10 ms·

Firefox has its own funding issues but I don’t trust a browser that exists to support a cryptocurrency.

by eli 5y ago

prepend 5y ago
I trust it because it’s an open source project and I can see what goes in and comes out. Of course, maybe it won’t work forever, but it works for now. I’m not a crypto person and don’t use Brave’s crypto features, but I think it’s a more sustainable future than relying on Google’s largess.
- eli 5y ago
  Relying on google’s rendering engine is worse IMHO. And I think they are going to end having to pivot on funding.
- freediver 5y ago
  > I trust it because it’s an open source project and I can see what goes in and comes out. That is just the browser part. The code on their servers that actually processes the data the browser collected is closed-source. In general, browser being open or closed source has no correlation with how privacy respecting it is. Chrom{e|ium} and Edge are another examples. Pragmatically speaking there is only one thing that guarantees privacy and that is browser being zero-telemetry, regardless of if it is open source or not.
  - xtat 5y ago
    What server-side components are you referring to here? From my memory there was very little interesting private code, and I can't think of anything that would process user data that would be private.
  - prepend 5y ago
    To my understanding there is no data sent from my Brave client to any Brave servers. So my data are not stored or used by Brave servers, so I don’t care too much about their source. Of course, there’s nothing magical about open source that makes it more privacy respecting. It’s just that open source let’s me know what my browser is doing. For example, Chrome is reporting everything I do to Google. It’s possible to know that by looking at the code for Chrome. Brave doesn’t do this and it’s possible to know that by looking at the code for Brave.
    - freediver 5y ago
      > To my understanding there is no data sent from my Brave client to any Brave servers. That would be wrong. By Brave's own confession, there are 70 requests it sends "home" on startup [1]. Regardless of request payload, each of them contains your PII (IP address at the very least). There is plenty of opportunity for your data to be stored and used (not saying that it is). If and how is that data actually used, we do not know, because this part is closed-source. When companies that are running advertising-based business models like Brave and Google are in question, this is the most important part users should be concerned with. Only way to settle this would be if the browser actually sent no requests anywhere, like you initially believed to be true. Indeed, a web browser has no business making requests anywhere without my explicit approval! > It’s possible to know that by looking at the code for Chrome. Brave doesn’t do this and it’s possible to know that by looking at the code for Brave. Do not want to be harsh but I assume you didn't actually look into the Brave's source code. You could have, but in reality very few actually do. Open-source "tag" on software can give this false sense of security because you rely on someone else to do the hard work and actually look through millions of lines of code. The only way to actually trust a browser from a privacy standpoint is to check if it is indeed not transmitting any data. Instead of relying on source code, a much easier and foolproof way to check this is to use a network proxy, many are commonly available for all platforms. Then you can believe your own eyes vs marketing. Disclaimer: I am in the business of creating a privacy respecting, zero-telemetry, browser. This topic is near and dear to my heart. More on this here [2] and here [3] [1] https://brave.com/popular-browsers-first-run/ https://brave.com/popular-browsers-first-run/ [2] https://browser.kagi.com/faq.html#ossprivacy https://browser.kagi.com/faq.html#ossprivacy [3] https://browser.kagi.com/faq.html#privacy https://browser.kagi.com/faq.html#privacy
      - prepend 5y ago
        > Do not want to be harsh but I assume you didn't actually look into the Brave's source code. This is a weird assumption to make on HN. I have. I also didn’t say that viewing source code is the only part of understanding a browser’s security. It’s a useful portion. Network monitors are also good. I’m not talking about startup telemetry, I mean browsing history and activity. Chrome reports this, Brave doesn’t. I don’t think Brave is perfect, I just think it’s better than Chrome and Firefox.
xtat 5y ago
This is so reductive I don't know where to begin, but having worked on Brave I can say that there's a lot more top of mind over there than building a browser to support BAT.

Firefox has its own funding issues but I don’t trust a browser that exists to support a cryptocurrency.

by eli 5y ago

Firefox has its own funding issues but I don’t trust a browser that exists to support a cryptocurrency.

I trust it because it’s an open source project and I can see what goes in and comes out. Of course, maybe it won’t work forever, but it works for now. I’m not a crypto person and don’t use Brave’s crypto features, but I think it’s a more sustainable future than relying on Google’s largess.

eli 5y ago
Relying on google’s rendering engine is worse IMHO. And I think they are going to end having to pivot on funding.
freediver 5y ago
> I trust it because it’s an open source project and I can see what goes in and comes out. That is just the browser part. The code on their servers that actually processes the data the browser collected is closed-source. In general, browser being open or closed source has no correlation with how privacy respecting it is. Chrom{e|ium} and Edge are another examples. Pragmatically speaking there is only one thing that guarantees privacy and that is browser being zero-telemetry, regardless of if it is open source or not.
- xtat 5y ago
  What server-side components are you referring to here? From my memory there was very little interesting private code, and I can't think of anything that would process user data that would be private.
- prepend 5y ago
  To my understanding there is no data sent from my Brave client to any Brave servers. So my data are not stored or used by Brave servers, so I don’t care too much about their source. Of course, there’s nothing magical about open source that makes it more privacy respecting. It’s just that open source let’s me know what my browser is doing. For example, Chrome is reporting everything I do to Google. It’s possible to know that by looking at the code for Chrome. Brave doesn’t do this and it’s possible to know that by looking at the code for Brave.
  - freediver 5y ago
    > To my understanding there is no data sent from my Brave client to any Brave servers. That would be wrong. By Brave's own confession, there are 70 requests it sends "home" on startup [1]. Regardless of request payload, each of them contains your PII (IP address at the very least). There is plenty of opportunity for your data to be stored and used (not saying that it is). If and how is that data actually used, we do not know, because this part is closed-source. When companies that are running advertising-based business models like Brave and Google are in question, this is the most important part users should be concerned with. Only way to settle this would be if the browser actually sent no requests anywhere, like you initially believed to be true. Indeed, a web browser has no business making requests anywhere without my explicit approval! > It’s possible to know that by looking at the code for Chrome. Brave doesn’t do this and it’s possible to know that by looking at the code for Brave. Do not want to be harsh but I assume you didn't actually look into the Brave's source code. You could have, but in reality very few actually do. Open-source "tag" on software can give this false sense of security because you rely on someone else to do the hard work and actually look through millions of lines of code. The only way to actually trust a browser from a privacy standpoint is to check if it is indeed not transmitting any data. Instead of relying on source code, a much easier and foolproof way to check this is to use a network proxy, many are commonly available for all platforms. Then you can believe your own eyes vs marketing. Disclaimer: I am in the business of creating a privacy respecting, zero-telemetry, browser. This topic is near and dear to my heart. More on this here [2] and here [3] [1] https://brave.com/popular-browsers-first-run/ https://brave.com/popular-browsers-first-run/ [2] https://browser.kagi.com/faq.html#ossprivacy https://browser.kagi.com/faq.html#ossprivacy [3] https://browser.kagi.com/faq.html#privacy https://browser.kagi.com/faq.html#privacy
    - prepend 5y ago
      > Do not want to be harsh but I assume you didn't actually look into the Brave's source code. This is a weird assumption to make on HN. I have. I also didn’t say that viewing source code is the only part of understanding a browser’s security. It’s a useful portion. Network monitors are also good. I’m not talking about startup telemetry, I mean browsing history and activity. Chrome reports this, Brave doesn’t. I don’t think Brave is perfect, I just think it’s better than Chrome and Firefox.

xtat 5y ago

This is so reductive I don't know where to begin, but having worked on Brave I can say that there's a lot more top of mind over there than building a browser to support BAT.