&gt; So, you don&#x27;t trust the JS served by Mozilla but you would trust their browser?<p>Mozilla&#x27;s browser is shipped out to everyone; their JavaScript is served to me every time I use it.  A compromised browser <i>could</i> be caught; compromised JavaScript sent one time only to a targeted user is highly unlikely to ever be noticed.<p>I get my browser via a distribution; it&#x27;s far less likely than Mozilla <i>and</i> Debian would collaborate to expose all of Debian&#x27;s users&#x27; passwords than that Mozilla would target — or be compelled by law, blackmail or violence to target — a single user or handful of users.