LibreWolf (Firefox-Based Browser)

anonymous477:

We’ve established earlier that comparing the rate of security fixes to that of Mullvad Browser’s was not well founded: Mullvad Browser being late on security fixes is an issue, but it serves a wholly different purpose from Librewolf and the value it brings to browsing (namely Tor-like fingerprinting protections but with better website compatibility) outweighs itLibrewolf, on the other hand, must be compared to Firefox and/or Brave, if anything; comparisons to Mullvad Browser are therefore off the agendaThe slow rate of security fixes that Librewolf has must be weighed with the value it brings compared to Firefox/BraveIf you want to discuss this point, you must explain why the late security patches are not an issue without appealing to that of Mullvad Browser’s

Well, I disagree. You could just use the lastest version of FireFox (so no security fix delay ➞ in that terms better than MullvadBrowser), configure it with MullvadBrowser’s configs before the first startup of FireFox, install uBlock Origin and configure it the exact same way MullvadBrowser does, don’t log in anywhere, don’t change any setting, use it with MullvadVPN and don’t install any extension more than uBlock Origin and you would look in the web exactly like any other MullvadBrowser user, wouldn’t you?

So where’s the difference? Why can’t you compare LibreWolf and MullvadBrowser? You can make FireFox nearly the same as MullvadBrowser and you can make FireFox nearly the same as LibreWolf.

anonymous477:

@any1 says that if the audience is for “technical” people, then that audience can and should go to Arkenfox. Convenience should not be a factor.

This argument looks kinda silly to me (now).

Why don’t use QubesOS with Whonix every single day? “But then surfing is slow and I can’t visit several websites and“ - “Convenience shouldn’t be a factor.”

I know you meant it only for the narrow limits of configuring, maintaining and learning ArkenFox instead of using LibreWolf. I just want to point out that in every way, you are making Privacy/Security/Convenience trade-offs, so the only question should be:

Outweighs the convenience and additional privacy features (yes, there are some, I will get into that later) of LibreWolf compared to FireFox & ArkenFox the security fix delay of LibreWolf?

So, here‘s what I think:

You just can‘t say objectively if some convenience features outweighs security disadvantages, so the User should choose. That’s why I think we should mention LibreWolf.

Also, I found a few more things in LibreWolf that can‘t be achieved in FireFox except the three things already named. Here‘s the List:

  1. FireFox is hosting its source code on GitHub, which itself is closed-source and owned by MicroSoft. I and many other people don‘t want to support closed-source projects and we certainly don‘t want to support MicroSoft. But LibreWolf uses Codeberg, which is a 100% Open-Source Non-Profit-Organisation.

  2. ArkenFox is hosting its source code on GitHub, which itself is closed-source and owned by MicroSoft. I and many other people don‘t want to support closed-source projects and we certainly don‘t want to support MicroSoft. But LibreWolf uses Codeberg, which is a 100% Open-Source Non-Profit-Organisation.

  3. Even if you disable any telemetry before the first startup, FireFox will send a one-time ping to Mozilla which says that telemetry was disabled.

  4. With new UpDates, there‘s more and more Crap in FireFox. Very disturbing Sync, Adverts for Mozilla‘s VPN, a „More from Mozilla“-Category in the Settings, AI-Features which partially activates themselves after disabling and much more.

  5. And since ArkenFox don‘t disables this Crap, you have to disable all these things again and again after every single ArkenFox-UpDate.

  6. Some things like “Set FireFox as the default browser” or the whole telemetry part are firmly anchored in the settings and cannot be removed. If you want to change something, you also have to scroll through these departments, which costs unnecessary time. Of course, this is only relevant - if at all - for perfectionists, but it should be mentioned here for the sake of attempted completeness.

  7. It is not possible to set a really clean HomePage. There are only three options: 1., Set it to “FireFox-HomePage (Default)”, where you then have to deactivate the sponsored links and all the news. Then it looks like there is only the search bar on the settings page for the HomePage; however, when you open a new tab, the FireFox LoGo is emblazoned above the search bar and “Firefox” next to it in bold letters. You can’t remove that, and I and many others hate this kind of advertising, “self-advertising”. 2., You set it to “Blank” (which is ArkenFox’s default), but then the HomePage really looks too naked. And 3rd, the last option, “Custom WebPage”, is of course not practical either, because you really don’t want to wait for every new tab until a website has finished loading. LibreWolf goes a perfect way in my opinion: The HomePage is just a very light grey background which isn‘t too intense but also not to nacked with a SearchBar in the upper center.

  8. There is the potential for mistakes (placing ArkenFox in the wrong directory, downloading an old ArkenFox, forgetting to unpack ArkenFox), as you have to reconfigure ArkenFox every time there is an ArkenFox update.

  9. FireFox is licensed under the MPL, which allows it to be incorporated into a proprietary product (weak copyleft). I and many other people don’t want to support something like that.

  10. ArkenFox is licensed under the MIT license, which allows it to be incorporated into a proprietary product (no copyleft). I and many other people don’t want to support something like that.

In know that Privacy Guides is also licensed under the MIT-License and the code is hosted on GitHub, but since that‘s more or less the only bad thing about Privacy Guides, I use it anyway.

GREAT points!!

At this point, I doubt the PG team will change their mind. It seems when a decision is taken, if the topic is slightly controversial, it’s pretty hard to reverse that decision, whatever the arguments thrown in are, even if it makes sense for a lot of people.

That being said, all these arguments are still be in this thread and people will be able to make their own decisions.

I could be wrong though!

Very good points!

Not challenging this opinion but in fact curios if some more “traditional” purist open source Linux distros would have similar take. So far a lot of repos and installations that I’m aware, normally have Firefox instead of Librewolf.

Checking the installation instructions it seems that for Arch is AUR not pacman, .deb and .rpm have to add third party Librewolf repo, the other Linux distros seems to be with the Flatpak option.

Perhaps, in this line of thinking one could say that Librewolf has installations available for Windows and MacOS and therefore are incorporated in closed source platforms that many people don’t want to support.

I see the difference on what you said but still that I have a little bit of trouble to separate the proprietary use of an application in closed source environment when the project creator also promotes it.

This was compared long ago, and you were shown all of it. Have you read it, or do you prefer writing?
The difference between Firefox, Mullvad, and LibreWolf isn’t just in the config file. They have different patches. How do you plan to integrate Tor patches into regular Firefox?
And LibreWolf has some questionable patches, for example, JXL enabled by default. What security can there be in this case?

What’s wrong with JXL?

I believe its irresponsible to recommend LibreWolf to anyone because their team is no longer able to keep up with the maintenance of the project after loosing their main maintainer as suggested last year.

This is further evident by the fact that the latest 145 release only came out when it did thanks to a member of this community who’s not even a LibreWolf user: #104 - Fix failing patches for version 145 - librewolf/source - Codeberg.org

You’re just repeating debunked argument. This is FUD at this point.

This is exactly what happened with Mullvad.

If Librewolf can’t be recommended because if this, then don’t recommend Mullvad either.

Adding another C++ decoder, what could possibly go wrong? Who is responsible for the new vulnerabilities? Mozilla or someone from who knows where?

Yes, and Tor too, everyone should use Google Chrome. Great suggestion. Do people forget they’re on PrivacyGuides, not SecurityGuides?

Strawmen.

I’m not advocating for the removal of Mullvad at all. I’m advocating for adding Librewolf.

Thank you, my thoughts exactly.

Sorry, but I didn‘t understand that point.

Great point and I also thought about that, and after research, I found out that LibreWolf was first only available for Open-Source OS‘s - so it was initially designed only for Open-Source Projects. Proprietary OS support came later due to big demand.

The TOR uplift project ports TOR privacy patches to Firefox. Well, you could argue that there‘s a delay, but often, there‘s also a delay for the TOR browser to port firefox‘ new privacy features to the TOR browser - for example, Letterboxing was almost half a year available in firefox before it was available in the TOR browser, so this argument from you isn‘t valid.​

Actually, since it‘s a feature also available in FireFox, Mozilla. Additionally, @starkle has responded to this at the beginning of this discussion very good:

This is not possible. Latest release of Firefox is not what Mullvad/Tor use. They don’t even use the latest ESR release directly but rebase their changes onto it instead. If you just slap the Mullvad config onto the latest release you will not be a part of the crowd.

I also don’t like the idea of having JXL in the browser using libjxl and would rather wait for the promised Rust implementation that Google said they would provide for Firefox.

I don’t understand why you keep going on about the same thing when it’s been proven to you that what CAN be achieved with Mullvad/Tor CANNOT be achieved with AF/LW/Firefox, and you yourself have acknowledged it:

I am already testing the patches against the release candidate for 146, so the next release should be much faster.

  1. Well then, can you just name a few concrete fingerprinting-relevant values which distinguish a user with that theoretical setup (lastest [ESR/Non-ESR] version of FireFox, configured with MullvadBrowser’s configs before the first startup of FireFox, installed uBlock Origin and configured with the exact same way MullvadBrowser does, don’t logged-in anywhere, don’t changed any setting, used with MullvadVPN and don’t installed any extension more than uBlock Origin) to a MullvadBrowser+MullvadVPN user?

  2. If that is true and you can’t compare MullvadBrowser with LibreWolf (which might be the case!), then my main argument still persists:

And also, none of the 13 in FF non-achievable advantages of LibreWolf has been yet refuted (except maybe one that Cyber-Typhoon mentioned).

Are you even aware of what you’re asking? You are asking whether there is a change in fingerprinting that, by the end of the lifecycle, represents almost a year’s worth of changes, not including Tor/Mullvad rebases that are missing compared to regular Firefox releases.

If you’re so convinced, then go ahead and make your frankenbrowser and compare it to Mullvad Browser with TZP.

I don’t understand your intentions. I see that you just signed up to codeberg and you’ve stated that you don’t even use LibreWolf, but you decided that you want to be its batman anyways and start working on new release? Why?

Anyways, I used to use LibreWolf for roughly a year before I found this community. I wanted to share why I’m never going back again. To me it’s a lack of community and past dev fuck ups that completely eroded my trust in the project.

  1. Maybe half a year ago LibreWolf rolled out a new release then rolled it back after about a day. Everyone that updated to the new release had their profiles updated for the new version. After that new release got rolled back, LibreWolf refused to use my old “new” profile and it required some manual intervention. To me this was catastrophic to temporarily “lose” my profile and it was ~15 minutes of panic googling to fix the issue. I’m a dev, so I can’t imagine how non-technical users managed.
  2. I’m on arch now and use AUR for third party packages. Unlike firefox, which is a first class citizen and lives in a more “trusted” repository, LibreWolf is managed by a single volunteer. Some malicious AUR user has been spamming packages with incorrect “out-of-date” flags that the maintainer wasn’t clearing promptly. The end user would see these warnings every time when running any installs/updates and this was going on for roughly a month, but I see that he was stopped now.
  3. The AUR maintainer also didn’t specify the correct version of ffmpeg (firefox-based browsers only run on v4.4 and can’t work with any other versions) as a dependency. One day, when I switched from VLC to mpv, most of my browser videos started failing with dubious errors. I’m a bit of a home assistant, IoT enthusiast so this was another catastrophe for me that I had to dedicated over an hour to solve. To be fair this ffmpeg4.4 dependency fuck up affected all the other volunteer-run AUR forks like zen and mullvad. I went on a personal crusade to get all the other maintainers to fix their shit too now.

I have since switched to Brave based on PG’s recommendation and its been working great for me. I do believe that PG could be much better at prompting their more technical users on how to deshitify Brave with “organizational override config” to remove all the AI/web3/other crap from Brave, but that’s a completely separate story.

It only takes five minutes to do all the adjustments, so there’s no need.

Why not? It’s something interesting to work on, and it might benefit some people down the line. Maybe LibreWolf will turn into something worth using, but that depends on how much resistance I face with my planned changes.

That’s not true. Local organizational policies do more than just check checkboxes which is what the PG guide suggests. They actually remove the enshitified parts from the Brave UI which leaves a vastly cleaner browser experience. In particular I removed: AI Chat, News, Rewards, Speedreader, VPN, Wallet so there’s no reference to them in my Brave anywhere.
I’m not going to talk about my Brave configs or anything like that further here to not derail this thread further.