The campaign to push Northstar into Linux distributions

We're bad at marketing

We can admit it, marketing is not our strong suit. Our strength is writing the kind of articles that developers, administrators, and free-software supporters depend on to know what is going on in the Linux world. Please subscribe today to help us keep doing that, and so we don’t have to get good at marketing.

There is not a broad selection of mature, open-source web-browser engines for Linux users. Most of the browsers available for Linux are based on one of just three projects: Chromium's Blink, Firefox's Gecko, or WebKit. A new entrant would generally be seen as a welcome alternative, but the recent campaign to push one of the LLM-written Nordstjernen browsers into Debian and Arch Linux has raised some questions about the project's development and security processes.

About Nordstjernen

The Nordstjernen project appeared early in 2026; it shipped a 1.0.0 release of its namesake browser on June 5. However, the release announcement makes mention of several pre-1.0 releases dating back to late May that seem to have been scrubbed from GitHub. According to the announcement, the browser engine "is about 88,000 lines of C written by Claude and Codex [...] small enough for one person to read and audit end-to-end". The development of the browsers seems to be driven almost entirely by Andreas Røsdal (and LLMs), though there are a handful of commits attributed to others in the various repositories.

Nordstjernen has a somewhat confusing dual-license scheme. The announcement specifies that it is released under the Nordstjernen Source License v1.0, a non-free custom license that prohibits "competing use", and converts to the MIT license after 10 years. The License.md file in the repository, however, states that the browser is available under the custom license or GPLv3.

Since the Nordstjernen browser was released, two others have followed: Northstar and Southstar. The Northstar browser, licensed solely under GPLv3, is billed as "the minimalist sibling of Nordstjernen: a single-window, single-page, single-process desktop browser" that leaves out tabs, per-tab rendering, WebGL, and WebGPU. According to the site, it shares the browser engine with Nordstjernen, but it also claims that Northstar was written from scratch. Southstar is described as a Rust version of Nordstjernen, and it carries the same dual-license scheme.

Please package

Røsdal opened an intent to package (ITP) bug with Debian on July 23, looking for a sponsor to help him in getting Northstar into Debian. He reasoned it would be useful for Debian because the other browsers shipped by the distribution are Blink, Gecko, or WebKit derivatives; including Northstar would help support "genuine browser engine diversity". He is not a Debian maintainer or developer, so he cannot push a package into Debian on his own. He did state that he intended to maintain the package long-term, and said that his packages were verified to build for unstable and the upcoming Debian 14 ("forky") release.

The bug was updated by Jérémy Lal in October, apparently after Røsdal had lobbied Lal and others directly by email to include Northstar in Debian. (Why Lal and the others were chosen specifically is unclear.) Lal provided some positive feedback but noted "it might be a good idea to not target next debian stable, given the youngness of this browser". Røsdal replied the same day to "pray and beg" for inclusion of one of the Nordstjernen browsers in the next stable Debian release.

If the Northstar browser is included in Debian Linux, I will do my utmost to make the browser successful and ensure it works well in Debian, and I will make sure that the Debian project and Debian contributors like you, and the four of you in particular, will be rewarded.

He did not elaborate on the nature of the promised reward, but did mention that he had applied to the NLnet Restack fund which is meant "to help deliver, mature and scale operational internet commons across the technology stack". Røsdal also made the claim that Nordstjernen, now at about 245,000 lines of C code, would be easy to audit. He suggested that Debian focus on packaging Nordstjernen, as it was more mature, but use the English name Northstar.

Gard Spreemann said that the project's Git repository cast doubt on the easy-to-audit claim. He calculated that there were 2,623,722 insertions and 1,527,351 deletions over the lifetime of the repository. "I struggle to reconcile your goal of 'more maintainable, ease of review and audit' with ~160k lines of code being added and ~100k being removed per person per month."

After some back-and-forth, Spreemann asked Røsdal: "Is the code of Nordstjernen reviewed (by the human beings who are responsible for the project), or is it not?" He added that it was unlikely any Debian developer would agree to maintain a package with so much churn without the people responsible even looking at the code. "This is insane, and nothing more than a toy or an experiment, certainly not a fit for Debian by a mile."

Røsdal ignored the question about human code review and replied that he would appreciate feedback from someone else: "Preferably from someone who actually works on real software development in 2026, someone with education in computer science, also considering that software development has changed with the introduction of AI llms".

To the list

On October 18, Røsdal appealed to the debian-devel mailing list to accept one of the Nordstjernen browsers into Debian. Andrey Rakhmatullin asked if the plan was for Røsdal to do the packaging himself or if he wanted others to do it. Røsdal replied that he planned to do it, but he expected frequent releases and would be open to help from the Debian community to help package all the variants of the browser.

Marc Haber responded to the thread to clarify something he felt was often misunderstood by authors who just want their program in Debian: "You cannot fix a security issue in Debian stable by just uploading the new version of your program, you need to [build] a patch that only fixes the security issue while keeping everything else in the package at the state it was in at the release of the respective Debian stable." That would require a supported version for at least three years. None of Røsdal's responses to the thread seem to acknowledge the need for a version with long-term support and security backports.

The request to package the browser also spawned a discussion around the licensing for the browsers. For example, Andrei Ionuţ Ştefan asked if Røsdal had reviewed the LLM-generated output to ensure that there was no verbatim reproduction of copyrighted code from the training data. Spreemann said that it seemed doubtful that Røsdal could claim copyright if he was not even reviewing the majority of the code generated by LLMs. After a few exchanges, Røsdal said that each improvement to the browsers had been small, incremental changes where he had verified the results afterward. "It's like an artist painting a painting, one stroke at a time."

The overarching question of whether LLM output is copyrightable, or how much human input is necessary for it to be so, remains unanswered. Ted Ts'o observed that participants in the discussion seemed to be looking for the threshold of human-generated code to allow a project to be copyrighted. "If 99% of the code is human-generated, and 1% LLM-generated or public domain code, can we consider the entire code base under the GPL license? What if it's 60% / 40%? What if it's 99% LLM or public domain, and 1% human-generated GPLv2 changes?" He doubted that Debian would be able to answer the question of how much code had to be generated by a human to be copyrightable, but he hoped that if Debian created a policy requiring a certain percentage to be human-generated that the Linux kernel would pass muster.

Security

After briefly weighing in about licensing, Ts'o (who is employed by Google) followed up on Northstar's security. He had run an experiment using one of Google's frontier models to see if Northstar adhered to its security policy, and if there seemed to be any deliberate backdoors. The 15-page report produced by the LLM claimed a number of discrepancies between the project's claimed security model and its actual code, as well as a number of critical security flaws.

The report says that the LLM found no backdoors; however, it identified undocumented environment hooks that automatically load extensions, silently grant webcam access to all sites, and more. It also noted that, for example, the pack-appimage.sh script would download and execute unverified binaries. The script has since been updated to pin build tools to fixed releases and verify their SHA-256 sums before executing them. In total, the report lists eight critical and eight high-severity vulnerabilities. In his reply to the bug summarizing his findings, he said he would not recommend that any user depend on Northstar if they care about their security.

He also suggested that the Northstar project consider rescinding its no-AI policy, which had been added to the project's README on October 22. The project now claims that the Northstar browser is being developed without AI starting in October 2026. "Contributions — code, documentation, translations, issues and pull requests — must be written by people, not generated by AI coding assistants, large language models or similar tools." However, there have been more than 70 commits that list Claude Opus 5.5 as co-author since that date.

Initially, Røsdal thanked Ts'o for his findings and said he would welcome a follow-up security review to verify that the issues had been addressed. However, he replied again to the thread to say he thought Ts'o was biased because he works for Google. "Therefore in my opinion the Nordstjernen web browser was not given a fair chance by the Debian community, and I will focus on other Linux distributions which does not have Google-/corporate-biases like Debian does in this instance."

Off to Arch

On October 24, Røsdal contacted the Arch Linux project via the aur-general list, which is for discussion about the Arch User Repostory (AUR). Typically, users can upload packages to the AUR without much oversight. However, new user registration has been turned off most of the year since it was subject to sustained attacks attempting to spread malware to unsuspecting Arch Linux users. Thus, Røsdal would have to receive assistance to create an account and upload packages to AUR—at least for the time being. It is unclear when registration will be re-enabled for the AUR.

After some discussion, some of it in favor of a new entrant to the browser ecosystem, Edmund Lodewijks brought up Røsdal's attempt to convince Debian to include Northstar. He cautioned against packaging the browser. Røsdal claimed that all of the issues raised in the report Ts'o generated were resolved. He reiterated his complaint that Northstar had not been given a fair evaluation, and said that while Claude had been used to develop the browsers "we will transition [Northstar] to be maintained in the traditional way".

Jelle van der Waa replied that browsers are complex pieces of software with big security and privacy concerns; users should not trust a young project for such things. He suggested that Røsdal continue development, get a good security review, and demonstrate that he could maintain the browser over the long term. "Maybe then people might be interested in packaging it in the AUR but for now I can only strongly recommend against it".

Status

It does not appear that Northstar will be appearing in the AUR or Debian repositories anytime soon. Whether Røsdal will adhere to the stated no-AI policy also remains to be seen; thus far it does not seem that Claude has made its last contribution to the browser.

Since the XZ backdoor, distribution developers are also likely to consider an over-eager maintainer lobbying for a new project's inclusion to be something of a red flag. A browser project that has less than six months development history and no community to speak of is, in a word, suspicious. Røsdal's motives may well be entirely benign, but it is hard to blame Debian and Arch maintainers for being cautious.

In fairness to Røsdal and Northstar, it is not as if the established browser projects are without security concerns of their own. For instance, Debian issued a security advisory (DSA-6577-1) for the chromium package in Debian 13 on October 22: it addressed 363 CVEs. The previous advisory for chromium (DSA-6562-1) which was sent on October 15, listed a mere 37 CVEs. The Chromium project is also notoriously difficult to package, with quite a bit of churn of its own.

Firefox 159, released on October 27, listed more than 100 high-impact vulnerabilities including 72 use-after-free flaws and five privilege-escalation flaws. Chromium and Firefox, however, do have a much larger set of developers working on them and quite a few people scrutinizing the projects' code.

There is clearly interest in a new browser project that is based on a new open-source browser engine. Many of us are watching the Servo project, for example, with great interest. However, an entirely or mostly vibe-coded browser project that is largely driven by a single developer is not something that seems likely to gain traction among Linux users who care about privacy, security, or stability.

Note: you can avoid this step in the future by logging into your LWN account.