That it's a Google-controlled project. Seriously, that's it. I have no reason to believe Google has my best interest at heart.

Don't turn that around and say "Oh, you think Mozilla is looking out for you?" because I don't. I just trust Google less.

The question you should be asking is whether you trust Brave to vet the source code and remove anything that seems like a problem.

Brave is (and you are) saying I should trust Brave because they're going to rip out Google's tracking and insert their own instead. No thank you. I'll stick with Firefox and whatever chicanery Mozilla is up to.

There isn’t any whataboutism in the post you are replying to.

Brave Ads are opt-in and client-based. There is no server side tracking of users or data in the clear. I can say more on how all this works, but I will pause here. Search for "catalog" elsewhere to find another comment explaining it a bit more.

The page goes over (high level) how the project is built and links to patches where functionality was disabled or modified (ex: proxied, etc)

I would trust a closed source project that has been thoroughly and extensively vetted by a third-party auditor I trust far more than an open source project that has no audit for me to reference.

As I am not a professional security auditor, my ability to understand the minutiae of developer decisions (intentional and unintentional) in some multi-million-LOC project is basically a limit approaching zero. My looking at the source code to give myself a false sense of security would only increase my risk, IMO.

It's like a restaurant tells you "yeah we have a clean kitchen, you can go take a quick look yourself!" and it's like, do you know to check that water and disinfectant buckets can't be within x feet of each other? To temp every fridge and warmer to ensure no danger zones? To monitor glove usage and hair net usage? And a thousand other things?

Being open source basically means that a nice auditor could do some audit work for free to help the community, but that's about it from my perspective.

Unless some of you are actively code reviewing the entirety of Chromium prior to launching any build of it ???

LetsEncrypt is an example of a non-profit open source based CA.

Before you could argue that the open source Chromium was largely immune to Google's various small bad behaviours, but when they make such a large close-minded move, at a certain point you can't keep supporting the platform as a whole when they are so hostile to the open internet. Even if it's indirect support.

Also, it can't be ignore that Firefox's recent move towards parity with Chrome has played a big role in giving people the option to even switch.

You mean the platform that specifically disallows competing browser engines, making Firefox just a shell over a Safari-enabled web view and that can't even access Safari's content blockers? The only Firefox that's not running a Firefox engine under the hood? That Firefox?

Given you're a developer for Brave, it's not possible for you to not know this, therefore your statement is misleading at best.

The pitfalls of Chromium are obvious... it gives Google the power to impose on the market whatever engine feature they want, they are the ones defining the web standards and there's nothing Brave can do about it because Brave does not have the capacity to maintain a full fork, or to fight for web standards, just like it doesn't have the capacity to build a browser without piggybacking on somebody else.

Don't get me wrong, nowadays even Microsoft admitted total defeat, but then Brave should recognize its total dependence on Google and its continued goodwill.

We do have upstream contributions to Chromium. Nowhere near as many as Microsoft (we may only have a few), but we do try to contribute back when possible

What do you mean? Brave is based on Chromium, which is open source. Google can't stop people from using it.

(Disclosure: I work for Google)

[1] Your categorization doesn't match what I've seen. Microsoft has been driving substantial changes as Edge moves onto it.

Basically, you guys are in a weird space where your decisions aren't looked at purely from a technical lens, but also an ideological one.

But don't let browsers pretend to be neutral runtimes for the terrible third party scripts on which surveillance advertising depends. They are not neutral. The big-4 browsers in the west apart from Apple are partly or fully captured by $100B ad businesses.

We are all in a weird space. Best to fight back at the endpoint with the right browser. Could be Safari, Firefox, or Chrome with opt outs and uBO and other defenses (but risks remain in Chrome especially), if you are not game for Brave.

In my mind, considering the push you’re making, you’d validate that vanilla chromium meets the requirements to achieve said push. If it didn’t, it’d be a non-starter and you’d have went a different route (leveraging aspects of Firefox’s stack maybe if, again, it met requirements).