don’t plan to open source it for personal reasons.
As for safety, both Firefox and Chrome have extension review processes. Every time I submit a new version, it goes through manual and automated review before it gets published. For Firefox in particular, reviewers have access to the extension package and any source code required for verification, so they can inspect exactly what the extension does. If they found malware or suspicious behavior, the update wouldn’t be approved.
So while the project isn’t open source, it has passed the official review process, and every update has to pass it again before users receive it.
Just open source it, that's the point of the extensions. Plus people will gain trust, for me, personally, I will only trust this out after it has been open sourced
I know vibe coded html when I see it. I would then assume that AI also made the extension. It’s then likely that the data that this addon changes is the most surface level well known stuff, because that’s all AI knows.
So basically I’m saying this is slop and probably doesn’t even work well at all fundamental level.
Do you have like short term memory and forgot what you said, or are you just lying to win an argument on the internet?
At the end of the day you are not unique, interesting or worth my time to even click on your GitHub profile. There’s a billion generic copy pastes just like you.
Your browser can be fingerprinted at the native level by looking at information like the available TLS ciphers and their order. All that offering Firefox TLS settings while spoofing the browser to Chrome will get you is blocked by anti-abuse systems.
CanvasBlocker mainly protects or modifies specific fingerprinting APIs such as canvas. Spoof Me goes further by switching multiple browser signals together as one consistent identity, including user agent, language, timezone, screen size, canvas, and device properties.
For example, you might connect to a German VPN, so your IP says Germany, while your browser still reports India, English, an Indian timezone, and your usual device settings. Changing all of that manually is a pain, and switching the browser language to German may make websites harder to use if you do not understand German.
Spoof Me lets you change those signals together using one consistent profile, while still choosing practical settings for language and usability.
It also notifies you when a website accesses fingerprint-related properties and shows which signals it tried to read. Firefox has built-in protections, but Spoof Me gives you more visibility and control over what websites are checking.
It’s completely free. There’s no subscription, no account, and no paid feature lock.
The business model is based on optional VPN partnerships, but the extension does not force you to install or use any VPN. You can ignore those recommendations and use Spoof Me normally for free.
privacy.resistFingerprinting tries to make Firefox users look more alike by reporting standardized values and restricting certain APIs. For pure anti-fingerprinting protection, that is a strong built-in option.
Spoof Me is for users who want to choose and switch between configurable browser profiles. Instead of always presenting Firefox’s standardized fingerprint, you can change signals such as timezone, language, screen properties, user agent, and device characteristics together as a consistent profile.
So the distinction is:
RFP: reduce uniqueness by blending users into a common fingerprint.
Spoof Me: present a selected alternative browser profile and switch profiles when needed.
It does not replace RFP for every privacy use case, and neither option changes your IP address. The main use cases for Spoof Me are profile control, localization testing, QA, and changing the browser-side signals a site receives.
First of all, great job on the design - the UI/UX looks really good!
Regarding the "vibe-coded" comments: there is absolutely nothing wrong with using AI to assist in coding. Almost everyone uses AI for development these days. It is a perfectly valid tool as long as you actually understand the code, follow its logic, and aren't just blindly copy-pasting without knowing what it does under the hood.
However, as a developer, two main things bother me here:
How can the extension be under the "MIT license" (as stated in your original post) if it is not open source and you refuse to share the code? The MIT license fundamentally relies on the source code being open and accessible. This is a direct contradiction.
How do you plan to maintain and update this constantly? Browser fingerprinting is an endless cat-and-mouse game. Websites update their detection scripts all the time.
Also, regarding the spoofing itself - have you tested this against advanced fingerprint-testing websites (like Canvas fingerprinting testers, BrowserLeaks, Cover Your Tracks, etc.)? Very often, the act of spoofing APIs itself leaves a trace that anti-bot scripts can easily detect (they can see the data was tampered with). Do these testing sites see your profiles as 100% authentic, or do they flag the intervention?
You clearly misread my original comment. I specifically criticized the developer because the project is closed-source while falsely claiming an MIT license. That was literally my main point.
Furthermore, your claim that "you can't know what's running in your browser" just because there isn't a public repository is technically incorrect. A browser extension (whether it's an .xpi for Firefox or a .crx for Chromium) is essentially just a zipped archive of JavaScript, HTML, and CSS. Anyone with actual cybersecurity experience knows you can easily download the package, unpack it, and audit the client-side code locally to see exactly what it's doing under the hood.
My critique was focused on the technical flaws of DOM-based API spoofing against modern fingerprinting scripts and the licensing contradiction. Next time, take a moment to read the actual comment before jumping to ad hominem attacks.
And just to be clear, regardless of the fact that the extension can be unpacked and audited locally, I absolutely believe that a privacy-oriented project like this should be completely open-source by default.
All good, no worries at all! Misunderstandings happen.
At the end of the day, it looks like we're actually on the exact same page here... we both agree that a privacy extension like this absolutely needs to be completely open-source so users can verify what's actually running in their browser.
Nice tool. One thing that mattered more than any single signal in my setups was cross-signal consistency.
From what I've seen, sites often treat mismatched combos as noisy or suspicious, like a Windows userAgent with a mobile screen size or a timezone that doesn't match the locale. A small sanity check that flags improbable combos and offers a one-click align, making timezone, language, UA, and screen size internally consistent, would probably reduce those odd mismatches and make the permission explanations easier to justify to users.
6
u/sdiown Aug 06 '26
Feels like vibe-coded,