14 ms·

I really hope the privacy-conscious people downloading this aren't just downloading these binary blobs and instead compiling it from source. Especially after se

I really hope the privacy-conscious people downloading this aren't just downloading these binary blobs and instead compiling it from source. Especially after seeing this disclaimer on their download page: >>>IMPORTANT: These binaries are provided by anyone who are willing to build and submit them. Because these binaries are not necessarily reproducible, authenticity cannot be guaranteed. For your consideration, each download page lists the GitHub user that submitted those binaries.

FinalBriefing 5y ago
Couldn't they (or someone) set up a Github Action to compile the project on every release?
- heavyset_go 5y ago
  GitHub Actions free tier comes with ~34 hours of free compute time with 500MB storage. Pro comes with 50 hours and 1GB. Enterprise comes with much more. Building on Windows or macOS divides those compute rates by 2 and 10 respectively. For a project with frequent point releases, building Chromium via GitHub might require a monetary commitment.
  - nicce 5y ago
    Has it changed? It used to be unlimited for open projects.
    - heavyset_go 5y ago
      I wasn't aware it was ever free for open projects. Reading this page shows that you're right[1], public repositories can use GitHub Actions for free. [1] https://github.com/features/actions https://github.com/features/actions
      - moffkalast 5y ago
        So what's stopping them?
        heavyset_go 5y ago
        Seems like something someone with some time can make a pull request for ;)
- easton 5y ago
  I forked the repo with the intention of doing this a couple months ago. The default Windows runner for Actions doesn’t have enough free disk space to compile Chromium (at least, given the build instructions the project provided). Given it took an hour to fail every time, it made trying to optimize hard and I eventually gave up.
  - francisduvivier 5y ago
    Got a link to that fork? I might want to pick that up sometime.
    - easton 5y ago
      https://github.com/jedieaston/ungoogled-chromium-windows https://github.com/jedieaston/ungoogled-chromium-windows isn't my original attempt (I deleted the original repo, oops), but I recreated pretty much where I was. GH Actions runners only have 14GB of usable space, and Chromium requires 100GB or so of free space to compile on Windows apparently: https://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/windows_build_instructions.md#system-requirements https://chromium.googlesource.com/chromium/src/+/refs/heads/...
bullen 5y ago
It's interesting the first release on that page is from 2016 and then the build .zip was 69MB, the last release from yesterday weighs 100MB compared to the official chromium which is 179MB that is alot of google and alot of non-google added in 5 years!
- NavinF 5y ago
  I can't find a list of removed features, but I'm gonna take a wild guess that it includes proprietary codecs. It's the same reason why the chromium binaries in most distro repos are smaller than the official ones, but also useless for normal users that want to experience all content on the net.
KennyBlanken 5y ago
I am baffled that they would accept binaries, instead of, oh, say, pull requests helping set up builds.
- onion2k 5y ago
  There is exactly such a PR - https://github.com/Eloston/ungoogled-chromium/pull/1693 https://github.com/Eloston/ungoogled-chromium/pull/1693 - as you might imagine building a complex binary for many target OSs and flavors within OSs, it's a little complicated and requires some discussion about the right approach. In the mean time, binaries are available.
heavyset_go 5y ago
Anyone know how the Flatpak builds of this project[1] are built? Does FlatHub have a CI pipeline that builds Ungoogled Chromium binaries? [1] https://flathub.org/apps/details/com.github.Eloston.UngoogledChromium https://flathub.org/apps/details/com.github.Eloston.Ungoogle...
- wjt 5y ago
  They are built by Flathub, just like the vanilla Chromium build on Flathub. Here is the most recent build logs for x86_64 https://flathub.org/builds/#/builders/12/builds/8123 https://flathub.org/builds/#/builders/12/builds/8123 which I found from the GitHub green-tick status icon on the latest commit on https://github.com/flathub/com.github.Eloston.UngoogledChromium https://github.com/flathub/com.github.Eloston.UngoogledChrom....
  - heavyset_go 5y ago
    Thanks
ronnier 5y ago
I just use Brave browser now. It's very good. I can use chrome extensions.
- smoldesu 5y ago
  I think I trust a random binary blob more than I do Brave's random binary blob, with all of it's crypto lug-alongs.
  - ronnier 5y ago
    The crypto stuff does weird me out. But I'd rather use it than a google product.
    - fsflover 5y ago
      How about Firefox? https://news.ycombinator.com/item?id=29378307 https://news.ycombinator.com/item?id=29378307
      - jptech 5y ago
        I use Firefox as my main browser, Brave as backup foot sites that don't work well with FF. Brave does a good job with randomizing fingerprints.
    - andrepd 5y ago
      Well why choose? Just use neither.
    - smoldesu 5y ago
      I'd rather use a Google product than a Brendan Eich one.
    - path411 5y ago
      Pretty easy to turn off the crypto stuff
      - 5y ago
FourthProtocol 5y ago
Well that's the thing - I'm not willing to build them. I wouldn't know where to start, even. And no ambition to learn, whilst Firefox and uBlock keep going. Seriously why should I? Maybe someone more able than I can share their knowledge with a pointer to a guide that says why this is better than what I have, and how to get it running on my Windows box. My current position is to step wide and rather carefully around anything by/from Google.
- deusum 5y ago
  Have some fun, make your own delta script. Download only what you need, recompile!
- minitech 5y ago
  If you don’t use ungoogled-chromium, you’re presumably not downloading and running community-provided non-reproducible binary blobs of ungoogled-chromium, so you don’t need to learn to compile them from source instead. That’s what the comment was about.
- henvic 5y ago
  So you say your current position is to be rather carefully around anything by/from Google, but you trust Internet randos to build the binary of the browser you use? Okay.
  - another-dave 5y ago
    Wisdom of crowds though — there's enough eyes on the stuff built by "internet randos" over at Mozilla to have a larger level of trust in it Vs an unknown fork of Chromium
    - deleted 5y ago
      [deleted]
  - throwntoday 5y ago
    I trust a homeless person on the street more than I trust google.
fabianhjr 5y ago
> I really hope the privacy-conscious people downloading this aren't just downloading these binary blobs and instead compiling it from source. Those would be on a nix (linux/bsd/other) free source OS with distro specific binaries (or rolling their own and would be better off compiling it themselves anyways)
iszomer 5y ago
Took a few hours to compile on a ryzen 2600. Worth it until the next "update", I think.
- londons_explore 5y ago
  Chromium security patches usually don't require a full recompile. Usually an incremental build will just take 30 seconds or so. Obviously that still means you need 100GB spare for the working directory.
- Uehreka 5y ago
  Does Chromium have `make -j$(nproc)` or equivalent? Because a few hours on a fairly recent processor with a whole bunch of cores sounds long.
  - gjs278 5y ago
    it does. that’s just how long chromium takes.
  - ghoward 5y ago
    Not GP, I am a Gentoo user that compiles ungoogled-chromium from source. I have a 16-core AMD CPU. Despite that, it takes 4-8 hours to compile, due to two factors: 40,000+ separate targets, of which most are C++ files (famously slow to compile anyway). And yes, 40,000+ separate targets is no exaggeration; ninja's first run claims about 18,000 targets, and after it finishes those, it generates a second ninja file that has to compile 23,000 targets. I personally think it's worth it. Others may disagree, and I can't blame them. I have to run it overnight.
    - danaos 5y ago
      It typically takes more than 20 hours on my dual core laptop. It's a pain, but once compiled I get the best of both worlds: fast as chrome, privacy friendly as firefox. EDIT: Looks like popularity is on the rise [1]. Hopefully it will make it into the community repository. [1] https://pkgstats.archlinux.de/packages/ungoogled-chromium https://pkgstats.archlinux.de/packages/ungoogled-chromium
Timothycquinn 5y ago
How hard is it to compile these days? I recall trying to build several years back for Electron development work on Ubuntu and it was a royal pain in the butt.
- NavinF 5y ago
  Pretty easy if you have a reasonably fast PC (>8 cores, ideally HEDT/server), use one of the two popular platforms (Windows or Ubuntu) and don't try to outsmart the build system.
- mattowen_uk 5y ago
  Ok, let's say I'm a tech savvy Windows user. Assuming I have something like Visual Studio installed, would this compile correctly off the bat? I doubt it. (I've not tried tbh) Personal experience, most of the source I download from GitHub either will straight refuse to compile in Visual Studio, or requires me tweaking a lot of the dependencies and stepping through the warnings and errors until it does. "Ah, but don't use Visual Studio" you say. "Use XYZ-compiler-de-jour". Right, that's now in the 'too-hard/too-time-consuming' bucket, and I'll look for something else.
marcodiego 5y ago
I installed it through flatpak. What is HN crowd opinion on this?
j-james 5y ago
Considerably more trustworthy binaries are available for Arch, Debian, and Fedora through OpenSUSE's Open Build Service. Arch binaries are also reproducible. https://build.opensuse.org/project/show/home:ungoogled_chromium https://build.opensuse.org/project/show/home:ungoogled_chrom... https://github.com/Eloston/ungoogled-chromium/discussions/1466 https://github.com/Eloston/ungoogled-chromium/discussions/14... https://github.com/ungoogled-software/ungoogled-chromium-archlinux/issues/70 https://github.com/ungoogled-software/ungoogled-chromium-arc...
tshaddox 5y ago
And for the precisely the same reason, I hope the privacy-conscious people who are compiling it from source aren't downloading their compilers as binary blobs!
- moffkalast 5y ago
  And I sure hope they didn't download and install their OS from a premade image too, you really can't trust canonical and the rest of those gangs these days!
- pabs3 5y ago
  There is a project to solve that, they aim to bootstrap an entire Linux distro from under 1K of machine code plus all the necessary source code. https://bootstrappable.org/ https://bootstrappable.org/
anotherhue 5y ago
NixOS has it packaged, reproducibly I presume? https://github.com/NixOS/nixpkgs/blob/8a308775674e178495767df90c419425474582a1/pkgs/applications/networking/browsers/chromium/browser.nix#L76 https://github.com/NixOS/nixpkgs/blob/8a308775674e178495767d...
pajko 5y ago
The Marmaduke build might be a better alternative in this regard: https://chromium.woolyss.com/ https://chromium.woolyss.com/
londons_explore 5y ago
Chromium builds are reproducible though .. So why isn't this project using that to publish hashes of valid builds?
thumbellina 5y ago
Or, more typically, the binary is built your distribution.
bigyellow 5y ago
This is the hilarious irony of this entire software project. I trust Google a lot more to produce a safe binary than some random internet stranger who promises to be good. Even if I don't ultimately trust Google as a software vendor, I can at least make some reasonable assumptions about the security of their product.
DavideNL 5y ago
> These binaries are provided by anyone I don’t think this is true for macOS? the builds seem automated…

FinalBriefing 5y ago

Couldn't they (or someone) set up a Github Action to compile the project on every release?

heavyset_go 5y ago
GitHub Actions free tier comes with ~34 hours of free compute time with 500MB storage. Pro comes with 50 hours and 1GB. Enterprise comes with much more. Building on Windows or macOS divides those compute rates by 2 and 10 respectively. For a project with frequent point releases, building Chromium via GitHub might require a monetary commitment.
- nicce 5y ago
  Has it changed? It used to be unlimited for open projects.
  - heavyset_go 5y ago
    I wasn't aware it was ever free for open projects. Reading this page shows that you're right[1], public repositories can use GitHub Actions for free. [1] https://github.com/features/actions https://github.com/features/actions
    - moffkalast 5y ago
      So what's stopping them?
      - heavyset_go 5y ago
        Seems like something someone with some time can make a pull request for ;)
easton 5y ago
I forked the repo with the intention of doing this a couple months ago. The default Windows runner for Actions doesn’t have enough free disk space to compile Chromium (at least, given the build instructions the project provided). Given it took an hour to fail every time, it made trying to optimize hard and I eventually gave up.
- francisduvivier 5y ago
  Got a link to that fork? I might want to pick that up sometime.
  - easton 5y ago
    https://github.com/jedieaston/ungoogled-chromium-windows https://github.com/jedieaston/ungoogled-chromium-windows isn't my original attempt (I deleted the original repo, oops), but I recreated pretty much where I was. GH Actions runners only have 14GB of usable space, and Chromium requires 100GB or so of free space to compile on Windows apparently: https://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/windows_build_instructions.md#system-requirements https://chromium.googlesource.com/chromium/src/+/refs/heads/...

bullen 5y ago

It's interesting the first release on that page is from 2016 and then the build .zip was 69MB, the last release from yesterday weighs 100MB compared to the official chromium which is 179MB that is alot of google and alot of non-google added in 5 years!

NavinF 5y ago
I can't find a list of removed features, but I'm gonna take a wild guess that it includes proprietary codecs. It's the same reason why the chromium binaries in most distro repos are smaller than the official ones, but also useless for normal users that want to experience all content on the net.

KennyBlanken 5y ago

I am baffled that they would accept binaries, instead of, oh, say, pull requests helping set up builds.

onion2k 5y ago
There is exactly such a PR - https://github.com/Eloston/ungoogled-chromium/pull/1693 https://github.com/Eloston/ungoogled-chromium/pull/1693 - as you might imagine building a complex binary for many target OSs and flavors within OSs, it's a little complicated and requires some discussion about the right approach. In the mean time, binaries are available.

heavyset_go 5y ago

Anyone know how the Flatpak builds of this project[1] are built? Does FlatHub have a CI pipeline that builds Ungoogled Chromium binaries? [1] https://flathub.org/apps/details/com.github.Eloston.UngoogledChromium https://flathub.org/apps/details/com.github.Eloston.Ungoogle...

wjt 5y ago
They are built by Flathub, just like the vanilla Chromium build on Flathub. Here is the most recent build logs for x86_64 https://flathub.org/builds/#/builders/12/builds/8123 https://flathub.org/builds/#/builders/12/builds/8123 which I found from the GitHub green-tick status icon on the latest commit on https://github.com/flathub/com.github.Eloston.UngoogledChromium https://github.com/flathub/com.github.Eloston.UngoogledChrom....
- heavyset_go 5y ago
  Thanks

ronnier 5y ago

I just use Brave browser now. It's very good. I can use chrome extensions.

smoldesu 5y ago
I think I trust a random binary blob more than I do Brave's random binary blob, with all of it's crypto lug-alongs.
- ronnier 5y ago
  The crypto stuff does weird me out. But I'd rather use it than a google product.
  - fsflover 5y ago
    How about Firefox? https://news.ycombinator.com/item?id=29378307 https://news.ycombinator.com/item?id=29378307
    - jptech 5y ago
      I use Firefox as my main browser, Brave as backup foot sites that don't work well with FF. Brave does a good job with randomizing fingerprints.
  - andrepd 5y ago
    Well why choose? Just use neither.
  - smoldesu 5y ago
    I'd rather use a Google product than a Brendan Eich one.
  - path411 5y ago
    Pretty easy to turn off the crypto stuff
    - 5y ago

FourthProtocol 5y ago

Well that's the thing - I'm not willing to build them. I wouldn't know where to start, even. And no ambition to learn, whilst Firefox and uBlock keep going. Seriously why should I? Maybe someone more able than I can share their knowledge with a pointer to a guide that says why this is better than what I have, and how to get it running on my Windows box. My current position is to step wide and rather carefully around anything by/from Google.

deusum 5y ago
Have some fun, make your own delta script. Download only what you need, recompile!
minitech 5y ago
If you don’t use ungoogled-chromium, you’re presumably not downloading and running community-provided non-reproducible binary blobs of ungoogled-chromium, so you don’t need to learn to compile them from source instead. That’s what the comment was about.
henvic 5y ago
So you say your current position is to be rather carefully around anything by/from Google, but you trust Internet randos to build the binary of the browser you use? Okay.
- another-dave 5y ago
  Wisdom of crowds though — there's enough eyes on the stuff built by "internet randos" over at Mozilla to have a larger level of trust in it Vs an unknown fork of Chromium
  - deleted 5y ago
    [deleted]
- throwntoday 5y ago
  I trust a homeless person on the street more than I trust google.

fabianhjr 5y ago

> I really hope the privacy-conscious people downloading this aren't just downloading these binary blobs and instead compiling it from source. Those would be on a nix (linux/bsd/other) free source OS with distro specific binaries (or rolling their own and would be better off compiling it themselves anyways)

iszomer 5y ago

Took a few hours to compile on a ryzen 2600. Worth it until the next "update", I think.

londons_explore 5y ago
Chromium security patches usually don't require a full recompile. Usually an incremental build will just take 30 seconds or so. Obviously that still means you need 100GB spare for the working directory.
Uehreka 5y ago
Does Chromium have `make -j$(nproc)` or equivalent? Because a few hours on a fairly recent processor with a whole bunch of cores sounds long.
- gjs278 5y ago
  it does. that’s just how long chromium takes.
- ghoward 5y ago
  Not GP, I am a Gentoo user that compiles ungoogled-chromium from source. I have a 16-core AMD CPU. Despite that, it takes 4-8 hours to compile, due to two factors: 40,000+ separate targets, of which most are C++ files (famously slow to compile anyway). And yes, 40,000+ separate targets is no exaggeration; ninja's first run claims about 18,000 targets, and after it finishes those, it generates a second ninja file that has to compile 23,000 targets. I personally think it's worth it. Others may disagree, and I can't blame them. I have to run it overnight.
  - danaos 5y ago
    It typically takes more than 20 hours on my dual core laptop. It's a pain, but once compiled I get the best of both worlds: fast as chrome, privacy friendly as firefox. EDIT: Looks like popularity is on the rise [1]. Hopefully it will make it into the community repository. [1] https://pkgstats.archlinux.de/packages/ungoogled-chromium https://pkgstats.archlinux.de/packages/ungoogled-chromium

Timothycquinn 5y ago

How hard is it to compile these days? I recall trying to build several years back for Electron development work on Ubuntu and it was a royal pain in the butt.

NavinF 5y ago
Pretty easy if you have a reasonably fast PC (>8 cores, ideally HEDT/server), use one of the two popular platforms (Windows or Ubuntu) and don't try to outsmart the build system.
mattowen_uk 5y ago
Ok, let's say I'm a tech savvy Windows user. Assuming I have something like Visual Studio installed, would this compile correctly off the bat? I doubt it. (I've not tried tbh) Personal experience, most of the source I download from GitHub either will straight refuse to compile in Visual Studio, or requires me tweaking a lot of the dependencies and stepping through the warnings and errors until it does. "Ah, but don't use Visual Studio" you say. "Use XYZ-compiler-de-jour". Right, that's now in the 'too-hard/too-time-consuming' bucket, and I'll look for something else.

marcodiego 5y ago

I installed it through flatpak. What is HN crowd opinion on this?

j-james 5y ago

Considerably more trustworthy binaries are available for Arch, Debian, and Fedora through OpenSUSE's Open Build Service. Arch binaries are also reproducible. https://build.opensuse.org/project/show/home:ungoogled_chromium https://build.opensuse.org/project/show/home:ungoogled_chrom... https://github.com/Eloston/ungoogled-chromium/discussions/1466 https://github.com/Eloston/ungoogled-chromium/discussions/14... https://github.com/ungoogled-software/ungoogled-chromium-archlinux/issues/70 https://github.com/ungoogled-software/ungoogled-chromium-arc...

tshaddox 5y ago

And for the precisely the same reason, I hope the privacy-conscious people who are compiling it from source aren't downloading their compilers as binary blobs!

moffkalast 5y ago
And I sure hope they didn't download and install their OS from a premade image too, you really can't trust canonical and the rest of those gangs these days!
pabs3 5y ago
There is a project to solve that, they aim to bootstrap an entire Linux distro from under 1K of machine code plus all the necessary source code. https://bootstrappable.org/ https://bootstrappable.org/

anotherhue 5y ago

NixOS has it packaged, reproducibly I presume? https://github.com/NixOS/nixpkgs/blob/8a308775674e178495767df90c419425474582a1/pkgs/applications/networking/browsers/chromium/browser.nix#L76 https://github.com/NixOS/nixpkgs/blob/8a308775674e178495767d...

pajko 5y ago

The Marmaduke build might be a better alternative in this regard: https://chromium.woolyss.com/ https://chromium.woolyss.com/

londons_explore 5y ago

Chromium builds are reproducible though .. So why isn't this project using that to publish hashes of valid builds?

thumbellina 5y ago

Or, more typically, the binary is built your distribution.

bigyellow 5y ago

This is the hilarious irony of this entire software project. I trust Google a lot more to produce a safe binary than some random internet stranger who promises to be good. Even if I don't ultimately trust Google as a software vendor, I can at least make some reasonable assumptions about the security of their product.

DavideNL 5y ago

> These binaries are provided by anyone I don’t think this is true for macOS? the builds seem automated…