Recommendation: Backup browser list - to avoid Chromium and to avoid official Firefox support

[Mæstro]

i was considering responding to this for a while, but have waited until now. The above conversation confirms my decision.
My backup browser is Epiphany, which uses the WebKit engine and is thus further removed from Chromium and Mozilla than anything else offered here. I was led to it because LibreOffice lists as a dependency, apparently for the help files, one of Firefox Release or ESR, Chromium, Epiphany or fellow WebKit-based Konqueror. Epiphany embeds EasyList and EasyPrivacy filtering as settings without any need for extensions. Until reinstalling LMDE last year, I would keep Ungoogled Chromium as a tertiary browser, and had found that UC would crash on sites where Epiphany worked.

[andyprough]

i was considering responding to this for a while, but have waited until now. The above conversation confirms my decision.
My backup browser is Epiphany, which uses the WebKit engine and is thus further removed from Chromium and Mozilla than anything else offered here. I was led to it because LibreOffice lists as a dependency, apparently for the help files, one of Firefox Release or ESR, Chromium, Epiphany or fellow WebKit-based Konqueror. Epiphany embeds EasyList and EasyPrivacy filtering as settings without any need for extensions. Until reinstalling LMDE last year, I would keep Ungoogled Chromium as a tertiary browser, and had found that UC would crash on sites where Epiphany worked.

That's impressive, I've never been able to get Epiphany/Gnome Web to work without constant crashing, I should try it again they must have improved it over the past few years. My go-to webkit browser has been Luakit, but I'll check out Epiphany again.

[Moonchild]

I'm afraid that Google is a step ahead again by proposing the next proprietary standard that nobody but them asked for: Web Environment Integrity API

If they manage to push that through, websites will have an API to literally enforce that you use browser X or Y with specific properties (aside from being able to "authenticate" the environment you're using the browser in). Not only does this lock down the web DRM-style, but it also effectively, especially in tandem with Manifest v3, allow them the tools and gears to serve their advertising needs (of course) if they prevent browsers which have adblockers integrated. Of course it also further reduces privacy of a user by having to present unique identifiers to "prove their integrity" and "verify their operating environment" and the likes. Sanctioned fingerprinting and tracking, IOW.

Ultimately, this will kill any alternative browser's use case on the web if widely adopted. So I pray it will not be -- but it's very well possible there won't be an option any more than to use Chrome for the websites that go along with this. Of course once again using the "security" misnomer to push extremely invasive and difficult-to-implement functionality into browsers.

[Moonchild]

As an aside, not sure why this is in "Off-topic" instead of "General Discussion" -- it's very much on-topic for this forum, the project, etc.

[Mæstro]

Is the proposal described here? I have not found any thorough descriptions of it; this proposal blends dithering and ‘TODO’. I feel optimistic in any case. Mozilla might be Google’s lapdog, but it bites; it has ruined some of Google’s plans (FLoC is a recent example), and Google’s attention span is poor. Even if this were to go through as feared, I should think it could be cracked like any other DRM.

[RealityRipple]

As long as a malicious client can emulate the expected communication with their third-party agency (which is supposed to be trusted not to leak the tracking information even though it's essentially a giant tracking hub that "promises" not to have long-term memory) - whether that be with a private key that's embedded in every copy of your browser on every user's computer and therefore would only be considered private in the technical description sense, or with whatever other obfuscation-not-security method they might try to manage - the whole thing falls apart before launch, simply by using a custom tool rather than a web browser; same as Cross-Origin Requests.

[Moonchild]

I have not found any thorough descriptions of it

https://github.com/RupertBenWiser/Web-E ... -Integrity
Relevant discussion on hackernews:
https://news.ycombinator.com/item?id=36817305

[Moonchild]

As long as a malicious client can emulate the expected communication with their third-party agency

Well that's the problem, isn't it? The so-called "attesters" is designed to be a (very) short list of entities that will cryptographically sign the request for attestation. Attestation requires a "low entropy" request, meaning a lot of plain identifying information unique to the client making the request. It really reeks of tight cryptographic client control. Attesters will undoubtedly be Google and a few other high profile entities as I can see this requiring a non-trivial amount of computing power to service the many millions of computers who would make requests for attestation.

[suzyne]

My backup browser is Epiphany, which uses the WebKit engine and is thus further removed from Chromium and Mozilla than anything else offered here.

This got me wondering what are the webkit options on Windows? Otter Browser looks like the only that isn't too out of date? Qt Ultralight Browser looks nice, but seems to have stalled.

[Mæstro]

From Otter’s own home page, which you have linked, the browser receives weekly commits. It would seem very much still to be in development.

[suzyne]

From Otter’s own home page, which you have linked, the browser receives weekly commits. It would seem very much still to be in development.

That is a good observation, but I am not a build my own browser from the repository type of person. So weekly commits don't really help me if they have decided to stop making executables.

When I click on the Official Binaries button of their website, the most recent files are March 2022 which are an XP compatible version. But if I want something for Windows 64, I need to go back to December 2020 which is getting a little old? So both of these can be true, Otter is in active development, but at the same time, for an end user like myself it is out-of-date.

I was interested in trying out of more recent version of Otter without having to learn how to build it, but if they don't want to make executables for Windows, that is totally fine with me, as I am more than satisfied with Pale Moon and was only curious.

[Moonchild]

I really wonder why they haven't bothered to build binaries for so long...

[back2themoon]

I thought the point of using a backup browser was mostly to deal with issues caused by using a lesser known/non-mainstream browser. Thus, using a mainstream browser makes sense.

I know these are direct forks/clones and do not diverge nowhere near as much as Pale Moon from current mainstream, but isn't using even lesser known browsers like Floorp, Pulse etc. kind of missing the point? Aren't these bound to cause similar issues due to their non-mainstream-ness?

I did use Librewolf for a while as backup, but started having compatibility issues here and there, too. So, I switched to Firefox and rarely, Edge. Having to fight with websites on the backup browser too, is a bit much.

[Moonchild]

I know these are direct forks/clones and do not diverge nowhere near as much as Pale Moon from current mainstream, but isn't using even lesser known browsers like Floorp, Pulse etc. kind of missing the point? Aren't these bound to cause similar issues due to their non-mainstream-ness?

It does make sense to use something that isn't necessarily supporting mainstream's abuse, while still staying close to it. Rebuilds/clones will not be functionally different in how they display the web because they aren't actually forks, and would give the user the same experience as mainstream without giving them direct support. So I'd argue it does make a lot of sense to use a clone instead of Chrome or Firefox as "mainstream backup browser" -- as long as they are kept up-to-date with mainstream, of course.

[Mæstro]

That is a good observation, but I am not a build my own browser from the repository type of person. So weekly commits don't really help me if they have decided to stop making executables.
When I click on the Official Binaries button of their website, the most recent files are March 2022 which are an XP compatible version. But if I want something for Windows 64, I need to go back to December 2020 which is getting a little old? So both of these can be true, Otter is in active development, but at the same time, for an end user like myself it is out-of-date.

I am also no such man. Every attempt to build something on my own has resulted in failure and literal panic attacks. I had not noticed that the executables are obsolete. While i should think that some of the Linux builds are kept up to date, this would scarcely help the Windows user. I apologise.

[gepus]

It does make sense to use something that isn't necessarily supporting mainstream's abuse, while still staying close to it. Rebuilds/clones will not be functionally different in how they display the web because they aren't actually forks, and would give the user the same experience as mainstream without giving them direct support.

The above statement is reasonable and logic at first glance.
However this thread lacks concrete information about mainstream's abuse, rebuilds/clones don't support. No wonder why.
IMHO all these rebuilds/clones will automatically inherit mainstream's abuse hard coded in the source they are using.

What these rebuilds/clones do at best is to ship with some changed default settings and/or bundling their shipment with (sometimes their own) extensions. Better than nothing - no more, no less.

[Moonchild]

However this thread lacks concrete information about mainstream's abuse, rebuilds/clones don't support. No wonder why.

I didn't feel like rehashing what most of us already know about Chrome and Firefox, primarily the telemetry and data gathering, and shoving hand-picked services down the pipe.
"No wonder why" is setting a pretty bad discussion precedent here. I'll choose to not take it personally.

[moonbat]

IMHO all these rebuilds/clones will automatically inherit mainstream's abuse hard coded in the source they are using.

Their selling point is that they remove or disable the tracking and telemetry crap. Such is the case with Firefox rebuilds Iceraven for Android which I use, and I've recently tried Floorp, which does the same except for its annoying vertical tabs that can't be changed.

[gepus]

Their selling point is that they remove or disable the tracking and telemetry crap.

Exactly.
However this is a fragile selling point albeit it works.
This was my point which Moonchild apparently misunderstood and for whatever reason even thought it was something concerning him personally.

Let's take telemetry as an example.
Mozilla offers the possibility to disable what they consider telemetry.
A selling point for using a feature offered by Mozilla itself is weird. Isn't it?

However Firefox makes calls to its servers which Mozilla doesn't consider telemetry and thus doesn't offer a way to stop them.
One can watch those connections taking place in rebuilds/clones as well.

So far about selling points and reality.

BTW, I have nothing against rebuilds/clones but rather against misleading advertisements.

[Basilisk-Dev]

If you're looking for a backup browser I've heard Basilisk is pretty good