3 ms·
I'm considering moving to LibreWolf, and also promoting it in various ways, so some due diligence questions on my mind: 1. How responsive is LibreWolf to secur
by neilv 2y ago
I'm considering moving to LibreWolf, and also promoting it in various ways, so some due diligence questions on my mind:
1. How responsive is LibreWolf to security updates? (Once Firefox pushes them out to users, how soon are LibreWolf users then also protected from the now-public vulnerabilities.)
2. Who maintains LibreWolf? Who is in position to vet Mozilla code, vet LibreWolf-specific code, modify, or release code? How are new people given these powers? What is the protection against bad actors on the team, or compromising people on the team?
3. Given some of the odd behavior in the last few years, is there a plan if, hypothetically, a Mozilla executive were to somehow cut off or sabotage LibreWolf? (For example, plan to pivot to doing a hard fork, while somehow assembling and vetting sufficient volunteers to make that viable? Or plan to rebase off some European or LatAm gov't-funded hard fork, while performing much the same third-party vetting&tweaking distro function as done now? Or plan to give up?)
4. Are there any thoughts on when it might make sense to get under the funding&governance umbrella of some tech public interest organization?
5. Any thoughts on moving to official Debian packages (e.g., a combination of the official Stable-track channels for something Firefox ESR-like, plus the Debian Backports channel for the latest browser features)?
(Please note that these infosec questions aren't intended to reflect negative impressions of LibreWolf. The reason for asking is that there are positive impressions of LibreWolf, and these are some questions to consider when moving forward.)
- yesnomaybe 2y agoFor no 1 - see https://librewolf.net/docs/faq/ https://librewolf.net/docs/faq/ looks like 3 days, sometimes same day
- neilv 2y agoThank you, that's unfortunate. (Incidentally, I like that their FAQ has some good questions and honest-seeming answers.) I think I've sometimes seen security update delays that bad from Tor Browser, but that's also bad there. I think the security update delay situation would need to be improved.
- eogrok 2y ago[dead]
- blibble 2y ago(2) is a real concern that I also share on their page, this is the only information on the project admin: https://codeberg.org/ohfp https://codeberg.org/ohfp who is this? can I trust them with literally my entire digital life and that of my family? this is a serious problem, "ohfp" might very well be trustworthy but at present there's no way to know your (4) would go a real way to solving this, but for now I'm not biting I'd rather take the risk that mozilla sell me some ads than use a browser with zero provenance
- hedora 2y agoI wonder how big the patchset is vs. upstream, and how hard it is to compile yourself. I’m not suggesting end-users do this, but I could see, e.g., a debian maintainer doing it.
- NoahKAndrews 2y agoIt's maintained as a set of patch files, so it's at least easy to see how it differs from upstream. The number of patches seemed somewhat manageable, though with the few I looked at I found myself wishing that they had much better documentation.
- 3np 2y agoIt's actually totally managable and reasonable for an end-user to stay on top of their patches and run a personally built subfork. I think it's better to think of it a a starting-point and template for your own builds rather than a Product. They're reasonably tidy, not too big, and much of the size comes from a typical userprefs a la arkenfox. I don't see why you would dissuade before even looking? This is one of those scenarios where verifying the work is a small fraction of the time and expertise to produce it.
- PeterStuer 2y agoEspecially on (2). Given that we are moving away from Firefox because of a trust issue with the maintainer, how does LibreWolf make this any better?