Conversation

Brave has always been a sketchy browser reeking of desperation. I've taken issue with their usage of DRM, their decision to have a hard dependency on Play Services and their sketchy cryptocurrency activities including their very likely illegal ICO launch.

Quote Tweet

Daniel Micay

@DanielMicay

Jul 25, 2019

I used to be optimistic about Brave, but I no longer consider it to be a good project. It has had some serious issues with security and the intent behind it is starting to seem nefarious. Monetizing other people's content was always sketchy and their DRM is going far beyond EME.

Show this thread

Replying to

Do you have an opinion on Iridium Browser (desktop only atm)?

Replying to

It says that it's "based on Chromium 81.0.4044.92" and the current desktop release is 83.0.4103.97. The first stable v83 release was May 19, 2020. chromiumdash.appspot.com/releases?platf 81.0.4044.92 is from April 7th. There were 4 subsequent releases for v81 from April 15 through May 5.

Replying to

and

They also build with a GCC-based toolchain which loses important security features like type-based CFI. There are other problems with how they build it too. You are better off using a proper build of Chromium, although most Linux distributions lack the competency to provide that.

This Tweet was deleted by the Tweet author. Learn more

Replying to

and

They think they know better, but they don't. By using GCC, they're losing type-based CFI and other security features. By using additional system libraries, they're weakening CFI and losing important changes. Inadvisable changes are often made due to lack of care / understanding.

11:39 PM · Jun 8, 2020Twitter Web App

Replying to

and

The bulk of the changes being made by these forks are just changing defaults or removing optional features. There are few changes with real substance. Most of those are just changing where static assets are fetched, etc. There aren't any leaks of data for them to remove anyway.

Show replies

Replying to

and

Can you recommend a nice overview/list/comparison of the various compile-time hardening features of GCC and LLVM/clang? The best I could find seems to be this one, but I'm not familiar enough with the subject to judge what's useful and what's not. autosar.org/fileadmin/user