22 ms·

Brave browser can inject headers in HTTP requests

267 points by rvnx 8y ago

rvnx 8y ago
Source: https://github.com/brave/browser-android-tabs/commit/911770a07549ce53f49a9d87a5a19b4da29fb767#diff-35dd256442c3c60f5bec67e5b2a86cda https://github.com/brave/browser-android-tabs/commit/911770a...
uberman 8y ago
Interesting. How did you discover this? Can you post something about how they are using this data in the actual header itself?
- rvnx 8y ago
  Just by reading source-code. Every day the browser downloads from "laptop-updates" server a list of hosts and list of headers to inject. This is supposed to help websites to identify that the user is running Brave (but there are other exceptions in the code, like at https://github.com/brave/browser-laptop/blob/master/js/data/siteHacks.js#L50 https://github.com/brave/browser-laptop/blob/master/js/data/... ) but in practice, the Brave developers can inject any header into any website remotely. Every single Brave installation is uniquely tracked by a "download-id" which makes the backdoor even more powerful.
  - TazeTSchnitzel 8y ago
    Does it do any kind of whitelisting of what kind of headers can be sent?
    - rvnx 8y ago
      No
orian 8y ago
Their full mission is "We're reinventing the browser as a user-first platform for speed, privacy, better ads, and beyond ", therefore I guess this is for a "better ads" ;-)
- jordigh 8y ago
  This is why I can't support Brave. They see it as a foregone conclusion that the only way to make sure the internet doesn't starve it so make sure we all watch ads, and they think that if they can make the ads nicer, we'll all watch them. They gave Brave tools to hide some or most ads hoping that this will make us willingly watch other ads. How about no? How about we find a better way to not starve than making sure everyone is fed their daily dose of manipulative marketing materials?
  - jplayer01 8y ago
    Well, get to it. Give us the solution. Outright rejecting Brave isn't helpful. Newspapers financed themselves through ads for decades, but now because websites try to do the same (while abusing their position) and Brave tries to find a fair middle ground that still respects our privacy and rights, they're suddenly the bad guy.
    - mr_spothawk 8y ago
      I'm interested in this: https://datproject.org https://datproject.org
    - enraged_camel 8y ago
      >>Well, get to it. Give us the solution. Outright rejecting Brave isn't helpful. Just because someone rejects a shitty solution doesn't mean they suddenly acquire the burden of coming up with a new one.
      - jplayer01 8y ago
        They haven't even given a valid reason to consider the solution shitty enough to reject. All I could derive from their comment is that they doesn't like ads at all (while ignoring the fact that nobody else has managed to implement a working solution, that ads work, and that Brave is implementing the one solution that has traditionally had plenty of support (micropayments) and some hope of working). Like, weren't micropayments all the rage just 5 years ago? Are ads really the problem in itself? I'd say the real problem with ads are ad networks that track you, create a profile of you and use that to personalize ads, meanwhile providing an attack vector for malware and site owners abusing it historically in the form of Flash or other ugly and distracting ways of displaying them. Brave is providing a way to display ads that don't track you and don't infringe on your privacy. I don't see the downside here, only the upside that we can continue to have a 'free' internet where not only the well-off have access to vast swathes of the internet.
ameyv 8y ago
I just switched from chrome to brave and now I need to seriously rethink this.
- Phenix88be 8y ago
  Firefox is still backdoor free :)
  - pmlnr 8y ago
    This is debatable: with the experiments, Firefox has the power to install addons behind the scenes. See the Mr. Robot fiasco: https://news.ycombinator.com/item?id=15956325 https://news.ycombinator.com/item?id=15956325
    - jonathankoren 8y ago
      I hate to tell you this, but every browser has the ability to run experiments.
      - pmlnr 8y ago
        read the link; i wasn't referring to website originated experiments. btw midori is without backdoors, so is dillo, or lynx.
        jonathankoren 8y ago
        I am well aware of the Mr Robot brouhaha. No one brought up “website oriented” experiments. We’re talking about the browser itself. All modern browsers of them have the ability to download JavaScript and execute it to change functionality. All of them have the ability to toggle behavior remotely. That’s how you experiment, and experiment driven development is how modern software is made. Finally, you can not be serious mentioning Lynx. It was obsolete in 1996. I know. I was there.
      - AnaniasAnanas 8y ago
thenanyu 8y ago
Wait, what am I missing here? - the source code is open, so we can see that this is going on - the url where the headers are downloaded from is open so we can see / monitor whatever headers get added I'm not a security expert, just a lowly developer, what sequence of events should I be concerned about?
useranon 8y ago
Function where this url is called: https://github.com/brave/brave-core/blob/8305d502aa72a5584815aa714dc3ba129df64546/components/brave_referrals/browser/brave_referrals_service.cc#L435 https://github.com/brave/brave-core/blob/8305d502aa72a558481...
augbog 8y ago
To be fair looking at the commit where it got merged, it was for a pre-release beta build for Android and release notes specifically say > That is a very first beta version of Brave Rewards on Android. It is pointed on test network. DO NOT TRANSFER REAL MONEY!!! We use SafetyNet API for device attestation.There are grants available on first run. There are no grants on devices where attestation is failed(rooted devices, emulators). Auto-contribution time is set to 10 minutes, just for test purposes. Couple of verified pub on staging: duckduckgo.com 3zsistemi.si Did it make it out? Here is the link https://github.com/brave/browser-android-tabs/releases/tag/1.0.74 https://github.com/brave/browser-android-tabs/releases/tag/1...
- TheForumTroll 8y ago
  Yes.
DyslexicAtheist 8y ago
[ { "domains":["coinbase.com","api.coinbase.com"], "headers":{"X-Brave-Partner":"coinbase"}, "cookieNames":[],"expiration":31536000000}, { "domains":["marketwatch.com","barrons.com"], "headers":{"X-Brave-Partner":"dowjones"}, "cookieNames":[],"expiration":31536000000 }, { "domains":["townsquareblogs.com","tasteofcountry.com", "ultimateclassicrock.com","xxlmag.com","popcrush.com"], "headers": { "X-Brave-Partner":"townsquare"}, "cookieNames":[],"expiration":31536000000}, { "domains":["cheddar.com"], "headers": { "X-Brave-Partner":"cheddar" }, "cookieNames":[],"expiration":31536000000 } ]
somada141 8y ago
Two of these in a day (other one under https://news.ycombinator.com/item?id=19129309 https://news.ycombinator.com/item?id=19129309)? Seems peeps are digging through the source all of a sudden :D. I do have to wonder if this is as egregious as some of the comments between the two threads would make it seem given that this is an open-source project.
- rvnx 8y ago
  It's just that I looked for curiosity in the source-code and found the whitelist (and separated the threads to not create confusion) but I'm sure people with more time would find more.
  - somada141 8y ago
    Don't get me wrong I applaud the fact that you dug through the code and let the rest of us know. People (including myself) take things at face value too much these days :).
Jonnax 8y ago
What is the benefit of Brave? A lot of people on the internet seem to be advocating it but reading the Wikipedia article they seem to have a business model of replacing website adverts with their own. Which doesn't seem all that ethical.
- Pharmakon 8y ago
  The benefit would be to early investors, and they get to be in the dirty world of adtech while engaging in some ethical duck and cover. It’s nice that the default blocks ads, but we all know how easy it is to flip that switch down the line. At its core, it presents itself as a kind of profit-sharing alt-ads cum adblocker, which is supposed to be a compromise between supporing the ad model of the internet and personal privacy. In practice it seems like an ethical black hole, but one with some big names invested in it, and loads of hype. Personally I think compromises with the ad industry only end one way, and the addition of cryptocurrency into the mix should set of alarm bells.
  - atomical 8y ago
    A small minority of users believe that they are entitled to all the resources on the internet for free.
    - Pharmakon 8y ago
      Maybe, but that’s not even orthogonal to my point, and unrelated to my post or this topic. I’m not going to engage in a trite debate over well-worn ideological ground in which you scream “freeloaders” and I talk about the right to fast forward through ads, or turn down the volume on the radio during ads. Instead I’ll just say that a majority of users believe that their computers are their property, and have the right to control what runs on them. This is especially true when advertisers have shown contempt for user privacy and even whether or not they deliver malware. Beyond that, I hope that you can start responding to things I’ve actually said, instead of just responding with “pithy” and tangential one-liners. I’m not interested in an intellectually bankrupt form of posturing in place of real debate.
rambojazz 8y ago
How should I interpret this json file?
withinrafael 8y ago
I asked Jonathan Sampson about this and it's a developing conversation. [1] > For some partners, Brave will set a custom header to identify the browser. We use the Chrome user-agent string, so accounting for traffic coming from Brave is otherwise hard. [...] As an example, if you navigate to https://www.marketwatch.com/ https://www.marketwatch.com/ you will notice a custom header. [image of header listing containing X-Brave-Partner: dowjones] [1] https://twitter.com/BraveSampson/status/1094713424452505601 https://twitter.com/BraveSampson/status/1094713424452505601
- driverdan 8y ago
  > We use the Chrome user-agent string It shouldn't. It should use Brave since it's not Chrome.
  - hirsin 8y ago
    That's a nice thought, but in reality lots of poorly coded sites out there do UA sniffing instead of feature detection. So lots of sites break (including many Google sites) if they think you don't have Chromium feature sets.
    - ndnxhs 8y ago
      Honestly the user agent string should just be removed. The correct way to use it seems to be do not do anything with it so why does it still exist.
      - spurgu 8y ago
        If you don't have an "officially recognized" UA string some websites will assume you're a scraper/crawler/bot/ and rightfully so.
        threatofrain 8y ago
        That's just a heuristic of the times. Soon bots will be much smarter than that.
unicornporn 8y ago
http://archivecaslytosk.onion/GwRwX http://archivecaslytosk.onion/GwRwX
- snazz 8y ago
  This link is just the same thing as the submission, wrapped in a webpage capture tool. The non-Tor version: https://archivecaslytosk.onion.pet/GwRwX https://archivecaslytosk.onion.pet/GwRwX
Deimorz 8y ago
How is this a "backdoor"? They could have just done this in the browser code itself if they wanted to. Unless you've found some way to change the content of that url without the browser detecting it, I don't understand what you think there is to be concerned about here.
deleted 8y ago
[deleted]
scarface74 8y ago
And Brave or similar programs that block ads but can intercept your web browsing wouldn’t be needed if Android had a built in content blocking framework like iOS. Ad blockers in iOS submit a JSON file to Safari that processes those rules. The third party ad blocked has no access to your browsing history. And the one I use has a novel revenue model that doesn’t require anything shady - I give them money and they give me a product.
- lern_too_spel 8y ago
  That's how Chromium is planning to work in the future. People don't want such a crippled system. https://news.ycombinator.com/item?id=18973477 https://news.ycombinator.com/item?id=18973477
  - scarface74 8y ago
    I read through the article and people were saying that the static rules limit its effectiveness. I haven’t noticed any difference between the effectiveness of ad blocking in iOS and using something like AdBlock for Chrome on desktops. It seems like people don’t trust the motives of Google (and rightfully so).
    - lern_too_spel 8y ago
      No need to look at motives. The end result matters, and the end result makes it as crippled as Apple's solution. Luckily, Android users will continue to have other options.
      - scarface74 8y ago
        Privacy invasive options which kind of defeats half the purpose of ad blockers. And those “other choices” only work within the browser. Apple’s ad blocking framework works with apps that embed web views using the SafariViewConttroller like Feedly.
        8y ago
deleted 8y ago
[deleted]
rolph 8y ago
when i look at whatever the link is pointed at i get this: > [{"domains":["coinbase.com","api.coinbase.com"],"headers":{"X-Brave-Partner":"coinbase"},"cookieNames":[],"expiration":31536000000},{"domains":["marketwatch.com","barrons.com"],"headers":{"X-Brave-Partner":"dowjones"},"cookieNames":[],"expiration":31536000000},{"domains":["townsquareblogs.com","tasteofcountry.com","ultimateclassicrock.com","xxlmag.com","popcrush.com"],"headers":{"X-Brave-Partner":"townsquare"},"cookieNames":[],"expiration":31536000000},{"domains":["cheddar.com"],"headers":{"X-Brave-Partner":"cheddar"},"cookieNames":[],"expiration":31536000000}] < also im not digging into the code at all, if i click on the link for this thread i land on the above snippet.
pwaai 8y ago
Never heard of Brave until now and never going to use it in the future.
andrenotgiant 8y ago
Reading this thread: https://twitter.com/BraveSampson/status/1094713424452505601 https://twitter.com/BraveSampson/status/1094713424452505601 They're adding a header to identify Brave browser to sites they have partnerships with, like MarketWatch.com and Cheddar.com. For example, if you add the header: `X-Brave-Partner: cheddar` to your headers in Chrome, and navigate to cheddar.com you get 3 free months of their paywalled content. (Who pays for a subscription to Cheddar.com?!) If you think about it, you can start to see why they HAD to add a new Header and not just use a custom Brave UserAgent string. They currently use Chrome's UA string, if they used a uniquely identifiable string, publishers who weren't on-board with Brave's ad network could start nagging users/trying to get around Brave's ad-switching technology.
bsclifton 8y ago
Employee here- I haven’t seen an official comment here yet The JSON file that was linked to does have partner domains which (when the header is present) the website will provide a specific integration. When those specific partner sites are visited, the headers are sent with the request An example someone mentioned here already is marketwatch. They have a promotion where you can sign up for a free subscription if you use Brave The browser is open source and nothing is being hidden- although this and the whitelist (used for a better webcompat experience) could be better documented Should these lists be shown in the UI and configurable? (ex: disableable?) I wonder what a better experience would look like for people that don’t want this functionality
- tyingq 8y ago
  Changing the code where it can only inject headers that start with "X-Brave-" would eliminate one class of concerns. It leaves others, but perhaps your idea of a UI to disable it addresses that somewhat.
  - bsclifton 8y ago
    This is a great point- I reviewed with team and created https://github.com/brave/brave-browser/issues/3301 https://github.com/brave/brave-browser/issues/3301 to track this (folks are welcome to give it thumbs up). The fix for this should be something we can deliver in our next product release (0.60.x - 9 days from now) edit: issue is now fixed! https://github.com/brave/brave-core/pull/1633 https://github.com/brave/brave-core/pull/1633 I also captured feedback on being able to customize/opt-out of this functionality with https://github.com/brave/brave-browser/issues/3302 https://github.com/brave/brave-browser/issues/3302 (thumbs up and comments appreciated!)
Proven 8y ago
iPhone users can patch it and build their own but in practice one can’t load it onto a non-jailbroken iOS, so the only reasonable approach is to not use Brave for anything remotely important
untangle 8y ago
To me, Brave left the moral high ground when they became an adtech company. Another harbinger of ill was foisting an ICO on the world -- to sell tickets to the adtech show. To date, Brave's moves have benefitted Brave, and no one else.
- bjl 8y ago
  Not to mention the charity fraud scheme from a couple months ago, which they still haven't stopped doing.
Markoff 8y ago
and stumbling on steps CAN kill you, so what? there it's difference between can do and doing something

267 points by rvnx 8y ago

rvnx 8y ago

Source: https://github.com/brave/browser-android-tabs/commit/911770a07549ce53f49a9d87a5a19b4da29fb767#diff-35dd256442c3c60f5bec67e5b2a86cda https://github.com/brave/browser-android-tabs/commit/911770a...

uberman 8y ago

Interesting. How did you discover this? Can you post something about how they are using this data in the actual header itself?

rvnx 8y ago
Just by reading source-code. Every day the browser downloads from "laptop-updates" server a list of hosts and list of headers to inject. This is supposed to help websites to identify that the user is running Brave (but there are other exceptions in the code, like at https://github.com/brave/browser-laptop/blob/master/js/data/siteHacks.js#L50 https://github.com/brave/browser-laptop/blob/master/js/data/... ) but in practice, the Brave developers can inject any header into any website remotely. Every single Brave installation is uniquely tracked by a "download-id" which makes the backdoor even more powerful.
- TazeTSchnitzel 8y ago
  Does it do any kind of whitelisting of what kind of headers can be sent?
  - rvnx 8y ago
    No

orian 8y ago

Their full mission is "We're reinventing the browser as a user-first platform for speed, privacy, better ads, and beyond ", therefore I guess this is for a "better ads" ;-)

jordigh 8y ago
This is why I can't support Brave. They see it as a foregone conclusion that the only way to make sure the internet doesn't starve it so make sure we all watch ads, and they think that if they can make the ads nicer, we'll all watch them. They gave Brave tools to hide some or most ads hoping that this will make us willingly watch other ads. How about no? How about we find a better way to not starve than making sure everyone is fed their daily dose of manipulative marketing materials?
- jplayer01 8y ago
  Well, get to it. Give us the solution. Outright rejecting Brave isn't helpful. Newspapers financed themselves through ads for decades, but now because websites try to do the same (while abusing their position) and Brave tries to find a fair middle ground that still respects our privacy and rights, they're suddenly the bad guy.
  - mr_spothawk 8y ago
    I'm interested in this: https://datproject.org https://datproject.org
  - enraged_camel 8y ago
    >>Well, get to it. Give us the solution. Outright rejecting Brave isn't helpful. Just because someone rejects a shitty solution doesn't mean they suddenly acquire the burden of coming up with a new one.
    - jplayer01 8y ago
      They haven't even given a valid reason to consider the solution shitty enough to reject. All I could derive from their comment is that they doesn't like ads at all (while ignoring the fact that nobody else has managed to implement a working solution, that ads work, and that Brave is implementing the one solution that has traditionally had plenty of support (micropayments) and some hope of working). Like, weren't micropayments all the rage just 5 years ago? Are ads really the problem in itself? I'd say the real problem with ads are ad networks that track you, create a profile of you and use that to personalize ads, meanwhile providing an attack vector for malware and site owners abusing it historically in the form of Flash or other ugly and distracting ways of displaying them. Brave is providing a way to display ads that don't track you and don't infringe on your privacy. I don't see the downside here, only the upside that we can continue to have a 'free' internet where not only the well-off have access to vast swathes of the internet.

ameyv 8y ago

I just switched from chrome to brave and now I need to seriously rethink this.

Phenix88be 8y ago
Firefox is still backdoor free :)
- pmlnr 8y ago
  This is debatable: with the experiments, Firefox has the power to install addons behind the scenes. See the Mr. Robot fiasco: https://news.ycombinator.com/item?id=15956325 https://news.ycombinator.com/item?id=15956325
  - jonathankoren 8y ago
    I hate to tell you this, but every browser has the ability to run experiments.
    - pmlnr 8y ago
      read the link; i wasn't referring to website originated experiments. btw midori is without backdoors, so is dillo, or lynx.
      - jonathankoren 8y ago
        I am well aware of the Mr Robot brouhaha. No one brought up “website oriented” experiments. We’re talking about the browser itself. All modern browsers of them have the ability to download JavaScript and execute it to change functionality. All of them have the ability to toggle behavior remotely. That’s how you experiment, and experiment driven development is how modern software is made. Finally, you can not be serious mentioning Lynx. It was obsolete in 1996. I know. I was there.
    - AnaniasAnanas 8y ago

thenanyu 8y ago

Wait, what am I missing here? - the source code is open, so we can see that this is going on - the url where the headers are downloaded from is open so we can see / monitor whatever headers get added I'm not a security expert, just a lowly developer, what sequence of events should I be concerned about?

useranon 8y ago

Function where this url is called: https://github.com/brave/brave-core/blob/8305d502aa72a5584815aa714dc3ba129df64546/components/brave_referrals/browser/brave_referrals_service.cc#L435 https://github.com/brave/brave-core/blob/8305d502aa72a558481...

augbog 8y ago

To be fair looking at the commit where it got merged, it was for a pre-release beta build for Android and release notes specifically say > That is a very first beta version of Brave Rewards on Android. It is pointed on test network. DO NOT TRANSFER REAL MONEY!!! We use SafetyNet API for device attestation.There are grants available on first run. There are no grants on devices where attestation is failed(rooted devices, emulators). Auto-contribution time is set to 10 minutes, just for test purposes. Couple of verified pub on staging: duckduckgo.com 3zsistemi.si Did it make it out? Here is the link https://github.com/brave/browser-android-tabs/releases/tag/1.0.74 https://github.com/brave/browser-android-tabs/releases/tag/1...

TheForumTroll 8y ago
Yes.

DyslexicAtheist 8y ago

[ { "domains":["coinbase.com","api.coinbase.com"], "headers":{"X-Brave-Partner":"coinbase"}, "cookieNames":[],"expiration":31536000000}, { "domains":["marketwatch.com","barrons.com"], "headers":{"X-Brave-Partner":"dowjones"}, "cookieNames":[],"expiration":31536000000 }, { "domains":["townsquareblogs.com","tasteofcountry.com", "ultimateclassicrock.com","xxlmag.com","popcrush.com"], "headers": { "X-Brave-Partner":"townsquare"}, "cookieNames":[],"expiration":31536000000}, { "domains":["cheddar.com"], "headers": { "X-Brave-Partner":"cheddar" }, "cookieNames":[],"expiration":31536000000 } ]

somada141 8y ago

Two of these in a day (other one under https://news.ycombinator.com/item?id=19129309 https://news.ycombinator.com/item?id=19129309)? Seems peeps are digging through the source all of a sudden :D. I do have to wonder if this is as egregious as some of the comments between the two threads would make it seem given that this is an open-source project.

rvnx 8y ago
It's just that I looked for curiosity in the source-code and found the whitelist (and separated the threads to not create confusion) but I'm sure people with more time would find more.
- somada141 8y ago
  Don't get me wrong I applaud the fact that you dug through the code and let the rest of us know. People (including myself) take things at face value too much these days :).

Jonnax 8y ago

What is the benefit of Brave? A lot of people on the internet seem to be advocating it but reading the Wikipedia article they seem to have a business model of replacing website adverts with their own. Which doesn't seem all that ethical.

Pharmakon 8y ago
The benefit would be to early investors, and they get to be in the dirty world of adtech while engaging in some ethical duck and cover. It’s nice that the default blocks ads, but we all know how easy it is to flip that switch down the line. At its core, it presents itself as a kind of profit-sharing alt-ads cum adblocker, which is supposed to be a compromise between supporing the ad model of the internet and personal privacy. In practice it seems like an ethical black hole, but one with some big names invested in it, and loads of hype. Personally I think compromises with the ad industry only end one way, and the addition of cryptocurrency into the mix should set of alarm bells.
- atomical 8y ago
  A small minority of users believe that they are entitled to all the resources on the internet for free.
  - Pharmakon 8y ago
    Maybe, but that’s not even orthogonal to my point, and unrelated to my post or this topic. I’m not going to engage in a trite debate over well-worn ideological ground in which you scream “freeloaders” and I talk about the right to fast forward through ads, or turn down the volume on the radio during ads. Instead I’ll just say that a majority of users believe that their computers are their property, and have the right to control what runs on them. This is especially true when advertisers have shown contempt for user privacy and even whether or not they deliver malware. Beyond that, I hope that you can start responding to things I’ve actually said, instead of just responding with “pithy” and tangential one-liners. I’m not interested in an intellectually bankrupt form of posturing in place of real debate.

rambojazz 8y ago

How should I interpret this json file?

withinrafael 8y ago

I asked Jonathan Sampson about this and it's a developing conversation. [1] > For some partners, Brave will set a custom header to identify the browser. We use the Chrome user-agent string, so accounting for traffic coming from Brave is otherwise hard. [...] As an example, if you navigate to https://www.marketwatch.com/ https://www.marketwatch.com/ you will notice a custom header. [image of header listing containing X-Brave-Partner: dowjones] [1] https://twitter.com/BraveSampson/status/1094713424452505601 https://twitter.com/BraveSampson/status/1094713424452505601

driverdan 8y ago
> We use the Chrome user-agent string It shouldn't. It should use Brave since it's not Chrome.
- hirsin 8y ago
  That's a nice thought, but in reality lots of poorly coded sites out there do UA sniffing instead of feature detection. So lots of sites break (including many Google sites) if they think you don't have Chromium feature sets.
  - ndnxhs 8y ago
    Honestly the user agent string should just be removed. The correct way to use it seems to be do not do anything with it so why does it still exist.
    - spurgu 8y ago
      If you don't have an "officially recognized" UA string some websites will assume you're a scraper/crawler/bot/ and rightfully so.
      - threatofrain 8y ago
        That's just a heuristic of the times. Soon bots will be much smarter than that.

unicornporn 8y ago

http://archivecaslytosk.onion/GwRwX http://archivecaslytosk.onion/GwRwX

snazz 8y ago
This link is just the same thing as the submission, wrapped in a webpage capture tool. The non-Tor version: https://archivecaslytosk.onion.pet/GwRwX https://archivecaslytosk.onion.pet/GwRwX

Deimorz 8y ago

How is this a "backdoor"? They could have just done this in the browser code itself if they wanted to. Unless you've found some way to change the content of that url without the browser detecting it, I don't understand what you think there is to be concerned about here.

deleted 8y ago

[deleted]

scarface74 8y ago

And Brave or similar programs that block ads but can intercept your web browsing wouldn’t be needed if Android had a built in content blocking framework like iOS. Ad blockers in iOS submit a JSON file to Safari that processes those rules. The third party ad blocked has no access to your browsing history. And the one I use has a novel revenue model that doesn’t require anything shady - I give them money and they give me a product.

lern_too_spel 8y ago
That's how Chromium is planning to work in the future. People don't want such a crippled system. https://news.ycombinator.com/item?id=18973477 https://news.ycombinator.com/item?id=18973477
- scarface74 8y ago
  I read through the article and people were saying that the static rules limit its effectiveness. I haven’t noticed any difference between the effectiveness of ad blocking in iOS and using something like AdBlock for Chrome on desktops. It seems like people don’t trust the motives of Google (and rightfully so).
  - lern_too_spel 8y ago
    No need to look at motives. The end result matters, and the end result makes it as crippled as Apple's solution. Luckily, Android users will continue to have other options.
    - scarface74 8y ago
      Privacy invasive options which kind of defeats half the purpose of ad blockers. And those “other choices” only work within the browser. Apple’s ad blocking framework works with apps that embed web views using the SafariViewConttroller like Feedly.
      - 8y ago

deleted 8y ago

[deleted]

rolph 8y ago

when i look at whatever the link is pointed at i get this: > [{"domains":["coinbase.com","api.coinbase.com"],"headers":{"X-Brave-Partner":"coinbase"},"cookieNames":[],"expiration":31536000000},{"domains":["marketwatch.com","barrons.com"],"headers":{"X-Brave-Partner":"dowjones"},"cookieNames":[],"expiration":31536000000},{"domains":["townsquareblogs.com","tasteofcountry.com","ultimateclassicrock.com","xxlmag.com","popcrush.com"],"headers":{"X-Brave-Partner":"townsquare"},"cookieNames":[],"expiration":31536000000},{"domains":["cheddar.com"],"headers":{"X-Brave-Partner":"cheddar"},"cookieNames":[],"expiration":31536000000}] < also im not digging into the code at all, if i click on the link for this thread i land on the above snippet.

pwaai 8y ago

Never heard of Brave until now and never going to use it in the future.

andrenotgiant 8y ago

Reading this thread: https://twitter.com/BraveSampson/status/1094713424452505601 https://twitter.com/BraveSampson/status/1094713424452505601 They're adding a header to identify Brave browser to sites they have partnerships with, like MarketWatch.com and Cheddar.com. For example, if you add the header: `X-Brave-Partner: cheddar` to your headers in Chrome, and navigate to cheddar.com you get 3 free months of their paywalled content. (Who pays for a subscription to Cheddar.com?!) If you think about it, you can start to see why they HAD to add a new Header and not just use a custom Brave UserAgent string. They currently use Chrome's UA string, if they used a uniquely identifiable string, publishers who weren't on-board with Brave's ad network could start nagging users/trying to get around Brave's ad-switching technology.

bsclifton 8y ago

Employee here- I haven’t seen an official comment here yet The JSON file that was linked to does have partner domains which (when the header is present) the website will provide a specific integration. When those specific partner sites are visited, the headers are sent with the request An example someone mentioned here already is marketwatch. They have a promotion where you can sign up for a free subscription if you use Brave The browser is open source and nothing is being hidden- although this and the whitelist (used for a better webcompat experience) could be better documented Should these lists be shown in the UI and configurable? (ex: disableable?) I wonder what a better experience would look like for people that don’t want this functionality

tyingq 8y ago
Changing the code where it can only inject headers that start with "X-Brave-" would eliminate one class of concerns. It leaves others, but perhaps your idea of a UI to disable it addresses that somewhat.
- bsclifton 8y ago
  This is a great point- I reviewed with team and created https://github.com/brave/brave-browser/issues/3301 https://github.com/brave/brave-browser/issues/3301 to track this (folks are welcome to give it thumbs up). The fix for this should be something we can deliver in our next product release (0.60.x - 9 days from now) edit: issue is now fixed! https://github.com/brave/brave-core/pull/1633 https://github.com/brave/brave-core/pull/1633 I also captured feedback on being able to customize/opt-out of this functionality with https://github.com/brave/brave-browser/issues/3302 https://github.com/brave/brave-browser/issues/3302 (thumbs up and comments appreciated!)

Proven 8y ago

iPhone users can patch it and build their own but in practice one can’t load it onto a non-jailbroken iOS, so the only reasonable approach is to not use Brave for anything remotely important

untangle 8y ago

To me, Brave left the moral high ground when they became an adtech company. Another harbinger of ill was foisting an ICO on the world -- to sell tickets to the adtech show. To date, Brave's moves have benefitted Brave, and no one else.

bjl 8y ago
Not to mention the charity fraud scheme from a couple months ago, which they still haven't stopped doing.

Markoff 8y ago

and stumbling on steps CAN kill you, so what? there it's difference between can do and doing something