🪦The Dying Web | Matthias Endler

｢ the world's largest websites are owned by the same company, which also owns the world's most popular browser and search engine. Coincidentally, they are also the world's largest advertising company. And people are wondering why they can't block ads on YouTube anymore ｣

endler.dev/2024/the-dying-web/
#google #monopoly #firefox #chromium

The Dying Web | Matthias Endler

I look left and right, and I'm the only one who…

^endler.dev

In the wake of a certain ad-funded browser company bundling adtech into its browser yet again, some people have been recommending Ungoogled-Chromium (UGC). I think it’s fine to recommend UGC with caveats, such as the fact that it disables component updates that include:

• Certificate revocation. Chromium uses downloaded CRLSets for revocation; it does not support OCSP.
• Out of band security patches. When browser components have exploits in the wild, they need to be patched ASAP; updating billions of installations within time-frames measured in hours often means restartless out-of-band updates.
• Out of band certificate bundle updates.

If you assume Google uses its component update server logs maliciously, you may wish to consider a fork that still offers component updates provided by a different party’s servers.

UGC disabled mDNS at one point. This exposed local IP addresses over WebRTC for years, but they seem to have shipped a fix in May 2023 to disable non-proxied UDP.

UGC also disables the Chrome Web Store in favor of installing extensions out of band. Make sure you regularly update your extensions installed out-of-band, since UGC won’t do it on its own. Some scripts and a special extension re-implement some of this functionality.

Overall, UGC is still safer than QtWebEngine despite making heavy compromises to security for privacy (though I can’t see how either benefited from disabling mDNS: I’m not aware of threat models under which revealing a local IP to every application is preferable to revealing it to just Google). Running UGC is fine if you understand these trade-offs and have accounted for them. I use it in headless mode to run accessibility and performance tests.

Originally posted on seirdy.one: See Original (POSSE). #Chromium #Chrome

Seirdy’s Home

My personal IndieWeb site. I write about and develop software to promote user autonomy. Topics include accessibility, security, privacy, and software freedom.

^{Seirdy’s Home}

My #FOSDEM presentation about #Wayland video offloading is online. If you are interested, you can watch it here: fosdem.org/2024/schedule/event…

I'm happy about feedback, both on the technical side as well as how I can improve doing presentations :)

#FOSDEM2024 #GNOME #gtk #Collabora #GStreamer #sway #kde #Chromium #mpv

I'll also be at #fosdem and do a short talk about #Wayland video offloading related stuff I've been posting about, featuring #gtk4, #gstreamer, #Chromium #gnomeshell and #weston

fosdem.org/2024/schedule/event…

See you there!

#Collabora #fosdem2024 #gnome #gnomeonrails

FOSDEM 2024 - The state of video offloading on the Linux Desktop

^fosdem.org

Update regarding #wayland zero-copy video playback (using hardware planes): with a few small patches it works with #Chromium, both with #vaapi (Intel/AMD) and #v4l2 stateless.

Here a short video using a #rk3399 - the #PINE64 #PinebookPro - playing a 4k 60fps video - only possible with hardware plane offloading. Playback is *almost* smooth already (~50fps), the goal is to catch up with #GStreamer where we get stable 60.

I hope this will all get upstreamed in the coming months.

Earlier this year we got into a surprising and somewhat annoying struggle with Web browser sandboxing failures related to our "web apps shared in a chat" feature. After much background work we released the hardened Delta Chat 1.36 series, also addressing a dedicated fourth independent security audit, and can finally share more of what was going on behind the scenes delta.chat/en/2023-05-22-webxd…

#chromium #deltachat #security #webxdc

Delta Chat: Bringing E2E privacy to the Web: 4th security audit 😅

Delta Chat’s “web apps shared in a chat” come with a unique privacy promise but in January it was shown to be compromised. We got into a surprising struggle with Web browser sandboxing issues that ...

^delta.chat

#Chromium landed support for fractional scaling on #Wayland a couple of days ago. It was reverted again today. Reason for revert: This change completely broke Chromium Ozone/Wayland on compositors that support fractional-scale-v1.

Nobody had ever tested it and the authors missed the whole actual scaling part with wp_viewporter.

Anyhow, here's a working initial patch for #Firefox:
bugzilla.mozilla.org/show_bug.…

⚠️ Avoid #Chromium-based browsers: Websites can detect what addons are installed by fetching their web-accessible resources. Try yourself: z0ccc.github.io/extension-fing…

This is yet another possible way of #tracking users all across the internet. However, there's a simple solution: Just use #Firefox.

Since the IDs of Firefox extensions are unique for every user, it is not possible to know or guess the addresses of their web-accessible resources.

Extension Fingerprints

Check how trackable you are based on your browser extensions.

^{z0ccc.github.io}

💡 New quick post about how I set up Ungoogled Chromium for web dev testing purposes.

minutestomidnight.co.uk/blog/u…

#chromium #degoogle #webdev

Ungoogled Chromium – Minutes to Midnight Sound and Web Designer

A brief list of steps taken to install and properly configure Ungoogled Chromium for pure web development testing purposes on macOS.

^{Simone Silvestroni (Minutes to Midnight)}