10 ms·
Supermium – Chromium fork for Win 2003/XP and newer
- easton 3y agoAnyone know how this works? My guess was that Google dropped support for older versions of Windows because Chromium needed libraries that only worked on newer versions, guess that isn't the case?
- 0x073 3y ago"Needed", means it's easier for them and why should they care about a dead and insecure os.
- Tommy430 3y ago> why should they care about a dead and insecure os. Developing for old technologies in general (especially hardware) can help make your code and project lighter in general. (see: alternative frontends for YouTube and Twitter, YouTube circa. 2005-2011, even 2012-2016)
- FinnKuhn 3y agoIt can do that, but it can also mean that you can't use better performing ways to do things that were only introduced in a newer OS.
- Narishma 3y agoYou can if you have fallbacks for when those features aren't available.
- CJefferson 3y agoBut why have fallbacks for unsupported OSes, which are hard to even test (as the OSes themselves probably shouldn’t be attached to the internet due to possible security issues).
- comex 3y agoTrue, but that tends to require a bunch of extra code, and adds complexity since now you have two different paths to test. Which is manageable, but definitely cuts against the goal of keeping the project “light”. (Of course, it depends on the feature and the language/environment you’re using. Sometimes the fallback is trivial, or can be neatly encapsulated in a third-party polyfill you never have to look at.)
- npteljes 3y agoNow that is the part where it doesn't make the project lighter.
- jsheard 3y agoIt is the case, but this project seems to be backporting Chrome to the older APIs or restoring original Chrome code which has since been removed. For example modern Chrome always uses DirectWrite for font rendering, which debuted in Windows 7, but Supermium can fall back to the legacy GDI font renderer that's available on XP.
- iforgotpassword 3y agoThis definitely gets a nerd award, I like doing that myself when working on win32 code (i.e. if possible and not to cumbersome, try to use functions that have been around in old windows versions). But it begs the obvious question if there's a legitimate use case for this, other than having a modern browser when spinning up your retro machine for that nostalgia once a year. And even then, unless you're visiting vogons, any modern website probably chokes your machine to death if it's a period-correct XP/7. Old POS terminals for example? But I think they would just display an ancient website in an ancient browser anyways, and again if the hardware is as old as the rest of the system, this will probably just add slowness with no actual benefit. Oh and yeah, nice job with the name, I misread it the first time. :-D
- oynqr 3y agoA period correct Windows 7 era machine is something like a Core 2 Quad with 4-8 gigs of RAM, I'd hope that even the worst modern web abomination runs on that.
- creshal 3y agoThe vast majority of systems back then had Core 2 Duos, modern web apps (or overcomplicated sites) can easily choke those.
- drewzero1 3y agoI was using a Core2 Duo with 4GB as my main home computer until about a year ago, and while some sites made it run slowly (mostly recipe sites and others with a lot of video ads) it was certainly still usable. The trick was to keep the browser down below 10 or so tabs and close it when I needed to use some other heavy piece of software.
- iforgotpassword 3y agoInteresting, maybe it actually is Firefox being slower than chromium, but incidentally a few days ago I was trying to make an old core 2 duo laptop a browser-only machine for a friend's kid, and with debian 12 and Firefox, the start page of YouTube with no video playing had both cores hover at around 70%. The page worked but was notably slow. Videos played smoothly. So I guess if you don't mind the fans spinning constantly it's usable, but eh...
- redder23 3y ago"A functional sandbox for enhanced security" Well, I think if you're running win 2003/XP and actually dare to go into the internet with the machine, you openly and proudly do not give a flying fuck about any security. The amount of open holes is insane, and some Chromium project that some dude ported is not going to save you. Projects like this never made any sense to me.
- Wowfunhappy 3y agoIf the browser is properly sandboxed, and you're only accessing the internet through the browser, you should reasonably safe, no? Obviously it's better to have defense in depth, but I don't see the immediate danger. What is the attack vector you are concerned about? --- I daily drive a 2013-era version of OS X, using a similar modified version of Chromium[1] to browse the web. I'm pretty sure I've plugged the holes I need to plug in order to be reasonably safe, but if you have a specific concern I'd like to hear about it! 1: https://github.com/blueboxd/chromium-legacy https://github.com/blueboxd/chromium-legacy
- jdiff 3y ago> you should reasonably safe, no? No, just as an example, Windows has had multiple kernel exploits that only required crafted fonts to be loaded by the victim computer. Any interaction with the world outside of the sandbox leaves room for a foot in the door, and there's necessarily a lot. Images, video, audio, the multitude of device APIs, and like the font exploits show, even the most basic page rendering.
- Wowfunhappy 3y agoMy understanding is that Chromium renders fonts and other graphics primitives via Skia. Video and audio uses ffmpeg. And all of these libraries are statically linked.
- jdiff 3y agoSupermium in specific will let you render text with GDI (for performance, probably?), videos are played with FFMPEG but that still means hauling untrusted footage outside of the sandbox for hardware decoding, and there's still countless other potentially-pierceable membranes in the sandbox. This (probably) isn't a practical vector for a browser, but kernel exploits have been crafted out of scrollbars in the past. Any time the sandbox calls out to the OS in any capacity it's trusting that the surface it's touching isn't vulnerable, and sometimes it is. For a sandbox to solve this, it's not good enough to just prevent people from misusing the APIs that exist on paper, you have to verify that the API itself isn't bugged and exploitable. And it's not just OS surface, either, Skia's just as penetrable as any other membrane in the sandbox.[0] [0] https://nvd.nist.gov/vuln/detail/CVE-2023-6345 https://nvd.nist.gov/vuln/detail/CVE-2023-6345
- Wowfunhappy 3y agoSee also: a roughly equivalent project for legacy OS X (Lion and newer): https://github.com/blueboxd/chromium-legacy https://github.com/blueboxd/chromium-legacy
- thanksbro 3y agoThanks for this. You read my mind. I think the few remaining browser makers are too eager to not support OSes that are just a few years old. It is done under the guise of 'security' but executables using older APIs would work perfectly well on new OS versions.
- Wowfunhappy 3y agoYou're welcome! If you use this, please consider sponsoring the developer if you can. I daily drive Chromium Legacy and I'm perpetually terrified its one very talented developer will abandon the project. As of this writing, the project only has two sponsors, one of which is me.
- npteljes 3y agoWorking executable is not the target, a reasonably secure system is the target, and so, it doesn't make sense to support an EOL platform, as that's insecure by default. In fact, the browser explicitly not supporting it is a benefit for the user, as they now feel added pressure to use something up to date.
- Springtime 3y ago> GDI font rendering, using #force-gdi in chrome://flags I'm jealous. GDI with MacType was so much better than the default DirectWrite rendering.
- ck2 3y agoWindows 7 is still stuck on Chrome 109 There are 3rd party patches to install 120+ but needs safety audit (and unfortunate name) https://github.com/Blaukovitch/GOOGLE_CHROME_Windows_7_CRACK https://github.com/Blaukovitch/GOOGLE_CHROME_Windows_7_CRACK Considering there are critical vulnerabilities in 109 you'd think Google might consider the non-evil thing to release an ESR
- bogwog 3y ago> but needs safety audit I don't think anyone still using Windows 7 cares
- staticlibs 3y ago> WARNING: Files not signed! I don't have a Google Inc. private key at the moment. Its readme is worth reading.
- dd_xplore 3y agoWtf is Hindu manager
- jsheard 3y agoI would guess they are racistly referring to Satya Nadella, who is Indian-American.
- abhinavk 3y agoPichai actually used to be the PM of Chrome. AFAIK Nadella never directly managed Windows.
- navigate8310 3y agoI guess, Sundar Pichai and Satya Nadela?
- rasengan 3y ago> For this reason, this website does not enforce HTTPS/SSL No SSL on the website means someone could easily MITM the connection and serve something else. That’s a very bad decision short of providing a different form of cryptographic authentication. SSL isn’t just for encryption, friends.
- Dalewyn 3y agoI've only ever been inconvenienced by HTTPS/SSL 99% of the time because 99% of my browsing doesn't involve transmitting sensitive information like my credit cards. Passwords? I couldn't care less if someone were to waylay 99% of my passwords. For the remaining 1% HTTPS/SSL definitely serve a legitimate purpose, but as for the other 99% it's a fucking nuisance and I find websites that don't force the issue a breath of fresh air.
- saagarjha 3y agoI’d appreciate the password to your account then.
- redder23 3y agoGet ready for getting downvoted, these people want to get hacked! I made a comment about how unsecure it is to run a 20+ year old OS and I got downvoted. These people hate facts, just like on Reddit. They are so delusional they think some "sandbox" in the Browser that some dude ported back is fixing 20+ years of security holes in the OS, this is so funny.
- OsrsNeedsf2P 3y agoDepends on your threat model. Back in the real world, more users have been hacked by Windows 10's update system than running XP since 2020.
- dang 3y agoCan you please stop posting like this to HN? We have to ban accounts that do it, for reasons which should be clear if you review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. I don't want to ban you because you've also posted some good things, but we've already warned you once, and you've unfortunately been continuing to break the rules quite badly—not just in this thread but in others. To mention a couple recent examples: https://news.ycombinator.com/item?id=39467401 https://news.ycombinator.com/item?id=39467401 https://news.ycombinator.com/item?id=39458160 https://news.ycombinator.com/item?id=39458160 If this keeps up, we're going to have to ban you. If you'd please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it.
- jug 3y agoI've been thinking, just for fun, which browsers still would support Windows XP. The answer was that nothing current or even half decent really did and I had to go back quite a bit in time to find anything. So this actually fills a niche! If you for some reason want this. I for one probably need to try run an XP VM with this soon! :D Looking forward to the future Windows 2000 support!
- guestbest 3y agoWin98 SE was the best OS Microsoft made.
- lproven 3y agoIn the trade, we used to call it "GameOS". I deployed it and attempted to support the wretched thing, and I always thought it was one of the worst ever. It had the deeply stupid and crappy "Active Desktop", turning the good solid Win95/NT 4 Explorer into a slow and unstable POS that rendered via IE4 so that MS wouldn't get sued or split up by the Department of Justice for illegal restraint of trade in bundling IE with Windows. A disastrous UI and its broken design contaminates every later release. Underneath there were good changes: >4 IP addresses, multihead graphics and things. But bundling IE meant it was broken junk, and that was unforgiveable.
- lproven 3y agoThe most useful Mozilla-family browser is MyPal68, which is highly usable. https://github.com/Feodor2/Mypal68 https://github.com/Feodor2/Mypal68
- mgaunard 3y agoI don't use Windows much, can someone explain to me the actual difference with Chromium?
- gattilorenz 3y agoThis works on very old machines with very outdated OSs
- mgaunard 3y agoWhat are the new APIs that require Windows 10+?
- peter_d_sherman 3y agoI wish to award massive kudos to the Author, because it's about time that somebody began the onerous (yet absolutely necessary!) task of backporting Chrome/Chromium to older simpler/more understandable -- systems. I don't think that everyone truly understands the nature of the larger problem, so I'll briefly explain it here... You see, a long time ago in computer history, OS adoption -- drove corresponding software development. That was the case with various versions of Microsoft Windows -- for many years. These days, it's not the Operating System but the Browser -- of which (Google) Chrome (and its open-source counterpart, Chromium) -- which drives corresponding OS adoption... Basically, if a given OS can't run the latest version of Chrome / Chromium -- then it's basically a dead OS! That's a huge problem because by way of this, Chrome/Chromium unintentionally forces adoption of increasingly complex newer OS'es on the general public... That's a problem because these increasingly complex newer OS'es are orders of magnitude more lines of code (LOC) than their predecessors. If the complaint is that older OS'es are not secure, then guess what? That complaint also applies at least doubly (and perhaps exponentially!) to newer OS's as well, which comprise exponentially more lines of code than the older OS'es! In the future, it would be great to see the simplest (least amount of lines of code) OS that could successfully run Chrome/Chromium -- but even going a step farther than that, it might be an idea to freeze the Chrome/Chromium source at a certain point, then simplify Chrome/Chroumium such that its dependencies on an underlying OS were minimized! In other words, develop a fork of Chrome/Chromium in lock-step with developing the simplest OS that Chrome/Chromium could possibly run on, with the corresponding idea of refactoring all of that software into the simplest, cleanest, most documented, most modular piece of software that is or could exist. It is not in that form now. That is because Chrome/Chromium has incorporated source code from a lot of third party software. Does any single person, much less a single person at Google (as bright as everyone is at Google?) truly understand ALL of those lines of code? ? Based on the source code hierarchy -- I highly doubt it. That's because if they truly did -- then all repeated functionality in all third party libraries would be merged in the most minimum form necessary. Don't get me wrong, I love Google, I love everyone that works for Google, I love their products -- but I have to believe after looking at the Chromium source that there isn't a single person (compare to Linus Torvalds and the BDL concept) "running the show"... In other words, Chrome/Chromium is a "diffusion of responsibility" system, with multiple parties taking responsibility for different parts of Chrome/Chromium at different times... Compare that concept to that of a Maintenance Programmer Vs. a Chief Architect... A Maintenance Programmer typically changes a few lines of code at a time in a system in response to support tickets and customer requests. A Maintenance Programmer might very well implement the change or feature requested -- but with their changes they also might introduce subtle future bugs into the system because their view is local in scope, and they lack full global awareness of all of the rules and constraints that the entirety of the system must obey. A Chief Architect on the other hand -- will have that global knowledge -- and will harmonize any changes they make with the broader rules, constraints, goals and caveats of the entire system... In other words, the changes they make to a system, should they make them -- will be more finessed, more nuanced, more filled with understanding -- than those made by a Maintenance Programmer in response to a support ticket, customer request, or bug fix... Anyway, great job (so far!) with Supermium!!! We need Chrome/Chromium on those older OS'es!
- 1-6 3y agoIn 2024, I prefer older operating systems that do not get updates. First, hackers have long moved away from creating exploits and second, OEMs and the OS maintainer no longer create software to log activity. Third, it just runs quickly on newish hardware given that it installs.
- jupp0r 3y agoThey also don't get any updates should vulnerabilities surface. Also they don't run newer software (which might be ok depending on your use case).
- nancyp 3y agoThis is exactly what DDOS hackers are looking for. Older unpatched vulnerability, that allows either remote execution or full take over. Please do not do that. A better alternative is to just move over to other os distribution such as Linux arch, chromium or something similar. Linux desktops are lot more capable these days.
- Wowfunhappy 3y agoI don't want to re-hash the discussion from down-thread [1], but I think this is important. If XP is behind a NAT firewall and the user is browsing the web via a modern build of Chromium, how exactly would a hacker take over the machine without a zero day? 1: https://news.ycombinator.com/item?id=39580985 https://news.ycombinator.com/item?id=39580985
- GrumpySloth 3y agoProbably through RCE-s in Windows XP’s TCP/IP stack implementation.
- Wowfunhappy 3y agoWhat CVE(s) in the TCP/IP could be used for this?
- dataflow 3y agoNot sure if dumb question but how do they actually build it? I don't mean the commands, I mean Chromium needs quite a few machines to build in a reasonable amount of time. Do they have their own build farm? Or does some dude just leave it to build overnight or something on his personal machine every release?
- throwaway11460 3y agoWhat do you mean? It's just a few hours on my 2017 i7 desktop.
- wkat4242 3y agoCool. A bit like tenfourfox for Mac (sadly deprecated now)
- issafram 3y agoOnly 17k commits behind Chromium. Interesting project though
- Borg3 3y agoThe problem with all the new stuff (OS, Apps etc) is that you are no longer own them. They are lend to you, and so, it can be easly rendered unusuable by companies by simply pushing special update. I hate auto updated with passion. It all looks cool on paper, but if we talk about security and control its big fail. Why? Because all those companies have their own agendas. People should wake up, or we will end up in place similar to China, where few clicks from gov official will exclude person from society.
- mvkel 3y agoPeople will always choose the most convenient option over the most secure or the most strategically sound.
- pm2222 3y agoSome folks prefer Debian as vm host as it’s considered stable. 2003/xp or even dos can be considered a stable host for browser. Why not? These days I don’t have to manually install many apps a browser meets most my needs.
- n3storm 3y agowhy not? beacuse it is not stable nor secure and code cannot be fixed or audited.
- p1mrx 3y ago> An Intel Pentium 4 processor or later that's SSE2 capable Sounds like Athlon XP users are out of luck.
- markjenkinswpg 3y agoI'm curious if Wine and ReactOS can run this, sounds like a good stress test.
- rkagerer 3y agoDid they manage to finally fix this Chrome bug? https://support.google.com/chrome/thread/18818459/chrome-taking-focus-when-mouse-passes-over-since-last-update?hl=en https://support.google.com/chrome/thread/18818459/chrome-tak... https://issues.chromium.org/issues/40770130 https://issues.chromium.org/issues/40770130
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- red_admiral 3y agoApart from old OS support, might this be the go-to chromium fork for keeping Manifest V2 compatibility in future?
- s1gnp0st 3y agoFor when you simply must run a secure, modern browser on your ancient, swiss cheese operating system.
- nar001 3y agoIt's less about running a secure browser and more about running something that can render modern webpages
- hdskfsdkjhfsdjh 3y agowhere is the download link
- tbbttbbt 3y agoTrue heros use Phoenix browser (the name Firefox had in it’s earliest stage) Wherever possible (not too many places due to HTTPS) Or even Netscape Communicator