Your concerns are valid but from the article:
> Firefox security patches are applied to prevent vulnerabilities
You are right about the reputation of the maintainers of LW though. The second this becomes abandonware I will ditch it.
> Firefox security patches are applied to prevent vulnerabilities
You are right about the reputation of the maintainers of LW though. The second this becomes abandonware I will ditch it.
Sure, but at what rate? If Mozilla releases a critical patch today, and the core maintainer responsible for build maintenance is away on vacation for two weeks, what happens?
Timely maintenance is also problematic with hobby closed-source projects or hobby apps on closed platforms, like iOS and Android.
Mozilla gets paid $500m a year by Google so that Google can be default search engine on Firefox. They have the money that keeps them "incentivized" although they are FOSS and nonprofit. Or in another words Gitlab and Github FOSS devs do not have salaries like Mozilla people do, the only thing they get is an occasional donation.
It's great when a fork ensures that it is always taking security patches from upstream. But what about the code unique to the fork? Is that new code following the same security practices as the upstream project? Are enough eyeballs poking at it to get it the same security scrutiny as upstream?