4 ms·

Chromium is the name of the project. Chrome is a specific release of Chromium that bakes in a few extra features. Neither are substantially different when it

Chromium is the name of the project. Chrome is a specific release of Chromium that bakes in a few extra features. Neither are substantially different when it comes to tracking or release cadence. You can get Chrome nightly just as you can get Chromium nightly. Chromium-based browsers have strong sandboxing, and a dedicated security team at Google. If security is your main priority that makes for a compelling argument. They have strong code guidelines such as their rule of two[1], make heavy use of fuzzers and others techniques. You can read some of the other techniques they use for security here[2][3]: Despite these techniques, they are using a language that is not memory-safe. Security bugs do occasionally pop up in Chromium. They're also patched very quickly, but the possibility exists of a 0-day impacting users. Firefox has improved considerably in their sandboxing, but it is still a legacy codebase. Many techniques used to ensure code safety were not originally available, but have been slowly patched into the codebase. Firefox has one advantage: it was the progenitor of Rust. They've had a head start in building components in a memory-safe language which offers them safety that Chromium does not currently have (Google are still considering adopting Rust). For this reason it's possible that Firefox will be able to avoid a memory bug that will affect Chromium-based browsers. Both companies offer a generous bug bounty program. Firefox is occasionally targeted as it's used by TOR users, but Chromium receives far more scrutiny overall (which isn't necessarily a bad thing). I don't think either browser is a bad option, but neither are they perfect. I'd feel safer overall with Chrome (or Chromium, whatever) primarily due to the considerable resources Google is able to put into their security focus. [1] https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/rule-of-2.md https://chromium.googlesource.com/chromium/src/+/HEAD/docs/s... [2] https://docs.google.com/document/d/e/2PACX-1vRZr-HJcYmf2Y76DhewaiJOhRNpjGHCxliAQTBhFxzv1QTae9o8mhBmDl32CRIuaWZLt5kVeH9e9jXv/pub https://docs.google.com/document/d/e/2PACX-1vRZr-HJcYmf2Y76D... [3] https://security.googleblog.com/2021/09/an-update-on-memory-safety-in-chrome.html https://security.googleblog.com/2021/09/an-update-on-memory-...

WorldDev 4y ago
Thanks for your detailed answer. That makes sense. It feels like running Chromium might be a good trade-off : good security, less privacy risk. However, I struggle to see how to run a stable version of Chromium. It seems the website only offers build on the most recent version, which is unstable. Do you have any thoughts on that?
- SquareWheel 4y ago
  I mentioned in my first comment that Chromium is the project, and Chrome is a specific (and official) build of Chromium. So you need to understand that Chromium is the codebase, and Chrome wraps up that code and distributes it (with minor changes) to the public. Now you can still compile Chromium as-is at the trunk, without those small changes, but there's not an official binary as provided by Google for "pure Chromium". That needs to be compiled manually. On Linux, you'd typically use your package manager to keep up to date with the latest builds of Chromium. If you're on Windows, again there's no official binaries but there are sites that auto-build the latest releases. Nightly: https://download-chromium.appspot.com/ https://download-chromium.appspot.com/ Stable: https://chromium.woolyss.com/ https://chromium.woolyss.com/ I'm guessing these do not include an auto-updater. You should also understand that the difference between Chrome and Chromium is not just "tracking" (user metrics and crash reports). Chrome also includes content that could not legally be included in Chromium due to licensing, such as H.264 and AAC codec support. Those are pretty important to the web today. I don't generally recommend running pure builds of Chromium except for developer use. You might consider an alternative like Ungoogled Chromium, though understand they focus more on privacy than security. You will lose features like auto-complete, browser sync, and Google's Safe Browsing service which warns of website malware. For this reason you'd actually be sacrificing security for privacy, which runs contrary to the goal you laid out above. From all the information you've given, I do think a stable or beta branch of Chrome is your best option (though not Canary or dev branches, which are too recent).
  - WorldDev 4y ago
    Thanks again for your answer. I am familiar with the difference between Chrome and Chromium. "that needs to be compiled manually" => I thought this contained chromium binaries : https://commondatastorage.googleapis.com/chromium-browser-snapshots/index.html https://commondatastorage.googleapis.com/chromium-browser-sn... "I do think a stable or beta branch of Chrome is your best option" => thanks for the advice. What are your thoughts on the privacy leaks of chrome affecting security? Is that a fair concern? I also read somewhere that some time ago chrome was scanning the hard drive of the host. This seems fairly bad as well, if correct.

WorldDev 4y ago

Thanks for your detailed answer. That makes sense. It feels like running Chromium might be a good trade-off : good security, less privacy risk. However, I struggle to see how to run a stable version of Chromium. It seems the website only offers build on the most recent version, which is unstable. Do you have any thoughts on that?

SquareWheel 4y ago
I mentioned in my first comment that Chromium is the project, and Chrome is a specific (and official) build of Chromium. So you need to understand that Chromium is the codebase, and Chrome wraps up that code and distributes it (with minor changes) to the public. Now you can still compile Chromium as-is at the trunk, without those small changes, but there's not an official binary as provided by Google for "pure Chromium". That needs to be compiled manually. On Linux, you'd typically use your package manager to keep up to date with the latest builds of Chromium. If you're on Windows, again there's no official binaries but there are sites that auto-build the latest releases. Nightly: https://download-chromium.appspot.com/ https://download-chromium.appspot.com/ Stable: https://chromium.woolyss.com/ https://chromium.woolyss.com/ I'm guessing these do not include an auto-updater. You should also understand that the difference between Chrome and Chromium is not just "tracking" (user metrics and crash reports). Chrome also includes content that could not legally be included in Chromium due to licensing, such as H.264 and AAC codec support. Those are pretty important to the web today. I don't generally recommend running pure builds of Chromium except for developer use. You might consider an alternative like Ungoogled Chromium, though understand they focus more on privacy than security. You will lose features like auto-complete, browser sync, and Google's Safe Browsing service which warns of website malware. For this reason you'd actually be sacrificing security for privacy, which runs contrary to the goal you laid out above. From all the information you've given, I do think a stable or beta branch of Chrome is your best option (though not Canary or dev branches, which are too recent).
- WorldDev 4y ago
  Thanks again for your answer. I am familiar with the difference between Chrome and Chromium. "that needs to be compiled manually" => I thought this contained chromium binaries : https://commondatastorage.googleapis.com/chromium-browser-snapshots/index.html https://commondatastorage.googleapis.com/chromium-browser-sn... "I do think a stable or beta branch of Chrome is your best option" => thanks for the advice. What are your thoughts on the privacy leaks of chrome affecting security? Is that a fair concern? I also read somewhere that some time ago chrome was scanning the hard drive of the host. This seems fairly bad as well, if correct.