Privacy Guides
Add Librewolf #206
-
|
I recommend that we add Librewolf for people who don't want to spend time setting up Arkenfox, but not without caveats. Librewolf has some nice features over the Firefox + Arkenfox:
Caveats:
|
Beta Was this translation helpful? Give feedback.
Replies: 0 comments 49 replies
-
|
I'm not going to do more than correcting a few things, for obvious reasons I don't want to be part of this discussion.
only in some releases where that patch hasn't been removed yet. it will be removed very soon from all of them.
you mean CRL? I agree we should switch to that, we have an open issue for it so it should be coming soon. what do VPNs have to do with any of this tho? |
Beta Was this translation helpful? Give feedback.
-
see the relevant issue.
ocsp vs crl, and according to mozilla crl is also faster. one could ask why not use ocsp until we fix include in librewolf, and that's a fair point, but I'm hoping we are ready starting with the next release.
true. choco, brew, aur and other package managers are the best way to handle updates (eg. the mac .app does not auto-update)
we force
I verified with our win maintainer and nightly builds have been dropped, we only build on top of stable now.
except for the RFP one which is going to be dropped, the patches that differ do not impact functionality but mainly app naming and directory organization. |
Beta Was this translation helpful? Give feedback.
-
Ah that's a pitty. I replied on the thread. I don't think it should be removed :/ |
Beta Was this translation helpful? Give feedback.
-
without derailing this topic: the RFP override for prefers-color has already been debated to death in private and in arkenfox/user.js#1218 (second post and after). It's not even a universal solution (prefers-color) and undermining the principals of defeating FPing sets a terrible example. If you want continue the debate there This (the RFP patch being removed) is just one of the many steps that have me at the point of almost endorsing LW as an arkenfox love-child, and sticking a note on the AF readme that says |
Beta Was this translation helpful? Give feedback.
-
Do you not provide only en-US builds? |
Beta Was this translation helpful? Give feedback.
-
|
yes. if you try to add a language pack, LW shows a message saying that we force en-US and that there's a faq entry that explains why -> the faq entry explains that changing language pack would make some things not consistent, but that if really needed one can use overrides and download it anyway. |
Beta Was this translation helpful? Give feedback.
-
|
Was half way through requesting myself when I saw this! |
Beta Was this translation helpful? Give feedback.
-
Firefox's Safe Browsing implementation is quite nice, I recommend this technical overview. |
Beta Was this translation helpful? Give feedback.
-
|
under `Privacy The only part that is potentially privacy invasive is Arkenfox only disables the real-time binary part. I think it is a bad precedent to disable SB altogether. I hear the screams about de-googling, and all google is evil, and the rants online about stopping unsolicited connections - but not all connections are "evil". Updating local lists and allowing all but real-time binary checks is a good balance - AND, arkenfox warns users that this bit of security was disabled in both the wiki and in the user.js (twice) LW does ship with uBO (IDK what default filters), so there is that to consider. But one would think that google's reach and knowledge and webcrawling etc would be quicker to spot new threats and deploy updates. Lastly, there is a concern with censorship: not so much blatantly direct (I think that could cause an absolute stink), but there are many instances of the pirate bay and other sites being incorrectly flagged. This isn't a privacy concern, of course. So my only concern here is LW removes some 100%-non-privacy-threatening security by default: all the local list stuff - which I disagree with, regardless of uBO |
Beta Was this translation helpful? Give feedback.
-
|
Arkenfox taking this approach to Safe Browsing, where the static lists are still used is something that should be appreciated. |
Beta Was this translation helpful? Give feedback.
-
Pockets is literally closed source and awful for privacy, it's absolutely not a "convenience thing"
... because it's literally using a Google list, downloaded from Google servers.
Auto update pings Mozilla's server often. Nothing should ever auto update, and recommending people to enable it is just a bad idea.
WOW. I have no words. This is SO dumb. |
Beta Was this translation helpful? Give feedback.
-
If you were quoting me out of quote: fwiw I've recommended Librewolf to many people The
Didn't apply to Librewolf, but moreso some other insane forks such as Pale Moon. |
Beta Was this translation helpful? Give feedback.
-
|
thanks for clarifying that, appreciated! |
Beta Was this translation helpful? Give feedback.
-
|
going to nit this to death, sorry
There is already a UI that completely disables/enables SB - it's one checkbox, doesn't get any easier. The UI that LW built, remembering that LW was only concerned about censorship, was done to handle the changes of a dozen or more SB prefs, so connections to google would be blocked, and those connections are not privacy issues. This is pandering to the ignorant. Don't pander to the ignorant :) There is already a UI for extension updating: albeit slightly hidden away behind a cog - even more reason it should be enabled by default (like AF). Be smart, be like pants :) |
Beta Was this translation helpful? Give feedback.
-
yes currently SB is controlled with 7 prefs (iirc, just wanted to confirm it is more than default firefox as you said) in LW: 3 are for the actual features and other 4 are URLs for the updates, which are emptied to prevent connections to google servers (
that was the reason to add it. |
Beta Was this translation helpful? Give feedback.
-
you mean in the LW panel? no need to reply. We're saying it should be default enabled, and I'm saying only technical users who know what they're doing should disable them, and they can find that on their own. Anyway, I only tagged it in the last post since it dealt with the UI
You sure? I count 13 SB prefs in LW |
Beta Was this translation helpful? Give feedback.
-
This is privacyguides.
Number of security issues doesn't mean anything.
It wasn't when it released (it maybe is now), and even then, the server is still closed source. |
Beta Was this translation helpful? Give feedback.
-
|
@TheFrenchGhosty please stop spamming this discussion with nonsense, and let the grown-ups talk, or @dngray will have to put on his angry polar bear face and eat yours (your face, that is). We do not wish another out of control debacle like the Brave discussion |
Beta Was this translation helpful? Give feedback.
This comment was marked as spam.
This comment was marked as spam.
-
So what? It's just fetching update. The only threat in pinging a random server is if your client hands out private info or if the server knowing your IP is somehow a threat. For the second problem, just use a VPN or Tor. For the first problem, you are trusting the browser vendor anyways. If they were malicious, they can screw you up at any time, regardless of whether auto-update is a thing or not.
Same as above. |
Beta Was this translation helpful? Give feedback.
-
|
Unless you review the source code and compile everything yourself, you are trusting the vendor. The only difference manually hitting the update button or letting it automatically update makes is that you get security fixes way later. If you are worried about a malicious server and what not, then you should be looking at secure operating systems like Android, where package signing is enforced and the server is not a trusted party past the first app installation. This is not regarding extensions auto update specifically, but to show you that auto-updating doesn't always mean you are taking a risk with a malicious server. It all depends on the implementation. |
Beta Was this translation helpful? Give feedback.
-
|
I warned @TheFrenchGhosty I'm not interested in their agenda. If they continue to spam our GH project with rubbish like this privacyguides/privacyguides.org#253 (comment) privacyguides/privacyguides.org#258 (comment) privacyguides/privacyguides.org#259 (comment) privacyguides/privacyguides.org#294 (comment) privacyguides/privacyguides.org#369 (comment) I'm just going to have to remove them. Consider this your last warning. |
Beta Was this translation helpful? Give feedback.
-
|
Considering we recently added Brave as a good and safe option which lowers the entry barrier to privacy by requiring minimal setup, tweaking and configuration, maybe we should revisit this. |
Beta Was this translation helpful? Give feedback.
-
|
as this is at the top of discussions and I don't want old information to start circulating: OCSP is now enabled by default, so are extension auto-updates. |
Beta Was this translation helpful? Give feedback.
-
|
It's a one year old discussion. Librewolf is now evolved enough to be recommended in privacy guides. Also, I see Brave browser is recommended which is Chromium based.. |
Beta Was this translation helpful? Give feedback.
-
|
Librewolf is indeed evolved a lot to be added. It benchmarks as good as Brave. If brave which is out-of-the-box hardened chrome can be added, why not librewolf which is out-of-the-box hardened firefox. According to these benchmarking results brave and librewolf are almost equal. Non hardened firefox falls behind. https://privacytests.org/ |
Beta Was this translation helpful? Give feedback.
-
|
As of writing, a lot of time has passed. I personally advocate for Librewolf, though that doesn't have much weight to this discussion; I don't have the technical know-how to determine how good Librewolf is compared to our existing recommendations of browsers. I think we should spark technical conversation once again so to see if it is up to Privacy Guides' standards based on its current version. |
Beta Was this translation helpful? Give feedback.
-
|
At this point, we will not be recommending Librewolf. |
Beta Was this translation helpful? Give feedback.
-
|
FYI: arkenfox/user.js#1541 (comment) PS: thanks @jonaharagon for stating the obvious |
Beta Was this translation helpful? Give feedback.
https://discuss.privacyguides.org/t/librewolf-a-fork-of-firefox-focused-on-privacy-security-and-freedom/148
At this point, we will not be recommending Librewolf.