MX Linux Forum

Posted: **Tue Jan 12, 2021 9:00 am**

Package request for LibreWolf to be added to the repo. https://librewolf.readthedocs.io/en/lat ... stallation

Posted: **Tue Jan 12, 2021 9:52 am**

Can you please post that in the package request forum next time? Thanks :)

Posted: **Tue Jan 12, 2021 9:57 am**

Eadwine Rose wrote: Tue Jan 12, 2021 9:52 am Can you please post that in the package request forum next time? Thanks :)

Where is it because I couldn't find it?

Posted: **Tue Jan 12, 2021 10:01 am**

Where it is now, since I moved it to the right spot :)

Posted: **Tue Jan 12, 2021 10:34 am**

They (the developers) seem to have a Debian Sid package being worked per their GitLab.

I am attempting to build it right now, but its complaining about some dependencies that I need to handle first, but these are Debian Sid packages.

No promises, but they seem interested in having a Debian package, we if we need to reach out to them we can do that.

They have an appimage in the mean time.

Posted: **Tue Jan 12, 2021 1:14 pm**

If you want it to integrate nicely into MX19, you can dowload the flatpak from here: https://gitlab.com/librewolf-community/ ... 64.flatpak

And install it from the command line (not as root user or sudo):

Code: Select all

flatpak install ./LibreWolf-84.0.2-1.x86_64.flatpak

Works well for me, and shows up in the MX main menu.

Posted: **Tue Jan 12, 2021 1:54 pm**

andyprough wrote: Tue Jan 12, 2021 1:14 pm If you want it to integrate nicely into MX19, you can dowload the flatpak from here: https://gitlab.com/librewolf-community/ ... 64.flatpak

Is that an official flatpak from them? From what I saw they didn't have an official one yet, but that could be out of date info.

If there is a flatpak they may be the best bet for folks, it may or may not take awhile to get it built for MX, I'm on dependency #4 of 6 that I know of so far.
Also no knowing if it will build and have issues or not since I haven't gotten that far yet. I got other packages to do to so I'm just starting with this thing and not sure I want to maintain it long term. Still too many browsers coming and going these days, I think we have 42 in our repos or something like that?

Posted: **Tue Jan 12, 2021 2:58 pm**

SwampRabbit wrote: Tue Jan 12, 2021 1:54 pm
andyprough wrote: Tue Jan 12, 2021 1:14 pm If you want it to integrate nicely into MX19, you can dowload the flatpak from here: https://gitlab.com/librewolf-community/ ... 64.flatpak
Is that an official flatpak from them? From what I saw they didn't have an official one yet, but that could be out of date info.

If there is a flatpak they may be the best bet for folks, it may or may not take awhile to get it built for MX, I'm on dependency #4 of 6 that I know of so far.
Also no knowing if it will build and have issues or not since I haven't gotten that far yet. I got other packages to do to so I'm just starting with this thing and not sure I want to maintain it long term. Still too many browsers coming and going these days, I think we have 42 in our repos or something like that?

Yes, it's in their Linux Releases page on their LibreWolf Gitlab: https://gitlab.com/librewolf-community/ ... -/releases

Unfortunately they haven't submitted it to Flathub yet, or users would be able to get it through MXPI. But the command line installation of it as a local file works just as well.

Posted: **Tue Jan 12, 2021 3:01 pm**

andyprough wrote: Tue Jan 12, 2021 2:58 pm Yes, it's in their Linux Releases page on their LibreWolf Gitlab: https://gitlab.com/librewolf-community/ ... -/releases

Unfortunately they haven't submitted it to Flathub yet, or users would be able to get it through MXPI. But the command line installation of it as a local file works just as well.

Cool thanks, it will come in handy if people want to check it out.

Posted: **Tue Jan 12, 2021 3:35 pm**

Its build-depends should be similar to that of Firefox 84 upstream, which involves newer versions of cargo and rustc, AFAIK.

Since they offer binary builds, we could duplicate what we do with Firefox and just bundle those into debs.

Posted: **Wed Jan 13, 2021 1:42 am**

Stevo wrote: Tue Jan 12, 2021 3:35 pm Its build-depends should be similar to that of Firefox 84 upstream, which involves newer versions of cargo and rustc, AFAIK.

Since they offer binary builds, we could duplicate what we do with Firefox and just bundle those into debs.

Yep rustc and cargo are the ones tripping this up right now. There are a few pre-reps for those too. I can dump what I have for the debian folder for you and/or Mike.... ya’ll might be better suited for for this one based on experience with Firefox.. I’ll hit you up in a PM.

Posted: **Mon Apr 26, 2021 4:39 pm**

Wow, if there could be a privacy patched Firefox installable straight from the MX Linux repository, that would be really great.

Where you, or those more experienced with compiling Firefox, able to make some progress with Librewolf?

Posted: **Mon Apr 26, 2021 7:56 pm**

Some drawbacks of a third- or fourth-(appstore)party flatpack are the delayed security-updates of bundled dependencies, and problems with using the install directory for customizing system wide defaults.

Posted: **Tue Apr 27, 2021 8:56 am**

I personally am not interested in fussing around anymore with trying to build this mess of a package. The developer needs to debianize it.

I haven’t looked to see if Debian upstream got anywhere with their WIP package or not, but will look when I have time.

Posted: **Tue Apr 27, 2021 9:12 am**

I'm running the Debian Sid version of LibreWolf on antiX Sid right now. Works well, but no better than using the appimage version. At this point I don't see any value in not sticking with the appimage on any Buster-based system. The appimage is lightweight and runs great.

If anyone wants to put the appimage in MXPI, I was able to link the appimage with 'ln -s' to /usr/bin to put it in the path, and make a .desktop file for it in /usr/share/applications to get the appimage into the menu. Pretty simple.

Posted: **Tue Apr 27, 2021 10:28 am**

SwampRabbit wrote: Tue Apr 27, 2021 8:56 am I personally am not interested in fussing around anymore with trying to build this mess of a package. The developer needs to debianize it.

Thanks for your assessment. It's a clear hint, and a mess is a warning sign if it's not addressed.

Did you have the chance to provide some details upstream? https://gitlab.com/librewolf-community/ ... x/-/issues

Posted: **Tue Apr 27, 2021 10:44 am**

Sterling wrote: Tue Apr 27, 2021 10:28 am
SwampRabbit wrote: Tue Apr 27, 2021 8:56 am I personally am not interested in fussing around anymore with trying to build this mess of a package. The developer needs to debianize it.
Thanks for your assessment. It's a clear hint, and a mess is a warning sign if it's not addressed.

Did you have the chance to provide some details upstream? https://gitlab.com/librewolf-community/ ... x/-/issues

I don't want to answer for @SwampRabbit, but I'll just say I'm pretty sure the LibreWolf devs are well aware that it's not packaging on any Debian but Sid right now. The person who makes the Sid package has been trying and failing to make a package for the current version of Ubuntu for awhile. Raising it as an issue on gitlab isn't going to make the problem resolve any faster. Most likely the problem is related to the advanced versions of rust and cargo that are required to build LibreWolf, and they each require their own advanced version dependencies which are not going to be satisfied on Buster.

Posted: **Tue Apr 27, 2021 11:52 am**

their pkgbuild files for their arch builds download mozilla source and then apply patches. I'm not even sure that qualifies as a fork. basically if mozilla support disappeared I think this one would too.

Posted: **Tue Apr 27, 2021 12:00 pm**

dolphin_oracle wrote: Tue Apr 27, 2021 11:52 am their pkgbuild files for their arch builds download mozilla source and then apply patches. I'm not even sure that qualifies as a fork. basically if mozilla support disappeared I think this one would too.

Correct, the dpkg script does the same thing. They even say to run the script then use something like OBS to build packages.

I don’t know if they want to actually “fork” fork it or not, or even need to for what they are trying to accomplish. But right now everything I see points to what you noticed and that is they are just pulling down the Firefox source package and “bolting on” things or removing some other things.

Posted: **Tue Apr 27, 2021 12:09 pm**

SwampRabbit wrote: Tue Apr 27, 2021 12:00 pm
dolphin_oracle wrote: Tue Apr 27, 2021 11:52 am their pkgbuild files for their arch builds download mozilla source and then apply patches. I'm not even sure that qualifies as a fork. basically if mozilla support disappeared I think this one would too.
Correct, the dpkg script does the same thing. They even say to run the script then use something like OBS to build packages.

I don’t know if they want to actually “fork” fork it or not, or even need to for what they are trying to accomplish. But right now everything I see points to what you noticed and that is they are just pulling down the Firefox source package and “bolting on” things or removing some other things.

ok fair point, they actually say its a customized firefox build in their code.

I see some -dev packages added as depends as well (libjack-dev?).

Posted: **Tue Apr 27, 2021 12:17 pm**

@dolphin_oracle i didn’t see that -dev package, but honestly didn’t look too hard or deep after.

I am not sure if the only way for use to include it is to run their script then build it proper or what. That process sounds like a pain and isn’t how it should be done. We would have to check the darn thing more each time. God forbid something gets slipped in to download random stuff during the dpkg script. You’d never know what gets built with something like this unless you review it. I am finding it hard to keep up with their commit breakdown, there appear to be gaps in what was done, but it could be my limited experience with GitLab.

For MX-21 we could probably just use their OBS to build from or include it in MXPI

Posted: **Tue Apr 27, 2021 12:20 pm**

That's sort of what I'm thinking. use their build from OBS. the flatpak is technically usable but I don't want to added flatpaks to Popular Apps. Popular Apps was meant for debs, and while techically we could probably make it work, life would e easier if they just got their flatpak up on flathub.

Posted: **Tue Apr 27, 2021 2:18 pm**

What I thought of was, if you would have found some specifics like a wrong packaging locations etc., something like that could be filed.

The advantage (and only objective) of this project I think is to just readily apply sensible privacy patches that otherwise need a lot of manual patching and checking out and merging user.js configuration etc.

But if the patches are not kept and managed nicely I guess it can easily look as or become a mess.

Found a feature list at https://librewolf-community.gitlab.io/docs/ :

* Latest Firefox — LibreWolf is compiled directly from the latest build of Firefox Stable. You will have the the latest features, and security updates.
* Independent Build — LibreWolf uses a build independent of Firefox and has its own settings, profile folder and installation path. As a result, it can be installed alongside Firefox or any other browser.
* No phoning home — Embedded server links and other calling home functions are removed. In other words, minimal background connections by default.
* User settings updates — We keep up with gHacks-user.js and pyllyukko’s user.js
* Extensions firewall: limit internet access for extensions.
* Multi-platform
* Community-Driven

But I'm wondering why the last commit removed the reference to the arkenfox user.js repository: https://gitlab.com/librewolf-community/ ... a162a0af6c

Posted: **Tue Apr 27, 2021 3:04 pm**

@Sterling it isn’t the package locations that’s the problem. I don’t intend to review everything they have and giving them pointers or fixes...

I got enough user requests piling up that actual application devs have ask for help with and I said I would help. Plus all things I package now and am working on in the background.
It’s a volunteer prioritization choice, I already told other folks I would work on stuff for them and haven’t finished.

And it’s more than just patches they are doing from the looks of it, if it was just patches, we could add it to FireFox and compile with no issues.

Most everything done with this thing can be done by users if they want to.

I also personally find it silly they disable “phoning home” (I don’t know what all is disabled), but it’s Mozilla, there is a reason this data is collected (anonymized I might add) and it’s to improve Firefox for all users, assist finding vulnerabilities, etc, etc. Disabling such things only hurts Librewolf and all Firefox forks and ultimately users. For those reasons I find it silly to tote it as a huge win for Librewolf.

Posted: **Tue Apr 27, 2021 4:06 pm**

SwampRabbit wrote: Tue Apr 27, 2021 3:04 pmI also personally find it silly they disable “phoning home” (I don’t know what all is disabled), but it’s Mozilla, there is a reason this data is collected (anonymized I might add) and it’s to improve Firefox for all users, assist finding vulnerabilities, etc, etc. Disabling such things only hurts Librewolf and all Firefox forks and ultimately users. For those reasons I find it silly to tote it as a huge win for Librewolf.

Mozilla is having to remove some of their telemetry as we speak because they were caught farming it out to an untrusted 3rd party. This is from just one week ago: https://www.ghacks.net/2021/04/18/mozil ... d-and-ios/

The Edward Snowden PRISM revelations proved to a lot of us that we can't trust any big tech company to safeguard and protect and properly anonimize our private data. That's why a lot of us are using Linux distros instead of proprietary offerings from MS and Apple and Google.

I wouldn't get too angry at LibreWolf or the people like me who use it. We have pretty solid reasons for distrusting companies like Mozilla. We don't make this forum a breeding ground for all of our philosophical stances, but rest assured there are plenty of us who harbor this distrust.

Posted: **Tue Apr 27, 2021 5:28 pm**

I'm not sure it will ever get in the repo or even if it matters. In librewolf's about:config, dev has locked files which are not locked in every other browser I mess with.
ex: services.sync.prefs.sync.privacy.resistFingerprinting
I like Basilisk too but it has no fingerprinting settings at all.

Posted: **Tue Apr 27, 2021 5:49 pm**

@andyprough did you digest that article, did you look at what is collected, and what is done before it is sent?

They aren’t “having” to, they are choosing to, big difference.

The user is identified by Leanplum using a random UUID generated by Firefox for Android when Leanplum is initialized for the first time. This unique identifier is only used by Leanplum and can’t be tracked back to any Firefox users.

User Identifier: Since Device ID is a random UUID, Leanplum can’t map the device to any know Client ID in Firefox for Android nor Advertising ID.

There is no darn PII or identifiable info on users from what I saw in the list of telemetry. Seems to be a move to pander to Privacy whack jobs who want to complain about that but their ISP is selling the same and more. Hell people’s “super super secure VPN”, the Post Office, local municipalities, banks, etc, etc are dumping more info than that daily and people are worried about Mozilla trying to stay afloat with some anonymized data?

I know full well why people want to try and avoid many of these things (and actually know the cases they don’t know but should).

But I also know the same people will use Brave who did a lot worse behind users’ backs without any public info on what they did and was caught red handed. Trust/Distrust but verify, people trust/distrust things they read too much these days, but don’t verify jack.

Who’s to say that build script from Librewolf isn’t (or could in the future) pulling down something at compile time that bypasses all protections?
We build in a schroot and not the way Librewolf wants us to build for a reason.

What happens when Mozilla has to shut down because they can’t pay the bills to keep the doors open because of the “privacy experts”?

Just the other day I had to do OSINT for work work to identify someone from their VPN provider, got local public IP... then it was over had everything in a short amount of time.

People need to learn to chill out a little. Trust me, the more someone tries to hide... the more they and their actions stand out and they become a target. This is because the data sets and info points become tighter and more focused. One fish in a pond is easier to catch than just one specific fish in the ocean. SSN cost $2-3, CC# cost $1-100, License # cost $3-18... anonymized telemetry data from Mozilla doesn’t cost a thing cause no one wants it and it’s not really useful.

Half the time people spend so much time trying to cover things that don’t matter while missing the really important things (e.g. baby hand print photos on Instagram) and also wasting tons of time when they could be enjoying their computer and the interwebs.

Edit: who cares if someone has your browser fingerprint? Ain’t nobody directly attacking rando users just by their browser info, it’s too much time. In every aspect of life... time > $ ... same goes for malicious actors. Right now someone’s front door is unlocked and they worrying about if someone finds out they have Firefox 13 installed or not. Then complains when Netflix doesn’t work or something.

Always - STEP 0 - Remain Calm.

Posted: **Tue Apr 27, 2021 5:56 pm**

Or.. in short: when you start acting different from the main stream, you stick out.

In simple terms: being sneakish avoidish on the web equals to you walking down the street always crouching. When you walk normally NOBODY is interested in you.

Posted: **Tue Apr 27, 2021 6:25 pm**

Sure, one can only do so much.

Notably, though, that may not include simply packaging a patched firefox. The ancestor project to package an easily accessible "unmozillarized-firefox" (as with chromium) looks like having a history of going silent in a strange way.

Looks like there are some specific points to assess the projects value for internet users, and generally watching directions of words and doings.
https://unixsheikh.com/articles/choose- ... mpromising
( =>and https://gitlab.com/librewolf-community/ ... /issues/16)

Posted: **Tue Apr 27, 2021 6:48 pm**

SwampRabbit wrote: Tue Apr 27, 2021 5:49 pm @andyprough did you digest that article, did you look at what is collected, and what is done before it is sent?

They aren’t “having” to, they are choosing to, big difference.

The user is identified by Leanplum using a random UUID generated by Firefox for Android when Leanplum is initialized for the first time. This unique identifier is only used by Leanplum and can’t be tracked back to any Firefox users.

User Identifier: Since Device ID is a random UUID, Leanplum can’t map the device to any know Client ID in Firefox for Android nor Advertising ID.
There is no darn PII or identifiable info on users from what I saw in the list of telemetry. Seems to be a move to pander to Privacy whack jobs who want to complain about that but their ISP is selling the same and more. Hell people’s “super super secure VPN”, the Post Office, local municipalities, banks, etc, etc are dumping more info than that daily and people are worried about Mozilla trying to stay afloat with some anonymized data?

I know full well why people want to try and avoid many of these things (and actually know the cases they don’t know but should).

But I also know the same people will use Brave who did a lot worse behind users’ backs without any public info on what they did and was caught red handed. Trust/Distrust but verify, people trust/distrust things they read too much these days, but don’t verify jack.

Who’s to say that build script from Librewolf isn’t (or could in the future) pulling down something at compile time that bypasses all protections?
We build in a schroot and not the way Librewolf wants us to build for a reason.

What happens when Mozilla has to shut down because they can’t pay the bills to keep the doors open because of the “privacy experts”?

Just the other day I had to do OSINT for work work to identify someone from their VPN provider, got local public IP... then it was over had everything in a short amount of time.

People need to learn to chill out a little. Trust me, the more someone tries to hide... the more they and their actions stand out and they become a target. This is because the data sets and info points become tighter and more focused. One fish in a pond is easier to catch than just one specific fish in the ocean. SSN cost $2-3, CC# cost $1-100, License # cost $3-18... anonymized telemetry data from Mozilla doesn’t cost a thing cause no one wants it and it’s not really useful.

Half the time people spend so much time trying to cover things that don’t matter while missing the really important things (e.g. baby hand print photos on Instagram) and also wasting tons of time when they could be enjoying their computer and the interwebs.

Edit: who cares if someone has your browser fingerprint? Ain’t nobody directly attacking rando users just by their browser info, it’s too much time. In every aspect of life... time > $ ... same goes for malicious actors. Right now someone’s front door is unlocked and they worrying about if someone finds out they have Firefox 13 installed or not. Then complains when Netflix doesn’t work or something.

Always - STEP 0 - Remain Calm.

Is there some reason you feel the need to publicly lecture me about an issue that I have been studying in great detail? I advised you kindly to back off, next time I won't be so kind.

Posted: **Tue Apr 27, 2021 7:13 pm**

I'd just guess a well understood package of a browser with reduced data spreading should tend to increase the crowd that uses it.
(But not sure if librewolf could become that. Re-packaging their binary in lieu of clean patchsets does not seem to be of the better suggestions.)

And it looks somehow like a contradiction, if turning off data collection, that is said to have no value, should lead to the company going out of business. It does not only seem like asking (opt-in/out) to send out data that could allow un-randomizing/matching of other identifiers, there seem to be pretty hardcoded requests to corporate servers (that issue #16).

Posted: **Tue Apr 27, 2021 7:28 pm**

Sterling wrote: Tue Apr 27, 2021 7:13 pm I'd just guess a well understood package of a browser with reduced data spreading should tend to increase the crowd that uses it.
(But not sure if librewolf could become that. Re-packaging their binary in lieu of clean patchsets does nott seem to be of the better suggestions.)

And it looks somehow like a contradiction, if turning off data collection, that is said to have no value, should lead to the company going out of business. It does not only seem like asking (opt-in/out) to send out data that could allow un-randomizing/matching of other identifiers, there seem to be pretty hardcoded requests to corporate servers as (that issue #16).

I wouldn't pay much attention to "get lost in the crowd" arguments against thoughtful privacy protection. They've been proven completely wrong time and again. The only browser that uses the "losing yourself in the crowd" method with any real effectiveness is Tor Browser, which is the only browser that combines that method with a nearly perfect defense against fingerprinting. You definitely are not "lost in the crowd" if all the trackers know exactly who you are and what you are doing because you use Firefox or Chrome or any regular browser where it is dead simple to fingerprint, set cookies, and track IP addresses. Brave has effective anti-fingerprinting if you set it to the "strict" level, but not as strong as Tor browser. Only problem with Tor browser is that a lot of sites refuse to work normally with it. For example, doing banking through Tor is nearly impossible. So we all need a "normal" browser if we are going to do routine online business. Brave with strict anti-fingerprinting is probably the best solution for now, but LibreWolf shows some real promise. I think using LibreWolf with the Chameleon anti-fingerprinting extension has the potential for a significant increase in online privacy, while still being able to do most of your normal online work.

Posted: **Tue Apr 27, 2021 7:55 pm**

andyprough wrote: Tue Apr 27, 2021 6:48 pm Is there some reason you feel the need to publicly lecture me about an issue that I have been studying in great detail? I advised you kindly to back off, next time I won't be so kind.

Woah, did that come off as directly lecturing you?

No reason to get like that... you should know I wouldn’t come at you negatively.

I’ll just take my 21yrs of being cybersecurity professional else where...

Posted: **Tue Apr 27, 2021 9:25 pm**

The problem with LibreWolf is that it isn't a "consumer" browser. If you need to change some setting you might need to change the user.js file. I don't think you can change these settings from within the browser, because they will be reset next start-up when LibreWolf reads the user.js file again.

I think users who are willing/capable of dealing with user.js are also able to download the AppImage.

Posted: **Wed Apr 28, 2021 12:24 am**

SwampRabbit wrote: Tue Apr 27, 2021 7:55 pm
andyprough wrote: Tue Apr 27, 2021 6:48 pm Is there some reason you feel the need to publicly lecture me about an issue that I have been studying in great detail? I advised you kindly to back off, next time I won't be so kind.
Woah, did that come off as directly lecturing you?

No reason to get like that... you should know I wouldn’t come at you negatively.

I’ll just take my 21yrs of being cybersecurity professional else where...

And I have a 30 year career as an anti-fraud professional with many online fraud investigations and hundreds if not thousands of hours of cybersecurity training. It's possible to state your opinion without denigrating me personally for holding the opposite view or questioning my ability to read and understand data and form an opinion - you should try it sometime.

Posted: **Wed Apr 28, 2021 1:29 am**

@andyprough Andy I don’t think I don’t think I degenerated anyone directly, let alone you, if someone takes something the wrong way or how they want to for whatever reason I can’t help that.

I honestly don’t know why you’re bent out of shape, but I’m pretty sure it don’t matter either way.

As far as resumes and accolades are concerned, I’m not here to bump cheats. Heck I don’t even try to get into my work or these convos.

People can think what they want, worry about browser fingerprinting all they want, no skin off my back.

I’ll just go back to packaging and leave the forum chit chat to the pros.

MX Linux Forum

LibreWolf

LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf

Re: LibreWolf