Konform Browser and other bits and bobs.
- 1 Post
- 12 Comments
1·2 days agodeleted by creator
101·4 days agoLet’s not forget that Win7 was almost 25% as responsive as Win2k3, which could even hold a candle to GNOME.
No mention if it is EME-Free (no DRM playback possible)
DRM/EME/WidevineCDM integration disabled by default. They can still be enabled via the usual preferences. They will also be fully enabled like in FF (including downloading and installation of trusted binaries) if user enables “Just Make it Work” preset.
Settings and prefs and bookmarks sync is a strong want from me, I just want to do so self-hosted, and not via Mozilla’s servers.
Konform Browser still supports enabling that and has UI to make configuring custom Sync- and Accounts server endpoints more straightforward.
Separately, profile import feature also supports other Firefox-based browsers as of recently.
Not like Apple cared to look at it when people reported it to them. So much for App Store safety.
1·19 days agoA dedicated Forgejo instance
f.example.com.For a small set of trusted “base” images (e.g.
docker.io/alpineanddocker.io/debian): A Forgejo Action on separate small runner, scheduled on cron to sync images tof.example.com/dockerio/usingskopeo copy.Then all other runners have their docker/podman configuration changed to use that internal forgejo container registry instead of
docker.io.Other images are built from source in the Forgejo Actions CI. Not everything needs to be (or even should) be fully automated right off. You can keep some workflows manual while starting out and then increase automation as you tighten up your setup and get more confident in it. Follow the usual best practices around security and keep permissions scoped, giving them out only as needed.
Git repos are mirrored as Forgejo repo mirrors, forked if relevant, then built with Forgejo Actions and published to
f.example.com/whatever/. Rarely but sometimes is it worth spending time on reusing existing Github Workflows from upstreams. More often I find it easier to just reuse my own workflows.This way, runners can be kept fully offline and built by only accessing internal resources:
- apt/apk repo mirror or proxy
- synced base container images
- synced git sources
Same idea for npm or pypi packages etc.
Set up renovate1 and iterate on its configuration to reduce insanity. Look in forgejo and codeberg infra repos for examples of how to automate rebasing of forked repo onto mirrors.
I would previously achieve the same thing by wiring together more targeted services and that’s still viable but Forgejo makes it easy if you want it all in one box. Just add TLS.
1: Or anyone have anything better that’s straightforward to integrate? I’m not a huge fan of all the npm modules it pulls in or its github-centric perspective. Giving the same treatment to renovate itself here was a little bit more effort and digging than I think should really be necessary.
Hard to give good advice without knowing more where you’re @. Leaving out the human and organizational aspects, which might be at least as important:
It could do you well to “harden” your environment and take a hard look at the software you are already running, what it does, and how it got there. Try to remove rather than add. Reduce your surface-area and exposure. Consider what options you have to isolate and “lock down” what remains.
Cut out or replace any software that calls home. Isolate and sandbox things. Take a critical look at your supply-chain(s): Are you satisfied with your repos/registries/installation methods? How auditable are your services in reality? Can you improve on that? Are there things that should be mirrored and/or built from source? (BTW, reading the source of the stuff you use and rely on and building it is a good exercise in itself whether you end up relying on the output or not)
Get familiar with relevant monitoring and debugging tools for whatever you have. Learn how to verify and validate your assumptions of “what is going on”. This probably involves getting comfortable and intimate with traditional data-engineering processes and tooling.
This applies to everything: shared infrastructure “in the cloud”, IDE and browser on your local workstation, transitive dependencies of apps you are working on and their toolchains, etc.
Maybe you need/want to set up some mirrors and dedicated CI. Forgejo is one easy way to get started as it comes with a lot of the components you need in one package.
If not used to doing so already, force yourself to think from first principles. Take less things for granted. Practice active threat modeling. Think about trust. Audit yourselves.
The “Sec” part is more about processes, focus and mindset. What tools are important can vary widely depending on what you have to work with.
Or further favourable: Konform Browser.
Tor Browser and Mullvad Browser also worthy mentions.
Grumpy ken thinks “Just use Foo” meming is promoting mindless use and I think should therefore be discouraged. Even in jest I think this affects us subconsciously to feel more comfortable with not thinking deeper for ourselves. Even if X is the right one. “Use Foo already!” is nicer~!
If I may illustrate:
Use Konform Browser1 already!
1: Disclosures: Am dev; is LibreWolf fork
Konform Browser is more recent Firefox (actually LibreWolf) fork which goes even further in debloating, removing “AI” functionality and disabling remote connections. It’s based on Firefox ESR (like GNUZilla IceCat).
If you have concerns about the telemetry and browser metadata privacy parts of AI integrations, I think Konform, IceCat, Waterfox and Mullvad Browser are a lot more relevant than Zen…
China, known for not caring about its supply-chain and outsourcing everything to other countries? It’s funny how they never seem to strategically build alternative pipelines for anything.
/s
TailsOS users who care about opsec would never have enabled HTML emails with loading of remote resources and JavaScript execution in the first place, right?