Deviations from Chromium (features we disable or remove)

https://github.com/brave/brave-browser/wiki/Deviations-from-Chromium-(features-we-disable-or-remove)/

by jacooper • 4 years ago

290 261 4 years ago

github.com

jacooper7• 4 years ago

I dont work for brave, the page's title uses "we". I just added " brave's" to give more context.

datchi• 4 years ago

Services We Proxy Through Brave Servers

Would it not be better to proxy these through Tor? Brave already has support for Tor built in.

lillecarl• 4 years ago

If they're reachable through Tor, that's not a given.

Phelinofist2• 4 years ago

In what way is proxying through Brave better than talking to the G directly anyway?

somenameforme• 4 years ago

Any request you make to Google's servers, including something as innocuous as e.g. Google Fonts can be used to shape and track you, your habits, and so on.

When it goes through a proxy, that becomes much more difficult.

gunapologist995• 4 years ago

That would probably massively increase latency, and most regular users would probably not tolerate that (and they'd think it was Brave's fault).

godelski5• 4 years ago

As cool as Brave is, I still think it has big issues running Chromium. Chromium still allows Google to dictate a lot of the internet. We should have more competition in the space and that will help us all. I honestly even wish there was more than Chromium (and the various colors), Safari, and Firefox. It really seems a lot of these decentralized services have become highly centralized and thus a lack or competition and growth.

endisneigh4• 4 years ago

I respect your opinion but honestly fragmentation sucks. I wish there was even more consolidation - ever use a power drill? 7 different battery types non compatible with each other.

On a related note I’m happy usb seems to be the general connector winner (though it’s certainly not without fault).

What would the average consumer gain if there were say, 10 different browser engines equally popular?

Chromium is open source and you can easily disable features you disagree with. Don’t see the downside. Fork it and add functionality you’d like, like Brave.

marricks• 4 years ago

A lot of if there was an independent web consortium which agreed on standards.

Which, hey, we do have and the more power chromium gets the more Google can just ignore that.

mike_hock• 4 years ago

The same the average user gains from having 10 manufacturers to choose from when buying standardized USB connectors.

xypage• 4 years ago

I'm finding it hard to give you the benefit of the doubt because it really sounds like you're advocating for a Google monopoly, which doesn't help anyone. Sure having a bunch of different battery types is annoying but in that case either you should find a brand you trust and stick with them, or brands have fragmentation within themselves which is a different issue altogether. The "fragmentation" you're talking about here is competition though, there isn't really any downside to having a bunch of different popular browsers and the upside is that none of them get to do anything crazy knowing there's no serious alternative so you can't leave. Google is already invasive of privacy, I can only imagine it'd be even worse if they didn't feel like there was significant risk of people switching browsers because nothing else was popular.

bombcar4• 4 years ago

I'm glad there are multiple different power-tool manufacturers, and I'm not entirely sure there'd be as much competition if they were all forced to use one battery connector.

(You can buy adapters if you want, but it's generally not worth it).

pawelk• 4 years ago

ever use a power drill? 7 different battery types non compatible with each other.

Battery is the proprietary part. The engine (battery + motor) makes it spin, but for the purpose of making a hole or driving a screw one can use a wide array of standardized bits from various manufacturers. You may need an SDS adapter (one way or the other) and that's it. Same bits will even work with a hand cranked drill press built 100 years ago.

michaelmrose• 4 years ago

There is some consolidation among power tools

https://toolguyd.com/tool-brands-corporate-affiliations/

They still screw you on batteries and indeed would do so harder if there were fewer companies. Instead of incompatible batteries per brand it would be per year.

Sorry sir that's a 2022 tool it can't use 2021 batteries.

You can either ask congress to establish a standard, start a power tool company that supports more brands with adapters, or basically suck it up because selling batteries way over cost is extremely profitable and nobody wants actual competition in that space.

The one thing you don't want is consolidation. Likewise you think you want consolidation among browser engines but you really don't because it gives the vendor future leverage to fuck you.

nocman• 4 years ago

The point you seem to be missing is that Chromium isn't a standard.

If you want to reduce fragmentation while avoiding having one entity with too much control, the solution is fair setting of web standards and multiple browser implementations from different entities.

Requiring everyone to "just fork Chromium" would leave far too much power in the hands of Google (as if they didn't have far too much power already).

jrochkind1• 4 years ago

ever use a power drill? 7 different battery types non compatible with each other.

OK, but do you think you would be well-served if this problem were solved by there being only ONE manufacturer of power drills, take what they give you at the price they charge or nothing?

It would be one way of solving the problem of lack of standardization of power drill batteries.

It is the analogy of what you are speaking in favor of by analogy.

The better solution might be multiple drill manufacturers agreeing on a battery standard to all use together, so their batteries can be interchangeable, but you still have your choice of different competing drill and battery manufacturers. What would be the analogy with browsers, do you think?

brnt7• 4 years ago

Fragmentation sucks, but code monopoly even more. A healthy ecosystem needs a plurality of implementations, or Chromium needs to come under committee control. (W3C? Something like the C++ standards committee.)

blowski• 4 years ago

Building a general purpose browser must be insanely complicated challenge with very little reward. It would be interesting to see more niche browsers for browsing specific types of site, though.

bombcar4• 4 years ago

The only way a new browser engine will be written in this day and age is if a massive company throws absolutely billions at it (Microsoft and Apple have both given up on this) or a competing browser on the Chromium engine gets popular enough that they become the main fork and begin to diverge.

I don't really see any other way until HTML and the web is replaced by something else entirely.

thrdbndndn• 4 years ago

I think this point often isn't mentioned enough to be fair.

Chromium is a ridiculously complex project. Most of these "independant" browser teams are simply not capable to create a browser from scratch.

I'm not saying people should praise Google or anything since they obviously have interest in it, But Google is still the one who (mostly) build chromium and leave it open source (I understand they have to since it was originally a fork of Webkit, but I feel Google can do it from scratch if they wanted). Without it none of these browsers would exist.

If anything, why almost no one uses Gecko/Firefox as a template/start point instead is a more interesting question, TBH.

gjsman-10003• 4 years ago

Building a web browser that is feature-complete, bug-compatible with Chromium, and relatively secure is about as complicated as building a whole operating system from scratch.

Plus, as Mozilla has learned, nobody ever made money from selling web browsers. Costs a fortune to develop, makes almost nothing in return except for influence or protecting other businesses. Plus, why the heck would you do that if Chromium is open-source? It's completely pointless.

jrm4• 4 years ago

Do we have to Stallman this question again?

Building from open source mostly controlled by a big-ol company is the opposite of future-proofing, especially when "connectedness" is part of that company's bread and butter. Just having access to source doesn't guarantee much in this day and age.

jjcon4• 4 years ago

Chromium isn’t written by just 1 entity, Microsoft intel samsung have all made major contributions - and anyone can hard fork it if they want to. I know most others here disagree but we do need standardization in this modern web world and chromium is just that.

Even if we don’t like it, the reality is what it is. Firefox is dead (about the same market share as ‘samsung internet’ these days). It would be best if we worked to make these web standards (chromium) bend to our collective will (like brave or Microsoft) rather than chasing pipe dreams of a Firefox return.

cowtools3• 4 years ago

Firefox market share is dying because of this mentality that is killing it. Self-fuffiling prophecy.

The standardization is in the standard, not the implementation. You do not need everyone to use the same implementation in order to have standardization: that just allows the implementer to bend the standard to his will.

kitsunesoba2• 4 years ago

Hard forking isn't a practical consideration unless the organization in question is willing to build a team that can rival Google's Blink/Chrome team, which is a ridiculously tall order. Microsoft is capable of doing that but I don't think they want to.

stanmancan• 4 years ago

WC3 creates the standards and it’s up to the browsers to implement them.

objclxt• 4 years ago

we do need standardization in this modern web world and chromium is just that.

Yes, we need standardisation - that means we need multiple browser engines. You can't have a standardised web with a single browser engine. That's the whole point of standards.

Generally speaking, the W3C will only move a standard into the recommendation track if two competing implementations have been demonstrated.

If Chromium was the only browser engine around we wouldn't have web standards: we'd have Chromium features.

tomxor3• 4 years ago

and anyone can hard fork it if they want to

Chromium is so large that it cannot be meaningfully forked by anyone but the most well funded enterprises... Even M$ track chromium as upstream. There are no true chromium forks, they are all derivatives that track chromium - it's too much to maintain.

The problem is not merely a chromium monoculture and chromium specific historic implementation complexities, but the difficulty involved in building and maintaining a complete, modern and compliant web browser.

silisili2• 4 years ago

I'm glad it did. They made an amazing browser at light speed that people actually want to use due to that decision.

The interesting question to me is...what happens if Brave gets bigger than Chrome. Like how Ubuntu did Debian, on the desktop at least.

Does Google nix Chromium? More restrictive licensing? Curious the outcome.

nicce• 4 years ago

The speed is caused by filtering many ads by default. Nothing rocket science what you could not do with browser extensions by yourself.

jacooper7• 4 years ago

I used to refuse Chromium for the Same reason.

But honestly it already happened, Firefox is already irrelevant.

Mozilla is mis-managed organization that is funded to avoid anti-trust investigations, they dont fully push for privacy because they are afraid of google, do out of touch changes, and focus on political advocacy.

Compare that to brave, which builds its own independent search engine, ad network, and has privacy by default in its products.

There is no hope that Mozilla and Firefox will change the status-quo anytime soon, Firefox is losing users at crazy rate, and Mozilla is absolutely failing to do anything to change Firefox's destiny towards irrelevance.

Brave is almost everything Mozilla should've been.

Actually do what they sey, no hidden google analytics in their products, no unique ID for each installer downloaded, push for privacy by default and independence from big tech, not being shy from google, because they are their only income.

I would argue, that if Mozilla wants to turn its course around with their "limited resources" it should drop gecko, and anything irrelevant to the users experience.

Fork Chromium, the best web engine out there by a mile, and remove any anti-privacy / anticompetitive code, while still taking advantage of the huge development resources directed to chromium from many parties, and maybe Mozilla can also influence Chromium's development.

Start pushing privacy by default, its the reason brave is gaining users at such a rapid pace, its a browser I recommend to everyone, as just by installing it they already are much more private than with chrome.

What matters is the users experience, its why brave is growing.

ravenstine2• 4 years ago

I totally agree that Mozilla is mismanaged, but I'll still take a mismanaged and politicized Mozilla over a tentacle of The Google any day.

And that's precisely why I use Firefox. In response to the comment you were responding to, I don't know why anyone should care about how relevant Firefox is. For every browser someone invents, there will be someone claiming how bad it is from a security standpoint because reasons. Whatever. I can't keep changing browsers every time someone on HN says my browser is flawed or that the company behind it sucks.

Unless things have changed, there are things about Firefox that I want that Chromium doesn't have. Can I disable history entirely in Chrome? Last time I looked, nope. Can I have multi-account containers? Nope. Can I block autoplaying videos? Nope. Can my ad-blocking not be nerfed? Nope. Can I not have the settings flags get taken away so frequently? Nope. I'm sure there's other things as well.

If Brave went the road of completely relying on its own browser engine or a fork of Chromium, I'd be all in. The longer Brave is around, the more likely I might make the switch. Another reason I don't want to leave Firefox is I've seen plenty of new and hip web browsers come and go.

alwillis• 4 years ago

Couldn’t agree more. Nice job re: analysis of the situation.

armchairhacker• 4 years ago

you can still use Konquerer or any old / niche browser if your site isn’t using the latest HTML/CSS features and Javascript APIs.

The issue is that webpages are incredibly complex - they can be full-scale applications - yet they are expected to run the exact same in different browsers, down to subtle implementation details. So in order to make a new browser you would basically be reinventing Chromium.

Or you could start fresh with a new language to write websites in complete with a new browser engine. I would actually love this, web design today is a huge mess with HTML / CSS / JS quirks and backwards compatibility. But you still have the literally trillions of existing websites, which you’ll have to support with Chromium or Gecko until the end of time. And more importantly, you have the 99.9% of users who are still using Chromium or Firefox and won’t be able to use your new website, so you’ll have to backwards-generate HTML/CSS/JS from your new script anyways.

jefftk3• 4 years ago

you can still use Konquerer

There are only three actively developed full browser engines (WebKit, Blink, Gecko) [1], and Konqueror runs on WebKit.

(It used to use KHTML, which WebKit began as a fork of)

[1] https://www.jefftk.com/p/browser-engines

jgalt212• 4 years ago

Chromium still allows Google to dictate a lot of the internet.

IE6 still allows Microsoft to dictate a lot of the internet.

the more things change...

concinds3• 4 years ago

The problem with that argument is that browsers don't compete on engines but on features, UX and integration (and bundling). All an engine is about, is webcompat (and Chrome wins here). It's literally not a differentiating feature. A good engine is an engine that never, ever fails to render a webpage (again, Chrome wins here).

Even if Gecko was fully on-par with Blink (I keep hearing from Firefox users that they struggle with some websites, though admittedly very few, but Chrome obviously works fine with them), they'd have just invested millions in man-hours to get to the starting line, and have webpages not fail to render.

A lot of companies might switch to Firefox if they switched to Blink and webcompat was never an issue. I've argued before that Firefox would benefit from switching to Blink (and gain better security, webcompat, enterprise support, and on and on), save tons of manpower and money, and compete on privacy, features, integration, and things users actually care about, as well as keeping Manifest v2, and patching out other Chrome-badthings. But that's basically Brave.

perryizgr8• 4 years ago

The problem with that argument is that browsers don't compete on engines but on features, UX and integration

Not always. Firefox lost much of its userbase not because it had less features or integration or was failing to render pages. In fact it was the preferred browser for most sites, with devs targeting it and testing on it.

It lost because the engine was just inferior, which made it slower than the competition.

speedgoose7• 4 years ago

Is there a web browser based on Brave but without the crypto scam features?

cowtools3• 4 years ago

Ungoogled Chromium?

I've heard that the cryptocurrency features are disabled by default in Brave, but I've never used it.

ycta39840398• 4 years ago

No, they're enabled by default. Brave makes a big deal about all of its features being opt-in, but the crypto shit is a big, glaring exception.

rosywoozlechan• 4 years ago

You can just not use those features. It's not like they upsell you on them or anything. If you don't use them they aren't in your face. I actually tried using them and found them kind of silly and useless. No website or creator I visit seems to be using attention tokens, and the tokens I bought to just to try it out remain unspent.

speedgoose7• 4 years ago

I don’t want to promote scams though.

Barrin92• 4 years ago

You can just not use those features. It's not like they upsell you on them or anything

as far as I can tell the crypto settings are the only settings that don't sync across devices which I think is a pretty annoying and deliberate dark pattern.

lmkg• 4 years ago

Take a look at Vivaldi and see if it's what you're looking for. Broadly, Brave is pro-privacy and pro-crypto while Vivaldi is pro-privacy and anti-crypto.

Vivaldi is forked from Chromium directly rather than from Brave, but the similar pro-privacy stances mean that they remove or mitigate many of the same features. E.g. both disable FLOC, both have built-in ad-blockers, and both have committed to maintaining compatibility with ad-block extensions broken by Manifest V3. For what it's worth, Vivaldi is closed-source.

RankingMember• 4 years ago

Brave's paywall-bypassing news article viewer is tops. Does Vivaldi have that? I love Brave save for the crypto nonsense.

brnt7• 4 years ago

Vivaldi is closed-source.

Therefore not even remotely a replacement for Chrome, Brave or any browser really. Vivaldi is also some of the chattiest in a network analysis I saw, which does not bode well either.

Good UX is nice, but orthogonal to privacy, sane defaults and user freedom.

suoduandao2• 4 years ago

If you dislike decentralization, why not just use chrome?

speedgoose7• 4 years ago

I don’t think crypto currencies are the right solution for web decentralisation. And anyway, I prefer sustainability over decentralisation at all costs.

PufPufPuf3• 4 years ago

I don't dislike decentralization. I dislike blockchain scams.

causi• 4 years ago

I wish there was a version of Brave without the loud orange logo on the address bar and without the stupid carded tab switcher.

maxloh• 4 years ago

It would be better if we have Chromium's UI too. Brave's theme is not as good as Google's one.

mongol• 4 years ago

What is Edge browser's privacy story? Is it any good?

speedgoose7• 4 years ago

In summary, Microsoft tracks you instead of Google.

brnt7• 4 years ago

Even chattier.

jeroenhd3• 4 years ago

It used to be great. Chrome without the Google tracking and some Microsoft tracking that was easy enough to disable.

Then they completely Microsofted it up. More tracking than Google, with more opting out you need to do and no way to opt out completely. Even comes with an interest free loan plugin that sometimes alters the HTML of checkout pages.

Edge is the bloated corpse of what could be the best new browser from the last 10 years. A corpse that keeps coming back to life, trying to replace your default browser every other Windows update.

gnicholas3• 4 years ago

Is there a way to use tree style tabs on Brave? I was using Sidewise (via sideloading since it's not in the Chrome Store anymore), but it seems to have been broken by a recent update. I'm about ready to jump ship because I need TST. I have otherwise liked using Brave though!

spiffytech• 4 years ago

Chrome-based browsers have poor support for side tabs. There are some extensions that mimic it with an extra window, but it's not great.

The Cluster Tab Manager extension has been good enough for me. I have to open it explicitly as a tab, but then I can easily see and manage all of my open tabs.

sascha_sl2• 4 years ago

Chrome-based browsers have poor support for side tabs.

Edge has the best side tabs, closely followed by Vivaldi.

kyleee• 4 years ago

Here is most up to date work I am aware of to be implemented directly in brave: https://github.com/brave/brave-browser/issues/23467

gnicholas3• 4 years ago

Super cool. I'm on the Developer edition and will look forward to this rolling out, hopefully soon!

mminer237• 4 years ago

Disable Scroll To Text Fragment

Why would Brave disable this? In my opinion, this is one of the most useful additions to browsers in recent memory, and it's quite annoying to click a link expecting to go a specific section and just be put at the top of the page. I noticed this was broken in Brave, but I never would have imagined they intentionally broke the feature.

Phelinofist2• 4 years ago

Came to ask the same question

FatalLogic• 4 years ago

Came to ask the same question

It IS an interesting question. But you should simply upvote it, if you have nothing at all to add.

Waterluvian2• 4 years ago

This is probably the #1 feature that gives me the most personal conflict.

I remember seeing it for the first time and thinking, “oh here we go. Google needed browsers to have a feature to make its search engine UX better…” But I also cannot deny just how useful it is.

maven292• 4 years ago

Does the internet have any discovery mechanisms except social media curation and search engines?

If videos can be timestamped for links, why not webpages? Linking to automatic content-indexed excerpts shows respect for the time spent by recipient and saves markup effort for the author.

darepublic2• 4 years ago

Scroll to text? How about in page anchors.

dannyobrien• 4 years ago

There were some privacy concerns, regarding leaking of user information: https://github.com/WICG/scroll-to-text-fragment/issues/76

illiac7864• 4 years ago

I read this and I am surprised the link fragment is sent to the DNS server, that is not how I understood DNS worked.

Why isn't only the FQDN sent?

spicybright• 4 years ago

Maybe because you can put identifying data in the URL, I guess?

Not that you can't do that with a anchor, param, or an endpoint that can take arbitrary numbers/strings.

I'd love to know the explanation too.

kevincox• 4 years ago

IIUC the main risk is that they can check if text appears on a page based on it.

In an extreme case imagine that someone sends you a password in a messaging app which is available via the web. If an attacker can trick you to open webpages (maybe they intercept a HTTP site and open a few tabs) they can detect if the page scrolled based on side channels (data transfer) or direct information (did you load a lazy-loaded image from their server?). You can use this to learn page content. This is vaguely similar to https://en.wikipedia.org/wiki/CRIME.

As a concrete example imagine that a webpage has something like this past the first page.

  <p>Your password is 56acc1bc03298ec0</p>
  <img loading=lazy src=https://cdn.example/secure.png>

If I can trick you to load #:~:text=Your password is 5 and observe that you looked up the DNS for cdn.example and loaded secure.png (especially if that resource isn't cachable) I have learned the first character of the password.

If I do this 64 times (on average) I have learned the whole password.

This is a little hard to do, especially with pop-up blockers being built into most browsers so it is hard for a site to open many top-level windows (origin isolation of modern browsers will likely block this in iframes) it is not too extreme of a case.

Of course there are simpler attacks. Maybe someone can link to https://www.youtube.com/feed/history#:~:text=Voice+Feminizat... and they can tell if you have watched this video based on how many thumbnails have loaded. You load too many thumbnails and you get thrown in jail for being trans.

chrismarlow9• 4 years ago

Fair warning that I have not actually attempted these things, but:

1. I think you could potentially embed an iframe on a page and use the scroll positions combined with this feature to read information on a page. Start with "a", check scroll position, then "ab", then "abc". Similar to a blind sql attack where you gather data/hashes by continuously adding to the SELECT query using a substring function and a sleep (to detect if the substring was found). You brute force character by character. I believe this is commonly called an "Oracle attack"

2. XSS/Phishing/Spam. You add a png with a "Your account has been compromised" or a "fake form" (think Google docs) or whatever your spam message is to a part of a page. You send an email with this special url that will cause it to jump directly to that location on load.

Just some theories. I'm pretty sure the first one would qualify for some sort of bounty, but my experience is most bug bounty programs wouldn't count the second one as valid (requires user interaction).

googlryas• 4 years ago

I don't really get it. It seems like one of those theoretical potential privacy violations, but seems more like an academic exercise than anything exploitable.

I guess the idea is, someone can derive data about what you clicked based on some side channel (DNS queries? wifi activity? power draw?).

TechBro8615• 4 years ago

It does seem mostly theoretical, but it also seems like a natural feature for a privacy-focused browser to exclude. Web browsers have a long history of “mostly theoretical” becoming “effectively practical,” like when some new unrelated change invalidates an assumption underpinning the privacy guarantees of the original feature.

In terms of this vector, I could imagine it leading to history enumeration when combined with CSS, similar to the classic “check the color of the link.” Or maybe some fingerprinting scripts could send signals to server-side traffic analysis heuristics by preloading a specific script based on which region of the screen is visible within the first second of loading the page.

That’s all speculation of course, but clearly the feature increases privacy attack surface, by giving an external observer more paths for potentially reducing your possible anonymity sets.

darepublic2• 4 years ago

I am guessing a timing attack

psygn89• 4 years ago

They should just make it an option to opt into.

madamelic• 4 years ago

Same with letting you disable their built-in extensions.

Seems pretty wild to me that a privacy browser is alright with having their own extensions run in browser without any way to disable them or even know they exist.

"But the extensions are open-source so that means you can audit them!"

Uh yeah... but maybe I just don't want them to run and put "Tip" links on everything. It doesn't matter whether they are secure or not, the user should get to choose what they run in their browser.

Brave is great (in my opinion), but the more you look the more you realize how strongly opinionated it is about how people should use the web which is pretty antithetical to what Brave says they are trying to do.

karaterobot• 4 years ago

They're kinda damned if they do, damned if they don't. If they left it in, (some) people would condemn them for not taking privacy seriously. Since they took it out, (some) people condemn them for taking this theoretical privacy risk too seriously.

Zamicol• 4 years ago

As it stands today, the spec has issues when considering other pre-existing options and future compatibility. For example, there is no way to get the URL if the protocol is `file://`.

For a real world example: https://github.com/mozilla/standards-positions/issues/194#is...

See the stack overflow issue: https://stackoverflow.com/questions/67039633/get-the-text-fr...

(See also the currently "conflicting" library for URL fragment queries: https://github.com/Cyphrme/URLFormJS)

I think it can be easily fixed, using solutions like a delimiter, but that discussion probably needs to be apart of a wider discussion concerning URL extensibility.

bburky• 4 years ago

https://xsleaks.dev/docs/attacks/experiments/scroll-to-text-... may be a better description about the security impact, and has more context about this and similar cross site leaks possible with browsers.

illiac7864• 4 years ago

It says "This scenario is mitigated in the Chrome implementation"

TheLoafOfBread5• 4 years ago

That was reason why I switched to Brave. I hated that feature with passion on Chrome.

Aachen• 4 years ago

But why did you want it removed / dislike it

NikolaNovak• 4 years ago

I'm extremely ignorant in ways of Web and HTML. But this sounds like the Anchor functionality of 25 years ago?

Edit: this thing

https://www.w3docs.com/snippets/html/how-to-create-an-anchor...

code_duck• 4 years ago

It is similar, except it doesn’t require anything special in the HTML. It scrolls to an occurrence of the specified sequence of text.

autoexec2• 4 years ago

You're right, it does much the same thing, but this works on external sites so a webmaster doesn't need to create a bunch of anchors to specific information on a page. Instead you can link to any site and force the browser to highlight/jump to an arbitrary location on that external site.

It's the kind of thing I'd disable because of the privacy leaks it makes possible (Ctrl-F on the new page works just as well and keeps the user in control), but I can see how some people might like the extra convenience (when it's not being used maliciously to collect sensitive information from otherwise secure websites).

gigel82• 4 years ago

Also check out Ungoogled Chromium (https://github.com/ungoogled-software/ungoogled-chromium) which goes above & beyond by not just "proxying" services but rather removing all phone-home functionality altogether.

There's no for-profit entity behind it, so no perverse incentives to monetize either (but that also means they don't have a budget for proper CI, signing, distribution, etc.) so there's a bit of DIY work involved on less-popular platforms.

I use Ungoogled Chromium as a backup whenever a website makes the unfortunate choice of not properly supporting my main browser, Firefox.

jacooper7• 4 years ago

The reason brave is a bit less hardcore ungoogled-chromium is usability.

Brave can be used by anyone, with the experience they expect from a modern browser.

No need for some weird workarounds to install extensions, no support for widevine, etc.

chasil• 4 years ago

I personally use Bromite.

https://www.bromite.org/

I used to use SRWare Iron on the desktop, but not for many years.

https://en.m.wikipedia.org/wiki/SRWare_Iron

commoner2• 4 years ago

Ungoogled Chromium is the Chromium-based desktop browser that I use as a backup to Firefox, but I almost never need it.

I have two installations of Firefox: a primary installation that has Enhanced Tracking Protection and privacy extensions enabled, and a secondary installation that has neither but clears all history when the browser is closed. I'll switch to the secondary installation when the primary one doesn't work with a site, usually because the privacy features interfere in some way. It's easy to do this with two editions of Firefox (e.g. stable and Beta/Developer Edition, or a fork like LibreWolf or Mull).

With this setup, I rarely ever use Ungoogled Chromium, and haven't used it for some time.

deadbunny• 4 years ago

You can just use profiles in FF and achieve the same. No need for 2 separate installs.

the_duke• 4 years ago

Firefox is also full of bloatware, telemetry and potential privacy concerns. Try enabling a firewall for Firefox and see how many domains are contracted on startup ...

I've sadly felt like I had to switch to Librewolf, a fork of Firefox that resembles Ungoogled Chromium. Sadly because Mozilla really needs all the Firefox users they can get... to stay alive. But they make it hard.

cinquemb• 4 years ago

Yup, thankfully for my family, i've compiled alot of this crap out :D

Dwedit• 4 years ago

Cookies are given a maximum lifetime of 7 days for cookies set through Javascript and 6 months for cookies set through HTTP

What the hell, I don't want my logon cookies to expire so quickly.

forgotusername6• 4 years ago

Do you mean if you open up a website you used two weeks ago you still want to be signed in? For a website you visited daily the cookie could be refreshed.

tetromino_• 4 years ago

Depends.

A banking website? No, a quick automatic signout is obviously safe and correct.

An entertainment site, a forum, some kind of social media? Certainly I want to stay signed in.

9dev• 4 years ago

To the contrary, why would you want to be signed out? Your account, and therefore by extension, your cookies, should only be usable by you.

I cannot think of a reason why I would want to loose my sessions every other day.

stjohnswarts2• 4 years ago

Have the best of both worlds with cookie autodelete plugin :) . It's one of the first things I install (along with ublock origin and bitwarden)

MockObject• 4 years ago

Timeouts and expirations are an absolute plague of the modern world. I can count on one hand the number of sites that I want to be logged out from automatically.

xnx• 4 years ago

Even worse when they lose track of what page you were on when you log back in. (cough Sharepoint cough)

brnt7• 4 years ago

My browser is configured to not save any state past shutdown. I prefer that login info is not stored in an opaque way in a 'jar' that's hard to control.

croshan• 4 years ago

Your logon cookies should be set serverside, with the Secure and HttpOnly flags set, entirely unaccessible by javascript. So they'll last 6 months.

When I see cookies set by javascript, their primary purpose seems to be user tracking, not auth.

matips• 4 years ago

Sometimes cookies are used as they were designed - to store data in browser. For example 5etools-mirror-1.github.io. App without cloud storage or user account system. It stores your shortcuts in YOUR cookies, not in the server's DB.

polski-g• 4 years ago

This might be why my browser is constantly logged out of SteamPowered.com

PufPufPuf3• 4 years ago

Nope. Same problem on Firefox. Steam just loves logging you out.

CobrastanJorji• 4 years ago

I think if convenience measures favorably against even minor security concerns in nearly any situation, you are probably not the target audience for specialty security-focused web browser projects.

k__4• 4 years ago

This makes Chrome look like a garbage fire.

jacooper7• 4 years ago

It always has been.

Chrome is a privacy nightmare.

encryptluks24• 4 years ago

This isn't about Chrome, but about Chromium... the same source that Brave is based on. Most of these settings are configurable via policies as well. Firefox looks equally bad if not worse.

k__4• 4 years ago

I can read, thank you.

eternityforest• 4 years ago

These are why I don't use Brave.

If they made them toggle-able options, or added a global privacy mode switch to get them back, it would be a great browser besides the cryptocurrency stuff.

I left a year ago when the list of removed stuff started growing.

Nextlevelpepega• 4 years ago

I don't know how people can use the Brave browser:

Scandals:

  1º First scandal.
     Source: https://archive.ph/cAGpe

  2º Scamming people into thinking they are giving donations to content creators.
     Source: https://web.archive.org/web/20190606100032/https://twitter.com/tomscott/status/1076160882873380870

  3º Injecting affiliate codes into url's without user consent.
     Source: https://davidgerard.co.uk/blockchain/2020/06/06/the-brave-web-browser-is-hijacking-links-and-inserting-affiliate-codes/

Extra sources: https://www.theverge.com/2020/6/8/21283769/brave-browser-aff...

From a security standpoint, Brave is most of the time at least 1 to 3 days behind security patches from chromium plus they add a new superfice of security issues with all the changes they do to it, with chromium at least I know they are the first to patch things due to it coming from Google.

I welcome competition but I just can't see what the Brave browser brings to the table.

rising-sky• 4 years ago

This is a subset of what they bring to the table: https://github.com/brave/brave-browser/wiki/Deviations-from-...

I personally use either Safari or Brave (for chrome extensions and debugging) exclusively

mmastrac2• 4 years ago

I don't remember hearing about #2 at the time, but that's incredibly disappointing.

I don't really get the love for Brave. It always strikes me as being a completely opportunistic company (brave tokens were are particular turnoff).

jonathansampson2• 4 years ago

There's some considerable context missing here. When Brave held its token sale in 2017, we allocated 300M tokens to the User Growth Pool. Shortly thereafter we began staking Brave users with tokens to identify creators for whom they would like to offer support. Brave's UI showed a check-mark for verified creators, and nothing for unverified creators (we naively followed the Twitter model).

Some users took the BAT grant they received from Brave, and attempted to tip it to unverified creators (which landed those tokens in an omnibus settlement wallet where it could later be claimed, similar to the PayPal model of sending money).

The UI/UX of this feature and process caused a great deal of confusion towards the end of 2018, leading to monumental feedback from several content creators, including Tom Scott of YouTube. Tom's insights gave us the direction we needed to overhaul the Rewards (called 'Payments' at the time) system in major ways.

Ultimately, Tom approved of the changes. But note, there was clearly no scam involved. Additional details are provided in our 2018 blog post at https://brave.com/rewards-update/. I hope this helps!

skrowl• 4 years ago

Interesting, but I think I'll still use Firefox and Mull

NonNefarious3• 4 years ago

I don't really care what they do. You can't use their browser without signing up for an account, which is absolute hypocrisy and even WORSE than regular browsers.

gunapologist995• 4 years ago

This is incorrect. I've used Brave and never created an account (not even sure how). Are you confusing this with Google Chrome and its accounts, because that also can be used without creating a Google account?

NonNefarious3• 4 years ago

No, I do not use Chrome.

kunwon1• 4 years ago

I've never used Brave before. I was curious about this, so I just downloaded the browser. I'm able to use it without signing up for an account. I was never even prompted to create an account.

rav3ndust• 4 years ago

I've been using Brave since 2019, and I am unsure what a "Brave Account" is.

In fact, I don't know of a desktop browser that requires account signin. Chrome encourages it, but you don't have too to be able to use the browser.

MichaelCollins2• 4 years ago

Comments like this make me wonder if people are just making shit up because they hate Brendon Eich. If you're not just making it up, where did you get this idea from?

NonNefarious3• 4 years ago

As I recall, I signed up for the beta, so maybe they removed this requirement after release. I deleted Brave, and I was pretty sure it was for this reason. I just re-downloaded it and installed it, and sure enough there was no log-in requirement.

Was there some other privacy-touting or "alternative" browser that came out in the last couple of years?

One thing I did find annoying after installing it just now is that it doesn't import bookmarks from Safari, but rather only Firefox. It would be nice if it did; in fact it would be cool if some browser would do bi-directional bookmark syncing with Safari, to piggyback on iCloud syncing across devices.

sammyteee• 4 years ago

Anyone know why Chromium lacks H.264 & AAC support?

gunapologist995• 4 years ago

Both are patent-encumbered and good to very-good alternatives exist.

brnt7• 4 years ago

It lacks DRM support I thought.

Thoreandan• 4 years ago

MPEG-LA Patents, over 5,500 of them.

https://en.wikipedia.org/wiki/Advanced_Video_Coding#Patent_h... https://www.mpegla.com/programs/avc-h-264/

To get h.264 into Firefox, Cisco stepped up and offered to take the heat -

https://en.wikipedia.org/wiki/OpenH264 https://blog.mozilla.org/en/mozilla/royalty-free-web-video-c... https://news.ycombinator.com/item?id=25706252 (recent HN repost)

but that doesn't mean they can safely be in Chromium.

See also: The entire reason VLC can do MPEG-2 decoding being a French student research project.

gunapologist995• 4 years ago

Once FF started doing experiments on its userbase and started churning through their executive teams (and userbase!), I was already looking for an alternative. IMO, Brave has now definitely overtaken Firefox as the most privacy-focused browser.

Releasing this list publicly on Github is an awesome move, especially given the links to the issues that explain the reasoning and discussion behind all of it. Kudos on this transparency.

karlzt• 4 years ago

check Librewolf https://librewolf.net/ .

gunapologist995• 4 years ago

Good point, and also Mull on F-droid.

js2• 4 years ago

The gclient utility (part of depot tools) will fetch the official Chromium source code. The tag that is fetched is captured in our package.json (for example, 70.0.3538.35). All of the source code will be downloaded into the ./src/ folder

The captured in our package.json text links to https://github.com/brave/brave-browser/blob/master/package.j...

But I think it's supposed to link to https://github.com/brave/brave-core/blob/master/package.json

zerotrustonthis• 4 years ago

Imagine trusting Brave to be your browser:

1º Injecting affiliate codes into users url's without consent:

    https://davidgerard.co.uk/blockchain/2020/06/06/the-brave-web-browser-is-hijacking-links-and-inserting-affiliate-codes/

 2º Scamming people into thinking they are giving donations to content creatos:

https://web.archive.org/web/20190606100032/https://twitter.c...

Brave is always behind in security patches to Chrome by design, Google first need to push the patch to Chromium, Brave need to grab that patch and adapt it to Brave.

Brave adds new potentially security issues with all the modificatios and code they add to it.

suprjami3• 4 years ago

I don't use Brave and I'm not shilling for it, but it does consistently rate high in privacy research:

https://privacytests.org/

https://arstechnica.com/information-technology/2020/03/study...

jeroenhd3• 4 years ago

It should be noted that the person behind privacytests.org is a current Brave employee. That said, I haven't seen any signs of compromise yet; it makes sense that privacy-focused developers end up at privacy-focused companies.

However, you can have a good privacy record for protecting users from third parties and still make bad decisions. Not informing users about what websites do or do not take part in the crypto collection programme from the start was a bad decision IMO. Altering URLs to insert referrer codes is also a bad idea. This doesn't mean Brave doesn't try to protect your privacy, but it's still quite user hostile in my opinion.

Markoff• 4 years ago

This website and the browser privacy tests are an independent project by me, Arthur Edelstein. I have developed this project on my own time and on my own initiative. Several months after first publishing the website, I became an employee of Brave, where I contribute to Brave's browser privacy engineering efforts.

Don't ever link such biased website shilling for Brave.

concinds3• 4 years ago

Both have been reversed, and both were addressed convincingly (that these were true mistakes, not misbehavior they walked back).

https://www.theverge.com/2020/6/8/21283769/brave-browser-aff...

https://www.reddit.com/r/brave_browser/comments/a8d34y/youtu...

It's suspect to me that every thread that mentions Brave attracts such bizarre vitriol, with people who keep rehashing old arguments (which are off-topic and never with any actual context so people can make up their own minds). Haven't

BrendanEich• 4 years ago

Hi green handle. Don't parrot David, he lies about us blatantly. https://news.ycombinator.com/item?id=31088604

We reduce Chromium attack surface while keeping up within ~12 hours of updates: https://github.com/brave/brave-browser/wiki/Deviations-from-...

imbnwa2• 4 years ago

Real question is how're they gonna support distribution of critical Manifest v2 extensions like uBlock Origin once the Chrome extension store ceases to distribute v2 extensions in January[0]

[0]https://github.com/brave/brave-browser/issues/15187

HKH22• 4 years ago

uBlock Origin is not so critical for a browser that comes with a decent ad blocker that is on by default.

imbnwa2• 4 years ago

If that were true then they wouldn't have committed to support v2 extensions past the sunset date in perpetuity (which they made a public announcement of) since uBO is the biggest reason for as indicated by other issues in their tracker as well as the fact that this ticket hasn't been immediately closed. Also, good luck with the privacy crowd if you're not providing feature-for-feature behavior in your native adblocker, which Brave's adblock does not.

joshspankit2• 4 years ago

It seems so trivial, but I really wish they found a way to support the Serial API.

If I want to flash an ESP32 through the web browser, my only choice (besides installing Chrome) is to boot up Windows and use Edge.

bawolff2• 4 years ago

I honestly can't tell if this is sarcasm or not.

jeroenhd3• 4 years ago

I have to admit that the ESPHome flash tool is quite convenient. There's a quick web interface to set up some config and you can flash microcontrollers with dedicated firmware from pretty much any device.

It's one of those silly features that you use maybe once or twice a year at best; same with WebUSB and WebBluetooth.

bawolff2• 4 years ago

Huh,they list lang client hints, but not accept-language header???

dark-star• 4 years ago

Services We Proxy Through Brave Servers

So they're asking users to trust that their servers don't track them? Has there been any audit done on their infrastructure (a quick Google search didn't reveal anything)? How are they making sure that there are no employees who enable some simple tracking on their proxies for some extra cash?

True, it's probably far-fetched, and one could argue that "it's still miles better than Google", but (as some others further down have noted) Brave didn't have the best track record in the past (they tried tracking their users too...)

senttoschool• 4 years ago

Has there been any audit done on their infrastructure

Any centralized crypto company (Brave is considered a crypto company IMO) is less trustworthy than centralized non-crypto company.

I stand by this.

Also, the shady way Brave makes money should already warn you.

Deviations from Chromium (features we disable or remove)

Related Stories