It does not mean making Firefox into the Tor Browser.
It's a great way to make the efforts of both teams available to both groups of users. I'm very glad this effort is happening!
It does not mean making Firefox into the Tor Browser.
It's a great way to make the efforts of both teams available to both groups of users. I'm very glad this effort is happening!
"Un-fork" in this context means "upstream", or get the patches that Tor browser uses into mainstream Firefox.
The developers of Tor Browser will still always need to check that Firefox isn't doing anything improper and that privacy is maintained – but upstreaming the patches will make it a lot easier.
"Mozilla leadership has already decided to help Tor move toward being able to build off a Release Firefox rather than an ESR--it's safer for our users. I don't know if we'll get to the point where they can just ship a re-packaged bundle with some pref flips and add-ons, but the more of their patches we incorporate into mozilla-central the easier it will be for them to apply their remaining patches each release." (https://bugzilla.mozilla.org/show_bug.cgi?id=1173199#c16)
Firefox in particular has been evolving quickly, with many of under-the-hood improvements that may not fix "high-risk" security issues, but constantly improve security directly or indirectly (e10s?). You can't expect maintainers of an ESR to backport all those things.
There's always a risk in adopting the latest version of a program, but there's also a risk with keeping the old, less actively maintained version. I get burned all the time with Debian Stable, running into bugs fixed in the latest version but not backported. (nonetheless, I do prefer Debian Stable to most other solutions)
A project I'm involved in even has an automatic "toxic code" warning for PRs on known functions/classes that need to be refactored, and where monkey-patching will likely cause other security issues one way or another.
I wonder if this will create a load on exit nodes as the new users are unlikely to bring proportional exit nodes?
If your browser counted how much resources you've consumed in browsing and asked you to retroactively & optionally "pay your bill," could this generate the cash to keep the service running?
I bet it would increase donations to useful projects like these.
I've been guilted into donating by some of these, but if it's too annoying it can have the opposite effect and cause you to drop the software.
One that comes to mind is a download site that tracked your download count and put a rainbow-colored '(maybe you should donate)' link next to it. Not very detrimental to the UX, but gets the message across.