5 ms·

Coincidentally I had found out this one today and compiled it myself after a frustrating experience with `brew install chromium` (videos wouldn't play; inputs w

by vemv 8y ago

Coincidentally I had found out this one today and compiled it myself after a frustrating experience with `brew install chromium` (videos wouldn't play; inputs would blink). I guess this has more flags set up by default, and it makes it easier to target a stable commit to compile against. Also as a word of caution, don't use ungoogled-chromium binaries - they never are fully official/confirmed/reproducible. Running opaque blobs from strangers defeats the purpose of leaving Chrome for increasing privacy. Just bite the bullet and run the 2h compilation process yourself.

colordrops 8y ago
Is there a flag for compiling out integrated login?
djrogers 8y ago
> Also as a word of caution, don't use ungoogled-chromium binaries Unless you’re reading every line of code yourself before compiling it, I’d say you’re no safer going you’re route than downloading the binaries offered from the same source.
- vemv 8y ago
  Generally as a software developer I can assess which projects' source to trust, else I wouldn't be running thousands of transitive dependencies in my machine. Binaries which are unofficial to even ungoogled-chromium itself surpass my threshold of trust. But yes, one could take a further step and extract the interesting bits from this project and apply them to the official Chromium trunk.
  - User23 8y ago
    How do you assess the trustworthiness of thousands of transitive dependencies with a far greater number of code contributors in a way that scales? This is a serious question, and it would be great if you shared the solution you found. Thanks.
    - vemv 8y ago
      I should admit that my procedures are only marginally better than an average developer's. Sadly I have no arbitrarily deep audit in place. I just try to pick solid projects, and assume / quickly check that their dependencies don't suck. Also I'm particularly cautious with npm (as opposed to rubygems or clojars). I should be looking into either (or both of): - setting up a multi-user macOS ('me' + 'admin' + 'dev'. I normally operate under 'me'. sudo is only ever executed under 'admin'. Developer tooling is installed for 'dev', an account which cannot access the rest of the filesystem) - using Docker and/or a VM for all dev activity, as a sandbox.
      - Proven 8y ago
        Thanks Sherlock! Shouldn't we all. Yet no one does it and it's unlikely to happen anytime soon.
- Phylter 8y ago
  In spirit I'm with you but somebodies bound to do it and that alone makes it safer to compile from publicly provided source.
bubblethink 8y ago
>Just bite the bullet and run the 2h compilation process yourself. I don't think that's the best use of everyone's time or energy. Not to mention, it may be more error prone, or even insecure depending on what your base system is like. And you'll have to track updates. It seems like chromium is problematic to build in general. Debian hasn't marked it as reproducible. It is also not clear if it is possible to build it for Android using a Foss stack. Various efforts to include chromium or derivatives in Fdroid have failed.
- eganist 8y ago
  > I don't think that's the best use of everyone's time or energy. Seems like there's a simple solution to this dilemma. Assuming build time is the single determining factor: If the value of two hours' build time overnight is less than the value of a privacy-enabled build of Chrome, then build Ungoogled Chromium overnight. Else, get Firefox.
  - comex 8y ago
    Sure, that's a solution if you think that running their binary is unacceptable. But that's begging the question. Most people running macOS (as vemv at least is) run a lot of random binaries from various types of strangers – mostly proprietary applications, although there's also things like Homebrew cached binaries, 'curl | sh' installers, etc. Now, in this case downloading a binary isn't necessary, since there's the option of building it yourself. That's great, and it's definitely (somewhat) safer to build it yourself... but that doesn't make the binary less trustworthy than if that weren't an option. If building sounds like too much effort, you shouldn't automatically give up on using the program, but just fall back to your personal baseline policy for running binaries. And for a lot of people, for better or worse, I think that policy is fairly trusting.
    - vemv 8y ago
      Aren't you forgetting the fact that binaries aren't provided by the project itself? They come from contributors (in the project's words: 'anyone'). That's wildly different from the typical CI-built binary.
dj43nq 8y ago
Wasn't the compiled-from-source chromium also downloading binary blobs without telling the user? There was an advisory about chromium doing it awhile ago.
- Ws32ok 8y ago
  Chromium suddenly starts downloading a binary blob https://lwn.net/Articles/648392/ https://lwn.net/Articles/648392/
tacolizard 8y ago
ungoogled-chromium has deterministic builds EDIT: never mind, I was wrong
titanix2 8y ago
I did it one time. It was really long to download all the build tools and source code then even more to compile the thing. A lot of free space was required (there was few remaining on my SSD). After that the resulting browser was approximately two times slower (in my perception) than Chrome, so I ditched the thing after ten minutes. So it’s somewhat understandable that not everyone is willing to go thru this, especially for the disappointing result.

by vemv 8y ago

colordrops 8y ago

Is there a flag for compiling out integrated login?

djrogers 8y ago

> Also as a word of caution, don't use ungoogled-chromium binaries Unless you’re reading every line of code yourself before compiling it, I’d say you’re no safer going you’re route than downloading the binaries offered from the same source.

vemv 8y ago
Generally as a software developer I can assess which projects' source to trust, else I wouldn't be running thousands of transitive dependencies in my machine. Binaries which are unofficial to even ungoogled-chromium itself surpass my threshold of trust. But yes, one could take a further step and extract the interesting bits from this project and apply them to the official Chromium trunk.
- User23 8y ago
  How do you assess the trustworthiness of thousands of transitive dependencies with a far greater number of code contributors in a way that scales? This is a serious question, and it would be great if you shared the solution you found. Thanks.
  - vemv 8y ago
    I should admit that my procedures are only marginally better than an average developer's. Sadly I have no arbitrarily deep audit in place. I just try to pick solid projects, and assume / quickly check that their dependencies don't suck. Also I'm particularly cautious with npm (as opposed to rubygems or clojars). I should be looking into either (or both of): - setting up a multi-user macOS ('me' + 'admin' + 'dev'. I normally operate under 'me'. sudo is only ever executed under 'admin'. Developer tooling is installed for 'dev', an account which cannot access the rest of the filesystem) - using Docker and/or a VM for all dev activity, as a sandbox.
    - Proven 8y ago
      Thanks Sherlock! Shouldn't we all. Yet no one does it and it's unlikely to happen anytime soon.
Phylter 8y ago
In spirit I'm with you but somebodies bound to do it and that alone makes it safer to compile from publicly provided source.

bubblethink 8y ago

>Just bite the bullet and run the 2h compilation process yourself. I don't think that's the best use of everyone's time or energy. Not to mention, it may be more error prone, or even insecure depending on what your base system is like. And you'll have to track updates. It seems like chromium is problematic to build in general. Debian hasn't marked it as reproducible. It is also not clear if it is possible to build it for Android using a Foss stack. Various efforts to include chromium or derivatives in Fdroid have failed.

eganist 8y ago
> I don't think that's the best use of everyone's time or energy. Seems like there's a simple solution to this dilemma. Assuming build time is the single determining factor: If the value of two hours' build time overnight is less than the value of a privacy-enabled build of Chrome, then build Ungoogled Chromium overnight. Else, get Firefox.
- comex 8y ago
  Sure, that's a solution if you think that running their binary is unacceptable. But that's begging the question. Most people running macOS (as vemv at least is) run a lot of random binaries from various types of strangers – mostly proprietary applications, although there's also things like Homebrew cached binaries, 'curl | sh' installers, etc. Now, in this case downloading a binary isn't necessary, since there's the option of building it yourself. That's great, and it's definitely (somewhat) safer to build it yourself... but that doesn't make the binary less trustworthy than if that weren't an option. If building sounds like too much effort, you shouldn't automatically give up on using the program, but just fall back to your personal baseline policy for running binaries. And for a lot of people, for better or worse, I think that policy is fairly trusting.
  - vemv 8y ago
    Aren't you forgetting the fact that binaries aren't provided by the project itself? They come from contributors (in the project's words: 'anyone'). That's wildly different from the typical CI-built binary.

dj43nq 8y ago

Wasn't the compiled-from-source chromium also downloading binary blobs without telling the user? There was an advisory about chromium doing it awhile ago.

Ws32ok 8y ago
Chromium suddenly starts downloading a binary blob https://lwn.net/Articles/648392/ https://lwn.net/Articles/648392/

tacolizard 8y ago

ungoogled-chromium has deterministic builds EDIT: never mind, I was wrong

titanix2 8y ago

I did it one time. It was really long to download all the build tools and source code then even more to compile the thing. A lot of free space was required (there was few remaining on my SSD). After that the resulting browser was approximately two times slower (in my perception) than Chrome, so I ditched the thing after ten minutes. So it’s somewhat understandable that not everyone is willing to go thru this, especially for the disappointing result.