And, really, how do we know they are not? Unless we're checking the hash of the download with that provided on Firefox's on website, who even knows what we are

And, really, how do we know they are not? Unless we're checking the hash of the download with that provided on Firefox's on website, who even knows what we are installing? From a company with a history of stuffing adware down our throats. Edit: % md5 firefox-* MD5 (firefox-genuine.dmg) = 71c3d44cd5a612489a70e0f2ef825ba9 MD5 (firefox-sourceforge.dmg) = 71c3d44cd5a612489a70e0f2ef825ba9 So they are the same binary. All we need to do is create a Chrome extension that downloads the binary from both places and checks the hash then tells you if it's safe to download the SF one. Simple! Note that it took 8 times as long to download the binary from Sourceforge compared to Firefox's own site.