Chromium is definitely worse.

While these deserve an explanation, you should not wait to move.

Chrome is spyware that does web browsing. It's parent company also shows ads, all the time.

Chrome's auto update not only allows them to silently update or change your browser, it allows them to silently install other software on your computer.

Firefox is a browser. It can auto-update in a way that may be questionable, but it also has a lot of cranky devs looking over their shoulder to call them out years later because Mr. Robot may have been able to show them an ad. FF deserves to be called out on their mistakes, and need offer an explanation. But perspective!

Why would you not move now?

I want the ethics of Firefox and the speed / user experience (eg. select & move multiple tabs) of Chrome, so I moved to Brave. It's a Chromium fork that's a bit more Firefoxy -- made by Brendan Eich, former Mozilla CEO and inventor of JS, (eg has the "Switch to Open Tab" feature I love from FF), although there's some cryptocurrency stuff thrown in that I'm not a fan of, but so far it feels like a net positive over both FF and Chrome.

It's very privacy oriented, to such a degree that it actually breaks a lot of websites (but you can disable the shields easy).

If you haven't read this one yet, here's one data point on Brave doing something unethical (blocking ads and collecting payments on behalf of websites without consent/agreement). [1] Tangentially, I'm writing this comment using Brave.

[1]: https://news.ycombinator.com/item?id=18734999

Sadly, I'd also like more competition in the browser technology space; with Edge switching to Chromium, and Safari's years of neglect, it's not looking too good.

Chromium is not Chrome. It does not have auto-update. Surprisingly this gives more control by default than with Firefox.

But Chromium still has most, if not all, the Google integration.

There are forks that try to strip Google from it, but it is a mistake to assume that Chromium is somehow better than Chrome.

Firefox by default sends all your searches to Google, and uses Google search suggestions (so sends all typed in text to Google).

What other integrations, specifically please, does Chromium have with Google?

Aside: do Google serve the Firefox Newtab adverts, perhaps that "feature" was added for the extra money Firefox are getting from Google?

Many things.

1. It uses Google DNS internally, bypassing system DNS.

2. First-run analytics to Google, new tab page analytics to Google.

3. Various built-in google services that phone home: Google Host Detector, Google URL Tracker, Google Cloud Messaging, Google Hotwording, Google Safe Browsing, WiveDine DRM, Google AutoFill, etc.

4. Update checks for all these components (the browser does not have update, but the rest does).

5. Countless accesses to Google, such as geo-location to find nearest Google server, ping probes for connectivity, etc. For a list of domains that are accessed by Chromium, see this regex used by the ungoogled-chromium project: https://github.com/Eloston/ungoogled-chromium/blob/30969fddf...

More info at https://github.com/Eloston/ungoogled-chromium/tree/30969fddf....

I see no problem with neither Chrome nor Firefox defaulting to Google search and suggestions, as that is easily configurable for normal users. All of the above, however, is not.

Cool, thanks. Do you happen to know if Brave has these issues too?

It doesn't - like ungoogled-chromium, Brave have replaced references to any Google endpoints with placeholders that don't resolve to anything.

> and uses Google search suggestions (so sends all typed in text to Google)

This is not true. Firefox explicitly asks you the first time you start typing a search in the location bar whether to allow search suggestions. It is opt-in.

Firefox also allows you to keep the location/search bar separate so that you can have search suggestions without sending every URL you type to Google.

The Newtab adverts are not served by Google IIRC and they are only matched with you data locally in your browser, you get a lot of them from Mozilla and locally on your machine they get targeted so you aren't tracked online (If my memory of the article on it is correct)

Is this still true of the default search engine is set to something other than Google? What are the relevant config keys?

I find it very disturbing that the very dangerous issue with Chrome and its family is not discussed here, which is the erosion of web standards.

tl;dr : Choosing anything based on Chromium is giving the death sentence to the Web "democracy"

Moving to a Chromium based browser is letting more and more market share to a browser engine whose roadmap is fully determined by Google. The issue trackers of Chromium or Android projects clearly shows how much Google values its users'feedback about their most wanted features : Not At All. These days it seems they are starting to feel the same about open standards... At first with WHATWG getting in the yard of W3C they tried to get more influence on the redaction of standards, now they don't even bother since they can force anything they want in a "de facto standard" as they are doing with AMP.

The next step is to obliterate any standardized feature they don't like. It can seems to be a frivolous issue but they are doing this right now to SVG-in-OpenType, a standard that is currently implemented in all major browsers except Chromium family (yes even Edge see https://www.colorfonts.wtf/#section4 but the switch to Chromium will probably end it). Here is what Google responds to the numerous people aking them to implement it : https://bugs.chromium.org/p/chromium/issues/detail?id=306078... Apparently a feature even the -probably small- team of Edge developers managed to implement is too complicated for Google chrome engineers ?!? This will get more and more frequent as long they have more than 80% of browser marketshares.

So if you switch to ANY Chromium based browser, even if it's for privacy reasons, PLEASE keep in mind that you are working for the destruction of the web "democracy".

It is disheartening how we seem to learn so little from history, even recent one. It seems like yesterday that the web managed to come out from under the stranglehold of IE and now the wheel turns yet again. This time it may be even harder to break the monopoly since billions of ordinary web surfers have little to no idea of these issues and default to Chrome because it is pre-installed and has almost become synonymous for a browser.

Google still pay for Firefox; about $2 per user. So, Chrome and Firefox are funded by the same people. In fact Google upped the money they're paying despite FF's falling users share, what are they getting for their money - I doubt they're giving it out of charity.

It's like price differentiation, I feel. FF is for people who want to avoid Google, but Google are paying to get privacy-infringement lite. Who knows what else besides being default search provider, and getting every search you type in through search suggestions, they're getting for their money?

>cranky devs looking over their shoulder to call them out years later because Mr. Robot may have been able to show them an ad //

Way to underplay things. Do Chrome change their UI (ie chrome) to ad advertising? Do they force add-ons on people that are unremovable in order to advertise a product? And then update, re-placing the advert into users chrome who've removed it? Do they blank out users home-screen settings in order to add advertising? (I think they did do that one?)

Chrome may be spyware, but default so is FF. And Mozilla have shown they're more than happy to mess around with their users browsers for advertising/promotions.

Aside: how is Chromium worse? Waterfox is looking like a good option.

I've been reading lot of comments like the parent lately. Thanks for voicing my thoughts.

> why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is)

I came here to mention exactly this. I don't mind the certificate issue (as long as there is a post mortem and they learn something from it).

I was wondering how my addons came back automatically (without me having to upgrade to 66.0.4) and I found out about this studies thing, which I never consented to. I feel violated. And the problem is, what browser am I supposed to use from now on? Lynx? Sigh

ETA: I am (was) a proud Firefox user since it was called Firebird, and changing browsers never crossed my mind before (even if Chrome felt faster some times). At this exact moment, I have zero trust on Mozilla, just like I have zero trust on Google (Chrome). Extremely frustrated and disappointed.

> what browser am I supposed to use from now on?

There's actually quite a few. This Wikipedia list [0] might not be the best curation, but it carries my point, somewhat. For example, I've really enjoyed the power-user browsers, like surf, luakit or uzbl.

I know you were expressing the fact that we're stuck between Firefox and Chromium, because they're the only browsers able to keep up with the rapidly moving web stack and provide a fluid user experience at the same time. My point is if you're willing to compromise on that, you actually have other choices.

Oh I do hope to see the day when there's a variety of browsers, all equally compatible with the day's web. Doesn't seem like we're moving in that direction though.

Personally, I tolerate Firefox, because I want some of the extensions, namely Dark Reader and ublock. Dark Reader doesn't really have alternatives, as far as I know, and I find that network level blocking isn't effective or ergonomic enough to replace something like ublock origin. If I solved these two problems, I'd jump ship to surf immediately.

Just to finish my rant; the other day I was experimenting with text browsers for rendering simple sites like thefreedictionary or HN. Their ability to do that is quite abysmal. I think that says a bit about the state of web's accessibility.

[0] https://en.wikipedia.org/wiki/List_of_web_browsers

> keep up with the rapidly moving web stack

Yeah, exactly. I mean, not even EdgeHTML could keep up!

> surf, luakit or uzbl.

Thanks for the suggestions. I had never heard of any of those three, but they look awesome! The only extension I need is Vixen (or any Vimperator-like addon), and they all seem to be keyboard-first. The only browsers I had used before were Lynx and w3m, which were way too hardcore for me. I'll give a shot with luakit. Seems to be an ideal middle ground between functionality and privacy.

>I don't mind the certificate issue

For me, it's the other way around.

They should have forseen the certificate issues and never implemented the system as it is, i.e. disabling addons that have been installed with a valid cert. At most there should be a warning. Addons are losing their configuration because of this and we have yet to see how they fix old FF versions. All of this indicates a total lack of foresight.

However, I see the value in having studies enabled and being able to test features and fixes with certain hardware configurations. Almost every software does it, because it's very useful. Maybe Mozilla, being an advocate for privacy, should be more transparent about it though.

You could just turn off all studies in Firefox. It's a simple option:

https://support.mozilla.org/en-US/kb/shield#w_to-opt-out-of-...

I did. The problem is:

- I had never heard of "Studies" before; which leads to

- I never agreed to be a part of Studies in the first place.

The docs says it must be opted in, so supposedly I have to give consent to it. I don't remember doing so. For all my life, I've always rejected any survey, opt-in request and similar stuff. I do admit there is a small, unlikely chance that I did opt-in. Maybe I misclicked it? Maybe I thought I was rejecting when I was actually agreeing to? Maybe someone else was using my computer and opted-in?

If this is indeed opt-in, and this unlikely scenario did happen, then I apologize for the rant. But I can't remember the prompt at all, and I would never consciously opt-in, hence the feeling of betrayal.

For the record: I now know what Studies are. I acknowledge that companies need to run A/B experiments in order to enhance their products. I just don't want to be opted-in by default.

> If this is indeed opt-in, and this unlikely scenario did happen, then I apologize for the rant.

No need to apologize. It's not really an opt-in if you are certain you would never opt in if you were aware of it, and somehow you accidentally "opted in" anyway.

I'm in the same boat, I would never opt in to any of this stuff. Now I had my "studies" setting turned off, so that's good. But when I looked at about:studies, it seems as though it had been on at some point in time (because it lists a plugin that it used for a study, or something). So I suppose that I actually opted out of this studies thing at some point, meaning it had been turned on without my consent either.

That's not enough. Opt-out features are wrong because organizations/companies know that most people won't pay attention or not fully appreciate the dangers of it.

What would you propose?

Opt-in. Firefox is all about informed choice, it seems people want them to stick to it.

They can just flip the option or create a version of studies called "enquiries" or force a new addon that you can't remove in the next update .. 3 years ago you'd think Mozilla wouldn't ever imagine doing things like that.

3 years ago, they were in the middle of deploying the current studies system.

I think it's actually 5 years ago, perhaps when the major management changes happened. My mistake.

I'm a privacy conscious person so I disabled all spyware that Firefox included. But I went to check, studies was enabled, probably because it was included and enabled by default in the last years and I didn't notice. So how long until Firefox adds something else to have remote code execution rights on my machine?

Studies do send telemetry which is not quite the same as being spyware.

You can actually check what is sent, though there's no option to more finely disable studies requiring, say, cursor, keyboard or tab name monitoring. I haven't seen any such studies though.

The "remote code execution" thing is already there, it is called JavaScript. Almost every browser has it. Add-ons use it all the time.

As for browser code itself, it is open, go read the changelog. If you're extra paranoid, you can build it yourself. Study code is also fully readable.

>Studies do send telemetry which is not quite the same as being spyware.

How is software whose sole purpose is to send my information to a third party not spyware?

>The "remote code execution" thing is already there, it is called JavaScript. Almost every browser has it. Add-ons use it all the time.

JS on any webpage can't do whatever it wants, since it's restrained to the webpage itself. otoh I'm sure this "studies" thing can change my browser configuration (including my certificates, making me vulnerable to MITM) and probably even execute any command with my current user privileges.

They cannot, the studies use JS available to the browser though with internal APIs available. It is potent, but not quite as much as to allow running arbitrary executables outside the browser or usually bypass file system level protection. It can read and write files the user can access. (Which may or may not include /dev on *nix.) It can also exploit your OpenGL driver.

The difference between spyware and telemetry is intent - use of data - and anonymization measures.

If you don't trust the company making the browser with user studies (and their toggle), you probably shouldn't use their build - and you can disable study code completely on compile time.

If Mozilla decided to be evil like a certain Alphabet company, there is nothing to stop them but forking and writing another web browser.

Sounds like you're arguing against a very specific meaning of the term "spyware". One that I'm unfamiliar with. It's not even the historical meaning of the term. I remember when it used to mean any application that "phones home" for any reason whatsoever--when apps ran locally.

It's pretty clear what they are worried about. That's not really arguing in good faith. And "intent" has nothing to do with it--also there is no singular intent from an organisation, if it goes wrong it's just stuff that happened but nobody to point a finger at whose intent it was.

Also, anonymization measures are a joke. It just shows an "intent" to anonymize. But when it turns out that the data is in fact easily de-anonymized somewhere between the browser and the aggregation unit, or in combination with the newest "opt in" monitoring feature, again no fingers to point and your only recourse is better having been safe than sorry.

Sensitivity of data? I'd associate "spyware" with "collects personal information", whereas studies that do not require explicit opt-in are only allowed to collect things on a level of "how many tabs are open", "has the user enabled this feature", and things like web browsing history or data derived from the history are explicitly excluded. If you don't trust Mozilla to hold that standard, then yes, you probably shouldn't use their product.

(Which apparently played part in the Mr Robot idiocy: since it didn't collect any data, it was easy to get it through the process...)

I don't like lots of stuff Mozilla is doing, but I trust them more than the alternatives to actually do what they claim privacy-wise.

I've switchted to qutebrowser, but not sure if it will fit your needs.

> And the problem is, what browser am I supposed to use from now on? Lynx? Sigh

You can try Firefox from your distribution's repositories. eg. Debian disables this sort of things.

>what browser am I supposed to use from now on? Lynx?

w3m is a pretty fun terminal based browser with modern enhancements

Chromium has a working exploit (AFAIK it still is not patched) that allows third-party code to masquerade as first-party code. Unless you run a special addon[1], you are vulnerable to this.

The fact that I still can't find that it's patched now tells me nothing good about the health of the ecosystem and who it is meant to serve. That should be all the reason you need to switch to Firefox, which admittedly also has huge warts but to my mind ones that aren't quite so egregious.

[1] https://chrome.google.com/webstore/detail/ublock-origin-extr...

You make it sound like it's a third-party RCE; but it's a cookie bypass, so it's tracking -- that's serious still [and the implementation sounds illegal to me].

The companies Instart Manager (used by cnet, tomshardware, etc., see link) and Upmanager that are doing this workaround of ublock -- are they not able to attack other browsers, only Chromium? I guess one benefit of being the biggest advertising company is that people don't want to mess with Google's stuff in case they suffer financial repercussions.

https://github.com/gorhill/uBO-Extra/wiki/Sites-on-which-uBO...

> workaround of ublock

This has nothing to do with ublock origin specifically, ublock origin's author just happens to have a band-aid for this exploit. Assuming I don't misunderstand what is happening, any other blocking plugin is vulnerable as well.

> people don't want to mess with Google's stuff

I don't understand what you're saying. Chromium is vulnerable and by extension, so is Chrome.

Edit:

> You make it sound like it's a third-party RCE

I don't think I am. I said third-party code looks like first-party code, that is precisely what is happening.

>third-party code

It's third-party cookies, look like first-party cookies, isn't it? Whilst they are "code", that's misleading because it's not being executed; which is what makes it sound like an RCE.

Or did my brief scan pick up the wrong idea?

> Or did my brief scan pick up the wrong idea?

I believe so. To quote: "The purpose of Instart Logic technology is to disguise 3rd-party requests as 1st-party requests"

The net result of this is also that third-party javascript will get loaded as if it is first-party. Third-party content will look like first-party content in it's entirety. This subverts any potential security features that rely on being able to distinguish a first party from a third party.

Edit: As an example you can read https://www.w3.org/Security/wiki/Same_Origin_Policy

Thanks for persisting in your explanation.

Wow this is... scary and you say it is still not patched? Thank you.

It is interesting the quantity of studies they push to their opted-in normandy students.

Take a look at https://normandy.cdn.mozilla.net/api/v1/recipe/

Looking Glass is a collaboration between Mozilla and the makers of Mr. Robot to provide a shared world experience

Mozilla wants to know more about knowledge and opinions of news on the Web.

Etc.

There are also links to what seems to be internal documentation.

It shocked me the interest and the infrastructure they have just for collecting information. This is not just a couple of developers trying to figure out what feature is used and/or studying bugs.

"To provide this fix on short notice, we are using the Studies system. This system is enabled by default, and no action is needed unless Studies have been disabled. [..] It may take up to six hours for the Study to be applied to Firefox. To check if the fix has been applied, you can enter “about:studies” in the location bar... "

https://blog.mozilla.org/addons/2019/05/04/update-regarding-...

Consider running Icecat. It's most convenient to use it by installing a fully libre distribution such as Parabola or Guix System. Distributions which respect the FSDG don't just exclude proprietary software, but actually take software like Firefox which is 99% libre, and chucks out the last 1% of junk, improving many defaults. You're unlikely to have ethical qualms with such an Icecat.

https://www.gnu.org/software/gnuzilla/ You can see how it's made here: https://git.savannah.gnu.org/cgit/gnuzilla.git/tree/makeicec...

Note that it looks like it disables sync, but that should still work, and you can add whatever addons you like.

Chrome has studies too, called field trials. https://blog.chromium.org/2012/05/changes-to-field-trials-in...

This might be a stupid question, but have you asked them through their support or social media channels yet?

I did from twitter, no answer yet. And I think this is an answer owed to all of the users - not just me.

Absolutely, I didn't necessarily want to disagree with you and was just asking.

I switched to FF a couple of months ago, and was not opted in to Studies automatically. I'm based in Norway though so maybe GDPR had something to say. I had to opt-in to Studies to fix the certificate issue.