News for hackers. Stuff that matters.
Re:Wikipedia Is Now a Brave Verified Publisher by skybrian on Thursday August 29, 2019 @01:59PM (#20831997)
This is kind of silly. When you copy open source code, it doesn't give any magic access to the people who wrote it. If there is anything wrong with it, it has to appear on the source code somewhere.

The question you should be asking is whether you trust Brave to vet the source code and remove anything that seems like a problem.

Re:Wikipedia Is Now a Brave Verified Publisher by phjesusthatguy3 on Thursday August 29, 2019 @02:23PM (#20832223)
It isn't silly. How about I don't trust either one of them?

Brave is (and you are) saying I should trust Brave because they're going to rip out Google's tracking and insert their own instead. No thank you. I'll stick with Firefox and whatever chicanery Mozilla is up to.

Re:Wikipedia Is Now a Brave Verified Publisher by Ajedi32 on Thursday August 29, 2019 @02:52PM (#20832477)
If you don't trust Brave, how would that be any better if they were using Firefox as the base for their browser over Chromium?
[dead]
Re:Wikipedia Is Now a Brave Verified Publisher by furyofantares on Thursday August 29, 2019 @03:40PM (#20832877)
It’s just confusing because then your original comment is a non-sequitur, not particularly relevant to the context of the discussion about trusting Brave on FF vs Brave on Chromium, because, as you say, if you don’t trust Brave then the base doesn’t matter.

There isn’t any whataboutism in the post you are replying to.

Re:Wikipedia Is Now a Brave Verified Publisher by phjesusthatguy3 on Thursday August 29, 2019 @04:01PM (#20833050)
No, you didn't go back to my original post, which said I don't trust Google. My apology was about the language I used.
Re:Wikipedia Is Now a Brave Verified Publisher by Buge on Friday August 30, 2019 @12:24AM (#20835964)
I still don't understand why you would prefer if Brave was based on Firefox instead of Chrome. One of your comments sounds like you're worried about Brave inserting tracking. Brave could do that regardless of what it's based on.
Re:Wikipedia Is Now a Brave Verified Publisher by BrendanEich on Friday August 30, 2019 @03:15PM (#20841658)
No, we rip out Google's tracking and insert nothing.

Brave Ads are opt-in and client-based. There is no server side tracking of users or data in the clear. I can say more on how all this works, but I will pause here. Search for "catalog" elsewhere to find another comment explaining it a bit more.

Re:Wikipedia Is Now a Brave Verified Publisher by underwater on Thursday August 29, 2019 @11:32PM (#20835769)
Absolutely not silly. By shipping a Chromium-based browser they weaken Gecko and Firefox. A real risk is that we are left with Blink and Webkit being the only two engines. That makes it easier for Google to use their influence to push for standard changes that benefit them (see: DRM).
Re:Wikipedia Is Now a Brave Verified Publisher by bsclifton on Thursday August 29, 2019 @02:15PM (#20832155)
The team has been capturing deviations from Chromium on a wiki page here: https://github.com/brave/brave-browser/wiki/Deviations-from-...

The page goes over (high level) how the project is built and links to patches where functionality was disabled or modified (ex: proxied, etc)

Re:Wikipedia Is Now a Brave Verified Publisher by craftyguy on Thursday August 29, 2019 @09:03PM (#20835121)
It's not silly. Google 100% controls upstream chromium, and they can afford to make decisions about it in a vacuum.
Re:Wikipedia Is Now a Brave Verified Publisher by root_axis on Thursday August 29, 2019 @10:17PM (#20835456)
So what? Brave does not have to incorporate every decision from upstream.
Re:Wikipedia Is Now a Brave Verified Publisher by craftyguy on Friday August 30, 2019 @01:43AM (#20836197)
They would be screwed if google decided to actively cut off downstream chromium projects by making breaking code changes, licensing changes, etc.
Re:Wikipedia Is Now a Brave Verified Publisher by BrendanEich on Friday August 30, 2019 @03:16PM (#20841677)
Many browsers would be screwed, and Google would for some of the code be in breach of the open source licenses governing the file or library. It's not likely for that and for many other reasons, but who knows? Anyway by the time Google went this evil, we'd hope to be big enough to do our own engine.
Re:Wikipedia Is Now a Brave Verified Publisher by criley2 on Thursday August 29, 2019 @02:21PM (#20832211)
IMO just because it's open source doesn't mean it's safe.

I would trust a closed source project that has been thoroughly and extensively vetted by a third-party auditor I trust far more than an open source project that has no audit for me to reference.

As I am not a professional security auditor, my ability to understand the minutiae of developer decisions (intentional and unintentional) in some multi-million-LOC project is basically a limit approaching zero. My looking at the source code to give myself a false sense of security would only increase my risk, IMO.

It's like a restaurant tells you "yeah we have a clean kitchen, you can go take a quick look yourself!" and it's like, do you know to check that water and disinfectant buckets can't be within x feet of each other? To temp every fridge and warmer to ensure no danger zones? To monitor glove usage and hair net usage? And a thousand other things?

Being open source basically means that a nice auditor could do some audit work for free to help the community, but that's about it from my perspective.

Unless some of you are actively code reviewing the entirety of Chromium prior to launching any build of it ???

Re:Wikipedia Is Now a Brave Verified Publisher by tlb on Thursday August 29, 2019 @03:21PM (#20832712)
Can you give an example of a closed-source project you trust because it has been audited by a third party?
Re:Wikipedia Is Now a Brave Verified Publisher by kbrosnan on Thursday August 29, 2019 @08:21PM (#20834917)
Just about all certificate authorities are trusted by billions of people a day to encrypt their data. Almost all of CAs are privately held companies, the only way they are trusted is by being audited by a third party. For info about the inclusion process see https://www.ccadb.org/ and https://wiki.mozilla.org/CA/Information_Checklist

LetsEncrypt is an example of a non-profit open source based CA.