5 ms·

Tell HN: Chromium forks for legacy platforms are disappearing from GitHub

121 points by Wowfunhappy 2y ago

This is really strange! Chromium Legacy is an up-to-date fork of Chromium which supports back to Mac OS X 10.7 Lion (from 2011). On Friday, the developer's Github account and all of his repositories suddenly disappeared. The links now return 404 errors. https://github.com/blueboxd/ https://github.com/blueboxd/chromium-legacy Today, the same thing happened to Supermium, an equivalent project for Windows which supports back to XP. To my knowledge, the developers of Chromium Legacy and Supermium are wholly unaffiliated. https://github.com/win32ss/ https://github.com/win32ss/supermium Does anyone happen to know what the heck is going on? It's a little scary and makes me not want to trust GitHub. I don't see anything relevant in GitHub's repository of DMCA notices[1], and I'm having trouble coming up with legal grounds on which such a takedown could happen. --- 1: https://github.com/github/dmca

its-summertime 2y ago
https://forums.macrumors.com/threads/chromium-legacy-google-chrome-for-os-x-10-7-10-9.2283612/page-16?post=33170934#post-33170934 https://forums.macrumors.com/threads/chromium-legacy-google-...
- beretguy 2y ago
  Looks like this is a step towards Google DRMing the internet. This is bad.
  - lxgr 2y ago
    How would Google push DRM by filing false [1] copyright claims against various Chromium forks, which presumably wouldn't even contain any hypothetical DRM keys? Regular old Chrome does in fact include a Widevine DRM binary blob, but Chromium doesn't contain the source for it. If Google really wanted to push something like browser attestation (like they potentially did with their Web Environment Integrity proposal), almost by definition that part couldn't be open sourced either and would not be part of Chromium. [1] Chromium is licensed under various open source licenses that Google can't retroactively revoke. Even for code that they own the full copyright on, they can at most release future versions under a closed license; for GPL-ed dependencies, that wouldn't work at all (not sure if Chromium has any).
    - deleted 2y ago
      [deleted]
    - DANmode 2y ago
      Why couldn't browser attestation code be OSS?
      - lxgr 2y ago
        The code could be (but often isn't, to frustrate circumvention), but the signature keys can't, just like with all DRM.
    - 63stack 2y ago
      What's the point of playing devil's advocate, or giving any benefit of doubt to Google? They have shown repeatedly that they intend to control the internet. Just because we can't see why yet, it's not far fetched to assume that this might be a step in that direction.
toomuchtodo 2y ago
https://github.com/gdamdam/iagitup https://github.com/gdamdam/iagitup
- Wowfunhappy 2y ago
  It's a little late for that, sadly.
  - deleted 2y ago
    [deleted]
HackOfAllTrades 2y ago
Could this be tied to Google's push to force everyone to use Manifest 3, and nerf Add Blockers?
- lxgr 2y ago
  How would it? Google can't retroactively un-license the Chromium source, which is under various open source licenses that I'm almost certain all include at a minimum the right to host a fork somewhere. Additionally, if you are concerned about MF3, your best bet isn't some outdated Chromium fork – it's Firefox.
  - Wowfunhappy 2y ago
    Just to be clear, Chromium Legacy and Supermium aren't outdated, that's what makes them great. They work on outdated operating systems, but they track up-to-date Chromium.
    - lxgr 2y ago
      That is great! I kind of assumed as much, but unfortunately that also most likely means that it'll lose Manifest V2 support at some point (not that upstream Chrome will keep it). That seems to be the concern of some people commenting here, and I wanted to highlight that the two are largely orthogonal as far as I can tell.
      - Wowfunhappy 2y ago
        Supermium has stated that they plan to retain Manifest V2. I agree with you for Chromium Legacy.
  - herewulf 2y ago
    Google can't take back the source but they can make distribution of binaries hard? Most Windows users are very dependent on pre-built binaries, for example. And doesn't Google have leverage over Mozilla by way of their funding?
beretguy 2y ago
Somebody needs to upload their local all over the internet to gitlab, codeberg, anywhere else.
- lxgr 2y ago
  Their local what?
  - wdh505 2y ago
    Copy of the source code?
    - rafark 2y ago
      The beauty of git (everyone has a full copy of the repo). Although this being an installable browser targeted more towards end users I wouldn’t trust a repo from anyone other than the official maintainers.
_lvbh 2y ago
Even though all of this should be perfectly legal and follows TOS, GitHub really isn’t the place to host anything possibly damaging to or annoying big tech. You can add push URLs to your origin branch such that `git push` automatically mirrors your code on multiple remotes: `git remote set-url --add --push origin git://another/repo.git`. If you maintain an open source repository, I would encourage you to have mirrors across gitlab, codeberg, and/or a self hosted gitea instance.
- Wowfunhappy 2y ago
  I'm certainly not against mirrors. But— > GitHub really isn’t the place to host anything possibly damaging to or annoying big tech. Why would Google give a crap if a handful of people futzing around with ancient versions of Windows and macOS want to run up-to-date Chromium browsers? If you wanted to be super conspiratorial, you could point to Supermium's statement[1] that they plan to retain Manifest V2 support. But that merely puts them in the same category as Brave and Firefox. At the same time, I don't know how else to explain what is going on! --- 1: https://win32subsystem.live/supermium/#:~:text=Manifest%20V2%20is%20NOT%20slated%20for%20removal%20from%20Supermium%20browser https://win32subsystem.live/supermium/#:~:text=Manifest%20V2....
  - cyanydeez 2y ago
    Conspiracy hat: Google is fighting ad blockers via the new v3 manifest to keep the YouTube milk cow going. They will soon be rejecting v2 plugins and probably expect some flight to chromium.
    - lxgr 2y ago
      Maybe take the hat off for a minute and consider how they'd possibly retroactively revoke the (non-revokable) open source licenses that all Chromium versions published to date have been licensed under. Then ask yourself what the benefit of all that – already impossible – endeavor would be, given that Firefox also exists and isn't deprecating Manifest V2. Finally, ask yourself which actual paths Google could take to still eventually force MFv3 on most web users without resorting to any such drastic and publicly-visible measures. See? You didn't really need the hat!
Kab1r 2y ago
I'm not sure if GitHub is the right place for chromium mirrors. When you upload to GitHub, you are agreeing that the code is licensed to GitHub under certain conditions (in addition to the license specified in the repository).
- throwme_123 2y ago
  Although a potential issue generally, it's unrelated here. If it's already open source, GitHub can almost (depending on license) use it as they see fit anyway.
rvnx 2y ago
In the thread you posted: "Bluebox doesn't know why his Github account disappeared, but it was not intentional and he has contacted Github support!" "the Supermium GitHub repository is currently unavailable. Efforts are being made to restore the repository" If this is true, it could be because of using Google API Keys in the software.
- Wowfunhappy 2y ago
  API keys are a good theory but as far as I can tell, at least in Chromium Legacy they're set up correctly per Google's policies. You can sign into a Google Account in the released builds of Chromium (so they are embedded in the binary) but when I compile the source myself the keys aren't there, so they haven't been disclosed in the source.
GianFabien 2y ago
Isn't GitHub owned by Microsoft? Isn't Microsoft using GitHub to train AI? Doesn't Google also have AI ambitions? I think it plausible that we are seeing the shadows cast by competitive maneuvering between two industry heavy-weights.
rurban 2y ago
Both up again. Probably an automatic spam filter, shadowbanning both users
londons_explore 2y ago
It's notable that Chromium is an especially large repo, and it seems has been special cased in githubs repo size limits. It's possible this is GitHub just enforcing their size limit
theginger 2y ago
Working for me now, so I guess they got it sorted out.

121 points by Wowfunhappy 2y ago

its-summertime 2y ago

https://forums.macrumors.com/threads/chromium-legacy-google-chrome-for-os-x-10-7-10-9.2283612/page-16?post=33170934#post-33170934 https://forums.macrumors.com/threads/chromium-legacy-google-...

beretguy 2y ago
Looks like this is a step towards Google DRMing the internet. This is bad.
- lxgr 2y ago
  How would Google push DRM by filing false [1] copyright claims against various Chromium forks, which presumably wouldn't even contain any hypothetical DRM keys? Regular old Chrome does in fact include a Widevine DRM binary blob, but Chromium doesn't contain the source for it. If Google really wanted to push something like browser attestation (like they potentially did with their Web Environment Integrity proposal), almost by definition that part couldn't be open sourced either and would not be part of Chromium. [1] Chromium is licensed under various open source licenses that Google can't retroactively revoke. Even for code that they own the full copyright on, they can at most release future versions under a closed license; for GPL-ed dependencies, that wouldn't work at all (not sure if Chromium has any).
  - deleted 2y ago
    [deleted]
  - DANmode 2y ago
    Why couldn't browser attestation code be OSS?
    - lxgr 2y ago
      The code could be (but often isn't, to frustrate circumvention), but the signature keys can't, just like with all DRM.
  - 63stack 2y ago
    What's the point of playing devil's advocate, or giving any benefit of doubt to Google? They have shown repeatedly that they intend to control the internet. Just because we can't see why yet, it's not far fetched to assume that this might be a step in that direction.

toomuchtodo 2y ago

https://github.com/gdamdam/iagitup https://github.com/gdamdam/iagitup

Wowfunhappy 2y ago
It's a little late for that, sadly.
- deleted 2y ago
  [deleted]

HackOfAllTrades 2y ago

Could this be tied to Google's push to force everyone to use Manifest 3, and nerf Add Blockers?

lxgr 2y ago
How would it? Google can't retroactively un-license the Chromium source, which is under various open source licenses that I'm almost certain all include at a minimum the right to host a fork somewhere. Additionally, if you are concerned about MF3, your best bet isn't some outdated Chromium fork – it's Firefox.
- Wowfunhappy 2y ago
  Just to be clear, Chromium Legacy and Supermium aren't outdated, that's what makes them great. They work on outdated operating systems, but they track up-to-date Chromium.
  - lxgr 2y ago
    That is great! I kind of assumed as much, but unfortunately that also most likely means that it'll lose Manifest V2 support at some point (not that upstream Chrome will keep it). That seems to be the concern of some people commenting here, and I wanted to highlight that the two are largely orthogonal as far as I can tell.
    - Wowfunhappy 2y ago
      Supermium has stated that they plan to retain Manifest V2. I agree with you for Chromium Legacy.
- herewulf 2y ago
  Google can't take back the source but they can make distribution of binaries hard? Most Windows users are very dependent on pre-built binaries, for example. And doesn't Google have leverage over Mozilla by way of their funding?

beretguy 2y ago

Somebody needs to upload their local all over the internet to gitlab, codeberg, anywhere else.

lxgr 2y ago
Their local what?
- wdh505 2y ago
  Copy of the source code?
  - rafark 2y ago
    The beauty of git (everyone has a full copy of the repo). Although this being an installable browser targeted more towards end users I wouldn’t trust a repo from anyone other than the official maintainers.

_lvbh 2y ago

Even though all of this should be perfectly legal and follows TOS, GitHub really isn’t the place to host anything possibly damaging to or annoying big tech. You can add push URLs to your origin branch such that `git push` automatically mirrors your code on multiple remotes: `git remote set-url --add --push origin git://another/repo.git`. If you maintain an open source repository, I would encourage you to have mirrors across gitlab, codeberg, and/or a self hosted gitea instance.

Wowfunhappy 2y ago
I'm certainly not against mirrors. But— > GitHub really isn’t the place to host anything possibly damaging to or annoying big tech. Why would Google give a crap if a handful of people futzing around with ancient versions of Windows and macOS want to run up-to-date Chromium browsers? If you wanted to be super conspiratorial, you could point to Supermium's statement[1] that they plan to retain Manifest V2 support. But that merely puts them in the same category as Brave and Firefox. At the same time, I don't know how else to explain what is going on! --- 1: https://win32subsystem.live/supermium/#:~:text=Manifest%20V2%20is%20NOT%20slated%20for%20removal%20from%20Supermium%20browser https://win32subsystem.live/supermium/#:~:text=Manifest%20V2....
- cyanydeez 2y ago
  Conspiracy hat: Google is fighting ad blockers via the new v3 manifest to keep the YouTube milk cow going. They will soon be rejecting v2 plugins and probably expect some flight to chromium.
  - lxgr 2y ago
    Maybe take the hat off for a minute and consider how they'd possibly retroactively revoke the (non-revokable) open source licenses that all Chromium versions published to date have been licensed under. Then ask yourself what the benefit of all that – already impossible – endeavor would be, given that Firefox also exists and isn't deprecating Manifest V2. Finally, ask yourself which actual paths Google could take to still eventually force MFv3 on most web users without resorting to any such drastic and publicly-visible measures. See? You didn't really need the hat!

Kab1r 2y ago

I'm not sure if GitHub is the right place for chromium mirrors. When you upload to GitHub, you are agreeing that the code is licensed to GitHub under certain conditions (in addition to the license specified in the repository).

throwme_123 2y ago
Although a potential issue generally, it's unrelated here. If it's already open source, GitHub can almost (depending on license) use it as they see fit anyway.

rvnx 2y ago

In the thread you posted: "Bluebox doesn't know why his Github account disappeared, but it was not intentional and he has contacted Github support!" "the Supermium GitHub repository is currently unavailable. Efforts are being made to restore the repository" If this is true, it could be because of using Google API Keys in the software.

Wowfunhappy 2y ago
API keys are a good theory but as far as I can tell, at least in Chromium Legacy they're set up correctly per Google's policies. You can sign into a Google Account in the released builds of Chromium (so they are embedded in the binary) but when I compile the source myself the keys aren't there, so they haven't been disclosed in the source.

GianFabien 2y ago

Isn't GitHub owned by Microsoft? Isn't Microsoft using GitHub to train AI? Doesn't Google also have AI ambitions? I think it plausible that we are seeing the shadows cast by competitive maneuvering between two industry heavy-weights.

rurban 2y ago

Both up again. Probably an automatic spam filter, shadowbanning both users

londons_explore 2y ago

It's notable that Chromium is an especially large repo, and it seems has been special cased in githubs repo size limits. It's possible this is GitHub just enforcing their size limit

theginger 2y ago

Working for me now, so I guess they got it sorted out.