LibreWolf (Firefox-Based Browser)

[any1]

@lone-cloud

I believe its irresponsible to recommend LibreWolf to anyone because their team is no longer able to keep up with the maintenance of the project after loosing their main maintainer as suggested last year.

This is further evident by the fact that the latest 145 release only came out when it did thanks to a member of this community who’s not even a LibreWolf user: #104 - Fix failing patches for version 145 - librewolf/source - Codeberg.org

I am already testing the patches against the release candidate for 146, so the next release should be much faster.

[SYST3M_D3STR0YER]

@any1

If you just slap the Mullvad config onto the latest release you will not be a part of the crowd.

1. Well then, can you just name a few concrete fingerprinting-relevant values which distinguish a user with that theoretical setup (lastest [ESR/Non-ESR] version of FireFox, configured with MullvadBrowser’s configs before the first startup of FireFox, installed uBlock Origin and configured with the exact same way MullvadBrowser does, don’t logged-in anywhere, don’t changed any setting, used with MullvadVPN and don’t installed any extension more than uBlock Origin) to a MullvadBrowser+MullvadVPN user?

2. If that is true and you can’t compare MullvadBrowser with LibreWolf (which might be the case!), then my main argument still persists:

   @SYST3M_D3STR0YER

   Why don’t use OpenBSD with Whonix every single day? “But then surfing is slow and I can’t visit several websites and“ - “Convenience shouldn’t be a factor.”

   In every way, you are making Privacy/Security/Convenience trade-offs, so the only question should be:

   Outweighs the additional convenience, privacy and freedom features/patches of LibreWolf compared to FireFox & ArkenFox the security fix delay of LibreWolf?

   So, here‘s what I think:

   You just can‘t say objectively if some convenience features outweighs security disadvantages, so the User should choose. That’s why I think we should mention LibreWolf.

And also, none of the 13 in FF non-achievable advantages of LibreWolf has been yet refuted (except maybe one that Cyber-Typhoon mentioned).

[any1]

@SYST3M_D3STR0YER

Well then, can you just name a few concrete fingerprinting-relevant values which distinguish a user with that theoretical setup (lastest [ESR/Non-ESR] version of FireFox, configured with MullvadBrowser’s configs before the first startup of FireFox, installed uBlock Origin and configured with the exact same way MullvadBrowser does, don’t logged-in anywhere, don’t changed any setting, used with MullvadVPN and don’t installed any extension more than uBlock Origin) to a MullvadBrowser+MullvadVPN user?

Are you even aware of what you’re asking? You are asking whether there is a change in fingerprinting that, by the end of the lifecycle, represents almost a year’s worth of changes, not including Tor/Mullvad rebases that are missing compared to regular Firefox releases.

If you’re so convinced, then go ahead and make your frankenbrowser and compare it to Mullvad Browser with TZP.

[lone-cloud]

I don’t understand your intentions. I see that you just signed up to codeberg and you’ve stated that you don’t even use LibreWolf, but you decided that you want to be its batman anyways and start working on new release? Why?

Anyways, I used to use LibreWolf for roughly a year before I found this community. I wanted to share why I’m never going back again. To me it’s a lack of community and past dev fuck ups that completely eroded my trust in the project.

1. Maybe half a year ago LibreWolf rolled out a new release then rolled it back after about a day. Everyone that updated to the new release had their profiles updated for the new version. After that new release got rolled back, LibreWolf refused to use my old “new” profile and it required some manual intervention. To me this was catastrophic to temporarily “lose” my profile and it was ~15 minutes of panic googling to fix the issue. I’m a dev, so I can’t imagine how non-technical users managed.
2. I’m on arch now and use AUR for third party packages. Unlike firefox, which is a first class citizen and lives in a more “trusted” repository, LibreWolf is managed by a single volunteer. Some malicious AUR user has been spamming packages with incorrect “out-of-date” flags that the maintainer wasn’t clearing promptly. The end user would see these warnings every time when running any installs/updates and this was going on for roughly a month, but I see that he was stopped now.
3. The AUR maintainer also didn’t specify the correct version of ffmpeg (firefox-based browsers only run on v4.4 and can’t work with any other versions) as a dependency. One day, when I switched from VLC to mpv, most of my browser videos started failing with dubious errors. I’m a bit of a home assistant, IoT enthusiast so this was another catastrophe for me that I had to dedicated over an hour to solve. To be fair this ffmpeg4.4 dependency fuck up affected all the other volunteer-run AUR forks like zen and mullvad. I went on a personal crusade to get all the other maintainers to fix their shit too now.

I have since switched to Brave based on PG’s recommendation and its been working great for me. I do believe that PG could be much better at prompting their more technical users on how to deshitify Brave with “organizational override config” to remove all the AI/web3/other crap from Brave, but that’s a completely separate story.

[Blackbird]

It only takes five minutes to do all the adjustments, so there’s no need.

[any1]

@lone-cloud

I don’t understand your intentions. I see that you just signed up to codeberg and you’ve stated that you don’t even use LibreWolf, but you decided that you want to be its batman anyways and start working on new release? Why?

Why not? It’s something interesting to work on, and it might benefit some people down the line. Maybe LibreWolf will turn into something worth using, but that depends on how much resistance I face with my planned changes.

[lone-cloud]

That’s not true. Local organizational policies do more than just check checkboxes which is what the PG guide suggests. They actually remove the enshitified parts from the Brave UI which leaves a vastly cleaner browser experience. In particular I removed: AI Chat, News, Rewards, Speedreader, VPN, Wallet so there’s no reference to them in my Brave anywhere.
I’m not going to talk about my Brave configs or anything like that further here to not derail this thread further.

[Hank]

@SYST3M_D3STR0YER

Actually, since it‘s a feature also available in FireFox, Mozilla. Additionally, @starkle has responded to this at the beginning of this discussion very good:

Actually, JXL only available in the Firefox Nightly. In LibreWolf, this is the default and it is enabled.

@SYST3M_D3STR0YER

The TOR uplift project ports TOR privacy patches to Firefox. Well, you could argue that there‘s a delay, but often, there‘s also a delay for the TOR browser to port firefox‘ new privacy features to the TOR browser - for example, Letterboxing was almost half a year available in firefox before it was available in the TOR browser, so this argument from you isn‘t valid.​

So what? Are all the Tor patches now fully added to Firefox?

You could just use the lastest version of FireFox (so no security fix delay ➞ in that terms better than MullvadBrowser), configure it with MullvadBrowser’s configs before the first startup of FireFox, install uBlock Origin and configure it the exact same way MullvadBrowser does, don’t log in anywhere, don’t change any setting, use it with MullvadVPN and don’t install any extension more than uBlock Origin and you would look in the web exactly like any other MullvadBrowser user, wouldn’t you?

Did you even try to test this nonsense yourself? Even the link to your config is already outdated. When using this config, or an updated one, in Firefox, some fingerprints are not hidden, but that’s for later. First, you’ll need to edit this config because Firefox doesn’t know which fonts to use and everything appears as squares. So, Firefox most likely doesn’t have all the Tor patches, right?

I think you need to start personally testing things and showing the results. Right now it looks like you’re not even sure of your own words. Personally, I haven’t seen a single reason to mention it in recommendations, except for far-fetched personal preferences.

[win11.shading291]

@any1

I am already testing the patches against the release candidate for 146, so the next release should be much faster.

Thanks for that!

@Hank

Personally, I haven’t seen a single reason to mention it in recommendations, except for far-fetched personal preferences.

You clearly haven’t read the thread then.

[SYST3M_D3STR0YER]

@lone-cloud

Maybe half a year ago LibreWolf rolled out a new release then rolled it back after about a day. Everyone that updated to the new release had their profiles updated for the new version. After that new release got rolled back, LibreWolf refused to use my old “new” profile and it required some manual intervention. To me this was catastrophic to temporarily “lose” my profile and it was ~15 minutes of panic googling to fix the issue. I’m a dev, so I can’t imagine how non-technical users managed.

Non-technical people don‘t use Arch

I am pretty sure that that was a problem only with Arch/AUR since I didn‘t had that problem and I‘m using LibreWolf over half an year. I use the AppImage

@lone-cloud

LibreWolf is managed by a single volunteer

You should problably take a look here

@Hank

Actually, JXL only available in the Firefox Nightly. In LibreWolf, this is the default and it is enabled.

So FireFox Nightly is not FireFox? And FireFox ESR is probably also not FireFox, right?

@Hank

So what? Are all the Tor patches now fully added to Firefox?

Didn‘t said that. I just wanted to point out that the way isn‘t always TOR-Project adds a Feature - Mozilla ports it into ForeFox, but also often Mozilla adds a privacy feature - TOR-Project ports it into the TOR-Browser, so arguing just one way around doesn‘t makes sense.

[lone-cloud]

I am pretty sure that that was a problem only with Arch/AUR since I didn‘t had that problem and I‘m using LibreWolf over half an year. I use the AppImage

My mistake. The catastrophic LibreWolf dev mess up I was referring to actually happened exactly a year ago with the 132< -– >133 upgrades. I was on Windows then and it affected all platforms. Read more about it here if you want: Reddit - The heart of the internet

[any1]

@SYST3M_D3STR0YER

And also, none of the 13 in FF non-achievable advantages of LibreWolf has been yet refuted (except maybe one that Cyber-Typhoon mentioned).

Here is a reason to avoid using it: a patch added nine months ago turned the remote settings into a whitelist. Not much was added to this whitelist.

Take a look at my PR and see what is missing that is actively making LibreWolf have worse security compared to just using Firefox. You are actively missing protections against add-ons that are insecure or malicious, and this is just one of the missing remotes.

This is just from quickly looking at what is being blocked, there probably are more that need to be added.

[SYST3M_D3STR0YER]

@any1

You are actively missing protections against add-ons that are insecure or malicious

I don‘t think this particular argument is valid since LibreWolf encourages strongly against installing more AddOns.

@lone-cloud

My mistake. The catastrophic LibreWolf dev mess up I was referring to actually happened exactly a year ago with the 132< -– >133 upgrades. I was on Windows then and it affected all platforms. Read more about it here if you want: Reddit - The heart of the internet

I also don‘t think this argument is valid. Time to time, there‘s always big mess ups in browsers. (FireFox also had those things (example) and it is still recommended.)

[any1]

@SYST3M_D3STR0YER

I don‘t think this particular argument is valid since LibreWolf encourages strongly against installing more AddOns.

Just because they don’t recommend installing more add-ons doesn’t mean that users will listen, and does not justify not having these protections.

What about these that are missing?

• main/hijack-blocklists — Supplies remote blocklists used to detect and block known malicious or hijacking domains and protect against address/URL hijacking.
• main/addons-data-leak-blocker-domains — Remote list of domains where extensions are prevented from accessing or exfiltrating data to stop known data-leak destinations.
• blocklists/gfx — Remote blocklist of graphics/driver-related entries used to disable or alter graphics features for problematic GPUs/drivers to improve stability.

[GorujoCY]

Not mentioning a password manager and/or alias manager like qwacky

[win11.shading291]

You can always find stuff on ALL browsers that happened that weren’t optimal. You can basically nitpick on anything.

For example, when I initially read this reddit post on Brave, I was shocked Brave was recommended.

When you dig a little, you can dismiss most of those as honest mistakes, or not that big of a deal.

Brave is recommended. Librewolf is not.

It still doesn’t make sense to me.