Re: TW Firefox 151.0.4 - pushing World Cup Widget Ads to users??

On 6/27/26 5:14 PM, OldTime85--- via openSUSE Users wrote:
>> What are you doing to validate?
>> 
>> All I can think to do is verify the sha256sum and then clamscan
>> the files. All are fine for both 1.21.3b and 4b. Anything else you
>> do or recommend?
> I do the same.
> 
>> After the issues github has had as recently as Friday with Miasa,
>> that is the only concern I have. A shame too. Trusting known
>> projects releases on github, as long as they didn't include npm/
>> Nonejs/Bun or pypi, used to be the norm, but no more.
> I have tried many different browsers but I seem to return to "zen".
>
> I also have Brave, and on my phone.

   I guess one additional note of caution is that while the browser 
package files themselves do not contain Nodejs/npm, the entire build 
system for Zen is based on Nodejs and pnpm.

https://docs.zen-browser.app/contribute/desktop/building

   So extra precautions must be taken if you decide to customize/build 
it. I was surprised to find the zen folks making use of it for the build 
given the near-weekly supply-chain poisonings with Nodejs/npm.

   In the malware arms-race, I'm not sure how well clamscan works 
against new variants, and if it is a build-dependency poisoning the 
sha256sum isn't a guarantee. But I guess that is the world we live in today.

   I'd have more confidence is openSUSE packaged it (hint, hint :)


-- 
David C. Rankin, J.D.,P.E.