Waterfox browser
en.wikipedia.org
en.wikipedia.org
The official response by Mozilla has always been to avoid ALL forks and ALL old versions like the plaque. I know why Mozilla wants to suppress them, but the community shouldn't. Waterfox is basically the result of the decision by Mozilla to abandon a part of their most loyal userbase.
In theory a diverse set of browsers actually increases security due to the lack of attack surfaces with which you can target a wide audience.
Because basically all attacks that you have to fear from normal browsing as an average user are actually non-targeted attacks, and those attacks usually focus on a large user-base, in order to be financially viable. Also a script-blocker is probably the only thing needed to reduce attack surface to basically zero for non-targeted attacks.
The security argument is actually the only case one can make against Waterfox. While it is partially valid, there are many other reasons why people use a browser, which is exactly why Waterfox has so many users. Not everyone wants to focus on high level and mostly theoretical security.
By the way, the founder of Waterfox has published an alpha-version based on Firefox 86 ESR.
> GNU IceCat is the GNU version of the Firefox browser. Its main advantage is an ethical one: it is entirely free software. While the Firefox source code from the Mozilla project is free software, they distribute and recommend non-free software as plug-ins and addons.
EDIT: removed a clause about the relationship with IceWeasel, thanks for the historical context @quadrangle and @war1025
Nope. IceWeasel was a Debian rebranding of Firefox which has been discontinued. GNU IceCat was always GNU IceCat and was not formerly IceWeasel.
(I still upvoted your mention of IceCat here)
This is intellectually dishonest and the root of the reductive thinking that a target is too small to matter so why should the target invest in security.
Also I think my claim that browser diversity actually increases security of the bigger system as a whole is correct, because I did mention it is only valid for non-targeted attacks.
There would be no financially viable way I can think of of targeting waterfox users with code on a website, because there are basically no waterfox users. Even if you manage to include some malware code somewhere on the most used websites, you will probably not get more than a handful of waterfox users to compromise their system.
> there are basically no waterfox users
2. from the perspective of the entire web (Waterfox has only around 200-300k daily users, which isn't a lot in this context)
Of course the old type of addons may break from time to time as the browser's internals change but that was always a problem with the old addon system.
The advantage of Waterfox is more freedom to use extensions that increase privacy and security. And sure, also extensions that totally pwn you. But that's just how it is, when you have autonomy.
I'm not arguing, however, that the Waterfox approach is best. Tor browser adds lots of great stuff to increase privacy and security, and they stay ~up to date with Firefox releases.
If you're retaining code that has since been ripped out upstream, that means that there are no security fixes for you to uptake, but you still contain the same potential for security issues. This isn't an idle concern--the NSA used an exploit in code that was ripped out of Firefox to attack the Tor Browser, which was (at the time) stuck on an older version that retained code generally known to be much more poorly secured (E4X, specifically).
Security is also orthogonal to privacy concerns. For privacy, what matters most is how similar or dissimilar you are to the normal crowd. Using an unorthodox web browser that is observably different from the mainstream browsers is going to reduce your privacy more than any actual benefit you get from extra features.
I still miss some old extensions, though. Especially RefControl, which let me supply a site's root as referer to it. Smart Referer just drops referer, with some whitelist exceptions where sites break. RefControl never broke sites.
Tab mix plus is basically now a light extension that just points you to about:config setting that are more then enough for me. The most important setting for me is to open all popups in tabs.
Also Mozilla has deprecated that old APIs for security purposes! Maintaining it with a small team of volunteers or some little donations is not gonna cut it. I am not "Anti" everything its just that I do not see the point of this AT ALL.
// Ok its not even a team its a one man project, makes it even worse. And isn't ESR now also build on a version without the old APIs? If not already that day will come and especially then the using it will be a big security risk.
The vim extensions for firefox don't really work for me - I've not been able to navigate in pdfs and firefox own dialogs at all and the worst thing is that switching to a tab like that and you're stuck.
Even having 1 pdf open next to a couple of html tabs breaks the flow as soon as you change to the pdf tab you're stuck, no more gt or gT for you.
Your comment gave me hope and I tried tridactyl, but they still have the same issues. Sidenote: they actually have a hack in place that works around that problem when you spawn a new tab - it just loads a website so that the extension at least works.
AFAIK this is because of Mozillas design so there is no way this can be fixed by an extension, it has to be a fork. Or do you have a workaround for those problems?
I am big fan of mozilla's mdn but they broke my setup with the firefox api changes and the second time (with the expired extension cert) I was glad I had an alternative.
Take care, Martin
How about https://addons.mozilla.org/en-US/firefox/addon/panorama-tab-... ?
> No Telemetry Waterfox does not collect ANY telemetry, meaning you don't have to worry about any tracking or usage information about what you do inside YOUR browser.
> Limited Data Collection The only thing that Waterfox sends back is your OS and browser version to check for updates.
https://www.waterfox.net/about/
> absolutely no data or telemetry is sent back to Mozilla or the Waterfox project.
I honestly think that can still be truthfully called "No data or telemetry."
> "You don't have to worry about any tracking or usage information about what you do inside YOUR browser"
That still holds up, if all it sends is info the browser already knows about itself.
Also, do we know whether Waterfox gets a custom OS report, or just uses the user agent string?