Sounds frustrating and I can see how that can be confusing. Had similar peeves with other imposed limitations that initially drove motivation of developing this project so can relate!

While we have to recognize that there is inherent conflict in expectations of “browser doesn’t disclose my location” and “website knows my timezone” and that Konform Browser will continue defaulting to privacy, you highlight gap in UX and user control that I agree can be improved on. Shouldn’t be too much work to add more make more discoverable selective settings UI for this too in a future release.

There’s some other aspects that often play into this particular scenario and can vary per site:

• Apps showing relative time like “10 hours ago” or “in 15 minutes” should not be affected by any of this.
• Scheduling for events on services like the ones you mention also shouldn’t be affected by this: Time for events is global but display will be affected.
• There are are a lot of bugs in webapps out there that can be interacting with localtime in incorrect ways. It’s complicated¹.

Try being a part of a team in multiple timezones, some of which follow Daylight Savings Time (from different dates) and some not. Now schedule a recurring weekly meeting for the same time and coordinate that over chat. This is just inherently messy. Communicating this properly in UI is subtle and confusion like the one you described often arise when webapp developers assumptions and user assumptions don’t align. Some even say we should do away with timezones alltogether.

¹: Someone even made list of lists of falsehoods programmers believe about time

deleted by creator

If you’re talking about Librewolf’s “resist fingerprinting”:

To set the record straight, ResistFingerprinting was originally developed by Tor Browser developers, and is for some time now part Firefox (and therefore all forks) behind the privacy.resistFingerprinting (“RFP”) preference. So credit there goes to those devs, Tor Projectt, ad Mozilla. Konform Browser and Tor Browser have this on by default. There is also the related more recent and complex privacy.fingerprintingProtection (“FPP”) system. LibreWolf has historically been on RFP too - I’m not up to date if that’s still the case or if they’ve migrated over to FPP yet as I understand that is the intention of maintainers. The difference between the two is more than I bear to explain here and a bit of a rabbit hole x)

Hm, could you be more specific exactly what your issue is, and what behavior you are expecting? It sounds like you could be referring to this: https://bugzilla.mozilla.org/show_bug.cgi?id=1364261

There is a workaround mentioned at the bottom of that thread which should have the same result on all three browsers (and sounds like what you want, except having to disable ResistFingerprinting?). Just like for the forced-light-theme, I think it can make sense to provide a more convenient and obvious way to change the timezone without having to impact the other privacy protections. Might take a look at that but most likely after ESR153.0 is out of the way. If I read you right: Do you expect to be able to toggle this per-site, or would you be satisfies with a global toggle similar to the one we already have for allowing dynamic themes under RFP?

I am an exclusive flatpak user (as much as possible at least)

In that case I will certainly encourage you to get more comfortable with the flatpackaging side and getting that local build env up for yourself! Having self-hosted repo for self-built packages¹ in whatever format you use is one of the most liberating things one can set up IMO. Looking forward to seeing you around on the issue tracker ;)

¹: Ideally with sensible lifecycle 🤭

Ah, sorry you’re having issue! Re video playback¹:

• Do you have a URL not working for you I can reproduce your issue with (you can DM me if not want to share public)?
• Media Codec installed and available? about:support and look Media -> Codec Support Information. Are you on Arch perchance?
• Tried the “Basic Functionality” preset? about:welcome should show on first launch, can also be reused later.
• It’s not likely but still possible that some preference set in your old LW profile interferes. Different result in fresh profile?
• Same result without addons? (“Troubleshoot Mode” under about:support)
• Left-hand side of address bar, there should be a shield and couple of icons. You can click those to temporarily or permanently unlock protections for current site.
• In a fresh profile, you could try “Just Make It Work” preset - does it work there? That will, among other things, enable DRM modules and allow the browser to silently download and execute binaries from Cisco and Google in background, just like vanilla FF. This behavior is disabled under the other presets for security reasons and I don’t recommend it much beyond testing and troubleshooting.
• Sometimes, sites blocking you will yield CORS errors in console. If that’s the case you should also see HTTP responses with 4XX status codes under Devtools Network tab. or 5XX if legit server error.

¹: Should work; I’m streaming 4k fine.

Not highly prioritized since:

1. We’d need someone with a Github account (ie not us) to step up as maintainer for that in order to be on flathub.
2. Arguably problematic security tradeoffs for browser (yes flatpak has its own sandboxing but that disables the one of browser)
3. Users run into frustrating and confusing edge-cases with not working devices, directories, addon integrations, etc, and not grokking the security model. Flatseal is a bit obscure still.
4. Container option exists for advanced users who want containerization

That said, there is a starting point - if anyone feels inclined to pick it up shows up on the forge, would be happy to collaborate towards that. You can also just go ahead and package it up independently from us if you wish (free software and all that).

Are you on some dist existing package repos aren’t covering? Or just a matter of preference?

Ah, glad it worked out! Somehow this earlier reply only came in here after posting the same suggestion ;^^

Looking forward to hearing your thoughts and impressions!

Backup / restore is windows only

Ah right, I forgot that part - exposing that feature on Linux is a Konform thing.

Actually, there is one more thing you can try which I should have thought of first and might work better:

Do the original approach of copying the profile dir in place, but start Konform Browser with the --allow-downgrade flag: konform --allow-downgrade

After it has (hopefully successfully) completed the import, it can then use it like normally when started without the flag afterwards. I just tried it with a recent LibreWolf profile and seems to migrate everything fine.

Thanks for trying! Hmm, so I haven’t performed such a profile migration myself recently.

Previously, it was enough to just drop the directory over (which I guess is what you did?) but as Konform and LibreWolf are tracking different FF branches, this kind of things is not unexpected. “Touching tips” is a ~yearly happening and next time is currently many months away - such long time to wait!

Now, I am thinking of two options (in any case: separate backup first!):

• Profile Backup / Restore https://support.mozilla.org/en-US/kb/firefox-backup under about:preferences
• Use a Sync Server (either Firefox Sync or self-hosted syncserver) and sign in with same account in both to sync over.

If you have a librewolf.overrides.cfg, that should still be possible to just copy into your ~/.konform dir or corresponding system path regardless of rest of profile.

While the application code itself is C++/JS, instrumentation code is Python. Sure could use a hand with getting instrumented testing up for existing suites. Automated testing for network leaks etc would also be neat.

(I guess manual testing is not in scope for what you are looking for here but that is of course also welcome)

Feel free to open an issue on tracker if you think it might be relevant and want to discuss ideas, or you can “DM” here!

https://codeberg.org/konform-browser/

EDIT to add: If not (aw), how about QubesOS?

https://github.com/QubesOS/qubes-issues/issues?q=state%3Aopen+label%3A"C%3A tests"

https://github.com/QubesOS/qubes-issues/issues/2916

That is interesting!

BTW in case you’re not aware, direct links to fedia.io like the one you posted just lead to a loginwall so you probably don’t want to share those publicly. This one via beehaw.org works for everyone, though: https://beehaw.org/post/24563411

Thank you for kind words!

Ah, then the hope is that this curiosity will trigger you to dig into it yourself (for example using the provided tool or taking inspiration from it) so that it starts making sense! I know it’s an unconventional format to refrain from laying out my own opinions and analysis but that’s my thing today. So much “everyone knows” and vapid third-hand takes flying around these days that I think we would do well to actually verify (and pick up related knowledge in the process) rather than take forum comments and blog posts for gospel.

OK, all right, I can try. I guess I can point at one thing in the Mozilla telemetry at the very end, doesn’t that look very fine-grained if you look at the URLs (addresses) listed?

We can tell that many of the actions I took were communicated to the mothership for analysis and product improvement. Is this data really anonymized (or anonymizable)? Is it a reasonable amount for a user that has not opted in? My professional and personal opinion is: It is not.

But! That’s just one isolated example. And an extremely limited view. What about Zen? Chrome, Edge and Safari weren’t included here at all. And it’s not at all looking at what happens for a user who probably cares about this: when you go to settings and disable all the telemetry. See I just said that one thing about Mozilla Telemetry and now I’m going to have to run some new tests and write reports about them for days just to set that record straight!

Maybe I’m odd but I think it’s many (100?) times easier and quicker to gain understanding of the kinds of stuff we’re looking at here by getting hands-on than to communicate it verbally. And I’m concerned with this limited attention span so many people are afflicted with these days, and look at how long this comment is already, no we’re done with me telling you how it is, let’s wrap this one up and get on to the juicy stuff.

There’s an expandable section Basic test environment usage under Testing procedure but I realize now that might be easy to miss…

Anyway, to start it: Install podman, docker-compose (v2) and MITM_BROWSER=firefox-esr podman compose up --build. That should be it.

Then the browser pops up (hopefully), you do your thing, and after you Ctrl+C in the console, it will quit and the proxy will dump the recorded .har file which contains all HTTP and websocket traffic that went through the proxy in cleartext, in JSON format. There’re tools online that can help visualize I think but nothing I can recommend off the bat. Simply cating it to the terminal or opening it in a text editor can be educative. Also playing around with variations of the jq snippets and see if you can come up with questions of your own to answer. Or if anything in my numbers make you scratch your head or say “wait a minute” dig there.

In case you want to take a look at what the thing does before running it (trust me bro), these are the files involved when you run that compose up command:

• entrypoint compose.yml
• imported compose/proxy.compose.yml for mitmproxy
• The browser Containerfile (aka Dockerfile)

Available browser images

What about gwenview?

The author seems to think Mozilla should have protected our privacy by having someone act as the proxy for the request.

On the proxy part, they actually already have that and using it for some other parts:

https://support.mozilla.org/en-US/kb/ohttp-explained

TL;DR: Imagine an HTTPS-over-HTTPS proxy. Try to explain it like something groundbreaking without referencing existing tech. Now you have OHTTP.

https://firefox-source-docs.mozilla.org/browser/components/mozcachedohttp/docs/index.html

https://www.fastly.com/blog/firefox-fastly-take-another-step-toward-security-upgrade

It makes me scratch my head a bit why I’ve never see it enabled for DNS-over-HTTP in default stock Firefox config despite it being supported for years - the endpoints are just not configured. You have to know about it and configure the barely documented URL in about:config for that. Unlike for newtabpage and the FF shopping feature where OHTTP is used by default. Infra costs?

What are you curious about with Dillo And Netsurf? Isn’t it safe to assume at this point they will both be 0 across the board for all the queries in the report?

I think we need a different testing protocol for them to be interesting to include. AFAIK they don’t have add-ons that could be interesting to test either? Do you have any suggestion for step(s) you think could be added to the test in order to make those meaningful to include? Or is my assumption about Dillo and Netsurf out of date?

Oh, thanks for reminding me of Trivalent, I realize now I’ve come across it before but totally slipped my mind. If/when testing for chromium in place I think this can be interesting to sample next.

Assuming you mean the Mullvad extension (which is installed by default in MB) and not the Mullvad VPN app (which also exists but never came close to these machines) :)

That will indeed likely make a difference on Mullvad Browser numbers. However for now I’m not changing the “keep addons at stock defaults” invariant or the test matrix might get really out of hand… Should we disable uBlock Origin in LibreWolf? How about uBO or NoSccript in Mullvad then? Konform Browser loads uBO but only if its apt package is installed; should we do that? What happens when we try to explicitly opt out of everything under Preferences in Firefox? I guess the last one is something to actually consider but for now not touching the addons.

(Would be super cool if anyone else tries this out and reports back though! The compose should hopefully be straight forward and easy to get started with if you are on Linux and have podman available. The report mentions it TL;DR we had to work around the oBO install in LW not properly utilizing the proxy (?) like this and I think same approach could be used to Uninstall Mullvad extension from Mullvad Browser and prevent it from even loading)

Disclaimer: Am konform dev so shouldn’t be a surprise that it’s working well for ourselves I guess. Eager to hear to what extent it’s overfitted for our usage or really as great as I think it is ;)

BTW if you, dear reader, think queries in report of results are cherry-picked in a way that favors it (I don’t think they are but hey, fair), I’m also eagerly accepting input and especially PRs for queries (still have the raw dumps so I can add this quickly) or steps to test procedure (this means I have to rerun all of them so might take longer to update) that could illustrate different tradeoffs and show a more complete picture. Bring it on <3

Daily-driving it now. I think it’s great. If you’re somewhat familiar with the landscape otherwise I think readme explains how it’s different and why. If you don’t mind losing out on some "safety"¹ and latest upstream features² for the sake of a more stable and predictable base, not having reliance on proprietary integrations or even internet, and really removing all non-essential network integrations, then definitely worth a try!

¹: A surprising amount of people think (or at least write online) that a browser that doesn’t block user requests completely aligned with the Google SafeBrowsing blocklists is unsafe and that doing those syncs is an essential feature. If you think this is the only safe default option in 2026 I’m sorry but please consider uBlock Origin. See how opinions on who to trust can affect what “most secure” means. Konform Browser removes many assumptions of trust. But not all; Everyone still comes with an assumed PKI after all and there exists a default for DNS.

²: Since it’s ESR base it means new feature updates from Mozilla ~yearly instead of ~monthly. Still receiving security updates on the rapid schedule. No AI features out of the box.