Yep, I did the same.

Currently, I am still building my own fork of WebKit (RetroKit [1] ) that removes all attack surfaces it still has (e.g. canvas, webgl, webaudio, applet and embed support, pdf plugins...you name it).

I realized at some point that all bridge concepts are super buggy, in Gecko, in WebKit, in Blink...and the only way to reduce the attack surface is to remove the featureset.

Tried to do the same with chromium and gecko before...but arguably both projects come with so much overhead (repo tools, hardcoded git urls everywhere, custom clone scripts for each platform and environment etc) that they're inforkable.

Take a look at projects like nwjs, where the maintainer has to go almost insane trying to keep up to date with upstream...and he basically didn't change anything else than the public headers to be able to embed chromium more easily.

I don't need WebGL to browse websites. If I want to visit a web experiment I can still use ungoogled chromium --user-data-dir=/tmp/...

As for the alternative in the meantime: I'm using ungoogled chromium with my own Browser Extension [2] to block off all tracking and filtering/rewriting the actual content.

[1] Still WIP. Would love to get more people on board: https://github.com/tholian-network/retrokit

[2] https://github.com/cookiengineer/defiant

You sound kind of paranoid. Firefox’s security is fine.

> You sound kind of paranoid

Once you get directly spearphished it changes your threat modeling, and in my case, you learn phrases like threat modeling.

> Firefox’s security is fine.

There is some debate about this which can be found surrounding my linked comment in OP.

> Firefox’s security is fine.

They just patched two vulns as of time of writing. Don't assume a browser is bulletproof. Since a browser is so complex, bugs and vulns appear regularly in them and can exploited for months before a patch arrives.

So ...

Chrome has the best resourced development. Brave leverages Google's investment, and adds their own features (and vulnerabilities). Opera similarly.

So ... there's not a lot of choice, really. Firefox or the mono-culture.

Thanks. Yeah, I am aware of the sad realities there. I listened to Brave’s founder on Acquired.fm recently discuss the reason for their Chrome choice.

I want to get more granular and pick the best chromium flavor (distro?), but I am struggling to find the correct metrics to quantify “most secure.”

And if I get that detailed, maybe there is a different answer on each OS.

Am I even asking the correct questions here? Are my priors sound?

Yes. I recently switched to chrome after using firefox for 10 years. My main reason are firefox is going down in development/share and it in-turns effects security and performance.

One other question, did you look at using Chromium instead of Chrome?

It has a smaller attack surface which is a plus, correct? Does Chrome add any security features to Chromium?

Confirmation bias aside, thanks for the sanity check.

Well... Since you don't want to use Firefox and that anything Chromium-based is highly (NOT) recommend (really!), that leaves you with........

Lynx

Really, any thing is better than Chromium based browsers... And Lynx is actually great! (If you like this kind of software!!!)

There is also Firefox based browsers... But I'm not sure you would like them...

There's Lisp based browser Nyxt. It's being actively developed. I'm not using it. I recently found out about it and am intrigued.

I've been using Netscape for years. Never had an issue.