&gt; This reasoning just doesn&#x27;t apply at all to open source software like Firefox.<p>If you&#x27;re using the automatic updating functionality (which the majority of people are) then it absolutely applies. Firefox&#x27;s source code is available, but if you aren&#x27;t verifying the source upon each update then that fact is largely irrelevant.<p>The whole point of OSS is to allow YOU to verify the software, and only then to build it when you&#x27;re comfortable. If you are skipping the verify step and definitely if you&#x27;re skipping the build step then the fact that it is OSS adds little to nothing security wise (since the vendor can splice in anything they want).<p>So even with OSS you often either trust the vendor or you do not.<p>&gt; I think the reason OP points this out is because the old Sync system that Firefox had was much more secure (but unusable by the general public). We know this because we could see how it worked!<p>I suspect we&#x27;re having this discussion simply because people don&#x27;t equate the automatic updater with JavaScript in their own mind. The reality is that if you trust Mozilla to provide software updates then you can trust them to provide Javascript, after all the software brought down by the updater has far greater system access and can do far greater damage than JS.