This approach also assumes that you then compile the browser from source yourself (and also do that for each future update).

Yeah, and we know it's relatively common for open source projects to end up with malicious code in them unless the project has maintainers that can be trusted.

I have LibreWolf installed and I use it from time to time (although I prefer Brave), but I don't have that much trust in project as is. I think if it had sponsorship and could afford to pay a few reputable pro-privacy developers to maintain the project then there's less risk, but as it stands is anyone honestly looking through all the source code to validate their pro-privacy claims? And even if they did, could you trust them or their releases?

If I have to read and understand all the diffs myself I might as well maintain my own fork.

Just like that North Korean symbol downloader on GitHub, which had a malware downloader hidden in plain sight for nearly a year with no one noticing?

There are far more eyes on firefox and it's hardened forks, then on a random/obscure piece of software (sorry, I have no idea what exact malware you're referencing).

And as has been proven many many times, more eyes don't result in better code reviews.

On the other hand, on might ask: How long would it have gone unnoticed if the source wasn't open?

> it's open source, you can simply look at the code (or, better, at the differences with firefox)

Are you really serious? Firefox source is 21 million lines of code.

The diff between Firefox and librewolf is not that big though.