Waterfox and Web Browsers

Greetings, lains. I installed Waterfox amidst Firefox's extension and legacy addons glitch as seen earlier >https://techcrunch.com/2019/05/03/a-glitch-is-breaking-all-firefox-extensions/ Wanting older addons and downthemall anyway, I installed Waterfox. I must say, I am very pleased. No telemetry at all, and old addons still work fine. The Waterfox project is open source. What are your opinions? How many of you use this browser and like it?

I use it for my general web searches and things I don't need to be signed in for and find it very comfy to use.

According to Spyware Watchdog, Waterfox might not be as good as some think: https://spyware.neocities.org/articles/browsers.html IceCat is another derivative of Firefox that focuses on protecting user's data, but most add-ons won't work with the browser, and some sites won't work properly either, because of the massive amount of blocked content. Still, it may be the best option if you want to protect your data. It seems that Pale Moon (another fork of Firefox) can be configured to disable all the telemetry in it: https://spyware.neocities.org/guides/palemoon.html . I don't know if you can use most add-ons in this browser, though... Probably not, because it is a fork of an old version of Firefox. I was using Brave for a while until I realized it was too good to be true, and I'm installing Ungoogled-Chromium right now. I hope I can configure it properly. I also use IceCat from time to time, but there is this Midnight Lizard add-on that keeps me using other browsers, especially when I browse during the night.

>>17029 there's no point in using it when icecat exists

>>17029 Have used waterfox a while ago for browsing on windows machines, there was a reason to, firefox only provided 32 bit builds back then it felt like 120% faster than regular firefox, using it presently is like kicking dead whales down the beach because it runs same speed and has the ugliest UI firefucks ever had (australis) and has more telemetry than regular firefox as >>17038 notes, besides it did not ever had a purpouse outside of x64 windows. >>17038 You can not use most addons on palemoon mostly because mozilla likes to mess up their extensions every few years instead of setting a standard like what UXP tries to. Even if that is the situation palemoon does have most of what I need on extensions on https://addons.palemoon.org/extensions/ and https://wiki.hyperbola.info/doku.php?id=en:project:iceweasel-uxp_addons or using the old ones https://github.com/JustOff/ca-archive

>>17039 there is no point in using g*uzilla when firefox exists

>>17038 What has browser choice got to do with protecting your data? Use privoxy to protect your data and use whichever browser is better at being a browser.

>>17042 Does privoxy seamlessly handle TLS connections these days? Last time I used it (a few years ago) it could only properly filter unencrypted connections.

What's really the use of installing a browser that changed the logo and had the code base update few weeks back. At least Palemoon forked or info a completely different engine and browser.

>>17048 >Does privoxy seamlessly handle TLS connections these days? Last time I used it (a few years ago) it could only properly filter unencrypted connections. It can figure out the host filterer that. I don't think it can filter anything else like the full URL or HTML contents because it's encrypted. To do that I guess you need to mitm yourself with a self signed cert.

>>17039 Icecat's configuration fuarrrks up half of the websites out there waterfox is just firefox ESR with less bullsoykaf, you just install ublock, umatrix, any agent spoofer and cookie deleter of your choice and you're ready to browse >>17038 that website is a pile of soykaf, man.

>>17038 why not just use the mitigation guide from that same website

are any of these firefox forks using quantum yet? i'm basically looking for the firefox equivalent of what iridium is to chromium: basically the same as the mainline version but customized for privacy. it seems like most people prefer ESR but i actually really like the performance and feature improvements of quantum, and all of the addons i use are supported. right now i'm just using firefox with as much telemetry disabled as i can manage (plus the sync service thing, mozilla account, pocket, etc.).

>>17119 you can turn that off yourself (as you did, based on your post) so what's the point of a privacy-focused quantum fork?

>>17029 IceCat made easy (since you are all a bunch of noobs) IceCat install: A lot of noobs seem to not have noticed that the gnu project doesn't distribute binaries for windows and macos only. Go to their page and download "icecat-60.3.0.en-US.gnulinux-x86_64.tar.bz2". It just werks. You can also use guix, which is a truly extraordinary package manager. For more info check the GuixSD thread. Having a good experience: Disable all pre installed add-ons and set privacy.resisFingerprint on about:config to false. That will leave you with pretty much vanilla firefox minus telemetry. On the gnu page of icecat there is a link to the patch used to generate it from firefox, you can see there what else is changed, if anything.

>>17119 Quantum is simply anything above 60.0. ESR has been quantum for a while. Perhaps you can just apply GNU IceCat patchs to the last version.

>>17131 calling someone a noob but not giving any profound tips lol...

I was using Iridium, but I couldn't get a cookie auto deleter to work, CPU usage was high, and it uses its own useragent (Iridium) which is a bit conspicuous so I've moved to Firefox and followed spyware watchdog's mitigation guide: https://spyware.neocities.org/guides/firefox.html

On all my 32bit boxes I use Icecat. On all my PPC boxes I use Spiderweb. https://github.com/wicknix/SpiderWeb/wiki/Download On my phone I use Firefox. I really really really wish Midori would become stable. It has so much potential.

i've been using palemoon build with custom branding and mozconfig for a while now. it's slow compared to the mainline firefox and hunting for working extensions is a bit of a problem. i didn't hit any problems myself since i've been doing this thing where i've moved everything away from my browser as much as possible to my terminal. it's usable but i don't see many people using it compared to the mainline firefox.

if your browser leaks your ip address, the rest of its "privacy" features are of limited value

>>17038 >using Brave for a while until I realized it was too good to be true Shit I was temporally using Brave while FF was bust... Reddit users shi11ed me that one... whats the bad news on Brave?

I've had no telemetry with Safari for years. Waterfox is slowwwww.

>>17766 I sincerely can't tell if this is a troll post or not.

>>17778 it's no worse than the neocities site that thinks checking for available updates is spyware

>>17778 I think they mean it leaks your real IP while you're behind vpn/tor, not that it leaks your IP when you just directly connect somewhere.

>>17787 Having personally referenced that site multiple times when setting up PCs recently, the stance isn't that checking for updates is spyware, it's that connections which aren't explicitly initiated by the user constitute a spyware vector. Important distinction. Firefox makes a ridiculous number of somewhat arbitrary connections in its default configuration. For the average user opt-in autoupdate is probably the best bet for both security and modern features (despite the anti-user practices of most/all browser vendors) but they don't need to ping Mozilla servers every time they open or close a tab.

>>17029 If you like it and it works good for you, that really is all there is to it. >>17040 Ah, small lament. XUL extensions are more powerful than Web Extensions. I am not sure what the motivation behind Web Extensions were that led Mozilla to kill XPCOM/XUL. Probably the security model if I had to take a guess). That being said, it is possible to implement Web Extensions on top of XPCOM/XUL. There was this wrapper/shim for brining Web Extensions to XPCOM/XUL floating around. It was pretty terrible but it worked (with a very small number of extensions) until multiprocess (e10) was adopted (in Firefox). For what it is worth, Web Extensions made the maintence overhead for developing browser add-ons much lower. I do not think many developers like the idea of writing an extension for a specific browser these days. I am not really an add-on heavy person. When I used add-ons, I had GreaseMonkey to run my UserScripts (which mainly sent stuff to a URI handlers), NoScript, and uBlock for the security thing. Things like DownLoadThemAll I found were much better handled by using a dedicated application. What sort of add-ons do you use? >>17050 >At least Palemoon forked or info a completely different engine and browser This is both a strength and a weakness. Waterfox maintains a patchset applied against the trunk of Mozilla Firefox. The developer is at Mozilla's mercy because of this. Especially since it is a single developer, there is a limit to how much Waterfox can diverge. For example a lot of features in Firefox can be enabled and disabled by build flags. However, when Mozilla ends up wanting to fully kill something simply because it is incompatible with a future change they want to make, it is going to be a lot of work for him to re-incorperate it. A specific example comes to mind is Firefox once had a build flag to use QT instead of GTK2/3. (It still might, have not looked but last I tried it, it did not build and I found a post on bugzilla saying it was broken.) Pale Moon is a hard fork (the term fork has really changed since GitHub came around, sigh) that does not really care about what Mozilla is doing. Mozilla's codebase is not considered upstream/mainline. (Except for the components like NSS and friends.) Pale Moon does what it wants and does not care if it means features implemented by Mozilla cannot be brought back down. Last I looked Pale Moon does not have a dependency on Rust so that means the portion of Firefox which was rewritten to use Rust is nonexistent. The lead developer (wolfbeast) decided against incorperating the new cache backend that Mozilla created. >>17794 Mostly everything an average person does revolves around their web browser. Mozilla has/had a security team you could register yourself with in the BugZilla after some clearence. I recall in some issue that a security vulnerability was found in the wild being activilty exploited. They were able to drastically reduce impacted users thanks to auto-updating. (IIRC the vulnerability targeted Russian sites). From the neocities site under Waterfox I noticed it complains about: Waterfox version Operating system Language settings Installed Waterfox Add-ons The UserAgent of most browsers give the browser version and operating system. Why this is needed is because rather than detect for feature support they just hardcode what is supported in what browser version. Pale Moon has/had a Firefox compatibility mode which essentially lies about the UserAgent all because big name sites break since they do not do feature detection but use a hardcoded list. Quite a few servers log UserAgents like NGINX (access.log). Language settings, can be accessed freely using JavaScript or the HTTP header field "Accept-Language". This is also frequently logged by analytic tools and sites themselves. Mainly to see demographics related to what should have priority, etc. Quite unfair to call it spyware when most sites already log three of the four things. I am pretty certain a few about:config changes can disable reporting installed add-ons. I am not sure if it uses that information to figure out which add-ons need updating but if it does then the majority of users would probably want that. >it's that connections which aren't explicitly initiated by the user constitute a spyware vector Where do you draw the line? When I access a site there are generally a few CDNs which my browser will implicitly connect to do get JavaScript libraries. Sure you could call it a side effect of a user initiated request but then just extend that to using your browser. Ultimately I guess it comes down to whether you consider telemetry spyware. I do not.

Considering Pale Moon can't keep their own soykaf secure, why would you trust them to keep you safe? https://www.zdnet.com/article/pale-moon-says-hackers-added-malware-to-older-browser-versions

>>17794 I truly believe all software would be a lot more secure with at least two update channels. One is security only. It's either opt-out or mandatory. Mandatory would be fine. Ideally there would be some legal regulations in place stipulating that under threat of death there would not be anything allowed over this channel except essential vulnerability patches--software companies are not allowed to hide any other soykaf in there. The other channel would be so they can install Pocket or that damn Mr Robot plugin. Or I dunno, fuarrrking Bonzi Buddy. Almost all Windows updates. A 3d/AR/VR/machine learning version of Microsoft Paint for some reason. What would the users do without a version of MS Paint plus buzzwords? Ideally this channel would be opt-in, but I understand most tech companies today would make it opt-out with an extremely dark pattern to get to that option. All this stuff is why we get a persistent cultural movement of monkey-wrenching the registry and disabling all updates. If they kept it separate from extremely important security patches, we'd be good. Mixing in feature creep crock in with zero day fixes and obfuscating the hell out of updates with names like KB238934843 that you have to look up on MS's website where it's even further obfuscated as to what the damn thing does is just asking for it. It's their own fuarrrking fault, not stupid users' fault. They only offer security patches that promote herd immunity through the same turd-pipe they use to hose us all with adware and absolute garbage features that ruin our OS/browser/whatever. There has to be two channels, and marketers who try to slide their filthy engagement-maximizing cock inside when the user isn't looking should have a rather heavy book thrown directly at their head.

>>17029 Waterfox is spyware. https://spyware.neocities.org/articles/waterfox.html

>>18043 It turns out the dates actually were forged, and the hack took place way more recently

>>18089 oh wow. where can I read more? other lain's zdnet link seems to imply that wasn't the case because of backups, did they find further pwnage?

>>18094 https://forum.palemoon.org/viewtopic.php?t=22553&p=170903#p170903

Something annoying i noticed : It writes quite large backup files frequently. I don't think it has any smart approach to it either. Even if the system is static you can see 200+mb writes. Poor ssd is getting fried doing nothing.