The two closest build systems I’ve seen to getting it right: Nix (closest) and FreeBSD ports.
I’ll use the i3 window manager as an example. There are plenty of forks of i3 out there (example: adding space between windows, rounded corners, i3bar mods, etc). They’re each packaged and published as separate packages! You can’t compose them even though many of their changes are compatible. This leads to packages like i3-gaps-rounded.
What I really want out of a package manager is “patch support” - where I can publish, discover, share, and consume patches on top of the OSS I use.
Nix gets really close to this. I haven’t invested enough time in learning Nix yet, but it’s on my bucket list. Currently I use FreeBSD and use their ports collection for i3, and put all of my patches in the patch directory there. FreeBSD will apply the patches in order and then build the package for me.
I’m not sure exactly where I’m going with this rant beyond: I wish OSS package management adopted less of a producer-consumer relationship and more of a peer relationship when it comes to source code management and builds.
I would definitely recommend giving Gentoo a spin!
I wasn't that much concerned with it until recently. I got into the idea of the whole "website as app," thing (specifically, client-side you turn a website into a self-contained app, with or without the "sites" permission) -- and to find that Firefox had dropped this is disappointing because it feels well within Firefox's mission.
FWIW, presently I'm solving this through GNOME's Epiphany.
I feel like this is a common thing with forks and alternatives, they usually have a basic list of big differences (like Librewolf with saying it's more private).
But I'd like to know how they do that, are they blocking more cookies? Are they making the browser harder to fingerprint? What am I giving up vs Firefox (ie; sites breaking, or missing features like sync)?
> Firefox security patches are applied to prevent vulnerabilities
You are right about the reputation of the maintainers of LW though. The second this becomes abandonware I will ditch it.
Sure, but at what rate? If Mozilla releases a critical patch today, and the core maintainer responsible for build maintenance is away on vacation for two weeks, what happens?
Timely maintenance is also problematic with hobby closed-source projects or hobby apps on closed platforms, like iOS and Android.
Mozilla gets paid $500m a year by Google so that Google can be default search engine on Firefox. They have the money that keeps them "incentivized" although they are FOSS and nonprofit. Or in another words Gitlab and Github FOSS devs do not have salaries like Mozilla people do, the only thing they get is an occasional donation.
It's great when a fork ensures that it is always taking security patches from upstream. But what about the code unique to the fork? Is that new code following the same security practices as the upstream project? Are enough eyeballs poking at it to get it the same security scrutiny as upstream?
* Needing to constantly monitor whether the fork is being actively maintained, or if it's a vanity project which abruptly stops/slows down updates when its owner/principal contributors lose interest.
* Needing to constantly monitor if the fork is using the latest official Firefox builds to make sure that it's also getting the latest security updates.
* Not being readily able to see a complete humanly understandable (meaning not just comparing git versions) list of changes that the fork makes to the official build.
* Not knowing the reputation of the developers behind the fork.
In sum, I basically trust Mozilla more than I do $random_fork_developer, so I use the official build and carry out my own tweaks, but I am always on the look out for more tweaks, which is why I'd appreciate if lists of privacy tweaks custom builds do were more transparently shared.