10 ms·

Iridium Browser – A Chromium-based browser focused on privacy

127 points by Jerry2 10y ago

bikitan 10y ago
Is that a scrolling marquee in 2017?
- flukus 10y ago
  I know we used to rubbish them, but in a world of auto playing video ads, flash animations and unnecessary javascript scrolling marquees seem like the least of our problems.
  - richardwhiuk 10y ago
    Sadly, it doesn't even require JavaScript, it's CSS: animation: marquee 20s linear infinite;
    - saghm 10y ago
      I think s/he meant "scrolling marquees seem like the least of our problems in a world of auto playing video ads, flash animations and unnecessary javascript"
  - tritosomal 10y ago
    Used sparingly, the <blink/> tag was at times practical. Unforunately those that used <blink/> used it zealously. I feel like there's should be a word that described the things that get ruined by a small number of abusers. I'd probably already know it, if such a word were coined, but maybe not.
    - flukus 10y ago
      Tragedy of the commons?
      - tritosomal 10y ago
        I think that's reserved for neglect.
- 2T1Qka0rEiPr 10y ago
  You beat me to it! To come across one now fills you with nostalgia!
spankalee 10y ago
Previous discussion from almost two years ago: https://news.ycombinator.com/item?id=9482689 https://news.ycombinator.com/item?id=9482689
awqrre 10y ago
I'd be curious to see what they removed... Also, I get a 404 for the download link[1]. 1. https://iridiumbrowser.de/download.html https://iridiumbrowser.de/download.html
- axelfontaine 10y ago
  https://github.com/iridium-browser/tracker/wiki/Differences-between-Iridium-and-Chromium https://github.com/iridium-browser/tracker/wiki/Differences-...
  - cpeterso 10y ago
    It looks like some of these changes could be implemented as a Chromium extension that toggles these settings in Chrome. Mozilla and Tor are working to upstream many of Tor's privacy changes into the Firefox code base. Even if the features are disabled in Firefox for now, having the code already in Firefox will make Tor's work easier because they don't need to reapply bitrotted patches. They just need to toggle an about:config pref. This Tor blog post has more information about the upstreaming collaboration: https://blog.torproject.org/blog/tor-heart-firefox https://blog.torproject.org/blog/tor-heart-firefox
notatoad 10y ago
So increase your "privacy" at the risk of your security? Personally, I trust a fully-patched chrome more than a browser that lags behind the latest security updates by 6 weeks. (Iridium is currently branched off chromium 54, chrome is on version 55)
- na85 10y ago
  Maybe with more contributors they'd be able to keep up with the security patches in a more timely fashion.
- tptacek 10y ago
  Yes, this is a recurring problem with Chromium derivatives: https://news.ycombinator.com/item?id=9483064 https://news.ycombinator.com/item?id=9483064
- jklinger410 10y ago
  Maybe for some people Google owning their data is worse than the odds that they will be targeted by the latest exploits.
  - witty_username 10y ago
    I've configured Chrome to not send my address bar to Google and to encrypt my sync with a custom passphrase. What data does Google own?
    - CaptSpify 10y ago
      Have you done any network monitoring to see if Chrome is sending anything back to Google?
      - witty_username 10y ago
        No. But I use Chromium so the source code is open. I mean if we're going to go to this level of paranoid; then we might as well look at attacks on Firefox (which have been suspected to be used by the NSA against Tor Browser).
eh78ssxv2f 10y ago
Was the last commit back in Oct 2016 (https://git.iridiumbrowser.de/cgit.cgi/iridium-browser/ https://git.iridiumbrowser.de/cgit.cgi/iridium-browser/)? That looks like a long time gap. I am pretty sure there have been multiple security/critical bug fixes to Chromium between then and now.
- scoobydooxp 10y ago
  https://github.com/iridium-browser https://github.com/iridium-browser
  - deleted 10y ago
    [deleted]
  - em3rgent0rdr 10y ago
    https://github.com/iridium-browser/iridium-browser/commits/master https://github.com/iridium-browser/iridium-browser/commits/m... says last commits of actual code was from Oct 2016...
warcode 10y ago
Attempting to load https://www.twitch.tv/ https://www.twitch.tv/ results in ERR_CERTIFICATE_TRANSPARENCY_REQUIRED. Doesn't seem usable.
Kiro 10y ago
Why .de?
- detaro 10y ago
  Because it is backed by a German organization.
aargh_aargh 10y ago
The first link in the FAQ is broken, should be: https://github.com/iridium-browser/tracker/wiki/Differences-between-Iridium-and-Chromium https://github.com/iridium-browser/tracker/wiki/Differences-...
free2rhyme214 10y ago
Why this over the Tor Browser?
- lmedinas 10y ago
  I think the point here is to offer a browser that does NOT report to Google or offer any Google services in order to give a more privacy oriented experience while keeping the same expectation a user has from Chrome. Tor Browser on the other hand tries to be a very private oriented browser (blocks several features by default) and gives access to the Tor network.
onion2k 10y ago
After a very quick check, I think the chrome.webRequest API can be used without the browser giving any warnings. That means an extension can intercept and modify every incoming and outgoing request the browser makes, including sending a copy to a third party or redirecting xhr traffic in the background. Chrome (and consequently Iridium) makes it hard to hide an extension, and a malicious attacker would need to have access to the browser, but if you install this browser in the belief that it will "automatically" protect your privacy I don't think it's doing enough. There should be an indicator that an extension is manipulating requests that the browser is making.
Sephr 10y ago
Never use forks of popular browsers (exception: when browser libraries are dynamically included from official sources). Forks never get security updates as timely as the originals. This is pretty significant if you are important enough for someone to use their zero-days on.
- gst 10y ago
  In general I agree. My only current exception is that I use Brave[1] instead of Chrome on Android, because Chrome is missing adblocking. It appears that the company behind Brave is large enough to keep the fork somewhat up to date (compared with several other forks that are only updated very infrequently). Also not only security updates are an issue. Some of the previous forks have been maintained by people who hardly had any idea of what they were doing. Interesting blog post about the Iron fork: http://neugierig.org/software/chromium/notes/2009/12/iron.html http://neugierig.org/software/chromium/notes/2009/12/iron.ht... [1] https://en.wikipedia.org/wiki/Brave_(web_browser) https://en.wikipedia.org/wiki/Brave_(web_browser)
  - em3rgent0rdr 10y ago
    Could instead use FireFox on Android, which will allow you to install plugins, so you can have adblocking.
    - gst 10y ago
      That's what I did before I knew about Brave. If I don't have a choice I'd use whatever browser provides adblocking, but with a choice I'd prefer a Chromium-based browser.
  - neurostimulant 10y ago
    The IRC log of the conversation between the iron guy and the chrome devs is pretty interesting. > 10:26 < Iron> why must google be so evil :( > 10:27 <+evmar> it's pretty rough here, what with the strangling kittens all day
romanovcode 10y ago
I don't get it. When I launch it it still asks me if I want to sync with gmail. Privacy and google, really?
yAnonymous 10y ago
If you want a privacy-focused browser, Firefox is a better choice than Chromium without security patches.
- jbmorgado 10y ago
  Thing is, at least on MacOS Firefox is quite slow compared to Safari or Chrome. Firefox also keeps eating more and more memory the more time it's open (Chrome also uses a lot memory, but at least it's stable). Firefox devs usually blame extensions for this (and I can believe them), but I really don't care who's fault it is, I just want my browser to work nicely. Also, these are present complains. Since at work I'm back on Linux full time, I tried to stop using Safari at home and use Firefox in order to use the same browser everywhere. But Firefox just didn't cut it. I'm now deciding between Opera and Chromium. They have their quirks, but at least they are considerably faster (on my MacBook Pro) and don't keep leaking memory like Firefox does. Which brothers me, because the best browser on paper when it comes to multi OS support and privacy is Firefox and would be my default go to browser in this case it weren't for these big (for me personally) problems it still has after all these years of the same exact complains from a lot of users.
  - _joel 10y ago
    Try the 'Suspend Tab' plugin.
    - jbmorgado 10y ago
      I have Auto Unload Tab, according to devs and reviewers it saves more memory than just suspending the tab.
keypress 10y ago
How does Chromium fare by itself?
- keypress 10y ago
  Or rather, how much of this is user configurable: https://github.com/iridium-browser/tracker/wiki/Differences-between-Iridium-and-Chromium https://github.com/iridium-browser/tracker/wiki/Differences-... Can I make Chromium less Google and increase privacy?
skrowl 10y ago
My browser focused on privacy is called Firefox (with a few key extensions). Why take out of date Chromium over fully supported Firefox?
- WayneBro 10y ago
  Why? Because of all the reasons most people switched away from Firefox to Chrome to begin with... Firefox is slow, klunky and the UI is deplorable. Mozilla and also hates native platforms and therefore Firefox doesn't respect my OS. For instance - since the beginning of time, every Windows program let me close the window by double-clicking in the upper left corner. People have been asking Mozilla to change this for years and got ignored. Meanwhile, the Chrome team changed it immediately upon request when one of their builds lost the ability. IMO, Mozilla is a second-rate has-been that turns out nothing but useless crap like Rust and Servo that nobody needs or uses since there are much higher quality alternatives already in existence - http://www.mozillalabs.com/en-US/projects/ http://www.mozillalabs.com/en-US/projects/

127 points by Jerry2 10y ago

bikitan 10y ago

Is that a scrolling marquee in 2017?

flukus 10y ago
I know we used to rubbish them, but in a world of auto playing video ads, flash animations and unnecessary javascript scrolling marquees seem like the least of our problems.
- richardwhiuk 10y ago
  Sadly, it doesn't even require JavaScript, it's CSS: animation: marquee 20s linear infinite;
  - saghm 10y ago
    I think s/he meant "scrolling marquees seem like the least of our problems in a world of auto playing video ads, flash animations and unnecessary javascript"
- tritosomal 10y ago
  Used sparingly, the <blink/> tag was at times practical. Unforunately those that used <blink/> used it zealously. I feel like there's should be a word that described the things that get ruined by a small number of abusers. I'd probably already know it, if such a word were coined, but maybe not.
  - flukus 10y ago
    Tragedy of the commons?
    - tritosomal 10y ago
      I think that's reserved for neglect.
2T1Qka0rEiPr 10y ago
You beat me to it! To come across one now fills you with nostalgia!

spankalee 10y ago

Previous discussion from almost two years ago: https://news.ycombinator.com/item?id=9482689 https://news.ycombinator.com/item?id=9482689

awqrre 10y ago

I'd be curious to see what they removed... Also, I get a 404 for the download link[1]. 1. https://iridiumbrowser.de/download.html https://iridiumbrowser.de/download.html

axelfontaine 10y ago
https://github.com/iridium-browser/tracker/wiki/Differences-between-Iridium-and-Chromium https://github.com/iridium-browser/tracker/wiki/Differences-...
- cpeterso 10y ago
  It looks like some of these changes could be implemented as a Chromium extension that toggles these settings in Chrome. Mozilla and Tor are working to upstream many of Tor's privacy changes into the Firefox code base. Even if the features are disabled in Firefox for now, having the code already in Firefox will make Tor's work easier because they don't need to reapply bitrotted patches. They just need to toggle an about:config pref. This Tor blog post has more information about the upstreaming collaboration: https://blog.torproject.org/blog/tor-heart-firefox https://blog.torproject.org/blog/tor-heart-firefox

notatoad 10y ago

So increase your "privacy" at the risk of your security? Personally, I trust a fully-patched chrome more than a browser that lags behind the latest security updates by 6 weeks. (Iridium is currently branched off chromium 54, chrome is on version 55)

na85 10y ago
Maybe with more contributors they'd be able to keep up with the security patches in a more timely fashion.
tptacek 10y ago
Yes, this is a recurring problem with Chromium derivatives: https://news.ycombinator.com/item?id=9483064 https://news.ycombinator.com/item?id=9483064
jklinger410 10y ago
Maybe for some people Google owning their data is worse than the odds that they will be targeted by the latest exploits.
- witty_username 10y ago
  I've configured Chrome to not send my address bar to Google and to encrypt my sync with a custom passphrase. What data does Google own?
  - CaptSpify 10y ago
    Have you done any network monitoring to see if Chrome is sending anything back to Google?
    - witty_username 10y ago
      No. But I use Chromium so the source code is open. I mean if we're going to go to this level of paranoid; then we might as well look at attacks on Firefox (which have been suspected to be used by the NSA against Tor Browser).

eh78ssxv2f 10y ago

Was the last commit back in Oct 2016 (https://git.iridiumbrowser.de/cgit.cgi/iridium-browser/ https://git.iridiumbrowser.de/cgit.cgi/iridium-browser/)? That looks like a long time gap. I am pretty sure there have been multiple security/critical bug fixes to Chromium between then and now.

scoobydooxp 10y ago
https://github.com/iridium-browser https://github.com/iridium-browser
- deleted 10y ago
  [deleted]
- em3rgent0rdr 10y ago
  https://github.com/iridium-browser/iridium-browser/commits/master https://github.com/iridium-browser/iridium-browser/commits/m... says last commits of actual code was from Oct 2016...

warcode 10y ago

Attempting to load https://www.twitch.tv/ https://www.twitch.tv/ results in ERR_CERTIFICATE_TRANSPARENCY_REQUIRED. Doesn't seem usable.

Kiro 10y ago

Why .de?

detaro 10y ago
Because it is backed by a German organization.

aargh_aargh 10y ago

The first link in the FAQ is broken, should be: https://github.com/iridium-browser/tracker/wiki/Differences-between-Iridium-and-Chromium https://github.com/iridium-browser/tracker/wiki/Differences-...

free2rhyme214 10y ago

Why this over the Tor Browser?

lmedinas 10y ago
I think the point here is to offer a browser that does NOT report to Google or offer any Google services in order to give a more privacy oriented experience while keeping the same expectation a user has from Chrome. Tor Browser on the other hand tries to be a very private oriented browser (blocks several features by default) and gives access to the Tor network.

onion2k 10y ago

After a very quick check, I think the chrome.webRequest API can be used without the browser giving any warnings. That means an extension can intercept and modify every incoming and outgoing request the browser makes, including sending a copy to a third party or redirecting xhr traffic in the background. Chrome (and consequently Iridium) makes it hard to hide an extension, and a malicious attacker would need to have access to the browser, but if you install this browser in the belief that it will "automatically" protect your privacy I don't think it's doing enough. There should be an indicator that an extension is manipulating requests that the browser is making.

Sephr 10y ago

Never use forks of popular browsers (exception: when browser libraries are dynamically included from official sources). Forks never get security updates as timely as the originals. This is pretty significant if you are important enough for someone to use their zero-days on.

gst 10y ago
In general I agree. My only current exception is that I use Brave[1] instead of Chrome on Android, because Chrome is missing adblocking. It appears that the company behind Brave is large enough to keep the fork somewhat up to date (compared with several other forks that are only updated very infrequently). Also not only security updates are an issue. Some of the previous forks have been maintained by people who hardly had any idea of what they were doing. Interesting blog post about the Iron fork: http://neugierig.org/software/chromium/notes/2009/12/iron.html http://neugierig.org/software/chromium/notes/2009/12/iron.ht... [1] https://en.wikipedia.org/wiki/Brave_(web_browser) https://en.wikipedia.org/wiki/Brave_(web_browser)
- em3rgent0rdr 10y ago
  Could instead use FireFox on Android, which will allow you to install plugins, so you can have adblocking.
  - gst 10y ago
    That's what I did before I knew about Brave. If I don't have a choice I'd use whatever browser provides adblocking, but with a choice I'd prefer a Chromium-based browser.
- neurostimulant 10y ago
  The IRC log of the conversation between the iron guy and the chrome devs is pretty interesting. > 10:26 < Iron> why must google be so evil :( > 10:27 <+evmar> it's pretty rough here, what with the strangling kittens all day

romanovcode 10y ago

I don't get it. When I launch it it still asks me if I want to sync with gmail. Privacy and google, really?

yAnonymous 10y ago

If you want a privacy-focused browser, Firefox is a better choice than Chromium without security patches.

jbmorgado 10y ago
Thing is, at least on MacOS Firefox is quite slow compared to Safari or Chrome. Firefox also keeps eating more and more memory the more time it's open (Chrome also uses a lot memory, but at least it's stable). Firefox devs usually blame extensions for this (and I can believe them), but I really don't care who's fault it is, I just want my browser to work nicely. Also, these are present complains. Since at work I'm back on Linux full time, I tried to stop using Safari at home and use Firefox in order to use the same browser everywhere. But Firefox just didn't cut it. I'm now deciding between Opera and Chromium. They have their quirks, but at least they are considerably faster (on my MacBook Pro) and don't keep leaking memory like Firefox does. Which brothers me, because the best browser on paper when it comes to multi OS support and privacy is Firefox and would be my default go to browser in this case it weren't for these big (for me personally) problems it still has after all these years of the same exact complains from a lot of users.
- _joel 10y ago
  Try the 'Suspend Tab' plugin.
  - jbmorgado 10y ago
    I have Auto Unload Tab, according to devs and reviewers it saves more memory than just suspending the tab.

keypress 10y ago

How does Chromium fare by itself?

keypress 10y ago
Or rather, how much of this is user configurable: https://github.com/iridium-browser/tracker/wiki/Differences-between-Iridium-and-Chromium https://github.com/iridium-browser/tracker/wiki/Differences-... Can I make Chromium less Google and increase privacy?

skrowl 10y ago

My browser focused on privacy is called Firefox (with a few key extensions). Why take out of date Chromium over fully supported Firefox?

WayneBro 10y ago
Why? Because of all the reasons most people switched away from Firefox to Chrome to begin with... Firefox is slow, klunky and the UI is deplorable. Mozilla and also hates native platforms and therefore Firefox doesn't respect my OS. For instance - since the beginning of time, every Windows program let me close the window by double-clicking in the upper left corner. People have been asking Mozilla to change this for years and got ignored. Meanwhile, the Chrome team changed it immediately upon request when one of their builds lost the ability. IMO, Mozilla is a second-rate has-been that turns out nothing but useless crap like Rust and Servo that nobody needs or uses since there are much higher quality alternatives already in existence - http://www.mozillalabs.com/en-US/projects/ http://www.mozillalabs.com/en-US/projects/