Captchas I have read the instructions. I have searched existing issues and avoided creating duplicates. I am not filing an enhancement request. What happened? There are multiple privacy and telemtr...
It does, but less than Firefox does. Their lack of manpower means delayed updates to fix zero days compared to Firefox. It also means less eyes on any patches introduced, so I’d be more concerned about malicious code being introduced.
Their lack of manpower means delayed updates to fix zero days compared to Firefox
From their site:
LibreWolf is always built from the latest Firefox stable source, for up-to-date security and features along with stability.
As soon as firefox pushes a release, for instance to fix a security vulnerability, librewolf can immediately rebuild It is literally just firefox with different setting. Delay between firefox release and librewolf release should be negligible. You can verify this by noting that 136.0 was offered on the same day.
I’m not saying Librewolf is insecure, I’m just saying its a bit less secure. They generally do a good job keeping up to date, but there can be delays if an update conflicts with their changes.
Librewolf is not just a Firefox config. You can look at the repo and see a number of patches. Without a paid security team to review these patches with every update, it is less secure.
I’m not saying not to use Librewolf, the likelihood of a zero day specifically targeting it and effecting a significant number of users is very unlikely, simply based off of the size of its userbase compared to more mainstream browsers.
I agree, Mullvad is the only fork that I have confidence in the security of (ignoring Tor ofc since it’s not really for general use).
I’ll bite: what’s wrong with LibreWolf?
It just lacks manpower unfortunately. Going with a browser that has the funding for a security team is the safer option.
Librewolf is firefox with different settings how does it not already benefit from Firefox’s security team
It does, but less than Firefox does. Their lack of manpower means delayed updates to fix zero days compared to Firefox. It also means less eyes on any patches introduced, so I’d be more concerned about malicious code being introduced.
From their site:
As soon as firefox pushes a release, for instance to fix a security vulnerability, librewolf can immediately rebuild It is literally just firefox with different setting. Delay between firefox release and librewolf release should be negligible. You can verify this by noting that 136.0 was offered on the same day.
https://codeberg.org/librewolf/source/commit/2b90daeb5aa5a80443f4f7655393f610fb16418a
https://www.mozilla.org/en-US/firefox/136.0/releasenotes/
The difference in time between firefox and librewolf security updates is less than the variance between users updating their machines.
I’m not saying Librewolf is insecure, I’m just saying its a bit less secure. They generally do a good job keeping up to date, but there can be delays if an update conflicts with their changes.
Librewolf is not just a Firefox config. You can look at the repo and see a number of patches. Without a paid security team to review these patches with every update, it is less secure.
I’m not saying not to use Librewolf, the likelihood of a zero day specifically targeting it and effecting a significant number of users is very unlikely, simply based off of the size of its userbase compared to more mainstream browsers.
Thanks! Makes me wonder if there’s a chance all this separate effort can come into one.