Zen browser(Firefox based browser) had a backdoor enabled by default. (news.ycombinator.com)
from Tea@programming.dev to firefox@fedia.io on 22 Mar 10:52
https://programming.dev/post/27344040

Relevant: github.com/zen-browser/desktop/pull/927

#firefox

threaded - newest

jmcs@discuss.tchncs.de on 22 Mar 11:11 next collapse

enables remote debugging by default and removes the prompt

I thought it just allowede easier debugging, sorry

Dunning–Kruger strikes again.

Unfortunately browsers are probably the single most complex piece of software in a computer nowadays, and doing it right is very difficult if you don't have the resources to back it up. And it doesn't help if it's being done by someone that removes security warnings because they don't understand them.

notanapple@lemm.ee on 22 Mar 11:47 collapse

This. I personally avoid random firefox forks because there is such a large surface to make mistakes or hide backdoors. If people want a private, hardened firefox, Mullvad's fork (or Tor) is the best option. If you only want to disable telemetry, you can use betterfox user.js with Firefox.

pfr@lemmy.sdf.org on 22 Mar 11:21 next collapse

Fuck! I was just starting to like that browser. Back to librewolf

southsamurai@sh.itjust.works on 22 Mar 13:51 collapse

It's fud

pfr@lemmy.sdf.org on 24 Mar 09:10 next collapse

Damn, I'm glad. I took the bait for a second there

FeelzGoodMan420@eviltoast.org on 24 Mar 11:52 collapse

I’d expect nothing less from these fucking Garbage firefox communities. They were dogshit on Reddit and they’re dogshit on Lemmy.

notanapple@lemm.ee on 22 Mar 11:42 next collapse

This is apparently an old issue that somehow got resurfaced again (pull).

tl;dr dev had enabled remote debugging back when the project was new to make debugging easier, apparently forgot about it, someone noticed and reported it, dev apologized and said he was learning and won't do it again:

Maybe I underestimated the actual risk of this? Yes, but again, it was probably on the first month of development, we learn from our mistakes so we can now provide the most private and secure experience we can. Thanks

deroyonz@lemmy.zip on 22 Mar 17:02 collapse

this looks like a project of one random guy who has now all of a sudden found themselves in charge of maintaining a super virally popular browser, after Arc Browser was left to die in maintenance. That star history on their github readme is insane.

This is to say, they are probably under a lot of pressure right now dealing with the responsibilities of a big browser, and do not necessarily have the manpower and knowledge to handle it all promptly. If you guys want this browser to succeed, consider helping the dude out, it is open source after all. I hope they can hire a team or something, maybe get a security focused person