List of Hosting Providers That Accept Cryptocurrencies or Cash as Payment

[Patrick]

This is getting super comprehensive. Probably a new forum thread would be great.

FranklyFlawless/FlawlessFox: FlawlessFox is a privacy-hardened Firefox fork built from source with compile-time removal of telemetry, crash reporting, and DRM. - Forgejo: Beyond coding. We Forge. - Is this AI generated?

Do you speak C++, rust?

How long does it take to build from source code?

Also important: Binary Build Locations? Project Controlled Builds or Third-Party Controlled Builds?

I am not sure Kicksecure could require project controlled builds as a criteria because other browser projects may also not have this feature. If it was an in-house browser project, then the criteria would be more stringent and this would be a criteria.

Another Kicksecure not-yet-criteria for browser projects are supply chain risks. For example: fix(build): use rustup instead of Debian-packaged Rust · e59f580521 - FranklyFlawless/FlawlessFox - Forgejo: Beyond coding. We Forge.

curl --proto ‘=https’ --tlsv1.2 -sSf https://sh.rustup.rs | sh -s – -y --default-toolchain stable

It’s a curl bash pipe.

curl bash pipe - Security Discussion

And it lacks Verifying Software Signatures and therefore violates Kicksecure Digital Signature Policy.

It’s not a criteria yet for Kicksecure default browser choice because I didn’t survey yet how other browser projects handle this.

@FranklyFlawless

@Patrick

Capitalization is reasonable. Which are the most successful projects coming to mind and their names?

The only one off the top of my head that is maintained now and is close to Kicksecure’s criteria, other than my fork, is LibreWolf. I suppose the other approach is to look at what SecBrowser was actually deriving from originally:

1. Base Browser
2. Mullvad Browser
3. Tor Browser

These names simply have “Browser” at the end, so half of the equation is already done for you with this interpretation, although I would not necessarily use “Base”, “Kick”, or “Secure” as the initial word in this pairing.

Simple and brilliant. Yeah. Why not add “Browser” as the second word.

You can also widen the search. What are successful project names generally? Microsoft? 2 words only. Simple. But hard to argue its success is based on that since they existed for decades already.

@FranklyFlawless

@Patrick

The important part is “removed from the source code entirely”.

That’s not an easy task at all. And probably requires a hard fork.

It does not require a hard fork, and this is already done now, so I will explain in simple terms:

1. Building Firefox requires selecting or omitting compile arguments, along with values, typically Boolean(-like) in nature, or an empty string
2. Those arguments define what code to compile or not

Here is an example of DRM being compiled out, meaning that the entire source code

Interesting.

I mean, yeah, if it works…

@FranklyFlawless

That is the easy part, I already reviewed all of the build options (including implied options), and for FlawlessFox and BaseSecure (tenative name), they are identical at compile time, so they share identical maintenance. In a nutshell:

1. Mozilla releases a new Firefox version
2. I manually merge the new tagged version
3. Then two situations:
4. No compile options changed between versions, remaining CI/CD pipeline passes automatically without manual intervention (expected)
5. Compile options has been changed between versions, I manually audit/review them, commit, then CI/CD build passes (fallback, very easy maintenance)

I did all of the initial work upfront, so neither of us have to do much about compile options long-term.

Sounds good.

@FranklyFlawless

On my way there, not a problem, adversarial suite is near the end of the roadmap, dynamic analysis will be addressed around there in due time, here is a sneak peek:

Excellent.

@FranklyFlawless

@Patrick

Requires reasonably stable funding and multi team-member project.

It does not, it only takes one person, one CI detection runner triggering a cron job at 6 UTC everyday (upstream-sync.yml), and one Python script (upstream-sync.py) to create an issue for me to manually merge the new upstream tag.

• Long-term maintainability: The browser project should be active and well-funded (or backed by a strong community), with regular security updates. If it’s abandoned or poorly maintained, users could be left vulnerable to known exploits. Also, switching browsers is hard for some users. Therefore, the default browser must be a stable choice for years.

This criteria is more about the “bus factor”.

Home

docs/checks.md

@FranklyFlawless

I was already maintaining my own runtime preference files, but after I decided to start a Firefox fork, it made sense to consolidate them:

FlawlessFox/flawlessfox/profiles/flawlessfox/user.js at flawlessfox - FranklyFlawless/FlawlessFox - Forgejo: Beyond coding. We Forge.

Very cool.

@FranklyFlawless

Arkenfox “only” maintains a comprehensive user.js file, but ignores the compile and other runtime layers, whereas my Firefox fork will address every layer and every parent-child dependency between and within them, all the way down to the C++/Rust source code for complete static analysis defense-in-depth.

Great!

@FranklyFlawless

However, the devil is in the details.

Yeah, I am very much expecting a rabbit holes.

@FranklyFlawless

GNU IceCat realized this and applied explicit source transformations during the compile process,

Interesting. Got any references?

@FranklyFlawless

but line-oriented sed is fragile and unmaintainable because there is no registry to keep track of every new, changed, or deprecated parameter.

Yes, that sounds super fragile and unmaintainable.

@FranklyFlawless

The best part is that I already have all of the experience I will ever need because of the Whonix Wiki.

@FranklyFlawless

The only hard part is deciding on a ideal name for the Kicksecure browser, because that is simply not my decision to make.

For now it’s your decision to make.

I don’t have the bandwith for In-House Browser Development and would prefer if this is maintained as an independent project and gains traction. I do depend on the wider community to scrutinize the project.