MrAlex94

It isn’t really, just marketing fluff. Foxify[1] allowed Firefox to install Chrome extensions almost a decade ago and then I ported that to Waterfox after privileged extension support was removed from Firefox 56.

Currently still in Waterfox stable but figured there’s not actual much advantage to supporting Chrome extensions as Firefox ones are more featureful, so have removed it in the final version based on ESR 153 - albeit would be trivial to add support back in.

[1] https://github.com/bnpoirier/foxify

Developer of Waterfox here - if anyone is looking for other options just know Waterfox will carry on allowing extensions to access the browsers own privileged JavaScript APIs, not just MV2 or MV3 APIs - so you’re free to do whatever you like within the browser

This question is for us: will we keep using Blacksmith, despite them giving us an unpleasant surprise and a prickly support exchange?

Well, there are other drop-in GHA runner services, so I wouldn’t see why anyone would be tied into a specific provider.

Namespace.so are one and my experience with their support has been incredibly positive. Great team there.

Honourable mention to WarpBuild as well, who I used before them.

If it wasn’t for SourceForge I’m not sure my life would’ve ended up where it is! They use to promote projects they liked and ended up putting Waterfox on their front page a few times. Really sad when they started blasting people with ads and swapping out installers with adware for popular projects. By that time I moved to Microsoft’s CodePlex, if anyone else remembers that? Felt like I was the only one using it at the time! I remember the connection speeds to it were atrocious, but appreciated they’d share ad revenue from the downloads of a projects page which was nice. I remember it was actually super expensive to offer downloads [for binaries] back then, using these code hosting websites was the only way to do it for “free”

I think people are reading into this too much - I don’t think Mozilla would ever implement an actual full spectrum ad blocker (although who knows with the new direction Firefox is headed), this will likely be used as an improvement/replacement for the current tracking protection implementation.

Weirdly enough, the same time this was added to Geckko is when I started implementing the adblock-rs library for Waterfox - I stumbled across the bindings by accident when using searchfox on the main branch instead of esr140! Quite the coincidence doing it at the same time.

The distinction I'm drawing is between a revenue share from a search partnership and something like an acceptable ads programme where individual advertisers pay to bypass the blocker - those are different things.

Yes, that's correct. Startpage is the default search partner, and their search ads aren't blocked by default. Users can enable blocking on that page too with a single toggle in settings. That's why I laid it all out in this post, to let users know - it's about keeping Waterfox sustainable (paying bills, putting food on the table) as it's my only source of income currently.

I've mentioned in another comment, that I've tried other ways such as with subscription paid services, but unfortunately there's nowhere near enough traction for it to be sustainable.

Also bare in mind Waterfox currently comes with nothing, so this is just an extra layer of protection.

Nothing to "fix" per se - webextensions need to interact with website data, otherwise they wouldn't be much use. Any extension with content script access can read page content including form fields.

The only real mitigation is being selective about which extensions you install and what permissions you grant them (even then, ownership of extensions change hands, updates can change what they do... it's a never ending battle really).

I think that's an unfair framing. No one is paying Waterfox to allow ads - it's a revenue share from the default search engine (which I've always been transparent about)[1], same as every other independent browser that has a search partner. It's not an "acceptable ads" programme where advertisers pay to be whitelisted.

[1] https://www.waterfox.com/docs/policies/revenue-model/

I've tried a few ways - people are generous with donations, but you can't really live off of it and I have a subscription based search service, but people just aren't willing to pay.

This is basically the only potential way I can keep this going, even then there may not be much uptake, but it's a hail Mary.

Librewolf and Waterfox have always had different goals. Waterfox has always had a more opinionated take on defaults and privacy. Essentially the goal has been keep the web as private as possible without breaking it (I know Librewolf is more aggressive there and that sometimes leads to website breakages) and I think I've managed that well, especially with the implementation of Oblivious DNS by default.

The upside of Librewolf being a community project is also IMO its downside - there isn't any accountability and with the current climate around the world becoming more hostile to online services, I think governance is hugely important, which is why I've tried to collate everything as much as I can: https://www.waterfox.com/docs/policies/company-information/

At the end of the day, if something goes wrong, at least with Waterfox I can be held accountable.

I get the scepticism but IMO the reaction at the time was rough and I partially get why.

System1 is a search syndication company. Their business is contextual ads on search results - no PII, no tracking profiles, no behavioural targeting. It's functionally the same model as DuckDuckGo. If I'd sold to DDG, I don't think anyone would've batted an eyelid.

I get it, the timing (privacy browser sold to company with "ad" in its description) looked terrible in a headline and I take responsibility for not communicating it better at the time, which I feel like wouldn't have led to such a massive furor.

Yes, enabled everywhere - and it will just be a simple toggle to also enable it on the search partner page, no hoops to jump through.

The hard fork was "Waterfox Classic", which just became unsustainable to maintain.

Rather than support for XPI (which is just the packaging for Firefox webextensions), the current version of Waterfox does still support bootstrapped extensions - in theory anyone can still write one, with access to all the privileged JavaScript APIs typically not accessible to MV2/MV3 webextensions.

It's not widely used though, there are two repos I'm aware of that take advantage of this:

https://github.com/xiaoxiaoflood/firefox-scripts/tree/master...

https://github.com/onemen/TabMixPlus/

I’ve found Scaleway really good, I’m surprised it doesn’t come up more often here.

If it matters, I didn’t go to them because they were specifically an EU org either - when Packet became Equinix Metal and then that got shut down, SCW were the most equivalent in terms of cost / hardware specifications and I often used them in parallel when Packet was still around so as to not have all my eggs in one basket.

Am I being too cynical, or does anyone else envision a future where you ask Chrome to buy you something, anything, online and instead of it actually buying you the “best” item, you end up with items it “prefers” where Google make money from suggestions and/or completion of sale?

I know it calls out that there’ll need to be user confirmation before the final purchase, but if you’re already not expending the effort to find the product or service yourself, are you really going to sit and research what it’s given you? If you are, then what’s the point of using the agent?

Just seems like the next evolution in Google’s ad revenue generation.

lags behind upstream Firefox in terms of security fixes

I’m not sure why this has become a thing - usually I either release Waterfox the week before ESR releases (the week the code freeze happens and new version gets tagged) or, if I’m actively working on features and they need to coincide with the next update I push, I will release on the same Tuesday the ESR releases.

You can check the GitHub tag history for Waterfox to see it’s been that way for a good while :)

I disagree that it’s fear mongering. Have we not had numerous articles on HN about data exfiltration in recent memory? Why would an LLM that is in the drivers seat of a browser (not talking about current feature status in Firefox wrt to sanitised data being interacted with) not have the same pitfalls?

Seems as if we’d be 3 for 3 in the “agents rule of 2” in the context of the web and a browser?

[A] An agent can process untrustworthy inputs

[B] An agent can have access to sensitive systems or private data

[C] An agent can change state or communicate externally

https://simonwillison.net/2025/Nov/2/new-prompt-injection-pa...

Even if we weren’t talking about such malicious hypotheticals, hallucinations are a common occurrence as are CLI agents doing things it thinks best, sometimes to the detriment of the data it interacts with. I personally wouldn’t want my history being modified or deleted, same goes with passwords and the like.

It is a bit doomerist, I doubt it’ll have such broad permissions but it just doesn’t sit well which I suppose is the spirit of the article and the stance Waterfox takes.

Looking back with fresh eyes, I definitely think I could’ve presented what I’m trying to say better.

On a purely technical play, you’re right that I’m drawing a distinction that may not hold up purely on technical grounds. Maybe the better framing is: I trust constrained, single purpose models with somewhat verifiable outputs (seeing text go in, translated text go out, compare its consistency) more than I trust general purpose models with broad access to my browsing context, regardless of whether they’re both neural networks under the hood.

WRT to the “scope”, maybe I have picked up the wrong end of the stick with what Mozilla are planning to do - but they’ve already picked all the low hanging fruit with AI integration with the features you’ve mentioned and the fact they seem to want to dig their heels in further, at least to me, signals that they want deeper integration? Although who knows, the post from the new CEO may also be a litmus test to see what the response to that post elicits, and then go from there.

I am more of a sceptic of AI in the context of a browser, than its general use. I think LLMs have great utility and have really helped push things along - but it’s not as if they’re completely risk free.

Not intended to be misleading in a way, but it is on purpose as Mozilla don’t like it when there’s mention of Firefox on the website so I make any references sparingly.

Waterfox might be what you’re after?

- Supports JXL out of the box (including support for alpha transparency and animations)

- Vertical tabs with optional tree tabs (hired the original tree style tab developer to implement the feature)

- For profit, but I don’t want your data, collect it or use it to earn a living (telemetry/analytics/experiments disabled at build time and alongside a fair few patches on top to make sure external connections are limited to what’s necessary)

Sidebar, I’m the developer of Waterfox

Waterfox, I’ve spent a good amount of time on scouring through the code looking at what to remove and the next release I’ve found some last remaining remnants to disable

I hope I don't come across too harsh in my criticism here, but this is in my wheelhouse and I like to keep tabs on the privacy browser market in comparison to Waterfox.

A bold technical choice: WebKit, not another Chromium clone

I don't find this a bold technical choice at all for a macOS only browser? I think this would be more impressive if it was Windows as well, as back (maybe ~5 or so years ago) when I was investigating WebKit on Windows, builds were not on an equal playing field[1]. So the engineering to get that up and running would be impressive.

Speed by nature

Unfortunately, as of 16:40 UTC, I am unable to run the browser (installer?) to benchmark it due to "An error occurred while parsing the update feed.", but I recall 2 years ago when I tested Orion it was the slowest of all the browsers on macOS and Safari had quite a lead. I'd also be curious, being based on WebKit, how much faster it will actually be on macOS vs Safari?

I dropped speed as a focus point on Waterfox after compilation flags started making less of a difference compared to the actual architectural changes Mozilla were making for Firefox.

Privacy etc

I think comparing to other major browsers such as Chrome the points are valid, but against Safari I'm not convinced it holds up as much. I know there is some telemetry related to Safari, but privacy is a big selling point for Safari as well and I'd be curious to see actual comparisons to that?

Safari includes iCloud Privacy Relay (MPR based on MASQUE[2]) and Oblivious DNS[3] - arguably two very valuable features that a company at a scale like Apple can subsidise.

The entire AI section also feels like trying to have it both ways as well. They criticise other browsers for rushing AI features, position themselves as the "secure" alternative, then immediately say they'll integrate AI "as it matures." This reads more like "we're behind on AI features" than a principled stance. If security is the concern, explain your threat model and what specific architectural decisions you're making differently? Currently Firefox has kept AI out of the "browser core" as it's been put, and I don't see them ever changing that.

Kudos that they have >2000 people paying for the browser directly, but I will say it doesn't excite me to see another closed source browser entering the market (I don't see any mention here of open-source apart from mention of WebKit being open source).

I do realise this is more a marketing post than an actual technical deep dive, but so much is just a rehash of every feature almost every modern web browser has?

I'll keep updating this comment as and when I can explore the browser itself a bit more.

[1] https://fujii.github.io/2019/07/05/webkit-on-windows/

[2] https://datatracker.ietf.org/wg/masque/about/

[3] https://dl.acm.org/doi/10.1145/3340301.3341128

I can attest to that! While I never reached the upper echelons of virality that other browsers in recent memory have, I had much the same experience with Waterfox. Right place, right time gave it its initial user base: posting about a 64-bit build of Firefox on the Overclock.net forums. It hit the right time as people were starting to switch to 64-bit Windows and upgrading their hardware to match

I think that first week the project got 50k downloads! I was of course only 16 so had no concept of what to do but just keep getting new builds out - after all I made the builds because I couldn’t find anyone who would consistently and regularly do so.

Currently only Google, but Brave and Mojeek are going to be made available as well very soon

Not quite independent as it’s a meta-search, but I developed a subscription based one at search.waterfox.net. Pays for the infrastructure costs and remains ad/tracking free.

Waterfox (which I maintain), Tor Browser, Mull (based on Tor) and I assume LibreWolf as well?

I understand why Mozilla have started implementing these features, it seems to have more mass market appeal than not - look at how popular “AI” powered browsers have become.

But boy does it not add extra effort removing these features every time there’s a new roll-out and it’s not done the best way IMO. I feel as if these features would go down better if Mozilla actually notified the user that they’re available and then offered whether to enable them or not (could have them enabled by default for new users). That way you’re still giving a choice, but in a more respectful manner.

If anyone is interested I’ve gutted all the more obscene stuff out of Waterfox and have instead left the useful ones such a ML translation, which is opt-in.

Related: I feel like onboarding is a lost art, more software should bring back software wizards and UI tours. Feels like you somehow have to intuitively know how something works (unlikely) or do a web search on how to use everything instead of having it shown to you nicely.

You can see here[1], I'll avoid pasting again. But yes, can still use a Mozilla account and the website is getting a refurb - I will add a third hard thing in computer science.. letting people know all the things you've actually built :')

[1] https://news.ycombinator.com/context?id=43206110