how low will they go. only their hair dresser knows for shure.

sure.

let me guess, for telemetry?

not quite sure how/what FF downloads "by default", as in like how the stub downloader plays in, but from a page like:

sure enough you'll get a full installer, with a unique hash each time. now that's smart.

this part - in the binary .exe will be different:

__MOZCUSTOM__:campaign%3D%2528not%2Bset%2529%26content%3D%2528not%2Bset%2529%26dltoken%3D50fa1ecf-0f37-487e-8e24-b63ea7c8a077%26experiment%3D%2528not%2Bset%2529%26medium%3D%2528direct%2529%26source%3D%2528other%2529%26ua%3Dfirefox%26variation%3D%2528not%2Bset%2529

& more specifically this:

dltoken%3D50fa1ecf-0f37-487e-8e24-b63ea7c8a077

presumably the digital certificates of the downloads are valid. & if one were to base "correctness" (validity) on that basis, & yet the hashes vary, i.e. the actual file content, to me, that is simply moronic.

7-zip, while saying that the "archive" is correct, also says there is a checksum error:

7-Zip 21.07 (x64) : Copyright (c) 1999-2021

Scanning the drive for archives:

1 file, 53527184 bytes (52 MiB)

Testing archive: Firefox Setup 98.0.1.exe

WARNINGS:

Checksum error

you MUST answer the default browser dialog (i.e., you cannot not answer, ESC, out of it)

"and privacy every time you browse."

yep, we're attaching a GUID to your ass. that's private! well at least, most consider it a private part.

hah! you cannot even close that window/dialog from the (Windows) taskbar. it does not close. (you have to actually answer or kill it.)

How do you generate unique .EXEs without tampering with the signature?

signing EXEs on the fly doesn't sound too viable for me

and! and it also, during the install, automatically pinned itself to the Windows taskbar (or some such)

what a crock-a-doodle-do!

the solution is obvious

not to mention installing the "maintenance service"

let's raise Mozilla's CEO salary again!

not to mention removing .ru search engines from itself (in the name of political correctness, i suppose)

appear these id's are in the "header" part of the file, so outside of the purview of the digital signature, i suppose. but if something like that can be done, then could not "anything" i.e. malware just as well be put there, & if that is the case, just what is the point of this digital certificate?