* There is no legal entity behind the project. Should anything ever happen with the project (it can happen, even if unlikely), there are no legal ramifications.
* The binaries aren't signed. Yes, code signing is a bit of a racket, but there is some merit in it.
* There is no auto-update mechanism. Might not seem like a big deal, but IMO it is, especially on Windows where you're recommended to rely on 3rd party client to update the browser for you. You've now added a middle man, and since the binaries are not signed... well there's no guarantee you aren't downloading a malicious binary.
>There is no auto-update mechanism. Might not seem like a big deal, but IMO it is, especially on Windows where you're recommended to rely on 3rd party client to update the browser for you. You've now added a middle man, and since the binaries are not signed... well there's no guarantee you aren't downloading a malicious binary.
To me, this seems like a plus. If you want users to update, provide them with something worth updating to. This tracking suddenly being enabled for a ton of users is the very result of automatic updates.
Also, for some software vendors, frequent/automatic upgrades are a great place to hide silent reconfiguration.
Mozilla has been repeatedly resetting "Always check if Firefox is your default browser" option to "yes" with upgrades. I don't see why "private-attribution submission enabled" wouldn't be reset in future in the same way.
As mentioned above, we aren't talking about Firefox's update mechanism here, but rather Librewolf's.
> Mozilla has been repeatedly resetting "Always check if Firefox is your default browser" option to "yes" with upgrades.
I'm sorry to say this, but this just seems to be misinformation.
I don't see that anywhere in the source code[1]? Anything I can find regarding prompting the user regarding the default browser is hidden behind an if guard to make sure the pref is `true` and not `false`.
The only scenarios I am aware of that will change the pref if the user has toggled one manually is the `_migrationUI`[2] function (as you can see, no changes relating to `browser.shell.checkDefaultBrowser`). Otherwise, untoggled prefs will be changed if the value in `firefox.js`[3] or `all.js`[4] is changed. As you can see, the last time the pref was modified was 2004.
But we're not talking about Firefox's update mechanism here, we're talking about Librewolf's. They are already the custodians of custom settings and making the choice for you, so it doesn't seem like a valid comparison here.
I would also say a web browser should be the one piece of software constantly updated due to the sheer volume of security patches issued every few weeks.
>But we're not talking about Firefox's update mechanism here, we're talking about Librewolf's.
Doesn't matter. I don't inherently trust any organization.
>They are already the custodians of custom settings and making the choice for you, so it doesn't seem like a valid comparison here.
I can make the choice to install software. I should be able to make the choice to upgrade it as I choose as well.
If I buy a chair from Crate+Barrel, I have given them the choice of designing and manufacturing that chair and all the decisions that went into it. But I do not give Crate+Barrel the choice of sneaking into my house and swapping it with some newer version of the chair that 51% of the population liked slightly better after 5 minutes of testing or that they think will make them more money somehow.
> I can make the choice to install software. I should be able to make the choice to upgrade it as I choose as well.
I think that's completely valid.
I was just assuming (maybe incorrectly?) we're talking about what should be happening in general (so what the experience for the layman should be). Now whether that applies to Librewolf is another story, but arguably it becoming fairly known, it should.
Side-note: In Waterfox, I've re-added the ability to disable auto-updating completely. I completely understand the want to manually update software.
> You know perfectly well that point 1 is completely irrelevant in the world of open-source.
Genuinely, why not? Open source projects go through ownership changes (as unlikely as they may be), social engineering, etc. In the unlikely chance something were to happen and anything malicious were to occur, what recourse is a user to have? And we are talking about a web browser here, which will be accessing peoples most sensitive data. I don't think this is an unreasonable stance.
> A UK Ltd. is less transparent than Librewolf, an open-source project run by many volunteers without the incentive to make any money.
Well this UK Ltd is still beholden to English law and UK GDPR. You could argue the merits and teeth that GDPR has, but I don't see why it's not a valid comparison? I can't just start processing personal data without complying with GDPR, for example.
> The risks you are talking about are not inherent to Librewolf, but to Linux and open-source, and thus are not legitimate criticisms of Librewolf.
Linux has the Linux foundation, which AFAIK is going to be beholden to California law? I don't see how that can't also be a criticism of Librewolf (and any OSS in a similar spot?).
> Point 3 is no longer true, the installer comes with the option to enable auto-update and on Linux, it also auto-updates, depending on distro, etc.
It seems to me to still true, because the installer is installing WinUpdater. Which, as it seems, is maintained by an individual developer?
> If you want LibreWolf to be automatically updated (recommended), you can choose to install the LibreWolf WinUpdater[1], which is included in the installer.
* There is no legal entity behind the project. Should anything ever happen with the project (it can happen, even if unlikely), there are no legal ramifications.
* The binaries aren't signed. Yes, code signing is a bit of a racket, but there is some merit in it.
* There is no auto-update mechanism. Might not seem like a big deal, but IMO it is, especially on Windows where you're recommended to rely on 3rd party client to update the browser for you. You've now added a middle man, and since the binaries are not signed... well there's no guarantee you aren't downloading a malicious binary.