Bromite is Dead, Use Cromite Instead

[2zzly]

Preliminary checklist

• I have read the README
• I have read the FAQs.
• I have searched existing issues for my feature request. This is a new issue (NOT a duplicate) and is not related to another issue.
• This is a feature request for the Bromite browser; not the website nor F-Droid nor anything else.

Is your feature request related to privacy?

Yes

Is there a patch available for this feature somewhere?

no

Describe the solution you would like

Bromite has not been update since 2022
Use Cromite instead
https://github.com/uazo/cromite

Describe alternatives you have considered

https://github.com/uazo/cromite

[dismal002]

Doesnt support arm

[Spark4000]

You could use Mulch, a security hardened, chromium based browser that has arm builds. It's from the DivestOS devs. https://divestos.org/pages/browsers

[HarriBuh]

Yes. Cromite fan here. Uazo still credits Cromite's origin respectfully, while improving Chrome drastically.

[ghost]

Doesnt support arm

what do you mean? there are arm64 builds.

[robocop98]

Does support arm64, but not arm, what is quite sad, as all the mobiles I maintain are not 64 bit.

[Morasithil]

Thanks for highlighting cromite, much appreciated!

[foxjaw]

Cromite don't ship webview. Strange.

[HarriBuh]

@foxjaw There is literally nothing strange about it at all. Most devs don't have their own webview served alongside their browser.

[Spark4000]

@foxjaw you can try Mulch webview

[foxjaw]

I'm already on Mulch webview. Just looking into better alternatives. Vanadium could be. But they don't publish updates on f-droid.

[HarriBuh]

@foxjaw What's wrong with Mulch Webview anyway? I've been using it for months, too.

[foxjaw]

@foxjaw What's wrong with Mulch Webview anyway? I've been using it for months, too.

I've never said there's something wrong with Mulch webview. Just exploring more better alternatives.
For example, Thorium comes with the most performance out of the box But can't install that easily, as it doesn't come with open webview, nor it has overlay support.
Vanadium doesn't have f-droid updates, nor they publish the app anywhere. It's just a Graphene exclusive.

[g-k-m]

@foxjaw What's wrong with Mulch Webview anyway? I've been using it for months, too.

I've never said there's something wrong with Mulch webview. Just exploring more better alternatives. For example, Thorium comes with the most performance out of the box But can't install that easily, as it doesn't come with open webview, nor it has overlay support. Vanadium doesn't have f-droid updates, nor they publish the app anywhere. It's just a Graphene exclusive.

Vanadium says "It depends on hardening and compatibility fixes in GrapheneOS rather than reinventing the wheel inside Vanadium. For example, GrapheneOS already provides a hardened malloc implementation so there's no need for Vanadium to replace it. Similarly, it can deploy security features causing breakage on other operating systems due to the ability to fix compatibility problems in the OS." Thus it's missing security features because those are already implemented in GrapheneOS. It also has other features that will cause breakage because the other OSes don't have the compatability fixes that GrapheneOS has. Thus if you're not on Graphene or Divest OS, it's probably best not to use Vanadium (and thus Mulch). Thorium's last release is from a whole month ago, that's very outdated, v117. Thus, Cromite appears to be the best choice, although i've read good things about Brave Browser too. According to privacyguides.org "
On Android, Firefox is still less secure than Chromium-based alternatives: Mozilla's engine, GeckoView, has yet to support site isolation or enable isolatedProcess." This means firefox-based browsers are bad too, although I'm not sure if Mull has patched those two things above, probably not, otherwise they would be using Mull as the main browser for DivestOS, and not Mulch. This is also confirmed by the fact that Mull is written as "privacy oriented web browser" and Mulch is written as "security oriented web browser", because Mull lacks the security while Mulch lacks the privacy protections.

[HarriBuh]

@g-k-m It's always better to NOT use stock Google Webview than doing so. Ergo, using Mulch Webview will always be superior. And it did not cause a single issue during usage. Your whole reasoning doesn't make sense (to me).

[foxjaw]

@g-k-m You're right that Vanadium browser/webview is not as effective outside GrapheneOS environment.
Firefox does have it's own site isolation implementation called fisson. And yes, they did roll out to the stable branch. Mull has it too. Firefox forks are definitely secure. But not as performant as chrome forks on Android. The scroll config is lackluster. UI is non intuitive. Very heavy on memory & CPU. TL:DR; Inefficient. It would be worth using if your device is powerful with a modern chip (<8nm transistors). But on old devices, Firefox Android is a nightmare.

And I don't like brave at all. It claims to block all ads, but it doesn't. At least not as effective as using uBlock Origin. And it even comes with crypto stuff that not everyone are a fan of. And please don't say you can disable it. Everyone on social media praises brave, caz brave obviously sponsored them. And they even let people earn crypto, hence you always see appraisals on their reddit post. Just talk against crypto there & the mods will block you.
And privacyguides.org is a useless site. Don't believe in all these websites claiming which is privacy friendly & which one not.

A browser can never be privacy friendly out of the box. The only browser which achieves that, is Librewolf on desktop. On android, it's Privacy Browser, which is webview based & non-standalone. The main reason, is because out of the box, it disables JS, cookies, DOM storage, enables easylist privacy filters, & does some extra things like stripping out device info from user agent & x-requested-header. Provides Proxies for Tor, I2P & custom ones too. It even doesn't retain browsing caches by default, & runs all of it's browsing session in memory space only. Hence it's performance is 10x fast. But you have to manually configure which sites you trust & allow js, cookies, etc & maintain a list of domain settings, which might be some hassle.

Other browsers just don't provide this much control, hence none of them are privacy friendly to me. You should only consider the security aspect when choosing a webview, & maintain your privacy within the browser that uses it.

@g-k-m It's always better to NOT use stock Google Webview than doing so. Ergo, using Mulch Webview will always be superior. And it did not cause a single issue during usage. Your whole reasoning doesn't make sense (to me).

@HarriBuh The main reason why Google's WebView shouldn't be preferred, is:

1. Not FOSS
2. Has google integrated services
3. Has google analytics trackers

[VA1DER]

WTAF! You have got to be shitting me... a privacy-oriented/degoogled browser that has a built-in un-disable-able Microsoft tracker?!? Jesus, was @uazo high that day??

[foxjaw]

@VA1DER

BRUH

Github privacy statement ≠ Microsoft Trackers

[VA1DER]

Welcome to 2018. Please set your watches back six years.

the Github privacy statement...

...is as trustworthy as the company who made it.

But regardless of this, trackers are trackers. Why on earth go to the trouble of degoogling Chromium at all then? After all, those network accesses are subject (theoretically) to Google's privacy statements, so that's ok then.

The point of privacy protection is not to analyze the privacy statements, the point is to not to give them the data in the first place.

[foxjaw]

You are literally using Github account with username @VA1DER, providing ample amount of data to Microsoft by commenting here. They probably have your ip address unless you're always on vpn.
Github privacy statement, is only a privacy statement. Cromite gets it's updates literally from it's repo releases section. You don't agree with that, you don't get to update the app, unless you manually go https://github.com/uazo/cromite/releases and download/install it, you're doing the same damn thing.
Same thing with ABP filter updates. You're just being paranoid over for just stating the privacy statement.

[HarriBuh]

Lol why do you even bother this troll 🤣 Don't feed him.

[VA1DER]

You are literally using Github account with username @VA1DER,

So that makes it ok? If a person ever uses Google on any platform then that must mean it's ok for every app that person uses to log its use with Google? Sure I use Github sometimes. And my username is even my ham radio callsign, so it's drop dead simple to find me IRL. When I make contributions and comments here, I'm aware that it's all linked to Microsoft and that's my choice to make at the time. It's a large reason why I use Codeberg for my own projects and limit my footprint here. But my occasional use of Github doesn't mean I want Microsoft knowing my phone provider, location, and times I use my phone browser.

And yes, I do have an always-on VPN, right to my OpenWRT router.

You don't agree with that, you don't get to update the app

It's not just the app updates which are the problem now, is it? If it were, I could just turn them off from my phone, and I would be fine. It's the adblock filters which auto-update and which I can't turn off. That is very troubling. My choice to contribute here at odd times is a far cry from what purports to be a privacy-enhanced browser on my phone that is making the choice for me to to log my IP with Microsoft every time I use it.

Why rip out things like Safe Browsing from Bromite/Cromite? Because it automatically gives your IP to Google and is invasive. So why turn around and hand it to Microsoft? And why the fuck make it so the user can't turn that off?

[foxjaw]

It's the adblock filters which auto-update and which I can't turn off.

@VA1DER You can turn off ABP itself & filters won't update mate.

Codeberg for my own projects and limit my footprint here.

Remember that you aren't reducing your privacy risk. You're just putting your eggs in different baskets. Chances are not just GitHub, even Codeberg owns the data you store in their servers. The only way to reduce your privacy footprint is to self host everything on your home server.

from what purports to be a privacy-enhanced browser on my phone

There's no such thing as privacy enhanced browser. There's only privacy conscious browsing.

[mrx23dot]

Chrome is cancer, why not improve the Firefox app instead?

[HarriBuh]

Chrome is GOLD, if you trusted the right devs working on it 🙄

BTW: I pity these thousands of ppl still endorsing this dead app daily. Most likely many s.c. security interested sites on the www still recommend Bromite.

[MillionsToOne]

Chrome is cancer, why not improve the Firefox app instead?

Firefox on mobile is shit. Althrough it's the only browser among it's forks and kiwi browser that supports extension, it's just shit in every other way.

[asiapax]

Cromite supports ARM, I think it will never support 32 bit as new devices are 64 bit and from Android 14, you can't even run 32 bit apps