4 ms·

I can think of 2 pragmatic reasons: 1. If one wished to use .xpi/.crx (akin to F-Droid's install pathway) then the user would have to teach the browser to trus

I can think of 2 pragmatic reasons: 1. If one wished to use .xpi/.crx (akin to F-Droid's install pathway) then the user would have to teach the browser to trust the signature of them. F-Droid doesn't suffer from this because each .apk is self-trusting, meaning it is signed, and that signature conveys lineage (v1.0 is owned by the same publisher as v1.1, so safe to upgrade), but the operating system doesn't have to be informed about any chain of custody for the .apk cert 2. I am not aware of any self-hosting extension registry, even from Mozilla, and extra lol for Chromium. If such a thing existed, the browser would have to allow the user to add "trusted extension registries" (along with their trusted CA chain). It would actually be snazzy if they went the Helm/Homebrew route and just leveraged OCI distribution (aka docker registry) for that, since it would open up almost unlimited self-hosting options, including publishing right from GitHub Actions to ghcr.io

riedel 1y ago
IMHO it would be rather easy to overcome this by forking. I anyways have used forks like librewolf, betterbird and recently Zen for Mozilla stuff due to all this telemetry (I guess you will need not care about malware if the browser already contains so many trackers)
- mdaniel 1y ago
  Rather easy, eh? Well, then great, you can submit your rather easy patch to any one of the named forks and see if they adopt all the non-code stupidity that's required to execute all the PKI star-alignment that I cited
  - riedel 1y ago
    The fullblown case is difficult, true. But the 'simple' case would be that one of the forks has a repo. Afaik Zen already has its own mods: https://zen-browser.app/mods/ https://zen-browser.app/mods/ (I did not check the details). Coupled with GitHub attestation packaging more FOSS from trusted sources, would maybe not easy but also not implausible difficult. The difficulty for sure is to set up some trusted moderation community. And I think with mozdev.org, the future was partially already here, before all the browser wars...

riedel 1y ago

IMHO it would be rather easy to overcome this by forking. I anyways have used forks like librewolf, betterbird and recently Zen for Mozilla stuff due to all this telemetry (I guess you will need not care about malware if the browser already contains so many trackers)

mdaniel 1y ago
Rather easy, eh? Well, then great, you can submit your rather easy patch to any one of the named forks and see if they adopt all the non-code stupidity that's required to execute all the PKI star-alignment that I cited
- riedel 1y ago
  The fullblown case is difficult, true. But the 'simple' case would be that one of the forks has a repo. Afaik Zen already has its own mods: https://zen-browser.app/mods/ https://zen-browser.app/mods/ (I did not check the details). Coupled with GitHub attestation packaging more FOSS from trusted sources, would maybe not easy but also not implausible difficult. The difficulty for sure is to set up some trusted moderation community. And I think with mozdev.org, the future was partially already here, before all the browser wars...