Proposal: Waterfox, IceCat, Pale Moon & Seamonkey / Firefox forks

[angela-d]

For those of us displeased with the direction Mozilla is headed, Waterfox and IceCat are suitable alternatives.
Are either or both of these browsers contenders for inclusion or mentions on Privacy Tools?

Pros of both:

• Firefox forks
• Telemetry removed
• Privacy tweaks pre-configured (in comparison to vanilla Firefox)
• Open source

Cons:

• Smaller userbase
• Less developers involved in both projects

Although Waterfox is currently just a "fork," it appears it's going to branch off & become a stand-alone project after the demise of ESR; from 56 release notes:

Waterfox will now remain at 56 for the time being, following the security releases of 59 ESR until it becomes End of Line (Q1 2019). In the meanwhile, a “new” browser will be developed to follow the ethos of Waterfox of customisation and choice, while staying up to do date with the rapidly evolving browser landscape.

It has been mentioned that compatibility with "legacy" extensions is also in work to be retained beyond ESR, as well.

Edit:
I forgot about Pale Moon, per @beerisgood's suggestion: https://www.palemoon.org/

Also worth mentioning: https://www.seamonkey-project.org/ - Though I'm not sure how intertwined Seamonkey is with Mozilla:

Under the hood, SeaMonkey uses much of the same Mozilla source code which powers such successful siblings as Firefox and Thunderbird. Legal backing is provided by the Mozilla Foundation.

Which is concerning, given Mozilla's recent activities; definitely not a company that should be handing out advice.

[davidtabernerom]

Hi, could you share what do you mean by "the direction Mozilla is headed"? Is there anything new we don't know?
Thank you.

[Atavic]

@davidtabernerom Shields project is meant to look at different user's settings and how they work on different sites. Here is the last one.

The only useful part was this one imho

[ghost]

what do you mean by "the direction Mozilla is headed"?

Mozilla managed to betray users' trust many times in a couple of months. https://github.com/mozilla/addons-frontend/issues/2785 https://www.theverge.com/2017/12/16/16784628/mozilla-mr-robot-arg-plugin-firefox-looking-glass @beardog108 might give you extra info.

Also, not a FF issue, but a Mozilla issue: https://www.youtube.com/watch?v=KPgyTzqDJhM. https://youtu.be/KPgyTzqDJhM?t=987 (16:28) talks about yet another betrayal of users' trust.

[beerisgood]

For Pale Moon, you should read this:
https://forum.palemoon.org/viewtopic.php?p=129767#p129767

And Pale Moon isnt just a fork like Waterfox, nor have telemetry included. So its currently the best alternative

[angela-d]

@davidtabernerom

• Installs an advertisement plugin to users participating in research studies, without their permission: https://sircmpwn.github.io/2017/12/16/Firefox-is-on-a-slippery-slope.html
• German users are chosen at random to participate in utilizing spyware on their browsers: https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-in-firefox/
• Aggressively tries to reset the default search to Google: https://www.reddit.com/r/firefox/comments/7hwr4o/startpage_firefoxs_latest_update_5701/ (which is nothing new..)
• Telemetry is opt-out, not opt-in: https://www.bleepingcomputer.com/news/software/mozilla-testing-new-default-opt-out-setting-for-firefox-telemetry-collection/
• Partnership with Google, their competitor; who is known for having an anti-privacy, money first approach: https://blog.mozilla.org/blog/2017/11/14/firefox-features-google-as-default-search-provider-in-the-u-s-canada-hong-kong-and-taiwan/
• Webextensions; which will kill "legacy" extensions and also make customization considerably more difficult: https://wiki.mozilla.org/WebExtensions
• Baking pocket into the browser & pre-enabling, instead of offering it as an extension: https://venturebeat.com/2015/06/09/mozilla-responds-to-firefox-user-backlash-over-pocket-integration/
• In-browser advertisements ("Snippets;" seen on both desktop and Android versions): https://arnowelzel.de/wp/en/disable-irl-podcast-in-firefox-for-android
• Dumbing down the browser with unneeded UI changes: http://techdows.com/2017/09/disable-new-preferences-ui-in-firefox-56.html

Edit:
How could I forget!

• Mozilla no longer manually reviews extensions, so AMO has turned into spam central: https://www.ghacks.net/2017/12/13/mozillas-extensions-store-has-a-spam-infestation/

How can this happen? Probably the main reason why you see an increase in spam extensions right now comes from the fact that extensions are not audited manually anymore before they are made available on AMO.

Pale Moon have a few integral extensions: https://addons.palemoon.org/extensions/privacy-and-security/
Here's hoping for Waterfox to follow suit: BrowserWorks/Waterfox#303

Considering that incredibly lucrative deal with Yahoo, a lot of Mozilla's recent actions reek of intense greed & abandonment of principles that made Firefox what it is in the first place.

With the recent changes to webextensions and the ui, (not to mention negation of user privacy with opt-out) they are emulating Chrome.

@beerisgood I updated my original post, had forgotten about Pale Moon. Though I don't think it's "better" than the other two. I think all 3 are suitable alternatives!

@Shifterovich supplied an excellent podcast detailing how much money Mozilla rakes in + some pretty shady happenings within the corporation/organization that aren't covered in any of the links above: https://hooktube.com/watch?v=qMALm1VthGY

[ghost]

Mozilla is Not Trustworthy

[ghost]

We should also make a section about Mozilla, similarly to the W10 section, as Mozilla is very often recommended to people seeking privacy and generally open-source freedom.

[angela-d]

@Shifterovich
Holy cow, there's so much more sheistyness going on with Mozilla than I ever knew!

Fixed your link: https://hooktube.com/watch?v=qMALm1VthGY

[ghost]

Thanks, didn't know about that.

[Hillside502]

Just be aware that HookTube sits behind Cloudflare, so there is a trade-off vis-a-vis YouTube.

[angela-d]

@Hillside502 - Valid point. Though without much competition for Youtube, I'd say Cloudlfare is the lesser of two evils.

Mozilla posted their "apology," does anyone take issue with the fact it came from their Chief Marketing Officer, instead of the CEO?
A grossly negligent violation of trust and they respond with PR speak from marketing.

Would it be controversial to remove Firefox from privacytools.io as a suggestion, entirely?

[beerisgood]

I agree with @z0m8i3

[PandaCodex]

Cyberfox is another alternative

[beerisgood]

@PandaCodex isnt it dead?

[Mikaela]

Possibly semi-offtopic, but do you have any feature comparsion table between those forks (and possibly Firefox itself)?

[angela-d]

@Mikaela Excellent suggestion. I submitted a PR https://github.com/privacytoolsIO/privacytools.io/pull/379 with a comparison chart (link beneath "Worth Mentioning" of the browser section)

[2E0PGS]

+1 for this. I avoid Mozilla after they said this: http://uk.businessinsider.com/mozilla-new-initiative-counter-fake-news-2017-8?r=US&IR=T

So now they want to filter what you see based on their political views or what they deem as true or false...

[Kcchouette]

You can add too:

• Tor Browser, a dependant-fork build in partnership with Mozilla.
  By removing the Tor-dependante feature (for eg https://superuser.com/questions/1117383/can-i-use-tor-browser-without-using-tor-network/1117660#1117660 ) you'll have a good hardening browser
• you have too project which override the user.js files of firefox, like https://github.com/ghacksuserjs/ghacks-user.js / https://github.com/intika/Librefox-Firefox / https://github.com/pyllyukko/user.js / ...

[ghost]

Perhaps recommending Tor Browser without Tor is better than recommending FF with some tweaks? You will look like Tor apart from your IP.

[beerisgood]

@Shifterovich depends. Tor Browser use Firefox esr. Some guys need modern stuff which only the normal version have (until esr go to new version)
Else: yes but it needs config too to use it without Tor network

[Atavic]

FF + user.js tweaks needs more time than setting Tor for non deepweb.

Intika's Librefox-Firefox includes ghacks.user.js in the available releases.

[beerisgood]

Librefox-Firefox

Can't recommend this. Firefox 63.0.3 is still used -> security problem!

Also guys which visit this site, care about privacy and have the few minutes to config the (gHacks) user.js tweaks

[quantumpacket]

@2E0PGS that's enough for me to ditch Firefox. When tech companies become political and censor information that doesn't fit their narrative is the day they are not in support of a free internet.

We really need to stop Firefox from being recommended and suggest forks that adhere to the original goals Mozilla seems to have forgotten.

[angela-d]

@quantumpacket

I wholly agree. Anytime this subject is brought up, someone counters it with, "The forks only have x developers and are volunteers; security patches are slow.. you can't beat the army of paid staff Mozilla has."

When a staff of size is working against their users, obscure security exploits are the least of anyone's worries. There's probably much worse going on inside that none of us are privy to.

Relying on community users to monitor and review such an enormous codebase is nonsense. The codebase is too large to analyze every line of code efficiently and Mozilla has become untrustworthy.

[Kcchouette]

I'll use your argument, @angela-d: "The forks only have x developers and are volunteers; security patches are slow.. you can't beat the army of paid staff Mozilla has."

• Pale Moon is for example based on (a really old version of) firefox and uses the fix developped for firefox (point 2 of https://forum.palemoon.org/viewtopic.php?p=129767#p129767 )
• Iceweasel is a other-brand version of Firefox
• same of Librefox
• Tor Browser is firefox for Tor

And remember that even Microsoft has switched to Google product chromium (and so add a more pressure to standardize all that Google want in term of web)

[beerisgood]

Tor browser is the only "fork" which have enough power to keep it secure.
Also remember even Mozilla implement some privacy feature in Firefox FROM Tor browser.

Also Firefox is (yet) the only solution. You can't config any other browser like you want and have good security & privacy

[mattatobin]

Well that was misleading.. Anyway, the burden of proof really is on you to support the old and insecure narrative. OH you can link to those bashing articles but that just makes you fake news.. Where is your first hand proof.

[ghost]

Well that was misleading..

I figured other huge portions of your browser are missing so why not that.. 🙃

Anyway, the burden of proof really is on you to support the old and insecure narrative.

OH you can link to those bashing articles but that just makes you fake news.. Where is your first hand proof.

I have done so in my comments. You have just been in denial and haven't provided anything to counter it.

I know you will just keep responding until the issue is closed, specifically jasperla/openbsd-wip#86 So I won't be responding after this unless there is something of value for me to respond to.

[mattatobin]

That's okay. Also, the public record is all the proof I need. Our work like the truth speaks for its self.

Also, you didn't need to cite the bsd issue because I already admitted that I handled that poorly. But you wouldn't know that since you don't seem to know much beyond what you are told. That is okay too.

I also directly said I wouldn't quit as long as you want to continue this.

[Ligge]

So that user was trying to form a brigade.

I was not trying to form a brigade. Instead, I was annoyed at what appeared to be yet another example of someone repeating the same old claims that I have seen being spouted for years, as a user of the browser, when the fact is that independent development - when done seriously, as Pale Moon (and Basilisk, along with other UXP applications) is - isn't actually a bad thing just because someone doesn't have the resources of Microsoft/Google/Mozilla etc.

My other intention with replying here as suggested, was in the hope of providing another viewpoint so that at least one person may come across what has been said and give them more information to make their own decision based on that (rather than only being exposed to the "old and insecure" narrative).

I certainly still believe that Pale Moon is highly focused on privacy and security, and thus it would still fit in with the point of this list in my opinion, but that decision is not mine to make and I won't try to argue for its inclusion if it isn't included.

As long as the further information provided in this issue helps at least one person who comes across it to make a more informed decision, then that's good enough for me.

[ghost]

I was not trying to form a brigade.

Complaining to your friends about misinformation that is not misinformation and expecting someone to do something about it is brigading.

Instead, I was annoyed at what appeared to be yet another example of someone repeating the same old claims that I have seen being spouted for years

Old claims, because they are old problems, being in denial isn't going to solve them. There's a very good chance the future will only make them worse.

as a user of the browser, when the fact is that independent development - when done seriously, as Pale Moon (and Basilisk, along with other UXP applications)

Just because you make some modifications to an old discarded Mozilla codebase doesn't make it yours.

Sure you may have made some additions, changes, improvements, but the large majority of code would go untouched and unused. Many parts won't be touched for many years if at all. Less eyeballs means less chance of a problem being discovered "merely because the code looked wrong -@mattatobin" won't be a thing. Just because something is working doesn't mean it is right.

isn't actually a bad thing just because someone doesn't have the resources of Microsoft/Google/Mozilla etc.

Well it is. As I have said previously, an application as large and complex as a web browser requires manpower to maintain.

A web browser deals with a lot of very sensitive user data. It is the primary focus for security researchers and black hats. To most people there is their "operating system" and their "web browser" which is the gateway to their entire online life.

You guys are deluding yourselves if you think 3 developers and a few contributors can somehow maintain all the components of a web browser. In addition to maintaining forks of old XUL extensions that have been abandoned by their own original authors.

To market yourself on privacy and security would be dishonest for a few reasons. Nearly all your time will go into maintaining XUL/XPCOM these are huge codebases in themselves abandoned by upstream.

Eventually Mozilla is going to deprecate more and more code which you depend on or still use. This will mean less security information from upstream will be useful to you.

Mozilla having the marketshare it does is the primary target of research (along with the other major browsers) at events like Pwn2Own. As nobody could care less about Palemoon it's unlikely to get any real auditing from outside parties (TorProject, Private netsec researchers, commercial cybersecurity firms etc). Essentially what you have is security through obscurity.

That being said if a specific Palemoon user was a target, browser fingerprinting would be a trivial thing to do. There are many ways to do it. It is very much a cat-and-mouse game between browser vendors and interests that would identify individual users (advertising companies, governments etc).

It's going to become more difficult to merge code from upstream when your codebases diverge. You can be in denial about it all you like but it isn't going to change that fact. You won't have the resources to develop replacement security technologies like those mentioned above (sandboxing), permission model etc. This is going to exacerbate any security issues existing in your browser.

Anything you do develop you won't have the resources to provide proper QA, integration, automation testing etc. I work in this industry and it often requires a team just to write new tests.

You have no presence on mobile platforms, and extension developers are going to be using WebExtensions in order to target both platforms and have code that can be used in Chrome.

There are new RFCs being released from the large vendors such as DANE verification and all the other things around TLS all the time. There's new W3C standards being drafted all the time.

Once Mozilla abandons Gecko for Servo (or something based off it) your browser is not going to be tested by web developers. This is because Firefox will no longer be using Gecko and thus won't have any similarity to your forked engine Goanna.

Even Microsoft with their vast resources decided to abandon EdgeHTML for Chromium this would have been because they did not want to maintain it all by themselves. EdgeHTML was by no means old (2014) before that they had Trident.

So in addition to fixing all the previous issues you'll also have to fix issues related to specific websites. When are you supposed to then make time to focus on things like performance (something that Gecko and XUL were never good at) and other general improvements?

You have a monumental amount of work ahead of you. Optimism will only get you so far, there will come a point when you have to be realistic.

Nobody here has explained why these things aren't something I should worry about if I used your product. All I've seen is denial and claims of misinformation.

My other intention with replying here as suggested, was in the hope of providing another viewpoint so that at least one person may come across what has been said and give them more information to make their own decision based on that (rather than only being exposed to the "old and insecure" narrative).

Personally if I was you, it wouldn't be a "view point" I would want to stand by as it damages your credibility.

As far as @mattatobin goes (a core member of the Palemoon team) in regard to "public record", that is exactly why I have invested the time I have in this issue. So it can be referenced whenever Palemoon ever comes up, whether that be here on github, Reddit, HN or anywhere else.

I certainly still believe that Pale Moon is highly focused on privacy and security, and thus it would still fit in with the point of this list in my opinion, but that decision is not mine to make and I won't try to argue for its inclusion if it isn't included.

Nope for the reasons above.

As long as the further information provided in this issue helps at least one person who comes across it to make a more informed decision, then that's good enough for me.

Hopefully that decision is not to use your product.

[mattatobin]

I have formed an opinion on if Pale Moon et all should be listed by privacytools.. I am against it because this organization gives bad advice like disabling the blocklist and supports the very mainstream companies they apparently want to fight against vs any alternative.

So yeah, I can secure an official statement from Moonchild if you want but you should just consider adding any Moonchild Productions or Binary Outcast products to your lists or w/e it is you do do when not giving terrible advice and making stuff up to justify your world view as a bad idea.

[ghost]

I have formed an opinion on if Pale Moon et all should be listed by privacytools..

Nobody cares for your opinion so yeah... It wasn't going to be listed anyway.

I am against it because this organization gives bad advice like disabling the blocklist

Well actually if you read what it says there:

extensions.blocklist.url = https://blocklists.settings.services.mozilla.com/v1/blocklist/3/%20/%20/

Limit the amount of identifiable information sent when requesting the Mozilla harmful extension blocklist.

Optionally, the blocklist can be disabled entirely by setting extensions.blocklist.enabled to false for increased privacy, but decreased security. Source

Notice the word optionally. Yeah. The first recommendation is simply to remove the parts of the blocklist URL string that might infringe on one's privacy ie %APP_ID%/%APP_VERSION%/%PRODUCT%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/%PING_COUNT%/%TOTAL_PING_COUNT%/%DAYS_SINCE_LAST_PING%/

and supports the very mainstream companies they apparently want to fight against vs any alternative.

Many open source projects of today wouldn't be a half as good as they are without commericial backing.

So yeah, I can secure an official statement from Moonchild if you want but you should just consider adding any Moonchild Productions or Binary Outcast products to your lists

Binary Outcasts you mean your organization of one person, you. Again with the trying to make yourself sound big. By the way it's very nice to know about how you like the Lorem ipsum dolor sit amet. I like it too.

As for Moonchild Productions's crew of 3 there is nothing there worth adding. So you won't have to worry about that.

So you're trying to dump us before we dump you? 🤣.

or w/e it is you do do when not giving terrible advice and making stuff up to justify your world view.

Where's your evidence. You've refuted nothing. You know what there is evidence of?

15:05:34 www.palemoon.org -- script https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js 3p
15:05:34 www.palemoon.org -- script https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js 3p
15:05:34 www.palemoon.org -- script https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js 3p

I guess that's just my "world view". aka uMatrix's logger.

[ghost]

I don't really have the time to read all this but assuming @mattatobin is a Pale Moon dev,

I have formed an opinion on if Pale Moon et all should be listed by privacytools.. I am against it

sounds like we shouldn't add Pale Moon. Not sure if I can see all the org members here https://github.com/orgs/MoonchildProductions/people but looking at the commit history, Pale Moon is too small to be added to PTIO imo.

This thread is very long so the Waterfork/IceCat discussion should be moved to a separate thread imo.

[Atavic]

I have formed an opinion on if Pale Moon et all should be listed by privacytools.

I don't see mattatobin as a member of privacytools organization.

Everytime I found issues with mattatobin, I had the impression of reading boring words by some lawyer.

[ghost]

Everytime I found issues with mattatobin, I had the impression of reading boring words by some lawyer.

A practicing lawyer would almost certainly not have issues with reading comprehension, punctuation and writing coherent sentences. Failing at reading comprehension is counter productive to reading technical standards and then implementing them in your application.

[Atavic]

Yes, it appears like they want their browser banned from most of the projects: some distributions have banned it.

[FrostKnight]

To be fair, I am not against @mattatobin or the idea that the new firefox is crap... But I think he just shot himself in the foot with an AR15 being as agressive as he was with the aruging, etc...

I disagree though with privacytools.io that Basilisk Browser and forks shouldn't be on the list. Though I also agree the blocklist that is within palemoon is crap.

Aka, some addons which are extremely useful such as noscript are blocked unless the blocklist is off. People I install it for never have issues with noscript unless I have video blocked by default and all scripts are not enabled by default.

My point being, I believe in many of the different points that are here.
PS, I also think Tor Browser though it has web extensions, is fine. The tor people know what they are doing. More so than say... mozilla nowadays... ;)

You are more than free to disagree with me, but that is entirely my view. I currently use Iceweasel-uxp, and it is a fork of Basilisk-Browser.
The only thing I wonder though, is if Servo indeed is taking over as much as you say. If so, that is a problem for firefox forks. I wonder if anyone plans to make a Firefox alternative like Abrowser or IceCat.

[FrostKnight]

But one that is more regularly updated of course. :) and is available for most distros.

[mattatobin]

More fake news.. noscript is level 1 which is just a Stability OR Security warning because it is known to cause stability issues and support nightmares.

[beerisgood]

@FrostKnight but only for mainline browser and not for old engine based forks ;)

[mattatobin]

More fake news

[FrostKnight]

More fake news.. noscript is level 1 which is just a Stability OR Security warning because it is known to cause stability issues and support nightmares.

It does not do any such thing actually. Unless you have it setup the way it is by default. Doing those two things I mentioned, allowing all video and enabling all scripts, makes it work for anyone without the nightmare you say it is. I have that setup on my mother's windows 10 laptop in firefox, and she doesn't complain at all. So nice try, but what you are saying is the real fake news. No worries though, I don't take it personally, I understand you must have had a bad experience with noscript. PS, its in the tor browser for a reason. :) even back when it was a legacy based tor browser. 👍

PS, Tobin, its not on the blocklist for a reason... well a good one anyways. Its just because you got tired of complaints from users that's pretty much it. It is a security addon that gives firefox based browsers what would seem like tank armor in the cyber security world. So yeah, your argument is completely off point. I need to see some proof before I can even humor your argument. sorry, but that's how it is.

[FrostKnight]

@FrostKnight but only for mainline browser and not for old engine based forks ;)

That would be fine, if it is set for full privacy and security by default and rips out as much tracking nonsense as possible and/or disables the tracking nonsense. I guess in essence, a browser like Icecat like I said only very frequently updated. :)

[ghost]

@FrostKnight you're wasting your time arguing with @mattatobin, he has nothing better to do than go around reddit, HN and github spruiking Palemoon/etc. Any argument you make will be simply responded with "fake news".

[FrostKnight]

@FrostKnight you're wasting your time arguing with @mattatobin, he has nothing better to do than go around reddit, HN and github spruiking Palemoon/etc. Any argument you make will be simply responded with "fake news".

True, I guess I was bored and hoping I could help him in my spare time. I wonder if he likes the usa president. I wonder if that is why he keeps using that phrase. xD

Maybe he likes Putin like trump too. ;p

[ghost]

True, I guess I was bored and hoping I could help him in my spare time. I wonder if he likes the usa president. I wonder if that is why he keeps using that phrase. xD

Mental illness is no laughing matter. 🙃

[mattatobin]

HN? No idea what that even is and I rarely use reddit. I don't like how the site operates.

Additionally, I don't use Pale Moon as my default browser and haven't for almost all of 2019 thus far. I am working on and using my Navigator.

I have never personally used NoScript nor felt any need to. However, I have dealt with hundreds of threads where users were having general issues and stability issues using the extension. So its level 1 status of known to cause stability issues is justified. You can disagree of course but it won't change anything.

Also, I have lots to do. I am here because I was notified and people such as your self are continuing to spread lies.

Stop doing that and I shall stop responding.

[ghost]

https://news.ycombinator.com/item?id=19527053, this in particular reads like something you would write:

• https://news.ycombinator.com/item?id=19528014
• http://archive.ph/EBAob
• https://web.archive.org/web/20190330061024/http://dpaste.com/3H8SRNZ.txt

In all honesty though, renaming whatever it is you're currently working on it's all the same and the same arguments apply.

Also who uses NoScript these days. uMatrix is waaay better, especially as you can do the same How to block 1st party scripts everywhere by default.

[beerisgood]

I recommend that we're stop talking about Pale Moon, cause mattatobin have a lot to do :D

Also he never use NoScript, but don't recommend it. I guess it's then fake that it's recommend and default in Tor browser?

[mattatobin]

Sorry dude, I have never seen anything you linked to before just now. I certainly didn't write it.

I don't use arbitary nicknames or anything and haven't for nearly 20 years. I use my name or something with my name in it like "New Tobin Paradigm".

[smnthermes]

@mattatobin Please tell your friend to stop using The Great Cloudwall of Google, Microsoft and Baidu
https://www.cloudflare.com/press-releases/2015/fidelity-google-microsoft-baidu-and-qualcomm-back-cloudflare-to-help-build/

[mattatobin]

I don't understand.