy Linux developers were wiser and had better security practices than Windows, but rather it was just simple economics.

colordrops 5y ago

Brave has some good ideas that could be adopted. Instead of completely forgoing features like DRM video, make them opt-in instead. The user can choose their level of privacy.

fabrice_d 5y ago
Opt-in DRM? Like in Firefox where you need to enable it for sites like Netflix or Spotify at first use?
fotta 5y ago
DRM is opt-in on Librewolf. It's in the pref pane.
- colordrops 5y ago
  Oh excellent. I had read that it wad removed from librewolf.

KennyBlanken 5y ago

The browser presents your client as being in the GMT timezone to reduce fingerprinting using timezones, supposedly. Guess what stands out like a sore thumb? Someone with a timezone many hours off from everyone else in their country/state/region. Fucking idiots.

account42 5y ago
Unfortunately, trying to hide the fact that you are using a particular privacy-conscious browser is generally impossible. The best you can do is hide amongs all the other users of that browser.
gkbrk 5y ago
UTC, GMT or the +0 timezone is pretty standard when using a browser that does not leak data like a sieve. So I don't think it will stick out that much. If they picked another value though it might be problematic.

jart 5y ago

But auto-update would require not only telemetry but remote system administration capabilities too. You'd have to monitor people's browsers to make sure a change you made isn't causing everyone's browser to break. In the event that it does, you'd be able to halt the incremental rollout before it impacts too many people.

account42 5y ago
> You'd have to monitor people's browsers to make sure a change you made isn't causing everyone's browser to break. In the event that it does, you'd be able to halt the incremental rollout before it impacts too many people. Just let people install the update when they want (so they can make their own decisions on the risks) and provide ways to get feeback to you if there are problems. No need for telemetry at all or even an explicit incremental rollout when you don't force users to update.
- jart 5y ago
  I agree, however there's more wisdom to that strategy if you're working with a novel technology stack like the SerenityOS browser. Chrome and Firefox are lucrative enough as targets that weaknesses are exploited in the wild rapidly enough that people are willing to make that bargain with internet leviathan on auto-updates. Something like LibreWolf has that same target painted on its back, but it's not the devil you know. On the other hand, SerenityOS is kind of like how back in 2003 when all the bad guys started targeting Windows users en masse, everyone switched to Linux, and then the whole virus issue went away. Not because the scrappy Linux developers were wiser and had better security practices than Windows, but rather it was just simple economics.