The "Brave" Browser Created by Firefox Web Browser Creator Brendan Eich

[Paul]

Posted by Bob (here)
Can anyone explain how security is guaranteed within the code? How JavaScript IS NOT going to be used? Anywhere with the code?

The Javascript train has left the station, Bob. Javascript isn't perfect, as Brendan Eich could explain to you in more detail than anyone. But it will be with us for a long time. You might have to go back to one of the venerable text browsers, such as links, lynx, elinks, netrik, w3m, or links2, if you want to avoid Javascript. Not many will be doing that.

As for security ... there are no guarantees. Even the first C program I learned to write, "main(){write(1, "Hello\n", 6);}", back in the days when we got new versions of Unix on 9 track tapes, directly from Ken Thomson, had security holes, as Ken explained here.

What matters is open code and open discussion and adopting, consistently and over time, as best as practical, an open architecture that allows others to understand what's going on.

Nor is privacy from all servers on the Web very practical for many uses. Some form of micropayment or information harvesting is what pays the bills for many important web content providers. Rather I seek a "division of powers", so that we users can control who knows what, can keep anyone party from "knowing too much", and keep any one party from becoming "too indispensable" (hello, Microsoft; hello Google; ... <grin>).

For example, I would welcome the opportunity for members and guests of Project Avalon, if they so choose, to send us along a few shekels. Such an additional income stream, however modest, would be most helpful to Bill's shoe string budget.

[Bob]

You understand then my concern about security. Being stuck with something may be the case, but if something better can come along I am ALL FOR IT. I just REALLY want to know it is better, and that there aren't ooops or gotcha's within it. Open source certainly looks logical, but so was ANDROID and take a look at that StageFright bug - all in open source, and totally missed..

Open source is no guarantee. It is a start, but it has to be PEER REVIEWED.

OPEN SOURCE STAGEFRIGHT - summary - http://www.whitesourcesoftware.com/w...vulnerability/

[Paul]

Posted by Bob (here)
Open source is no guarantee.

There are no guarantees .

[Bob]

Posted by Paul (here)

Posted by Bob (here)
Open source is no guarantee.

There are no guarantees .

I like this analogy Paul, one jumps out of plane, with a main parachute and a backup. One TRUSTS technology, one's skill (and sanity ) by taking an action which definitely can affect one's future, safety, life.. One does what one can to "GUARANTEE" that they will come out without any damage. If one is smart, but who says jumping out of a plane is smart ;p the analogy though to some people is that a BROWSER is their connect to their banks, their business, work, play, in short even security for their home may be accessed by their smartphone, or laptop, or smartpad..

They need reasonable assurances that the technology that they trust with their lives, family and future is as guaranteed safe as possible. Maybe the internet to some is a hobby that they couldn't care less if they get Ads advertising something, they do care if they got compromised like having a mp4 file in their machine that their open source operating system's security holes gave the hacker access to their privates. If there were no privates we'd be in some utopia, but that isn't here.

Security is needed, with enough EYES reviewing the security, the features, and so OPEN SOURCE provides that opportunity to gain exposure and gain more checking - BUT that which is in BETA with bugs should be noted clearly and up front. Users need to know they are "testers" and not expecting a checked working product where security is addressed and that they know they can feel safe.

It's common sense in my mind. We need the security and moving in ways that maximize that in the era of what Snowden pointed out seems to me to be tantamount. When I found what really concerned me I didn't just sit there, I presented my findings. But I was not expecting to be betatesting.

No Guarantees? Well, I get what you are saying, but one expects when jumping out of an airplane to make it to the ground safely. I view what access the internet, exposes one to the 'world' out there has to be the best it can be. I want folks to be safe, feel safe, know that they are safe. How to guarantee that? I wait to hear how that can happen.

[Paul]

Posted by Bob (here)
I wait to hear how that can happen.

That's a key reason that I'm glad a couple of developers in Brave have joined Avalon.

I look forward to continuing this discussion of Brave a bit better informed, thanks to their contributions.

[Bob]

Posted by Paul (here)

Posted by Bob (here)
I wait to hear how that can happen.

That's a key reason that I'm glad a couple of developers in Brave have joined Avalon.

I look forward to continuing this discussion of Brave a bit better informed, thanks to their contributions.

Absolutely my friend - this is the best thing we could have happen, short of maybe Brendan Eich joining !! (hint hint hint)..

[BraveClifton]

Hi there folks! and thanks Bob for the great intro

I signed up after seeing this thread and wanted to make myself available to understand some of the concerns and also to answer any questions regarding Brave (ask me anything!)

I'm a relatively new employee (two months in, my first day was August 1st) but I was a contributor in my free time before joining, starting back in April. I love the web, programming, and open source projects.

Brave caught my attention for a lot of reasons... but mainly for two:

• The focus that Brave puts on the end user, the person being Brave. They're the ones standing up to advertisers that not only clutter websites with obtrusive ads, but serve up ads containing malware
• Brave seeks to bring something new to the table. They offer a compromise which is amazing for both end users and content providers... versus the traditional model which is great for the advertiser and "ok" for the content provider.

GitHub

As Daozen had mentioned earlier, the source code is available on GitHub. For those not familiar with GitHub, it's a platform for sharing program source code which also gives the community a way to interact with the project and its developers.

Your interaction might be:

• downloading the installer
• sharing a bug or problem
• talking with other users about the project
• asking for a new feature
• getting the source code, so you can review it
• contributing code and/or bug fixes

Our project's GitHub page is available here:
https://github.com/brave/browser-laptop

(there are also iOS and Android versions, which live elsewhere)

Quick overview of the GitHub page:

• The code tab is the default one, which lets you browse the source code
• The issues tab is where you can report bugs or problems (or search for already existing problems, if you want to add your details in)
• The wiki tab contains documentation, known issues, and work-arounds

Brave leverages several other existing open source projects
two important ones being:

Electron - https://github.com/electron/electron - an application framework that leverages some of the Chrome libraries to allow you to create your UI in HTML with CSS and JavaScript. This is mostly written in C++ with some JavaScript
Squirrel (on Windows) - https://github.com/Squirrel/Squirrel.Windows - used for installing and updating. This is written in a mix of C++ and C# (.NET)

Some of the issues mentioned here can be traced to either the project itself or how we integrated with the project. Jonathan captured some great details in a document which you can see here:
https://gist.github.com/jonathansamp...f7f2c417475818

Some of the ones I wanted to talk to:

• I know for sure that the Squirrel installer has a bug where the uninstall doesn't occur properly and the folder which contained the binaries has DENY permissions set (so you can't move it to the trash). Unfortunately, Bob hit this bug and had to retake ownership of the files so that he can delete them. It should NOT be creating an account (if you have details about that, please let me know- details can be shared privately in a PM ).
  
• The Squirrel installer doesn't clean up all the files when you are successfully able to uninstall. Jonathan captured more details in the above doc (including how to clean them up)
  
• Electron has a built in crash reporter that we make use of. Jonathan's link above describes this in more detail and also has a link to the code itself. No personally identifying information should be sent- I'd like to learn more about this. I captured an issue on GitHub asking for a way to opt-out of crash reporting. You can track that (and leave comments) here: https://github.com/brave/browser-laptop/issues/4479

Sorry for the large first post and if you got this far, thanks for reading

Brian

[Paul]

Posted by BraveClifton (here)
I know for sure that the Squirrel installer has a bug where the uninstall doesn't occur properly and the folder which contained the binaries has DENY permissions set (so you can't move it to the trash).

That would explain why I saw none of the problems that Bob reported, when I installed Brave on Linux.

The Linux installation appeared normal and reasonable, in every way, and I have more tools and experience than most, to notice any problems or anomalies in such things.

Thanks for the update ... we welcome your input.

[Paul]

A couple of questions that I have regarding Brave, that perhaps you, BraveClifton, or Jonathan Sampson, can comment on.

A critical feature for me, in my main browser, is Lastpass or Keepass (KeepassX on Linux). I recall seeing an open bug on Brave, that it wasn't supporting the auto-typing of passwords by KeePass, and I noticed (but have not reported yet) a problem with Lastpass entering passwords as well. With Lastpass, I'd see it apparently type in the actual password, and then, as quick as the eye could see, overwrite that field with a single '*' character (I can assure you that none of my passwords just one character long.) I had to copy and paste the correct password into the password field myself, to login successfully.

Are these known or unsurprising or already fixed problems with Brave?

===

On a semi-related issue, is there a general purpose API for browser extensions (Add-Ons) planned for Brave, that will become visible, in the not too distant future? I have some 20 extensions in my main browser, Firefox, and would miss most of them, if some such were not possible.

[Bob]

Posted by Paul (here)

Posted by BraveClifton (here)
I know for sure that the Squirrel installer has a bug where the uninstall doesn't occur properly and the folder which contained the binaries has DENY permissions set (so you can't move it to the trash).

That would explain why I saw none of the problems that Bob reported, when I installed Brave on Linux.

The Linux installation appeared normal and reasonable, in every way, and I have more tools and experience than most, to notice any problems or anomalies in such things.

Thanks for the update ... we welcome your input.

I didn't try it on Linux, just two versions of Windows (7 and 10). The assumption then is the Squirrel Installer had the issues.. My guess is existing MS reporting libraries were used and called, and those MS libraries were quite happy to use a generic procedure to create a report which would have gone to MS (originally as they were written for MS) what all was running (but in this case was redirected to the Brave server (but blocked from going out). What all was running on my system were private. But MS has a habit of taking everything similar to a screen shot of one's desktop (but in this case taking file names, folders) and sending all that (like a stack trace maybe). I have had that problem happen with another developer who used parts of the MS libraries, and they also showed me a dump they received (before I had turned on the blocker) the contents which included machine name, folders, programs running.

I'll have to install and then uninstall Brian and I am hesitant on this particular machine to go through that exercise again. I can setup an experimental Win 7 machine to go through such step by step. I deleted a lot but only left up the xxxx.tmp.node and .pf files for my review/analysis. The .pf files also contain privates. I'll get you a snippet (Brian) of those in a PM where the exe pf's contain what looked very potentially compromising.

[BraveClifton]

Posted by Paul (here)
A couple of questions that I have regarding Brave, that perhaps you, BraveClifton, or Jonathan Sampson, can comment on.

...

Are these known or unsurprising or already fixed problems with Brave?

===

On a semi-related issue, is there a general purpose API for browser extensions (Add-Ons) planned for Brave, that will become visible, in the not too distant future? I have some 20 extensions in my main browser, Firefox, and would miss most of them, if some such were not possible.

LastPass integration *should* be working correctly right now- I know that we have a few issues reported at the moment, which you can be found here:
https://github.com/brave/browser-lap...ger%20lastpass

...however, I didn't see the issue you described (if you're still encountering this with the latest release, I'd be more than happy to open an issue on your behalf )

I occasionally use KeePass but I believe the auto-typing isn't supported. Here's a link to the specific issue we have if you wanted to track it, give it a +1, or leave a comment (I'd love to see someone add this)

Regarding extensions, we just shipped our first major release which has extension support. It's not ready for public extensions yet (we're still in a process of making sure all the required APIs are available, Jonathan has more info on that), but the 1Password and Dashlane password managers are now being loaded as an external extension (and should be update-able). Lots more coming soon for sure

[BraveClifton]

Posted by Bob (here)

Posted by Paul (here)

Posted by BraveClifton (here)
I know for sure that the Squirrel installer has a bug where the uninstall doesn't occur properly and the folder which contained the binaries has DENY permissions set (so you can't move it to the trash).

That would explain why I saw none of the problems that Bob reported, when I installed Brave on Linux.

The Linux installation appeared normal and reasonable, in every way, and I have more tools and experience than most, to notice any problems or anomalies in such things.

Thanks for the update ... we welcome your input.

I didn't try it on Linux, just two versions of Windows (7 and 10). The assumption then is the Squirrel Installer had the issues.. My guess is existing MS reporting libraries were used and called, and those MS libraries were quite happy to use a generic procedure to create a report which would have gone to MS (originally as they were written for MS) what all was running (but in this case was redirected to the Brave server (but blocked from going out). What all was running on my system were private. But MS has a habit of taking everything similar to a screen shot of one's desktop (but in this case taking file names, folders) and sending all that (like a stack trace maybe). I have had that problem happen with another developer who used parts of the MS libraries, and they also showed me a dump they received (before I had turned on the blocker) the contents which included machine name, folders, programs running.

I'll have to install and then uninstall Brian and I am hesitant on this particular machine to go through that exercise again. I can setup an experimental Win 7 machine to go through such step by step. I deleted a lot but only left up the xxxx.tmp.node and .pf files for my review/analysis. The .pf files also contain privates. I'll get you a snippet (Brian) of those in a PM where the exe pf's contain what looked very potentially compromising.

Thanks, that would be great

I believe the Windows error reporting (more details in Jonathan's doc: https://gist.github.com/jonathansamp...f7f2c417475818) can be disabled entirely. You should be able to find it in control panel under "Security and Maintenance". This is a good concern and maybe we should document it. I am curious if Microsoft allows for apps to opt-out of the crash reporting mechanism? By default, any app that crashes will trigger this process (if enabled, which it is by default)

[Paul]

Posted by BraveClifton (here)
I occasionally use KeePass but I believe the auto-typing isn't supported. Here's a link to the specific issue we have if you wanted to track it, give it a +1, or leave a comment (I'd love to see someone add this)

This issue: https://github.com/brave/browser-laptop/issues/1313 ?

[Bob]

What is curious Brian, is no crash window appeared, nada.. it was invisible that there was a crash there, I was using Brave Browser testing it out and saw my machine tell me an unauthorized send was being attempted. Closing the browser I then looked for what was being sent, saw it and my jaw dropped, then got into the logs what all it was doing.. The logs revealed a lot stepwise what failed and what didn't.. but the point is no error was shown to the user, no crash noted.. I would not have known about the failure or the send if the machine wasn't monitoring for illegal unauthorized activity.

Windows ERROR reporting WOULD have shown that an error happened - it did not.. What that said to me was spyware behavior was noted. No crash popup appeared, and after the fact found out a file with privates was tried to be sent to a server not authorized by me as 'safe'..

--update-- thought I would put a note here for the lay person, non-technical. A referral to "illegal activity" as a generic term used in programming to denote when the program performs something with is/has not been authorized (either by the system, a security program, the operator or a combination of both), an operation was performed in an illegal way (not a legitimate way as expected by the operating system), a call to memory which does not exist (illegal call) and so forth.. Such activity could result in loss of data, routines (sub-programs) being left in unknown states, general failure of the computer especially if it was writing to the hard drive (dreaded file corruption).. Getting an illegal operation warning is not something to take lightly.. So that is the reference to 'illegal activity' was being attempted.. (Different than violating constitution, law of the land, etc.)

reference: https://support.microsoft.com/en-us/kb/320227 - "Illegal Action" - "This program has performed an illegal operation ..."

http://www.computerhope.com/issues/ch000138.htm - how to fix illegal action/operation

When the operating system or computer processor receives an instruction from a program that it does not recognize and cannot process, it may issue a command known as an Illegal Operation.

Being aware of Viruses, my first thought was this and I made it quite clear I was very worried about wondering what was going on:

Computer virus

Because computer viruses and other malware load into memory and can improperly modify files they can cause Illegal Operation error messages.

Make sure an anti-virus protection utility is installed on the computer and that it is up-to-date.

First thing I did after reading the logs was to run AV, then malware checking, but I did not do a windows comparison for any changes, such as modified dates against the originals. (That is still on my list todo.)

[Dianamar]

Posted by Bob (here)

Posted by devplan (here)
I noticed something odd too: I usually use the Adblocker browser on my Android Smartphone and I wanted to give Brave a try and installed it. The next day I uninstalled it and when I used my Adblocker browser again, it reported at the cleanup option about some potential harmful elements which I had it clean up.
I am not fully sure, if that was caused by Brave.
Has anyone experienced the same issue?

I tried it on Win 10 which was the worst and most difficult to cleanup, uninstall (one can review another user reporting on win10 uninstall of 'brave browser' HERE, and on a Windows 7 OS. Of course the leading name browsers have adware reporting and cookie checking for referrals. Chrome has a very good blocker called Ghostery if you want to add that. (Interesting watching for instance PA popup GoogleTranslate (when using chrome) and DoubleClick on some pages too)

I personallywouldn't try it on the smartphones, what I have seen with smartphones is there is just not enough ability to get into the hidden folders within the Smartphones (maybe developers can do that, but a normal user can't). At least Brave's uploader wanted secure 443 to it's report gathering website when it was trying to send private information about my computer, its running programs to their repository (based on the IP and links found within the log files and script files). I suppose so nobody else would get them. Probably just for "statistical" purposes to debug why their program wouldn't run. Didn't NSA say something like that, we are just gathering statistical data, not actually looking/listening.. just really annoyed I wasn't asked if I wanted private data sent to some site without my permission.

Some one doing a blow by blow analysis (Peer Review, it is OPEN SOURCE RIGHT?), including how billing is accomplished, how one's passwords, wallet, programs one is running, bank account numbers/ID's, in general, maybe looking into the security section code (not just saying it's secure on port 443) for transferring funds to Brave.. how all that is guaranteed that your machine will never be snooped on by them or their associates, would be a great exercise. I don't have the month to get into that much code to do a security check..

References: - how NSA data is worked with - "how your data becomes 'our' data" https://nsa.gov1.info/surveillance/ - if you haven't seen this webpage, it may be a great read.. when one see's what may be holes in a "brower's" way of doing things, just maybe one may need to take a closer look.. I did when this didn't uninstall properly.. Glad I did.

Hi Bob , you know there's more than one way to skin a cat


https://brave.com/assets/jobs/Brave_...er_Android.pdf

[Paul]

Posted by Daozen (here)
Browser funding is revolutionary, and could develop into a multi-billion dollar industry within 2-15 years. It solves some major problems associated with fairly monetizing content. Brave would need to accept Paypal directly for it to really work. Right now going through Coinbase will cut out some casual, impatient users, like me. But maybe Brave want to move the net economy away from Paypal onto Bitcoin. I can see that.

Aha - Coinbase announced in June of 2016 that you can purchase bitcoins using PayPal or Credit Card: https://blog.coinbase.com/2016/06/22...-credit-cards/

I've not tried it ... but perhaps all the critical pieces are in place to handle this.

[Hughe]

@Bob

If you seriously concern about security, hardened Linux without systemd or FreeBSD are the best alternatives.

FOSS gives full responsibility to end user. It's defined in the license term to ensure developers' reliability.
Inception of systemd in Linux is a fine example how corporations try to take over FOSS. Most Linux users hardly aware about it or simply don't give a ****.
Ubuntu was the first distribution that accepted systemd as service management instead Init. Nowadays all big Linux distrubitions force systemd-ed Linux to end users including Debian. Core developers of systemd are under the paycheck of major corporations. I run Devuan Linux in workstation, laptop, and raspberry pi 2.

Secruity implementation at personal level I can think of:
- Run FOSS operating system
- Encrypt every e-mail transaction
- Open Source web browser that doesn't have back door routine
- Fake MAC address that hides real network interface
- Dynamic IP address thats hide true location of the user through Tor
- Use paid Virtual Private Network server (Can we trust the VPN server company?)
- Run a Open Source router

My web browser history:
Firefox (many years) -> Chrome (two years?) -> Firefox (few weeks) -> Pale Moon (months)

[Bob]

Hughe thanks - I do run Linux, Ubuntu, various Apple OS's, just that for certain programs that I have and find my self using more so than browsing, they were never ported to any of those alternatives, thereby keeping me tied to windows. Doing a reboot to switch over to other OS's tends to be prohibitive time wise having to switch back and forth continually. Appreciate the thought

(running under emulation has been tried and in many cases the drivers are just not there and I just don't want to try to learn that level of coding. The programs that I use have specially designed machine code modules (non-standard) which were setup to use windows hooks, and windows I am more familiar with than I am the other OS's as far as using calls to their libraries for instance. Maybe someday

[Paul]

Posted by Hughe (here)
If you seriously concern about security, hardened Linux without systemd or FreeBSD are the best alternatives.

I'll second that suggestion .

Systemd is an abomination ... might as well bring Windows to Linux.

(Speaking of which ... Windows itself is probably a greater problem than any of the afore mentioned browsers ever thought of being <grin>.)

[Daozen]

Posted by Paul (here)

Posted by Daozen (here)
Browser funding is revolutionary, and could develop into a multi-billion dollar industry within 2-15 years. It solves some major problems associated with fairly monetizing content. Brave would need to accept Paypal directly for it to really work. Right now going through Coinbase will cut out some casual, impatient users, like me. But maybe Brave want to move the net economy away from Paypal onto Bitcoin. I can see that.

Aha - Coinbase announced in June of 2016 that you can purchase bitcoins using PayPal or Credit Card: https://blog.coinbase.com/2016/06/22...-credit-cards/

I've not tried it ... but perhaps all the critical pieces are in place to handle this.

Yes, the pieces are there, but Paypal to Bitcoin is non-trivial from a legal and technical standpoint. Paypal don't officially let users buy BTC directly (last I checked) because users can just claim they were scammed and get a refund. Merchants worked around this with intermediate currencies, but some of them took a huge cut as you went from Paypal, to Linden Dollars, and then to BTC. I tried it with 15USD, I lost 30 percent. That was no good. So add mistrust of BTC to clunky User Interfaces, and you have a mess.

Circle and Coinbase are making it easier and easier to go from Paypal and Credit CArds to BTC. Whoever wins in this market will help funnel the 60 billion dollar per year Paypal economy into Bitcoin, so the race is on. It's all about guiding the user through the process and saving them mouseclicks. Most merchants have sub-optimal UIs, and don't implement feedback.