I use the latest version. I also have resist fingerprinting disabled and sync enabled. It's been a while so I don't quite remember but I think one or both of those might be required for it to work. I know resist fingerprinting disables a lot of stuff so for convenience I disable it and instead use a JS blocker.

Unfortunately, you're statement from before is wrong. Saving passwords is still broken. I just double-checked it Librewolf on the latest 148.0.2.2 version. By saving password I mean the "Ask to save passwords" in Private & Security settings. Librewolf completely ignores it. Librewolf folks do some very stupid UI things with their fork.

That's strange. I just tested it on my machine and it is still working so there must be something weird going on that makes it only work for some people. I am using Debian and have it installed with extrepo, perhaps it is an issue with a specific release?

I meant specifying the corner case of what exact type of data is shared, not an exhaustive list of companies it's shared with that would inevitably go out of date.

Do you audit every release of any open-source program you use before you run it?

Open-source alone isn't enough if the creators are known to do weird things.

See here.

Frustration post

My personal hope is if Firefox ever dies that the LibreWolf team will just use Chromium as a base instead. I'll go wherever the LibreWolf team does.

I meant specifying the corner case of what exact type of data is shared

You mean this?

not an exhaustive list of companies

You mean this?

that would inevitably go out of date.

They, and everybody else who shares user data, are legally obligated to keep track of said data and have that published and available for both users and other companies.

Single reason it's my main browser still are addon functionality.

Thanks for tip

You're really sure that you get this popup?

If so, can you pin down the exact version you use and the source you get it from?
I think the last Librewolf that had rememberSignons working was 134.

I am using 148.0.2-2. It appears as a little key icon in the address bar and you have to click on it to open it.

nice, found it.

"Technical data", "Interaction Data", very specific, uh-uh. (I'm being sarcastic.) The latter especially sounds like it can be literally a keylogger. Update: it isn't, see response, but it e.g. seems to include all sites and sub pages visited which already seems fairly bad.

I would love for Mozilla to fix this, which is why I try to be pragmatic and concrete. But so far, they don't seem willing to do so.

I know you ask this question in jest but basically it cascades, e.g. if I trust Debian or F-Droid, then I trust that the applications they include in their distribution or store is both secure enough (no piece of software is perfectly secure) and actually does what it say it does. In turn I believe they do the same, namely that initially when an application is added to their collection, they do review the application and the code yes. Then each update is only a gradual check, if ever done, assuming nothing special happened, e.g. no main maintainer change. If it's far from perfect, and as somebody linked else there are limits (e.g. https://en.wikipedia.org/wiki/XZ_Utils_backdoor ) but in "normal" situations it's enough for me.

Anyway that's just my perspective on the matter, on your problem specifically after a brief ~5min search I haven't found exactly what you are looking for but here are still some examples of what I do find helpful :

• IMHO very close but limited to Android https://reports.exodus-privacy.eu.org/en/reports/org.mozilla.firefox/latest/ and only technical, not about the "business" side, still it shows what is potentially collected and thus sold back
• example of 3rd party security audit on the accounts part of Firefox https://blog.mozilla.org/security/2017/07/18/web-service-audits-firefox-accounts/
• some publication from that 3rd party https://cure53.de/#publications-2024 but not specific to Firefox
• what Mozilla itself sponsored in terms of auditing other open source software https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed

Those though are mostly around security. They are definitely linked to privacy but still distinct. If I genuinely cared about the topic I would directly ask if organizations, non-profits, etc do think about the topic, e.g. Access Now, EFF, Exodus Privacy.

If by any chance you do find something helpful there please do share back.

The linked reports don't seem too useful since 1. the first one seems some automated scan not a code review, and 2. the second one is "Firefox Accounts" and not a browser code review. My apologies if I"m missing something.

I personally think you shouldn't run software that accesses such intricate personal information if you don't trust it, if it can be updated to change to grab all that data. Especially since Mozilla seems to potentially give itself a license to all your data, apparently. Update: This seems to only apply to "Mozilla Accounts", my apologies for the error: https://www.mozilla.org/en-US/about/legal/terms/services/

you shouldn’t run software that accesses such intricate personal information if you don’t trust it, if it can be updated to change to grab all that data.

Yes, and you should also brush and floss your teeth, do physical activities, buy local produces, recycle everything, do your due diligence on all political candidates, etc, etc. In practice we ALL have to make pragmatic choices. There are not a lot of browsers and basically for fully featured engines there are (arguably) only 2, Chromium by Google and Firefox by Mozilla. One is an advertising for profit company, the other is not. If you genuinely care a lot about privacy though you might not have to use either, you might be perfectly fine with much simpler browsers like Links or even lynx and I can tell you with a lot greater confidence that there no data will leak. You can also containerize your browser using e.g. https://docs.linuxserver.io/images/docker-webtop/ and then run within there whatever you want.

since Mozilla seems to potentially give itself a license to all your data, apparently.

That's not correct, you mean some data from your browser usage. I think it's important to be precise here otherwise through shortcuts you try to convince yourself, and others, about a problematic situation that just does not exist.

So which browser do YOU trust and why?

FWIW I don't recommend starting a post about selling data where the very first link points to a Google product.

Consider next time not linking to YouTube but instead the blog post that linked to it and ideally an alternative more privacy conscious frontend, e.g. invidious.

Interesting, it's also not a chapter in https://browser.engineering/

That being said I imagine Google messed up the whole landscape with its Manifest V3 situation.

Also I imagine after a certain expertise threshold, one can relatively easily re-create an addon themselves. I'm thinking people who are familiar with Tridactyl or GreaseMonkey might not be as sensitive as this problematic.

It seems like the official original source for this video is Youtube.

I would love for Mozilla to fix this, which is why I try to be pragmatic and concrete. But so far, they don’t seem willing to do so.

Here's the problem - people don't care if the information is there or not. Microsoft has been disclosing their required telemetry data for years and people still thing it's an invasion of their privacy.

Take you for example - I gave you a source, you checked 1/3rd of the information in it and started complaining.

Why am I assuming you didn't bother to read the whole thing? Because you're claiming that "technical data" is too obscure of a term to figure out what it is. "Interaction Data", in your words, "can be literally a keylogger", right? Well, it's very clearly defined in the table:

Click counts, impression data, attribution data, how many searches performed, time on page, ad and sponsored tile clicks.

Which of these would you consider to be "literally a keylogger", hmm?

Point taken and I appreciate the correction, but it still seems to include e.g. all URLs which could leak all your search queries and other rather invasive conclusions. If anything, this makes me feel like it confirms Mozilla does sell data it shouldn't.

but it still seems to include e.g. all URLs which could leak all your search queries

Which one? Interaction data? It literally cannot, or it would've been stated there.

If anything, this makes me feel like it confirms Mozilla does sell data it shouldn’t.

Yes, I know. That's because you don't really understand what you're reading here.

These are not just "pinky promise" lists. These are legally binding lists of data types being shared and the data sub-processors. If you find anything incorrect there, you basically get free money in a lawsuit.

It might or might not be true, but I'm not sure it's particularly helpful advice. It's too wide-sweeping. Literally everything is a fork, apart from Firefox and Safari. Maybe Chrome, since they hard-forked and now go their separate ways from WebKit. But still, that's only 3 browsers. And unless you think that Firefox needs to be avoided because of its privacy violations but somehow are ok with Google Chrome, "avoid forks" doesn't work as an option.

I don't think we've been reading the same link. In any case, I don't think this conversation is going in a useful direction, so I'll part ways here.

Yeah, both Phoenix and Dove (Thunderbird's counterpart) are two projects that I do recommend, as they are the best example of what I mention.