Bonum Certa Men Certa

Don’t Use Mozilla VPN (Security Problems and Incompetence); Just Get Mullvad. Bonus: SeaMonkey 2.53.17, WEI, Firefox on Linux Getting Worse.



No FirefoxReprinted with permission from Ryan

Don’t Use Mozilla VPN (Security Problems and Incompetence); Just Get Mullvad. Bonus: SeaMonkey 2.53.17, WEI, Firefox on Linux Getting Worse.



The special client that Mozilla VPN has for Mullvad (they use Mullvad’s VPN network) has a really nasty security hole that Mozilla has failed to address properly.



The long story short is that Mozilla incompetently designed their client software, then refused to fix the problem for over three months after a security researcher at SUSE reported it to them, at which time it was publicly disclosed.



This is Microsoft-like in how Mozilla responds to security problems. Microsoft typically waits until it’s an emergency and there’s malware making the rounds and they’ve taken a completely unnecessary PR black eye by having to be outed as not caring about security.



And why would you want security in an operating system or some Virtual PRIVATE Network software, right?



Mozilla essentially just repackages Mullvad VPN which already has an excellent privacy policy and open source client that has worked fine for me. Every once in a while I just grab the latest RPM, verify it, and then unpack it on top of the last one using dnf. It works great. I have had no problems with Mullvad VPN.



Basically, Mozilla’s contributions here are raising the price, having a privacy and terms of use policy that go on for miles so you could be selling them a kidney (Who knows? I’m not a lawyer and I don’t have time for this shit.), creating a really piss-poorly designed client (calling it bad would be praise at this point), and then not fixing gaping security holes in it.



To make matters worse, the idiots running Mozilla seem to think that “Linux support” means you shit out an Ubuntu package and ignore the RPM users when making an RPM isn’t even that hard. So apparently they don’t need the money badly enough to have an RPM build bot.



Roy Schestowitz asked me what I’m using lately for Web browsing. I have a really highly custom-configured SeaMonkey 2.53.17 from Fedora RPM, followed by GNOME Web (WebkitGTK), followed by Firefox ESR 115.1, as of this writing. I also have Brave because it’s Chromium without the spyware and garbage. Like Google’s new total Web DRM and super-cookie (WEI and FLoC).



SeaMonkey is certainly not perfect, but NoScript and ubo-legacy make it much more tolerable and secure. I only allow limited amounts of JavaScript and I have some useragent hacks (including so Google won’t log me out of GMail and say my app isn’t secure), and overall I mostly have it set to tell Web sites I’m using Firefox ESR 102.14. It’s a lie, but any sites that detect UAs and break themselves on purpose don’t deserve the truth.



Since I don’t know what will happen when I click on a link for a bank or something, I use “Standalone SeaMonkey Mail” and told it to open /opt/firefox, but not to open links I middle click on anywhere else in Firefox.



The extension also added a right-click menu item to SeaMonkey called “Open in External Browser” so if I hit a page that really doesn’t want to cooperate, I can press that and open the link in Firefox and then close Firefox again. In a way, Firefox ESR is sort of like the “Open in Internet Explorer” I was using in Mozilla Suite sometimes on Windows back in the day. The wheel turns, does it not?



Then I have Palefill (intended for Pale Moon) which applies hacks to make some bad Web sites work in SeaMonkey by rewriting the offending function in a way that works. That’s why I can use my WordPress editor right now.



SeaMonkey 2.53.17 (at least on Fedora) seems to have made some good improvements to Web standards and quality of life (you can more easily add search engines to it now and HLS video sites and MPEG-4 codecs are working again.



Another reason I like SeaMonkey is you can set global prefs and then give individual sites the right to do something else. Something Mozilla pretty much got rid of in Firefox a long time ago. Like, I don’t let sites set cookies in SeaMonkey that persist longer than that browser session, but my search engine and a few others get exemptions (“Allow”) as easily as right-click, view page info, Permissions.



This is important because sites like Reddit track what users who don’t have accounts look at with a 15 year cookie. The point is mainly to tie together a user profile across multiple VPN servers, on and off the VPN, and through different ISPs and WiFi networks. Truly nasty.



Then there’s ChatZilla. So I have an IRC client too.



The Mozilla Suite (which is what Netscape 6/7 were based on) went on as SeaMonkey for a lot of reasons, but mainly because the development practices at Mozilla went on in the wrong direction to the point where they ship a lot of broken crap. The particular person they complained about is at Google now working on Chrome, but there’s bigger problems.



Going back to Mozilla VPN.



Given their generalized incompetence in making software for Linux (Firefox is basically being held together by bird shit and Red Hat patches at this point.), it does not surprise me at all that nobody there, at this company looking to make a quick buck and then call it done, bothered to use PolKit correctly. They obviously gave this one to some pissed off intern or something, and it’s not at all secure and you have to wonder what other horrors are in there.



Even when it comes to Firefox, Mozilla still defaults to giving Linux users software-decoded video, X11, and non-accelerated “WebRender”. You have to dive deep and set environment variables and about:config crap to get it running as well as it does on other platforms.



They half-ass everything on Linux, the only platform where their stinking rotting mess is even the default, and then they pack it full of adware, spyware, and DRM, and wonder why everyone moves to another browser.



The problem is that this other browser is often Google Chrome, and as Vivaldi put it, Google seems to abuse their marketshare to inflict another horrible “proposed standard” that chips away at the open Web every day.



When Google Chrome started out in 2008, it was obvious to me then that Google had ambitions far beyond being a search engine. The only possible reason to not keep sitting back and paying Mozilla to be a Web browser company was that they planned to dump unlimited money into Chrome while slowly bleeding out Mozilla until it couldn’t operate any longer.



As Chrome grows, the open Web is in more and more danger. They’re now in a position to demand not only crippled ad blockers, but a “standard” that won’t allow you to view a site even if you use a proprietary one that has been attested to by an NSA/CIA-affiliate such as Google, Apple, Microsoft, and MAYBE Mozilla.



Tor would be finished, SeaMonkey would be finished, GNOME Web finished. Linux with anything? Who knows. “Here, run this!” What’s in it. “Fuck you.” -Google



That is WEI in a nutshell. And Mozilla will pretend to push back and then go ahead and swallow, like Widevine.



Recent Techrights' Posts

Our Three Lawsuits Against Microsofters Are About to Become a Lot More Relevant to GNU/Linux
The Master will easily understand why Garrett has been attacking me since 2012
They Don't Tell Us that 'Digitalisation' (Now Sold as "Hey Hi") Just Means Customers Become Unpaid Staff and Are Made Accountable
People are being conditioned to associate technology with something undesirable, at times even unbearable
 
New and Old
On Ageism in Tech
Slop Is Not Intelligence and It Does Not Enhance Productivity
Like voice dictation, which cannot tell the difference between "sheet" and "shit"
EPO Crimes Are Spreading to the British Court System
Society is now paying the price for failing to tackle crimes at the EPO
It's Time to Dump SharePoint and Here's What to Use Instead
Nextcloud, ownCloud, Bookstack, MediaWiki, and MediaGoblin
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, July 22, 2025
IRC logs for Tuesday, July 22, 2025
Brett Wilson LLP Has Gone Silent
Sometimes silence says more than nothing at all
Slopwatch: LinuxSecurity, Planet Ubuntu, and LinuxTechLab
some slopfarms show no remorse and they don't value their reputation at all
Links 23/07/2025: Book Bans, Storms, and Kangaroo Court for Patents Commits More Unlawful Acts of Overreach
Links for the day
Gemini Links 22/07/2025: Thinkpad and Pinephone
Links for the day
Links 22/07/2025: "Blog Restart" and Microsoft Clobbered by “ToolShell"
Links for the day
Global Warming and Global GAFAM Energy-Wasting
Burn more money (borrowed, loans), then hope the waste will somehow translate into profit?
No Compliance With the European Patent Convention (EPC) at the European Patent Office (EPO)
It's about preventing competition against this autocracy
Blue-Collar Trolls vs White-Collar Trolls
Examples of white-collar trolls
Apple Vision Pro Failed So Badly That Its Sales Are About 2,000 Times Smaller Than iPhone Sales
What's left for Apple to offer other than hype?
To Millions of People "Year of the Linux Desktop" Was Some Time in the 1990s (Bootable GNU/Linux as a Complete Operating System is Over 33 in Age)
In some sense, "year of the Linux desktop" was 33 years ago
Make No Assumptions (or Demands) About the Screen Resolution Used by Other People
There are usability aspects, aside from accessibility aspects
Why Wayland (and XWayland) Won't Solve the Key Problem It Proclaims to be Tackling (the Same Is True for Rust)
The problem isn't Wayland per se but the false promises and efforts to force everybody to move to it whilst insulting or demonising everyone who won't play along
Diplomatic Immunity Should Not Exist for Anybody
The EPO in its current form gradually 'normalises' the end of European democracy
Brett Wilson LLP Stopped Sending Me Papers When I Showed It had Sent Me Over 5 Kilograms of Legal Papers
A week ago we lodged our third lawsuit
Microsoft Mass Layoffs and Shutdowns Became the New Normal at Microsoft
Microsoft mass layoffs became a topic of everyday media coverage since May
Amazon Web Services (AWS) Has Layoffs and Microsoft Gaming/Entertainment Division Has an Uncertain Future
it's good to see all those horrible things crashing and burning
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, July 21, 2025
IRC logs for Monday, July 21, 2025
FSF "Raised Almost $139,000 During This Summer Campaign"
"Thank you for making a stand against dystopia!"
Gemini Links 22/07/2025: VPS Exploited and Fear of View
Links for the day
LLM Bots vs Techrights
Slows things down a bit
New Publication Sheds Lights on Abuse of Workers at the European Patent Office (EPO)
Put in simple terms, they're killing the Office, harming remaining staff, try to hire rubber-stampers
Links 21/07/2025: Hardware, Health, and Imperialism
Links for the day
Gemini Links 21/07/2025: "When Buying Isn't Owning" and "CMS Special Edition"
Links for the day
Links 21/07/2025: Indie Web and Toxic Politics
Links for the day
[Meme] Microsoft Lawyers Throwing Stones in Glass Houses
threatened me with bankruptcy
Google "AI Overview" is Not AI and Not Overview
do not be misled; what Google does isn't smart, it's just ripping off the sites it already crawled for as long as 27 years
Making the Case to Dump Microsoft and GAFAM for National and Digital Sovereignty
"Sovereignty is difficult"
The Tactics of the Opposition (Microsoft Lunduke): Associate With K00ks, Throw in Vaccines to Muddy the Water
Who stands to gain from this?
Europe's Second-Largest Institution (EPO) and Largest Patent Monopoly Office Needs More Transparency, Not Less Transparency
In the EPO, what good are elections when one candidate literally bribes all the voters?
How Not to Report News About Microsoft
This pattern of misreporting is so widespread that it's hard to believe it's not intentional
Computer Science is Under Attack, They Want Everyone to be a Consumer
If people can no longer acquire Computer Science education and real Computer Science experience, they will not know how to control their own digital destiny or emancipate the very same universities that now control the syllabus and instead of teaching Computer Science encourage the outsourcing of systems
The Best Tools Are the Simplest Tools
There's a hidden message here about the merits of sticking with X
Ofcom Online Safety Group Speaks of Protecting Women Online, Will Brett Wilson LLP Ever Listen?
They've essentially became like the Taliban's "burka police"
Social Control Media Relies on Advertisers, So It'll Always Be Hostile Towards Free Software
Sales, sales, sales
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, July 20, 2025
IRC logs for Sunday, July 20, 2025
Fragmentation of Data
Life is too short to "hoard" data
In Defence of "Spinning Rust"
Just because something is "old" (or older) doesn't mean it ought to become extinct
Using Free Software to Prepare Legal Documents
LibreOffice is openly complaining about OOXML as an obstacle
Tech and Technology Are Not the Same Anymore
"Are you into tech, Sir?"
Our Articles About SLAPPs Receive Recognition and Interest
This week we shall continue writing about the 3 lawsuits we filed