11 ms·

LibreWolf: A privacy-focused Firefox fork

76 points by Gedxx 4y ago

djbusby 4y ago
Homepage https://librewolf.net/ https://librewolf.net/
golf_mike 4y ago
So how does this rate in terms of what was discussed here? https://news.ycombinator.com/item?id=31891132 https://news.ycombinator.com/item?id=31891132 It sure looks interesting but that article definitely burst some of my privacy bubbles...
- heftig 4y ago
  It makes all of the changes supposed to "improve privacy" (both TR and TE), resulting in the conflicts described in that article.
hansword 4y ago
To me, having worked with OSS for multiple decades, but only ever having dipped my toe into the dev waters, the amount of forks happening seems ridiculous. (1) the 'subdivision of the estates' problem that primogeniture solved for inheritance is very well and alive in OSS. If you fork a project often enough most forks will have such a thin developer base, they wither. (2) this then channels quite a bit of development into projects that will soon die, thus effectively depriving the surviving versions of dev hours. (3) it's ridiculously complicated for non-technical people to keep up with what project formed from what and which fork is the most current/secure/convenient/otherquality of the bunch. I am genuinely asking, with all this being known, why hasn't there been a bigger push towards modularity. This was the idea of Unix pipes, and i don't see why it is a bad idea 40+ years later. Have a 'Gecko' module, have an 'UI' module, have a 'telemetry' module, ..... this would allow people to build Firefox 'flavors' instead of forking everything. Everyone would contribute to the same project/ecosystem, users can discover the big project, and immediately download 'vanilla', but also get info on whatever flavors there are and in what way they differ? What is the real problem here? Edit: autocorrect-correction
- Thiez 4y ago
  What is the incentive for the main project to build their software this way? It would likely be a lot of work to split up the software in modules like that. They would either regularly break backwards compatibility, negating the advantages of these modules, or they would have to bind their hands forever, unable to evolve the design and module boundaries. All to support forks that probably never get merged back into the main project, so from the main project perspectives the dev time is no less wasted than before. Except that they now wasted a lot of dev time to do this thing that doesn't bring them much, if anything. This RPC stuff would likely also be slightly slower, so people would just say Firefox is slow and use Chrome.
  - layer8 4y ago
    Separation of concerns and improved testability could be an incentive for such modularization.
  - funcDropShadow 4y ago
    Being able to join forces with more co-developers can be an incentive ... and a burden, to be honest. But for some it situations it could be an incentive.
  - omniglottal 4y ago
    The comment to which you are replying points out the obvious value of such a proposal. Your not seeing immediate value, else suggesting it is not valuable, seems to be your error. All projects benefit more from those who see value in an effort, who are willing to put in that effort, than those discouraging or subverting such effort, given their ignorance of such value.
- Sunspark 4y ago
  This makes me think of the problem text messengers have. Do they have one central server, or do they have a federation of independently run servers with differing software versions? If they have the latter, how do they encourage everyone to maintain a minimal standard level of compatibility? What if someone wants to introduce a great new feature? Does it take years because of the non-centralized nature and people refusing to update? What you envision about modularity in a small way has already happened with the Skia graphics api. "The library is used as of 2021 in Google Chrome, Chrome OS, Chromium OS, Mozilla Firefox, Mozilla Thunderbird, Android, Firefox OS, LibreOffice (from version 7.0), Flutter and Avalonia (from Alpha 4)."
masukomi 4y ago
> Disables IPv6 by default. um... what'd i miss? Why would i want this?
- Borealid 4y ago
  It's not wholly logical, but I think they might be working under the assumption that IPv6 addresses are usually "more public" (when accidentally not using random privacy addresses?) than NATed IPv4, and that it's more easily possible to configure a VPN that leaks IPv6 traffic via non-VPN routes. I don't agree that disabling IPv6 improves privacy, but there is some foundation for the idea.
  - gruez 4y ago
    >but I think they might be working under the assumption that IPv6 addresses are usually "more public" (when accidentally not using random privacy addresses?) than NATed IPv4 Are privacy address per machine or per connection? My impression is that they're the former, which still makes them worse than IPV4 + NAT.
    - zaarn 4y ago
      Privacy Addresses are for a time slice of connections. You can cycle a new address every 10 minutes but the OS will keep old addresses until all connections over these addresses have been closed. Stable-Privacy is just like having an IPv4, but if your prefix changes the suffix changes, so you can't be easily traced across prefix changes. For desktops, normal privacy should be configured.
      - gruez 4y ago
        > Privacy Addresses are for a time slice of connections. You can cycle a new address every 10 minutes but the OS will keep old addresses until all connections over these addresses have been closed. Sounds like it's still worse than IPV4 + NAT, because your address + port tuple changes with each connection, whereas with ipv6 it's the same across connections for 10 minutes.
zahma 4y ago
If I’m using Firefox with privacy badger, UBlock Origin, privacy possum, cookie and cache deleters, a URL tracker plug in, noscript, https enabled by default, a handful of others that are probably redundant on top of Firefox’s internal tracker protection, do I really stand to benefit from this fork? In other words, is this truly necessary?
- gchamonlive 4y ago
  Maybe for a zero-conf, out-of-the-box privacy-oriented firefox browsing environment, i.e. for convenience. One question. How does website availability fare with all these plugins and options active? Does it mangle or render sites unusable? And at what rate?
  - zahma 4y ago
    When it comes to new sites, I have to usually reset noscript to allow the top level domain. Honestly I don’t know why I don’t just do that by default. At least half the websites don’t load at all without JS enabled. On the sites with more heavy tracking —- chegg comes to mind or some different clothing stores with lots of media, payment service scripts, and heavy ad tracking like tentree — the plug-ins definitely interfere to the point where I will sometimes use a second browser so that the website operates as intended. NoScript seems to be the culprit in most cases, and I suspect the interface doesn’t adequately display all the scripts attempting to load after the initial render. I’ve had some trouble with sites which communicate between themselves too. (Airlines do this a lot). All in all, I’d say my browsing experience is normal to the extent that I don’t do a lot of browsing to new sites. I’ve got a good running list for noscript, but any new sites with lots of dependencies and media to load usually requires a couple refreshed after an updated rule list.
  - zeruch 4y ago
    ...mostly yes, at least initially. I use uMatrix and NoScript and its a matter of configuring/'training' them over such that most browsing over a few days/weeks becomes quite fantastic. That said, one has to get used to making those configs every time a new site is browsed (or a previous site changes significantly what it does), but really, for some of us, the experience after the fact is well worth the investment, as browsing and reading become sane again.
fartcannon 4y ago
I use it sometimes. Works quite well and has a nice icon. I also sometimes use Mull on Android. Its nice that there's some variety these days, even if they're just config differences. Choice is nice.
jchw 4y ago
I am a big fan of LibreWolf. Along with Ungoogled Chromium, these browsers feel a lot closer to what browsers should feel like. One of my favorite features of LibreWolf is truly disabled autoplay. If a site wants to autoplay, you have to allow it first, no exceptions. This might sound petty, but in a world where it feels like you have no control over anything, this small return to feeling like I am allowed to decide what happens in my own damn browser is liberating. Note that Librewolf doesn’t autoupdate, but you can get notifications when an update is available using an unofficial extension. https://addons.mozilla.org/en-US/firefox/addon/librewolf-updater/ https://addons.mozilla.org/en-US/firefox/addon/librewolf-upd... You can use a package manager to install and update it, too. Even on Windows; it’s available in Winget.
- freedomben 4y ago
  User control is remarkably empowering and makes the web more of a joy like it felt in the early days. The day that I can't run uMatrix anymore will be a sad day for me indeed.
  - MomoXenosaga 4y ago
    I tried to use this and it breaks most websites. Usability is clearly the least important concern for the devs. Mozilla can't make that decision it has to work out of the box. Of course the most private thing to do is not use computers at all.
- lbhdc 4y ago
  I use the fully leaded version of firefox, which has the disable autoplay feature. That is one of the best quality of life features there IMO. So often I will click on an article or something like that, and it steps on my music and drives me crazy. Gonna have to try out librewolf.
  - pessimizer 4y ago
    > disable autoplay feature. Sort of. They require you to dig around in about:config (where settings go to be hidden, then removed) to toggle some obliquely named and unnecessary exception to their autoplay policy, which is if your "gestures" trigger autoplay. This can mean simply mean that you scrolled the page to video was on. The setting to disable autoplay is therefore only reliable on unselected tabs.
woojoo666 4y ago
> Disable WebGL to avoid fingerprinting I don't know if this is done by default, but this is dangerous to do. A disabled canvas is itself a fingerprint, and can be more unique than your original fingerprint [1]. Canvas randomizers can have the same issues if they are not done properly. From what I've heard, the best mitigation is Firefox's `resistFingerprinting` flag, since it uses the same methods as Tor browser [1]: https://multilogin.com/how-canvas-fingerprint-blockers-make-you-easily-trackable/ https://multilogin.com/how-canvas-fingerprint-blockers-make-...
- cowtools 4y ago
  I can't imagine disabled WebGL is that specific of a fingerprint. Surely there have to be millions of consumer devices out there without OpenGLES2 support, right? However I agree that privacy.resistFingerprinting is probably the way to go.
  - speedgoose 4y ago
    > Surely there have to be millions of consumer devices out there without OpenGLES2 support, right? Perhaps, but not many people in your area run the latest version of Firefox while not supporting WebGL and having a display with a high DPI (for example).
  - gruez 4y ago
    >Surely there have to be millions of consumer devices out there without OpenGLES2 support Not really. Even my decade+ old laptop supports webgl on both firefox and chrome.
  - woojoo666 4y ago
    Apparently many computers have the same canvas fingerprint [1], much more than you'd think. So disabling it does seem like it would make you more unique. [1]: https://multilogin.com/the-great-myth-of-canvas-fingerprinting-part-i/ https://multilogin.com/the-great-myth-of-canvas-fingerprinti...
rubyist5eva 4y ago
Yeah....I'm not gonna trust a Firefox fork maintained by 1 dude, and if Firefox would ever disappear I don't expect any of these forks to pick up the slack. I'm not a fan of everything Mozilla does with the project but it's still better than the alternatives.
- ryanisnan 4y ago
  You are the only person to have brought this exact point up. And I think it's a huge one. I think it's pointless to go on about the features or the add-ons you'd need to add to Firefox to achieve this level of privacy in your browser, while ignoring the glaring problem that this has a really small maintainer pool and I assume folks have done no due-diligence on who those folks are. I'll admit, I haven't done due-diligence on any of the folks at Mozilla, but I think it'd be a lot easier to socially engineer a project like LibreWolf than Firefox. Edit: I'll add I mean no disrespect to the folks at LibreWolf, in fact it's awesome what they're doing. I just find it hard to take most things at face value these days, especially a browser.
  - emsixteen 4y ago
    Mentioned the one you replied to, but it syncs as normal to Mozilla's profile sync - what are you losing out on if the maintainer stops maintaining it? "It can die some day" - everything does.
    - ryanisnan 4y ago
      That is far from the only concern. For me, the biggest consideration is trust. With such a small maintainer base, you are placing a large amount of trust in their team. There would be huge motivation in creating a privacy-focused browser that secretly slurps data and/or monitors users somehow[1]. Using a project like this would require me trusting a small-handful of people I don't know at all, and aren't represented by an entity I somewhat inherently trust (Mozilla). I can't say my logic is without holes, for example I don't do much to verify my trust in Mozilla, but you have to make generalizations in this field or you would never get anything done. [1] If you need a real-world example, see Anom.
night-rider 4y ago
This saves a lot of time. I tried hardening Firefox and it took more than a day to get everything sorted. I added a few policies and about:config tweaks yet with each new release of Firefox some new stuff has to be disabled or tweaked for hardening purposes. I always wondered why Firefox doesn’t just do all this anyways and be more privacy-aware. Their data grab in recent years has gotten worse. Forks like LibreWolf are a godsend and I am glad it exists. My only issue with it is that it causes sites to have a CAPTCHA interstitial due to all the fingerprinting mitigations it does, and it doesn’t play nice with e-commerce since those sites do a lot of KYC and fraud prevention and flag browsers which are trying to blend in.
2Gkashmiri 4y ago
How can librewolf people "fork" Firefox which brave creators called "pita" ?? Guess they don't care about supporting privacy other than skimming off of work of google all the while lambasting their efforts of destroying the same privacy policies they believe they are protecting. Eh, fuck'em
4oh9do 4y ago
My concerns with ostensibly privacy-focused Firefox forks: * Needing to constantly monitor whether the fork is being actively maintained, or if it's a vanity project which abruptly stops/slows down updates when its owner/principal contributors lose interest. * Needing to constantly monitor if the fork is using the latest official Firefox builds to make sure that it's also getting the latest security updates. * Not being readily able to see a complete humanly understandable (meaning not just comparing git versions) list of changes that the fork makes to the official build. * Not knowing the reputation of the developers behind the fork. In sum, I basically trust Mozilla more than I do $random_fork_developer, so I use the official build and carry out my own tweaks, but I am always on the look out for more tweaks, which is why I'd appreciate if lists of privacy tweaks custom builds do were more transparently shared.
- night-rider 4y ago
  Your concerns are valid but from the article: > Firefox security patches are applied to prevent vulnerabilities You are right about the reputation of the maintainers of LW though. The second this becomes abandonware I will ditch it.
  - 4oh9do 4y ago
    > Firefox security patches are applied to prevent vulnerabilities Sure, but at what rate? If Mozilla releases a critical patch today, and the core maintainer responsible for build maintenance is away on vacation for two weeks, what happens?
    - night-rider 4y ago
      Valid point.
    - mrkramer 4y ago
      That's the main problem behind FOSS; they are not incentivized to be 100% dedicated to the project. Their FOSS projects are labour of love not labour of money.
s_ting765 4y ago
I'm glad this project exists. I stopped keeping count of how many new privacy offending features and nagware Firefox keeps churning out these days.
emsixteen 4y ago
I switched to this a week or so ago after getting annoyed with Pocket showing up in my Developer Edition install.
- dont__panic 4y ago
  I switched a couple of months ago from Dev Edition as well. The biggest improvement for me? On macOS, I can control upgrades myself via homebrew. No more popups every day begging me to update. It became really annoying that Dev Edition uses the same release cadence as Nightly, so you basically have a new update available all the time. And now vanilla Firefox doesn't even let you disable update checks.
tapper 4y ago
Well the a11y has bin removed so no privacy- for blind people. Thanks!
dang 4y ago
Related: LibreWolf – A fork of Firefox, focused on privacy, security and freedom - https://news.ycombinator.com/item?id=30720301 https://news.ycombinator.com/item?id=30720301 - March 2022 (217 comments) LibreWolf – A fork of Firefox, focused on privacy, security and freedom - https://news.ycombinator.com/item?id=29106155 https://news.ycombinator.com/item?id=29106155 - Nov 2021 (306 comments) LibreWolf: A fork of Firefox, focused on privacy, security and freedom - https://news.ycombinator.com/item?id=26034774 https://news.ycombinator.com/item?id=26034774 - Feb 2021 (1 comment) LibreWolf – A fork of Firefox, focused on privacy, security and freedom - https://news.ycombinator.com/item?id=23901130 https://news.ycombinator.com/item?id=23901130 - July 2020 (5 comments)

76 points by Gedxx 4y ago

Homepage https://librewolf.net/ https://librewolf.net/

So how does this rate in terms of what was discussed here? https://news.ycombinator.com/item?id=31891132 https://news.ycombinator.com/item?id=31891132 It sure looks interesting but that article definitely burst some of my privacy bubbles...

heftig 4y ago
It makes all of the changes supposed to "improve privacy" (both TR and TE), resulting in the conflicts described in that article.

hansword 4y ago

To me, having worked with OSS for multiple decades, but only ever having dipped my toe into the dev waters, the amount of forks happening seems ridiculous. (1) the 'subdivision of the estates' problem that primogeniture solved for inheritance is very well and alive in OSS. If you fork a project often enough most forks will have such a thin developer base, they wither. (2) this then channels quite a bit of development into projects that will soon die, thus effectively depriving the surviving versions of dev hours. (3) it's ridiculously complicated for non-technical people to keep up with what project formed from what and which fork is the most current/secure/convenient/otherquality of the bunch. I am genuinely asking, with all this being known, why hasn't there been a bigger push towards modularity. This was the idea of Unix pipes, and i don't see why it is a bad idea 40+ years later. Have a 'Gecko' module, have an 'UI' module, have a 'telemetry' module, ..... this would allow people to build Firefox 'flavors' instead of forking everything. Everyone would contribute to the same project/ecosystem, users can discover the big project, and immediately download 'vanilla', but also get info on whatever flavors there are and in what way they differ? What is the real problem here? Edit: autocorrect-correction

Thiez 4y ago
What is the incentive for the main project to build their software this way? It would likely be a lot of work to split up the software in modules like that. They would either regularly break backwards compatibility, negating the advantages of these modules, or they would have to bind their hands forever, unable to evolve the design and module boundaries. All to support forks that probably never get merged back into the main project, so from the main project perspectives the dev time is no less wasted than before. Except that they now wasted a lot of dev time to do this thing that doesn't bring them much, if anything. This RPC stuff would likely also be slightly slower, so people would just say Firefox is slow and use Chrome.
- layer8 4y ago
  Separation of concerns and improved testability could be an incentive for such modularization.
- funcDropShadow 4y ago
  Being able to join forces with more co-developers can be an incentive ... and a burden, to be honest. But for some it situations it could be an incentive.
- omniglottal 4y ago
  The comment to which you are replying points out the obvious value of such a proposal. Your not seeing immediate value, else suggesting it is not valuable, seems to be your error. All projects benefit more from those who see value in an effort, who are willing to put in that effort, than those discouraging or subverting such effort, given their ignorance of such value.
Sunspark 4y ago
This makes me think of the problem text messengers have. Do they have one central server, or do they have a federation of independently run servers with differing software versions? If they have the latter, how do they encourage everyone to maintain a minimal standard level of compatibility? What if someone wants to introduce a great new feature? Does it take years because of the non-centralized nature and people refusing to update? What you envision about modularity in a small way has already happened with the Skia graphics api. "The library is used as of 2021 in Google Chrome, Chrome OS, Chromium OS, Mozilla Firefox, Mozilla Thunderbird, Android, Firefox OS, LibreOffice (from version 7.0), Flutter and Avalonia (from Alpha 4)."

masukomi 4y ago

> Disables IPv6 by default. um... what'd i miss? Why would i want this?

Borealid 4y ago
It's not wholly logical, but I think they might be working under the assumption that IPv6 addresses are usually "more public" (when accidentally not using random privacy addresses?) than NATed IPv4, and that it's more easily possible to configure a VPN that leaks IPv6 traffic via non-VPN routes. I don't agree that disabling IPv6 improves privacy, but there is some foundation for the idea.
- gruez 4y ago
  >but I think they might be working under the assumption that IPv6 addresses are usually "more public" (when accidentally not using random privacy addresses?) than NATed IPv4 Are privacy address per machine or per connection? My impression is that they're the former, which still makes them worse than IPV4 + NAT.
  - zaarn 4y ago
    Privacy Addresses are for a time slice of connections. You can cycle a new address every 10 minutes but the OS will keep old addresses until all connections over these addresses have been closed. Stable-Privacy is just like having an IPv4, but if your prefix changes the suffix changes, so you can't be easily traced across prefix changes. For desktops, normal privacy should be configured.
    - gruez 4y ago
      > Privacy Addresses are for a time slice of connections. You can cycle a new address every 10 minutes but the OS will keep old addresses until all connections over these addresses have been closed. Sounds like it's still worse than IPV4 + NAT, because your address + port tuple changes with each connection, whereas with ipv6 it's the same across connections for 10 minutes.

zahma 4y ago

If I’m using Firefox with privacy badger, UBlock Origin, privacy possum, cookie and cache deleters, a URL tracker plug in, noscript, https enabled by default, a handful of others that are probably redundant on top of Firefox’s internal tracker protection, do I really stand to benefit from this fork? In other words, is this truly necessary?

gchamonlive 4y ago
Maybe for a zero-conf, out-of-the-box privacy-oriented firefox browsing environment, i.e. for convenience. One question. How does website availability fare with all these plugins and options active? Does it mangle or render sites unusable? And at what rate?
- zahma 4y ago
  When it comes to new sites, I have to usually reset noscript to allow the top level domain. Honestly I don’t know why I don’t just do that by default. At least half the websites don’t load at all without JS enabled. On the sites with more heavy tracking —- chegg comes to mind or some different clothing stores with lots of media, payment service scripts, and heavy ad tracking like tentree — the plug-ins definitely interfere to the point where I will sometimes use a second browser so that the website operates as intended. NoScript seems to be the culprit in most cases, and I suspect the interface doesn’t adequately display all the scripts attempting to load after the initial render. I’ve had some trouble with sites which communicate between themselves too. (Airlines do this a lot). All in all, I’d say my browsing experience is normal to the extent that I don’t do a lot of browsing to new sites. I’ve got a good running list for noscript, but any new sites with lots of dependencies and media to load usually requires a couple refreshed after an updated rule list.
- zeruch 4y ago
  ...mostly yes, at least initially. I use uMatrix and NoScript and its a matter of configuring/'training' them over such that most browsing over a few days/weeks becomes quite fantastic. That said, one has to get used to making those configs every time a new site is browsed (or a previous site changes significantly what it does), but really, for some of us, the experience after the fact is well worth the investment, as browsing and reading become sane again.

fartcannon 4y ago

I use it sometimes. Works quite well and has a nice icon. I also sometimes use Mull on Android. Its nice that there's some variety these days, even if they're just config differences. Choice is nice.

jchw 4y ago

I am a big fan of LibreWolf. Along with Ungoogled Chromium, these browsers feel a lot closer to what browsers should feel like. One of my favorite features of LibreWolf is truly disabled autoplay. If a site wants to autoplay, you have to allow it first, no exceptions. This might sound petty, but in a world where it feels like you have no control over anything, this small return to feeling like I am allowed to decide what happens in my own damn browser is liberating. Note that Librewolf doesn’t autoupdate, but you can get notifications when an update is available using an unofficial extension. https://addons.mozilla.org/en-US/firefox/addon/librewolf-updater/ https://addons.mozilla.org/en-US/firefox/addon/librewolf-upd... You can use a package manager to install and update it, too. Even on Windows; it’s available in Winget.

freedomben 4y ago
User control is remarkably empowering and makes the web more of a joy like it felt in the early days. The day that I can't run uMatrix anymore will be a sad day for me indeed.
- MomoXenosaga 4y ago
  I tried to use this and it breaks most websites. Usability is clearly the least important concern for the devs. Mozilla can't make that decision it has to work out of the box. Of course the most private thing to do is not use computers at all.
lbhdc 4y ago
I use the fully leaded version of firefox, which has the disable autoplay feature. That is one of the best quality of life features there IMO. So often I will click on an article or something like that, and it steps on my music and drives me crazy. Gonna have to try out librewolf.
- pessimizer 4y ago
  > disable autoplay feature. Sort of. They require you to dig around in about:config (where settings go to be hidden, then removed) to toggle some obliquely named and unnecessary exception to their autoplay policy, which is if your "gestures" trigger autoplay. This can mean simply mean that you scrolled the page to video was on. The setting to disable autoplay is therefore only reliable on unselected tabs.

woojoo666 4y ago

> Disable WebGL to avoid fingerprinting I don't know if this is done by default, but this is dangerous to do. A disabled canvas is itself a fingerprint, and can be more unique than your original fingerprint [1]. Canvas randomizers can have the same issues if they are not done properly. From what I've heard, the best mitigation is Firefox's `resistFingerprinting` flag, since it uses the same methods as Tor browser [1]: https://multilogin.com/how-canvas-fingerprint-blockers-make-you-easily-trackable/ https://multilogin.com/how-canvas-fingerprint-blockers-make-...

cowtools 4y ago
I can't imagine disabled WebGL is that specific of a fingerprint. Surely there have to be millions of consumer devices out there without OpenGLES2 support, right? However I agree that privacy.resistFingerprinting is probably the way to go.
- speedgoose 4y ago
  > Surely there have to be millions of consumer devices out there without OpenGLES2 support, right? Perhaps, but not many people in your area run the latest version of Firefox while not supporting WebGL and having a display with a high DPI (for example).
- gruez 4y ago
  >Surely there have to be millions of consumer devices out there without OpenGLES2 support Not really. Even my decade+ old laptop supports webgl on both firefox and chrome.
- woojoo666 4y ago
  Apparently many computers have the same canvas fingerprint [1], much more than you'd think. So disabling it does seem like it would make you more unique. [1]: https://multilogin.com/the-great-myth-of-canvas-fingerprinting-part-i/ https://multilogin.com/the-great-myth-of-canvas-fingerprinti...

rubyist5eva 4y ago

Yeah....I'm not gonna trust a Firefox fork maintained by 1 dude, and if Firefox would ever disappear I don't expect any of these forks to pick up the slack. I'm not a fan of everything Mozilla does with the project but it's still better than the alternatives.

ryanisnan 4y ago
You are the only person to have brought this exact point up. And I think it's a huge one. I think it's pointless to go on about the features or the add-ons you'd need to add to Firefox to achieve this level of privacy in your browser, while ignoring the glaring problem that this has a really small maintainer pool and I assume folks have done no due-diligence on who those folks are. I'll admit, I haven't done due-diligence on any of the folks at Mozilla, but I think it'd be a lot easier to socially engineer a project like LibreWolf than Firefox. Edit: I'll add I mean no disrespect to the folks at LibreWolf, in fact it's awesome what they're doing. I just find it hard to take most things at face value these days, especially a browser.
- emsixteen 4y ago
  Mentioned the one you replied to, but it syncs as normal to Mozilla's profile sync - what are you losing out on if the maintainer stops maintaining it? "It can die some day" - everything does.
  - ryanisnan 4y ago
    That is far from the only concern. For me, the biggest consideration is trust. With such a small maintainer base, you are placing a large amount of trust in their team. There would be huge motivation in creating a privacy-focused browser that secretly slurps data and/or monitors users somehow[1]. Using a project like this would require me trusting a small-handful of people I don't know at all, and aren't represented by an entity I somewhat inherently trust (Mozilla). I can't say my logic is without holes, for example I don't do much to verify my trust in Mozilla, but you have to make generalizations in this field or you would never get anything done. [1] If you need a real-world example, see Anom.

night-rider 4y ago

This saves a lot of time. I tried hardening Firefox and it took more than a day to get everything sorted. I added a few policies and about:config tweaks yet with each new release of Firefox some new stuff has to be disabled or tweaked for hardening purposes. I always wondered why Firefox doesn’t just do all this anyways and be more privacy-aware. Their data grab in recent years has gotten worse. Forks like LibreWolf are a godsend and I am glad it exists. My only issue with it is that it causes sites to have a CAPTCHA interstitial due to all the fingerprinting mitigations it does, and it doesn’t play nice with e-commerce since those sites do a lot of KYC and fraud prevention and flag browsers which are trying to blend in.

2Gkashmiri 4y ago

How can librewolf people "fork" Firefox which brave creators called "pita" ?? Guess they don't care about supporting privacy other than skimming off of work of google all the while lambasting their efforts of destroying the same privacy policies they believe they are protecting. Eh, fuck'em

4oh9do 4y ago

My concerns with ostensibly privacy-focused Firefox forks: * Needing to constantly monitor whether the fork is being actively maintained, or if it's a vanity project which abruptly stops/slows down updates when its owner/principal contributors lose interest. * Needing to constantly monitor if the fork is using the latest official Firefox builds to make sure that it's also getting the latest security updates. * Not being readily able to see a complete humanly understandable (meaning not just comparing git versions) list of changes that the fork makes to the official build. * Not knowing the reputation of the developers behind the fork. In sum, I basically trust Mozilla more than I do $random_fork_developer, so I use the official build and carry out my own tweaks, but I am always on the look out for more tweaks, which is why I'd appreciate if lists of privacy tweaks custom builds do were more transparently shared.

night-rider 4y ago
Your concerns are valid but from the article: > Firefox security patches are applied to prevent vulnerabilities You are right about the reputation of the maintainers of LW though. The second this becomes abandonware I will ditch it.
- 4oh9do 4y ago
  > Firefox security patches are applied to prevent vulnerabilities Sure, but at what rate? If Mozilla releases a critical patch today, and the core maintainer responsible for build maintenance is away on vacation for two weeks, what happens?
  - night-rider 4y ago
    Valid point.
  - mrkramer 4y ago
    That's the main problem behind FOSS; they are not incentivized to be 100% dedicated to the project. Their FOSS projects are labour of love not labour of money.

s_ting765 4y ago

I'm glad this project exists. I stopped keeping count of how many new privacy offending features and nagware Firefox keeps churning out these days.

emsixteen 4y ago

I switched to this a week or so ago after getting annoyed with Pocket showing up in my Developer Edition install.

dont__panic 4y ago
I switched a couple of months ago from Dev Edition as well. The biggest improvement for me? On macOS, I can control upgrades myself via homebrew. No more popups every day begging me to update. It became really annoying that Dev Edition uses the same release cadence as Nightly, so you basically have a new update available all the time. And now vanilla Firefox doesn't even let you disable update checks.

tapper 4y ago

Well the a11y has bin removed so no privacy- for blind people. Thanks!

dang 4y ago

Related: LibreWolf – A fork of Firefox, focused on privacy, security and freedom - https://news.ycombinator.com/item?id=30720301 https://news.ycombinator.com/item?id=30720301 - March 2022 (217 comments) LibreWolf – A fork of Firefox, focused on privacy, security and freedom - https://news.ycombinator.com/item?id=29106155 https://news.ycombinator.com/item?id=29106155 - Nov 2021 (306 comments) LibreWolf: A fork of Firefox, focused on privacy, security and freedom - https://news.ycombinator.com/item?id=26034774 https://news.ycombinator.com/item?id=26034774 - Feb 2021 (1 comment) LibreWolf – A fork of Firefox, focused on privacy, security and freedom - https://news.ycombinator.com/item?id=23901130 https://news.ycombinator.com/item?id=23901130 - July 2020 (5 comments)