If you are on Linux and want to stay private, Konform Browser is to my knowledge the only actively maintained Firefox derivative which will initiate 0 connections to Mozilla (or other) servers under default configuration.
Posted about it the other day here. Spread the word :3
Update: Latest release now has updated preferences pane. Took the opportunity to include some other small changes in that area from the backlog while at it. Improved thanks to your feedback ^^
Well, you did help with identifying at least one bug: The hints on Konform preferences pane still contained confusing and misleading wording leftover from LibreWolf and I can totally see how it would lead you to believe that enabling that option was a good idea. It was also a bit hectic with all the hints being "warnings" when several of them are more informational. Sorry for the confusion and thanks for mentioning it. Did some changes there today so the pref pane should be calmer and more helpful from next release.
On the CF part, one thing I missed in my previous reply is that they do have reporting channel for users. If you are OK with the data sharing that comes along with that, it could be helpful.
If none of the above resolves your issue, contact the website administrator with the error code and Ray ID or submit a feedback report through the Turnstile widget by selecting Submit Feedback.
Glad you figured it out and hope it keeps working without hitches from now on! I'm curious what error you got (feel free to DM) as I do installation in trixie with copy-pasting repo from the package registry instructions as part of testing process and I didn't catch any issue with that. The format in the instruction is an older one than the one you list (yours is correct and preferred in any case) but works on my trixie installs so far.
I am aware of issue with RPM repo instructions not working, though. Should be fixed in next Forgejo update. These should work.
Thank you for kind feedback! I'm glad you dig and that it fills a spot! Internal network management is very much one of a few use-case categories that's been motivating this.
I have a question. I’ve read that you position Konform closer to GNU IceCat than to LibreWolf, which makes me worry: does Konform provide at least the same level of fingerprinting resistance as Librewolf does, , if I 1) revert “Allow non-default theme” and 2) re-enable “Enforce OCSP hard-fail” in settings?
I don't understand the IceCat reference. Anyway, I would argue that Konform Browser has stronger privacy defaults (including less leaks for fingerprinting) and the focus is a natural part of the projects privacy goal. Reverting "allow non-default theme" makes sense but I'm wondering about your motivations for OCSP? I don't think it should do either for or against vs sites, and if anything making the situation worse vs service provider(s).
I believe what you probably want instead is CRLite? Will be enabled and receive updates for presets other than Purely Private.
And my first bug report:
Hm, that's unfortunate. But it's also not clear to me if this is a bug in Konform Browser or not. Only Cloudflare would really know. Possibilities:
False flag or misclassification from Cloudflare1 (ie the bug is @ Cloudflare)
Legitimate block at Cloudflare. For example, previously they might have been able to categorize with decent certainty in a "LW users on Linux on Tor" bucket but you are fuzzier and get treated like "sus" as you're not distinguishable enough from skillfully deployed spambot anymore. Should be resolvable on case-by-case-basis by site operator, still. This is unfortunate situation and not really something we can address without more specific information2
If you get consistently blocked with Konform but not with Tor Browser / FF ESR over Tor, that's an indication Konform might be distinguishable and treated differently and if so, that could be a bug in Konform Browser. If you can pinpoint what makes the difference, that would be very useful to know. "Cloudflare is blocking me at this site" is unfortunately not really actionable but if a behavioral difference can be identified, it's possible that it can resolved by change in Konform.
In case it's not as straightforward, and a workaround would involve something like selective UA-spoofing3, I don't think that's something we would work on or implement. If the site has a selective allowlist of UAs, that's either "working as intended" or a bug on their end, not something I think of as a bug in Konform. Resistance against censorship is of course not undesired - but privacy and security are still the higher priorities.
Still, Konform Browser does bundle WebCompat system addon just like FF. So the third path for fix, if only site-specific workaround can be identified, and the issue can be reproduced in FF ESR (maybe by applying KB userprefs), I think it could be to addressable by reporting and adding such workaround.
Does Cloudflare reliably distinguish between users of LW/FF RR, and KB/TB/FF ESR, etc as part of this turnstile page and does that contribute to the difference outcome you see? If so, how exactly is it done and how exactly does it contribute? Is it explicit or emergent? We don't know. Assuming answers to first two are yes and yes, the difference could even be explained simply by difference in user numbers. Best we can really do is striking a balance between closing the gap and closing leaks of entropy.
If nothing else, it might just work itself out over time due to unrelated changes on either side. If not before, I expect the ESR bump in a few months could "magically" sort these kinds of things out.
1: Cloudflare only provides support to their customers; not mere mortals like you and I. Resolution path: User (eg you) reaches out to site (ie NexusMods) who can then either 1) change their CF configuration or 2) contact Cloudflare who may or may not fix the issue.
2: DM me if you actually want to dig into this!
3: Konform is as vague and static as possible while conforming to FF ESR/TB format
It does! While existing userprefs should work for enabling the feature and setting your own syncserver endpoints as expected, Konform Browser also has basic UI for convenient configuration of custom sync URLs under about:preferences -> Konform Browser. Please report if any issue with that <3
Maybe you already figured this out but I think it's a common gotcha:
Wireguard AllowedIPs means just that: IP addresses that are allowed to be routed over the tunnel.
There is nothing that says that you need to have 1-to-1 mapping between that and actual routes. Most of the time it's what you want but there are situations where you want it different. Some people have a wider subnet for AllowedIPs but only add certain routes specifically.
wg-quickadditionally adds corresponding ip routes as a convenience. systemd-networkd did at some point but don't anymore. I'm not sure what NetworkManager's Wireguard plugin is even supposed to be doing there these days. Most of the time what looks broken is actually a result of unclear documentation and a mismatch in assumptions between dev and user.
It's an understandable source of confusion and the tools don't always help when they try to.
Just to be clear, most of these (think about egrep/fgrep for a moment) are deprecated and "shouldn't be used" in scripts for distribution. What's new is that you can't expect everyone else to have them and having dependency on them in shipped software is considered antipattern.
Nobody gives a shit what aliases and shims you use in your own shell.
On iptables: By now it's even gone from kernel and the turn tabled with the cli command now actually being a shim calling into its successor nft. IMO nft is much more approachable for beginners to pick up and the rules files become so much more readable and maintainable. If you're already committed to iptables syntax then cool - but with very few exceptions I don't think anyone needs to learn iptables today - just go straight to nft and you'll be happier for it. Similar for ifconfig.
Oh actually I wouldn't know - maybe it's one of those funny crossovers! Will have to remember asking about it next time I meet my Brazilian friend. If it works for you then why not ^^
X.Org Server's "Master" Branch Now Closed With Cleaned Up State On "Main"
Relatedly, check out AdNauseam.
https://github.com/dhowe/AdNauseam/
https://adnauseam.io/