6 ms·

Figured to try Brave as it keeps popping up. Installed it and then noticed in my firewall that it is - trying to connect to a number of IPs owned by google, u

by wila 7y ago

Figured to try Brave as it keeps popping up. Installed it and then noticed in my firewall that it is - trying to connect to a number of IPs owned by google, umm OK - sending a multicast SSDP UDP request on port 1900 to 239.255.255.250 So googled that and got this page: https://community.brave.com/t/why-is-brave-issuing-upnp-discovery-requests/46500 https://community.brave.com/t/why-is-brave-issuing-upnp-disc... Which basically tells you that the first thing Brave does is to try and detect what devices are in your local network. ... and that's where my Brave experiment ends. edit: Also note that uninstall is completely silent, no confirmation that it actually completed. The uninstaller also leaves behind the updater utility AND the Windows Task scheduler tasks that run the updater.

redm 7y ago
I think your comment is a bit misleading as they aren't doing anything nefarious as you suggest. My guess is this is a carryover from Chrome and not something Brave decided to build; if that's the case your not getting more secure by staying with Chrome. In evaluating Brave, you have to give it apples to apple comparison anyway. Brave vs. Chrome as its directly built on chromium. For compatibility, it shares the chrome app store too. I like to think of Brave as Chrome without most of Google but with all the benefits. Anecdotally, I switched a colleague to Brave about 3 months ago. He decided to switch back to Chrome. Chrome was so much slower than Brave and added battery drain that he came back. I assume it was all the additional requests cut out (Google) or blocked by Brave (Adblocker).
- wila 7y ago
  I'm not claiming they are doing something nefarious. Trust is something you have to earn. I do not install Chrome as I do not trust google. They have too much of my data already. Brave claims at their main page: "Brave is open source and built by a team of privacy focused, performance oriented pioneers of the web." OK well they failed my 5 minute test. Not having removed the SSDP parts is one thing. Not uninstalling your updater after running uninstall is straight out sloppy.
  - mindcandy 7y ago
    You are implying that they are doing something nefarious by omission. Because it’s implied, you also gave yourself the escape hatch to say “Where did I say that?” When called out on it. A reasonable person reading your comment would think you are claiming the Brave team added code to surveil your network. If they dig deeper through the link you provided, they learn that the reality is that they inherited code from the Chrome team that exists only to support Chromecast. The problem has been found, a bug has been filed and the feature will be removed. But, most people won’t dig. They’ll take your comment at face value and walk away with a very different story than the reality. Now I sound like I’m accusing you of being nefarious :p But, I don’t think you planned out spreading FUD. I think you were dissatisfied and wanted to share a strong version of your user story. Unfortunately, your story is so strongly worded that is ended up resembling techniques used by trolls.
    - TremendousJudge 7y ago
      They're the ones who are spamming with their marketing blogposts about just how great their product is. Calling them out with a strongly worded reply in the comments (after actually trying out the product might I add) is about the only counterattack for this spam.
    - wila 7y ago
      You are trying to make me say things I never said. What I did was try Brave out. I _want_ to like the product. On top of that I have a lot of respect for most of the people behind the project. As a security conscious person I looked at what kind of network activity there was on start. After installing Brave, I notice things that IMO should not be there. After that I even spent the time to search what it was. The link mentioned by me in my post looks to me like it is a post at a forum from Brave. As someone who is not familiar to the project it is not clear that there is any bug report or bug filed, where do you see that? There is also no indication to me that somebody from the Brave team replied to the post. There's 1 reply 6 days later, by an anonymous user, which explains what is going on, then 24 days later the thread is closed. The reason I did not reproduce the text from the link is that it is pretty clearly stated down there. If I wanted to spread FUD I would not have provided the link.
rolltiide 7y ago
Just tell them to fix that since it doesnt need to be looking for Chromecast devices The end
- timbit42 7y ago
  What kind of a Mickey Mouse (tm) operation providing a private and secure web browser wouldn't have fixed such issues from the start? Doesn't help me trust them.
  - rolltiide 7y ago
    They just pull from the Chrome repository before adding their own things, I dont know what you are expecting Its like you never heard of Brave You can just ask them to disable it and now you have your fictional higher standard team shrug emoji I guess you did mention that you dont use Chrome, so this level of distrust is going to be foreign for most of us to relate to
oshanz 7y ago
https://github.com/brave/brave-browser/issues/5057 https://github.com/brave/brave-browser/issues/5057
BrendanEich 7y ago
Hi, we have logging-based auditing but missed UPnP -- it won't happen again, sorry for this oversight and thanks for pointing it out. What "number of IPs owned by google" did you see? We do not see but you may be in a different region. Thanks for any info.

by wila 7y ago

redm 7y ago

I think your comment is a bit misleading as they aren't doing anything nefarious as you suggest. My guess is this is a carryover from Chrome and not something Brave decided to build; if that's the case your not getting more secure by staying with Chrome. In evaluating Brave, you have to give it apples to apple comparison anyway. Brave vs. Chrome as its directly built on chromium. For compatibility, it shares the chrome app store too. I like to think of Brave as Chrome without most of Google but with all the benefits. Anecdotally, I switched a colleague to Brave about 3 months ago. He decided to switch back to Chrome. Chrome was so much slower than Brave and added battery drain that he came back. I assume it was all the additional requests cut out (Google) or blocked by Brave (Adblocker).

wila 7y ago
I'm not claiming they are doing something nefarious. Trust is something you have to earn. I do not install Chrome as I do not trust google. They have too much of my data already. Brave claims at their main page: "Brave is open source and built by a team of privacy focused, performance oriented pioneers of the web." OK well they failed my 5 minute test. Not having removed the SSDP parts is one thing. Not uninstalling your updater after running uninstall is straight out sloppy.
- mindcandy 7y ago
  You are implying that they are doing something nefarious by omission. Because it’s implied, you also gave yourself the escape hatch to say “Where did I say that?” When called out on it. A reasonable person reading your comment would think you are claiming the Brave team added code to surveil your network. If they dig deeper through the link you provided, they learn that the reality is that they inherited code from the Chrome team that exists only to support Chromecast. The problem has been found, a bug has been filed and the feature will be removed. But, most people won’t dig. They’ll take your comment at face value and walk away with a very different story than the reality. Now I sound like I’m accusing you of being nefarious :p But, I don’t think you planned out spreading FUD. I think you were dissatisfied and wanted to share a strong version of your user story. Unfortunately, your story is so strongly worded that is ended up resembling techniques used by trolls.
  - TremendousJudge 7y ago
    They're the ones who are spamming with their marketing blogposts about just how great their product is. Calling them out with a strongly worded reply in the comments (after actually trying out the product might I add) is about the only counterattack for this spam.
  - wila 7y ago
    You are trying to make me say things I never said. What I did was try Brave out. I _want_ to like the product. On top of that I have a lot of respect for most of the people behind the project. As a security conscious person I looked at what kind of network activity there was on start. After installing Brave, I notice things that IMO should not be there. After that I even spent the time to search what it was. The link mentioned by me in my post looks to me like it is a post at a forum from Brave. As someone who is not familiar to the project it is not clear that there is any bug report or bug filed, where do you see that? There is also no indication to me that somebody from the Brave team replied to the post. There's 1 reply 6 days later, by an anonymous user, which explains what is going on, then 24 days later the thread is closed. The reason I did not reproduce the text from the link is that it is pretty clearly stated down there. If I wanted to spread FUD I would not have provided the link.

rolltiide 7y ago

Just tell them to fix that since it doesnt need to be looking for Chromecast devices The end

timbit42 7y ago
What kind of a Mickey Mouse (tm) operation providing a private and secure web browser wouldn't have fixed such issues from the start? Doesn't help me trust them.
- rolltiide 7y ago
  They just pull from the Chrome repository before adding their own things, I dont know what you are expecting Its like you never heard of Brave You can just ask them to disable it and now you have your fictional higher standard team shrug emoji I guess you did mention that you dont use Chrome, so this level of distrust is going to be foreign for most of us to relate to

oshanz 7y ago

https://github.com/brave/brave-browser/issues/5057 https://github.com/brave/brave-browser/issues/5057

BrendanEich 7y ago

Hi, we have logging-based auditing but missed UPnP -- it won't happen again, sorry for this oversight and thanks for pointing it out. What "number of IPs owned by google" did you see? We do not see but you may be in a different region. Thanks for any info.