Combining Cromite, Iridium, Thorium, and Ungoogled Chromium development?

[summersab]

I used to use Iridium as my primary browser. Then, they halted Debian releases when their Debian developer moved on. So, I switched to Ungoogled Chromium. The releases became less and less frequent, their Debian repository was out-of-date, and I stopped using it because of security concerns. I began using Brave on my desktop (eh . . . ) and DuckDuckGo on my phone.

I saw Cromite on F-Droid, so I installed it and waited to see how frequently it was updated. Thankfully, it appears to be a VERY active project, so I began using it as my daily driver. I really like it. Great work!

I know that getting developers to work together can sometimes be like herding cats, but could we get the developers of these disparate (yet excellent) security-focused Chrome forks to work together for a common goal? Just as Android developers were able to coalesce around CyanogenMod and later LineageOS, I wish this could happen for Chrome.

[summersab]

Tagging devs in the hopes to get a discussion going. I fully understand and appreciate that each of your projects have different goals and priorities, but I think there is more than enough shared interest to find common ground and work together. As a personal plea, I really hope so.

Iridium:
@medozas
@jengelh

Thorium:
@Alex313031

Ungoogled Chromium:
@Eloston
@Nifury
@squalus
@networkException
@jstkdng
@rany2
@Cubik65536

[uazo]

please don't do it again. it is annoying to be spammed like this, I apologise to everyone.

[summersab]

My apologies. I wasn't trying to be annoying or stir up trouble. I just hoped it might spur a useful and productive conversation.

Do tagged users get notified with future responses to this thread or just to the initial tag? If the former, I'll untag everyone.

[jstkdng]

Personally I use fennec browser on android (unmozillaed firefox so to speak) since adblock on android on the chromium forks isn't the best.

[summersab]

Has the performance for Firefox/Fennec gotten better on Android? I've tried to use Firefox and variants numerous times in the past, but Gecko is just SO. SLOW. On my desktop, things often don't render quite right, and that makes it a pain for me as a web developer. Those are the main reasons I stick to Chromium-based browsers.

That said, all of the great security-focused Chromium variants seem to spring up but get abandoned rather quickly. I really wish the developers of various security-focused Chromium projects would work together on a common browser to keep the work alive - it's a worthwhile pursuit. Just look at how many stars these projects have, and it's clear that people are eager to have a solid secure Chromium fork.

If devs worked on a common project, there would be a lower chance of it turning into vaporware, it would attract a larger userbase, and a larger userbase would likely translate into more financial contributions.

[rany2]

So, I switched to Ungoogled Chromium. The releases became less and less frequent, their Debian repository was out-of-date, and I stopped using it because of security concerns

Ungoogled Chromium updates frequently, it's just that the Debian repository depends on slow upstream for patches. If you want to update frequently (you should want that), you could use the Flatpak or portable linux builds. Personally I recommend the Flatpak because you could audit it and it gets built on a more trustworthy buildserver rather some guy's random machine (full disclosure: I maintain the flatpak).

I saw Cromite on F-Droid, so I installed it and waited to see how frequently it was updated. Thankfully, it appears to be a VERY active project, so I began using it as my daily driver. I really like it. Great work!

I recommend you use Firefox (or any fork on Android), the extension support is great and you could just use uBlock Origin as you would on the desktop. It is pretty good and doesn't really seem like a downgrade IMO from Chromium.

I know that getting developers to work together can sometimes be like herding cats, but could we get the developers of these disparate (yet excellent) security-focused Chrome forks to work together for a common goal?

I'm not sure if Ungoogled Chromium is focused on security, I think the primary focus is to make sure the browser doesn't phone home first. Ungoogled Chromium does add patches that often times are security related from other Chromium forks and in some cases, creates their own but I wouldn't see it as a focus.

[summersab]

I know you're a UC dev, but I honestly do see UC as a somewhat security-focused browser. Removing/limiting those Google bits IS a security mod, and it is much appreciated. Perhaps it should be used as a base for some of these other builds (and done in a collaborative way)?

Perhaps this is a pipe dream . . .

[uazo]

your intentions are laudable, it's the methodology that is wrong (in my opinion), but unfortunately I don't know what the correct one is and what steps need to be taken.

of course i would like there to be one browser in the opensource community, shared with everyone.
but it takes time. i think the biggest hurdle is to become more professional (speaking for myself). I am a developer for work, I know it is possible to do better.
and the team leader, who is not me, is missing.

in addition I myself cannot understand how correct my patches are and whether they do more harm than good. for now I am convinced that they are good, but it is not ‘scientifically’ proven.
Until I remove this doubt, nothing can be done. I have said it several times, I think I will put it in the documentation, what i think today is that cromite is a nice hobby, and a good starting point, also thanks to bromite, but it is not the arrival. it is far from being a benchmark and I understand the reluctance of other projects not to consider it.

[summersab]

What about sponsorships from certain FOSS organizations? I know things get really tricky when money is involved - it can wind up dictating the direction of the project, cause devs to lose control of their own code, etc. There are some grants that are very laissez-faire and let you keep doing your own thing, though.

If there were funding, it could afford build servers, automated QC checks, etc. It might also attract devs with a more solid security background to help review PRs you may not be sure about.

This was one reason I had a lot of faith in Iridium. It is backed by a German hosting company, and Germans are some of the best dammed developers with a keen sense of privacy (I learned this as an occasional Nextcloud developer - some great minds, over there). When their Debian package was abandoned, their releases slowed, and I saw testing to show that Brave did a better job for several privacy metrics, I was forced to move on. It honestly made me sad - I thought that finally, we had found the privacy and security focused browser that many were longing for. Perhaps they will redouble their efforts because it is a great project.

The explosion of interest in Cromite gives me hope. Perhaps it will be a solid foundation for things to come. I hope enough developers take notice and join your efforts. It may take time, so I hope you continue to persevere and develop this project until it (hopefully) happens. Perhaps you can have some offline conversations with the devs of other projects and formulate a game plan or some sort of consensus.

That's all I wanted to accomplish with this thread. My apologies for the tag spam and ruffling feathers - that wasn't my intention. I'll try to contribute more constructively in the future (maybe not so much with code - my C++ is rusty, and I'm more of a PHP/Node developer, these days).