@mmobder
I've had enough experience with most of these browsers to know myself. (both in regards to Chromium based and Firefox/Gecko based) that is why I recommended it cause most of these claims I have already self verified. I did not once take this persons word for it. Ideally people shouldn't take their word for it especially since most of the information is actually pretty easily verifiable simply by examining the browser and using some basic logic.
Although that doesn't mean I particularly agree with every point. I disagree with the fact of Cromite and Brave allowing for MV2 extensions being problematic
Cause while yes MV2 extensions are a security nightmare and MV3 should absolutely be preferred the User should still have the choice to use said extensions if they wish. This is not regressing security until the user chooses to do so and I don't think this change was implemented as a disregard for security but rather a regard for the fact the user should have choice.
However having said that the purpose of the documentation is focused on browser security over everything else so at the same time I cannot entirely say it's invalid in pointing that out either. Cause again this is about security.
And in regards to Cromite I am not sure how I feel about bringing up that whole JPEG XL situation. Cause yes it was implemented but then reverted due to the acknowledgement that it was more problematic than beneficial.
Me personally I wouldn't hold that specific part against Cromite or it's dev but at the same time I can see why others would.
Either way the fact it actively regresses security by refusing to fix CFI and introducing a very terrible content blocker that is memory unsafe i do find very problematic.
And their content blocker has the exact same issues of Brave's such as constantly downloading updates from sources. To Cromite and Brave's credit they did make this lower risk by having all the default lists come from their own servers so the lists are technically coming from a trusted source. But it still doesn't change the fact it is still a regression in security as it would be better if there were no remotely downloaded lists.
Vanadium's way is far superior even if it has less functionality currently as it still gives you efficient and effective blocking while introducing very little to no security risk as it just uses the content filtering engine already present in Chromium so therefore basically little to no extra attack surface is added.
I would actually have a lot less of an issue with Cromite if it would just get rid of that highly questionable adblocker and implemented a solution similar to this instead. But they aren't going to do that.
And yes I am aware the dev does a lot of patching to it beforehand but that still doesn't change a lot of the general problems with it particularly it being memory unsafe. Futhermore the fact it is optional doesn't really matter as it is still the default behaviour. It would be more okay if it was something the user had to opt into rather than opt out of. It's one thing not to have security improving configurations turned off by default, it is entirely another thing when you have security regressing features and configurations turned on by default.
Brave has similar issues of extra attack surface but they are a lot more careful about how and what they implement. Brave is not a good option but is certainly better than Cromite.
And as for the rest of the browsers covered in it.
And Opera also has a similarly problematic adblocker.
And the documentation forgets to mention Opera also does enable MV2 aswell.
Vanilla Chromium I'm not going to go over as the simple answer is it varies.
Ungoogled Chromium is a similar case to Vanilla Chromium but also has similar issues to Cromite just minus the horrendous built in adblocker and other things.
Webview Browsers are also a pretty terrible option due to the inherent limitations of the Webview.
Flatpak packaging breaks/cripples all Chromium and Firefox browser sandboxes. This is easily and trivially avoidable by just not using Flatpak packaging for your browser and using the actual compatible packaging provided by the devs for your distribution instead.
I'm not going to go over Firefox or any of it's forks cause well. It's been covered so many times and has constantly shown little to no improvement so my input here would not add much to what is already widely known.
- Epiphany never used or tested I wouldn't know.
In summary one problem that I noticed with the documentation after saying this is lacking complete information in some browser descriptions.
I'm not going to provide any links cause in reality that wouldn't really do much of anything? I mean that's just shifting from one source to another. If you really want to verify this you are going to have to do it yourself. Which you are free to do as matter of fact I would prefer if you didn't take my word for it as taking someone's. Anyone's. Word for something is not much different from saying "just trust me" when in reality I'm just someone online.
Furthermore how many of my claims here even have legitimate official sources? Most of these Browsers are Operated by for Profit companies and as such it is in their best interest to lie to their users about their security. Which most do in fact do in their own official documentation whilst simultaneously providing no effective way to backup what they say. The only effective way to verify anything is to test.
Regardless however the documentation does have good coverage on actually good and secure browsers and is still easily recommendable compared to most other guides with recommendations as most other guides often times yield actual misinformation.
Furthermore I would argue you calling Trivalent and Vanadium competitors is actual misinformation. Literally neither one seeks to actually compete with eachother and Trivialent literally admits that a significant amount of it's hardening are patches borrowed directly from Vanadium. Nothing about what they do fits the definition of a competitor at all.
And furthermore this wouldn't be the first time a browser maintainer has devised their own comparison table. The DivestOS developer did the same when they were around and only ever recommended Mull(which was their own browser) and Tor due to being mainly focused on Firefox based browsers.
Though they did not deny that Chromium Browsers did have massive security benefits and also maintained their own Chromium Browser called mulch. Which just like Trivalent also used a substantial amount of Vanadium's hardening. Yet despite all of this no one ever called them a "competitor"
But anyways I have spent way too much time writing this.
Point being you are free to disagree with people here you are free to disagree with the person who made the documentation but PLEASE do not go making accusations that someone is spreading misinformation or being misleading when you literally do not have any sort of substantial evidence to back it up. Just cause the person has a large hand in Trivalent means literally nothing. The info the documentation left out about Cromite is minimal and doesn't take away from it's biggest problems. If you really think that these things are worth mentioning then open a issue on github and kindly explain why they should be included.
I have reread the documentation over and over again this past hour probably like 5 times and could find no misinformation. Nor any misleading things about it. Yet you have been attacking this person on this Forum (and possibly on github)
Note that this portion is a response to all of your posts and not just what you asked me.
Oh and by the way.
mmobder Literally removed threads and comments = banned conversations, no need to be ashamed
That is because these people were constantly spreading misinformation about these projects you can still find plenty of talks where they are still around on the forum.
You won't get banned for simply discussing it but depending on what you say might get your post or thread removed yes. Cause that has been a genuine problem on this Forum in the past where people were blindly recommending things like Cromite and in some cases straight up ignoring it's security drawbacks which downplaying security is a big no no here.