brave browser is not private, autoupdate is remote code execution

[milahu]

brave is not private because autoupdate

autoupdate is effectively a backdoor for remote code execution
because yes, of course they can send different updates to different people

https://github.com/pluja/awesome-privacy/#web-browser

Instead use
...
Brave - Android/iOS. Brave offers a pretty good out-of-the-box set of privacy and tracker protections.

see also

https://gist.github.com/milahu/48ce36f368c5aeb9be8f784d694c2961

also see brave on the "Spyware Watchdog" https://spyware.neocities.org/articles/brave.html

Spyware Level: High

Brave is self updating software, uses Google as the default search engine, has built-in telemetry, and even has an opt-out rss-like news feed [Brave Today] similar to Firefox Pocket. These shouldn't be the things that come to mind if someone were to imagine a privacy oriented browser. solutions

these people are proud ex-members of NSA/CIA shell companies (intel, mozilla, godaddy), and now they are "freedom fighters"?

remember kids, autoupdates was invented (and aggressively pushed) by google and microsoft, which are also just shell companies for NSA/CIA

... but the devil is in hardware backdoors

the whole "atmosphere" around the brave people is just ... suspicious

they deleted 2 of my comments (censorship)

they refuse to implement simple privacy features like "disable autoupdate" (spyware)

they locked the github issue on autoupdate (censorship)
Add a "Disable autoupdate" feature (disable updates) #5576

https://github.com/brave/brave-browser/issues/5576

brave was aggressively marketed as a "yay privacy" browser
also targetting dissidents like republicans, qanon, ...

aggressively marketed

marketing is expensive. who paid for it?

if i was a secret service (NSA) i would do it exactly like this

similar problem with firefox (spyware by default), thats why we have librewolf

see also #277 (comment) by @monokrome

running something yourself in your own home without auditing or having done significant research to trust it could be exposing it to nearby services and data on your network, it can increase the surface area for attacks, and it could cause other privacy-adverse concerns.

[HDark15]

Open suggestion:
Add a "Disable autoupdate" feature (disable updates)
brave/brave-browser#5576

https://privacytests.org/
https://lukesmith.xyz/articles/hating-brave-is-cool/
https://lukesmith.xyz/articles/every-web-browser-absolutely-sucks/
https://code-cktn.org/CHEF-KOCH/Brave-Browser-Hardening
https://code-cktn.org/CHEF-KOCH/Brave-Browser-Hardening/issues/20
https://code-cktn.org/CHEF-KOCH/Brave-Browser-Hardening/issues/22
https://code-cktn.org/CHEF-KOCH/Brave-Browser-Hardening/issues/24

Brave Blog:
https://brave.com/web-standards-at-brave/8-first-party-sets/
https://brave.com/web-standards-at-brave/7-googles-topics-api/
https://brave.com/web-standards-at-brave/6-privacy-sandbox-concerns/
https://brave.com/web-standards-at-brave/3-web-bundles/
https://brave.com/web-standards-at-brave/1-client-hints/
https://brave.com/web-standards-at-brave/4-global-privacy-control/
https://brave.com/privacy-updates/19-star/
https://brave.com/privacy-updates/21-blocking-cookie-notices/

Firefox:
Recently adding ads to the URL bar
https://www.techradar.com/news/ads-have-even-invaded-the-firefox-url-bar-now
EME DRM botnet downloaded by default
Pocket (proprietary service, ads, promoted content)
https://en.m.wikipedia.org/wiki/Mozilla_Pocket#History
"The integration was controversial, as users displayed concerns for the direct integration of a proprietary service into an open source" application, and that it could not be completely disabled without editing advanced settings, unlike third-party extensions.
Automatically installing Mr. Robot adware through experimental extensions program
https://www.cnet.com/tech/services-and-software/mozilla-backpedals-after-mr-robot-firefox-misstep/
Promotes Cloudflare DNS MitM botnet
https://digdeeper.neocities.org/ghost/mozilla.html#cloudflare
Inferior fingerprinting protection and other leaks
https://bugzilla.mozilla.org/show_bug.cgi?id=1372288
Breaking compatibility for old extensions
https://blog.mozilla.org/addons/2018/08/21/timeline-for-disabling-legacy-firefox-add-ons/
Breaking add-on certificate signing, disabling NoScript on Tor browser and threatening millions of users
https://www.forbes.com/sites/kateoflahertyuk/2019/05/05/firefox-extensions-are-broken-heres-what-to-do/
Breaking css UI customization features
Breaking user modifiable options (most recent compact mode)
https://www.ghacks.net/2021/04/07/mozilla-decides-to-hide-compact-mode-in-firefox-for-new-users-but-keep-it-for-existing-ones/
Removing about:config sorting and filtering, completely removed on Android
https://www.ghacks.net/2019/01/31/firefoxs-new-aboutconfig-page/
Poor security, even with Fission they are years behind (especially on Android)
https://madaidans-insecurities.github.io/firefox-chromium.html

"they deleted 2 of my comments (censorship)"
Why are you doing personal attack?
"lets start a hostile fork : )"
https://archive.is/OKfAs#issuecomment-911342701
https://archive.is/lT6eS#issuecomment-912096187

I'm using hardened Firefox for my main. I know what I put here make Firefox look bad, but I just want to share the other side.
Feel free to share your opinion.

[milahu]

Why are you doing personal attack?

"lets be excellent to each other [and fuck politeness]" -- linus torvalds

stating public facts is no "personal attack".
on the other side, censoring such harmless statements is at least suspicious

= attackers acting like victims, wolves in sheep clothing, the "jew" cries out in pain as he strikes you, etc ...

"lets start a hostile fork : )"

yeah, i still would love to see an actual private-by-default fork of brave
but meanwhile i will just use ungoogled-chromium and librewolf

Open suggestion:
Add a "Disable autoupdate" feature (disable updates)
brave/brave-browser#5576

its not "open" because snowflakes are crying

brave locked as too heated and limited conversation to collaborators on Sep 3, 2021

in that discussion, brave staff make false promises like

This is on our radar. Will re-raise with @diracdeltas and @rebron

brave staff try to appease their critics like

I understand this is something we're passionate about

only to hide their autoritarian style of "we know whats best for you"
and "youre all too stupid to maintain a private-by-default fork of brave"
(also because compiling brave is non-trivial)

chef-koch looks promising at first, but on closer look, he fails my intelligence test

Auto Updates are mandatory to quickly fix security related issues as well as severe problems. Using an outdated Browser impacts your security as well as privacy.

-- https://code-cktn.org/CHEF-KOCH/Brave-Browser-Hardening/issues/22

thanks idiot, thats exactly the official mantra
they act like there is a zeroday exploit every day

3a. The Lockdown and Masks

Again what has this to do with Brave, absolute nothing. He can be pro or against COVID-19 and masks in his free time like he wants. This is a controversial topic and some people are against it. As long as he wears a masks in public and comply with the actual restrictions to avoid infecting others I see no problem with statements he does in the internet, his own thing. I do not like it but it is his opinion, he is not an expert.

Elon Musk and others also bullshitting on Twitter, that is their own thing, unless their Tweets actually influence the market, employees or the entire Corp.

-- https://code-cktn.org/CHEF-KOCH/Brave-Browser-Hardening/issues/24

someone who is vulnerable to social hacking (covid)
wants to defend users from tech hacking?
nah mate. just another "schmalspurdenker" (narrow thinker). next!

[monokrome]

I was quoted here but do not vouch for this issue tbh. If you can disable auto updating, then disable it. If you don’t trust brave browser, don’t install it or build it yourself.

Normally, we should expect privacy by default in all cases - including opt-in for things potentially harmful. In this case, however, we have competing concerns because we can easily recognize and have experience in the IE days in seeing how many more security and privacy issues come from browsers not providing important fixes by default.

Is it perfect? No. Does it completely implicate Brave as being anti-privacy? No.

Even as someone who doesn’t have any respect for Brave’s leadership, this entire issue comes off more as vindictive retaliation to having been ignored in some other repository’s issues than a reasonable claim to Brave being opposed to user privacy.

Things that may justify this would be, for instance, if someone found evidence of their binary build including source that isn’t on their GitHub, unusual network traffic sniffed from Brave, questionable statements / plans from leadership about the future of Brave, etc. As far as I know, we don’t have any of that here.

It can not be stressed enough how much things like browsers need to be updated as quickly as possible after a release and as frequently as possible. If you trust the first binary, there’s no strong reason for why you wouldn’t trust the next one.

[milahu]

revenge trip? no ...
the behavior of brave staff (censorship, lies) is suspicious and users should know that

its funny how i must give consent for website cookies
but autoupdate is on by default, not asking for consent

let me reduce my issue to

autoupdate is effectively a backdoor for remote code execution
because yes, of course they can send different updates to different people

usually i fetch my binaries from a "public" binary cache (in my case https://cache.nixos.org/)
which already is a security risk, but lets ignore that now

an app with autoupdate does not use that cache
but instead, it fetches binaries from a "private" cache (in this case cdn.brave.com or so)

this allows the vendor (brave) to send different binaries to different people

if someone found evidence of their binary build including source that isn’t on their GitHub

at least we could track checksums of the fetched binaries to "watch the watchers"

also, would be interesting if brave builds are reproducible

[monokrome]

but autoupdate is on by default, not asking for consent

Imagine supporting this argument without even understanding why it's so important for user privacy & security that browsers auto-update by default 🤯

the behavior of brave staff (censorship, lies) is suspicious and users should know that

where?

an app with autoupdate does not use that cache

Compile it without autoupdate, or disable the auto-update service. Brave runs a background service for auto-update, so disabling auto-update is just turning that service off.