search

PurpleI2P / i2pdbrowser

i2pd browser bundle
BSD 3-Clause "New" or "Revised" License
695 stars 79 forks source link

Switch to un-googled chromium #6

Closed majestrate closed 6 years ago

majestrate commented 6 years ago

Tor browser only used firefox because it was easier to hack on when they started, perhaps it may be worth the effort to use something like https://github.com/Eloston/ungoogled-chromium

ghost commented 6 years ago

Great! Chromium supports some great new-features like Webp format. Especially good for slow networks, including i2p :)

r4sas commented 6 years ago

As I know, chrome uses system proxy settings... @transifex3 i hope you heard about bpg? :D

majestrate commented 6 years ago

you can specify proxy settings via a runtime flag:

--proxy-server=127.0.0.1:4444

the biggest issue IMO is disabling stuff like web rtc

On Tue, Oct 31, 2017 at 12:26:48AM -0700, R4SAS wrote:

As I know, chrome uses system proxy settings...

— You are receiving this because you authored the thread. Reply to this email directly, [1]view it on GitHub, or [2]mute the thread.

Reverse link: [3]unknown

References

Visible links

  1. https://github.com/PurpleI2P/i2pdbrowser/issues/6#issuecomment-340681638
  2. https://github.com/notifications/unsubscribe-auth/AAefxeBkLgKlLLofZo6V_qu_w879_OAxks5sxsu4gaJpZM4P6jCc
  3. https://github.com/PurpleI2P/i2pdbrowser/issues/6#issuecomment-340681638
ghost commented 6 years ago

@r4sas Of course! but unfortunately, no browsers are supporting BPG currently :(((

@majestrate I think we should search some good alternatives for NoScript too.

r4sas commented 6 years ago

Run chromium with i2p proxy settings and user profile in data directory

chrome --proxy-server=http://127.0.0.1:4444 --user-data-dir="User Data" --crash-dumps-dir="User Data" --disable-bookmark-reordering --disable-boot-animation --disable-breakpad --disable-cloud-import --disable-component-cloud-policy --disable-component-update --disable-demo-mode --disable-default-apps --disable-dinosaur-easter-egg --disable-domain-reliability --disable-logging --disable-logging-redirect --disable-speech-api --disable-suggestions-ui --disable-sync --disable-system-timezone-automatic-detection --disable-tab-for-desktop-share --disable-wake-on-wifi --no-experiments --no-pings http://i2pd.i2p/

chromium

TODO

https://peter.sh/experiments/chromium-command-line-switches/

Need to check every switch.

futursolo commented 6 years ago

The overall stability should be more important than supporting a feature(e.g.: WebP Images).

I think main reason why Tor Project choose Firefox over Chromium is because Firefox has an ESR(Extended Support Release) version.

Tor project will audit the source code of the whole browser and patch any potential vulnerabilities that may disclose your identity. The lifetime of a Firefox ESR version is way more longer(more than 1 year) than normal Firefox or Chromium releases(4~6 weeks). It made the audit process much easier than normal releases which their source tree is being frequently updated with new features.

In addition, with the release of Firefox Quantum(57), Firefox has already become better than Chromium in terms of speed, usability and stability. It also has built-in tracking protection and is enabled by default in private browsing mode. And all of these awesomeness will become available to Firefox ESR with the release of Firefox ESR 59 in March 2018.

Overall, I don't see the point of switching to Chromium.

r4sas commented 6 years ago

I will not fully switch to chromium, only add one or two scripts to build bundle and start it. No more.

majestrate commented 6 years ago

Forking Tor Browser is a royal pain. We could do it but in general I have more faith in the chromium codebase than mozilla's when it comes to being secure.

On Sun, Nov 19, 2017 at 09:27:14PM +0000, Kaede Hoshikawa wrote:

The overall stability should be more important than supporting a feature(e.g.: WebP Images).

I think main reason why Tor Project choose Firefox over Chromium is because Firefox has an ESR(Extended Support Release) version.

Tor project will [1]audit the source code of the whole browser and patch any potential vulnerabilities that may disclose your identity. The lifetime of a Firefox ESR version is way more longer([2]more than 1 year) than normal Firefox or Chromium releases(4~6 weeks). It made the audit process much easier than normal releases which their source tree is being frequently updated with new features.

In addition, with the release of Firefox Quantum(57), Firefox has already become better than Chromium in terms of speed, usability and stability. It also has built-in tracking protection and is enabled by default in private browsing mode. And all of these awesomeness will become available to Firefox ESR with the release of Firefox ESR 59 in March 2018.

Overall, I don't see the point of switching to Chromium.

— You are receiving this because you were mentioned. Reply to this email directly, [3]view it on GitHub, or [4]mute the thread.

Reverse link: [5]unknown

References

Visible links

  1. https://gitweb.torproject.org/tor-browser-spec.git/tree/audits
  2. https://wiki.mozilla.org/RapidRelease/Calendar
  3. https://github.com/PurpleI2P/i2pdbrowser/issues/6#issuecomment-345551036
  4. https://github.com/notifications/unsubscribe-auth/AAefxSa3L2oCLbfbyKD2Xg_VIHaunH47ks5s4J0ygaJpZM4P6jCc
  5. https://github.com/PurpleI2P/i2pdbrowser/issues/6#issuecomment-345551036
futursolo commented 6 years ago

@majestrate I am not talking about code quality here. Being "secure" does not mean being incognito. And if you have concerns about code quality. Firefox has already started adopting Rust. The Rust compiler will not compile any code that is not "secure(memory safety)". This will definitely make the codebase of Firefox being more "secure" than Chromium in the long run.

To resist browser fingerprinting, you have to patch the browser. This involves a huge amount of work. Even Tor project struggle to do this. Do you think this project has the resources to audit and patch Chromium(The codebase of Chromium is probably as large as the Linux Kernel.)?

Also, you don't need to fork Tor browser. Mozilla will land all Tor patches to Firefox main trunk.

See: https://wiki.mozilla.org/Security/Tor_Uplift

majestrate commented 6 years ago

The fact that mozilla had to invent their own language because they sucked so hard at C++ is what I am concerned about.

That will reflect in firefox regardless of the language they use.

Fingerprinting protection is a never ending cat and mouse game that no one has time for, especially us.

On Fri, Dec 01, 2017 at 07:45:03PM +0000, Kaede Hoshikawa wrote:

[1]@majestrate I am not talking about code quality here. Being "secure" does not mean being incognito. And if you have concerns about code quality. Firefox has already started adopting Rust. The Rust compiler will not compile any code that is not "secure(memory safety)". This will definitely make the codebase of Firefox being more "secure" than Chromium in the long run.

To resist browser fingerprinting, you have to patch the browser. This involves a huge amount of work. Even Tor project struggle to do this. Do you think this project has the resources to audit and patch Chromium(The codebase of Chromium is probably as large as the Linux Kernel.)?

Also, you don't need to fork Tor browser. Mozilla will land all Tor patches to Firefox main trunk.

See: [2]https://wiki.mozilla.org/Security/Tor_Uplift

— You are receiving this because you were mentioned. Reply to this email directly, [3]view it on GitHub, or [4]mute the thread.

Reverse link: [5]unknown

References

Visible links

  1. https://github.com/majestrate
  2. https://wiki.mozilla.org/Security/Tor_Uplift
  3. https://github.com/PurpleI2P/i2pdbrowser/issues/6#issuecomment-348596172
  4. https://github.com/notifications/unsubscribe-auth/AAefxUlGXdsFEujF7D_wHzce760Fqm_Bks5s8Fc_gaJpZM4P6jCc
  5. https://github.com/PurpleI2P/i2pdbrowser/issues/6#issuecomment-348596172
futursolo commented 6 years ago

Are you trying to say that somebody develops a new language because they sucks at the existing ones?

Then Can I say that Google forked WebKit and OpenSSL because it's lazy and wants to take over Apple and OpenSSL Foundation's honour and all their hard work. After that, Google struggles/got board on C Programming Language on maintaining BoringSSL. So they decided to invent and use Go.

Fingerprinting Protection is an endless game and no one has time for it, so we should give up?

majestrate commented 6 years ago

In the context of i2pd browser I don't think fingerprinting is something we have time or resources for, at least at the moment and I have more faith in google's code than mozilla's any day given each's track record implementing a secure browser.

On Fri, Dec 01, 2017 at 12:34:23PM -0800, Kaede Hoshikawa wrote:

Are you trying to say that somebody develops a new language because they sucks at the existing ones?

Then Can I say that Google forked WebKit and OpenSSL because it's lazy and wants to take over Apple and OpenSSL Foundation's honour and all their hard work. After that, Google struggles/got board on C Programming Language on maintaining BoringSSL. So they decided to invent and use Go.

Fingerprinting Protection is an endless game and no one has time for it, so we should give up?

— You are receiving this because you were mentioned. Reply to this email directly, [1]view it on GitHub, or [2]mute the thread.

Reverse link: [3]unknown

References

Visible links

  1. https://github.com/PurpleI2P/i2pdbrowser/issues/6#issuecomment-348607559
  2. https://github.com/notifications/unsubscribe-auth/AAefxcNxGnqNfn7FkKQ3aLQE6k8LoyfHks5s8GLPgaJpZM4P6jCc
  3. https://github.com/PurpleI2P/i2pdbrowser/issues/6#issuecomment-348607559
futursolo commented 6 years ago

If nobody has time to patch Chromium, then it will not be suitable for this purpose(An I2P Browser).

Also, most people will not have the time to implement this, so Mozilla and Tor Project decided to take this job. You will have privacy.resistFingerprinting available in Firefox 59, the next ESR.

The amount of effort that Mozilla and Tor Project puts into protecting your privacy deserves respect.

In addition, if the actual case is like what you said "Chromium is more secure(code quality) than Firefox", then you will have to choose between:

  1. Use a browser that is less likely to crash, but the websites will be able to track(profiling) you easily.
  2. Use a browser that crashes more frequently, but it will be harder for the websites to track you.

For me, I will definitely choose the latter one.

See: https://wiki.mozilla.org/Security/Fingerprinting https://wiki.mozilla.org/Security/Tor_Uplift/Tracking

majestrate commented 6 years ago

"Fingerprinting" mitigating is currently an unobtainable goal even in tor browser. Current tor browser relies on the user not resizing the window to prevent "fingerprinting". if you're going to go that far just stop using the web IMO. Mitigating "Fingerprinting" in the w3c is a never ending game and a fundamentally flawed one at that. For our purposes we want to mitigate as much malicous attacks on the user, firefox has proven itself to be vastly inferior in that department. For our purposes firefox is a no go and since mitigating "Fingerprinting" is a waste of time for us we should go with google's browser with patches.

If you want protection from "Fingerprinting" stop using the web,

On Fri, Dec 01, 2017 at 01:52:01PM -0800, Kaede Hoshikawa wrote:

If nobody has time to patch Chromium, then it will not be suitable for this purpose(An I2P Browser).

Also, most people will not have the time to implement this, so Mozilla and Tor Project decided to take this job. You will have privacy.resistFingerprinting available in Firefox 59, the next ESR.

The amount of effort that Mozilla and Tor Project puts into protecting your privacy deserves respect.

In addition, if the actual case is like what you said "Chromium is more secure(code quality) than Firefox", then you will have to choose between:

 1. Use a browser that is less likely to crash, but the websites will be able to track(profiling) you easily.  2. Use a browser that crashes more frequently, but it will be harder for the websites to track you.

For me, I will definitely choose the latter one.

See: [1]https://wiki.mozilla.org/Security/Fingerprinting [2]https://wiki.mozilla.org/Security/Tor_Uplift/Tracking

— You are receiving this because you were mentioned. Reply to this email directly, [3]view it on GitHub, or [4]mute the thread.

Reverse link: [5]unknown

References

Visible links

  1. https://wiki.mozilla.org/Security/Fingerprinting
  2. https://wiki.mozilla.org/Security/Tor_Uplift/Tracking
  3. https://github.com/PurpleI2P/i2pdbrowser/issues/6#issuecomment-348623886
  4. https://github.com/notifications/unsubscribe-auth/AAefxUtfd3FUcqBiRmoP5IWoq2bzsA77ks5s8HUBgaJpZM4P6jCc
  5. https://github.com/PurpleI2P/i2pdbrowser/issues/6#issuecomment-348623886
futursolo commented 6 years ago

Most modern browsers(in this case both Firefox and Chrome) have their Web Content Processes sandboxed. In which case if an unknown vulnerability is being used to exploit the browser, it still have to be combined with sandbox escaping technology in order to make an effective attack.

For your point on that never ending game, there IS an ultimate solution. Everyone knows, but no one wants.

Disable JavaScript.

I will not argue with you if you are trying to turn this into a flaming war. Every adult should know how to talk with the others with respect. Go ahead and do what you want. And now I kind of understand why Monero left i2pd and started their own I2P implementation.

majestrate commented 6 years ago

There's No flamewar happening here, perhaps you are misinterpreting.

The fingerprinting problem I am personally sick of hearing about, there will always be a way to bypass it because the web was never designed to think about it. This is where an alternative would be able to thrive, but this is not that project and it's out of scope.

We are trying to provide a sane packaging of an insane protocol suite, a mighty task indeed.

On Fri, Dec 01, 2017 at 05:18:01PM -0800, Kaede Hoshikawa wrote:

Most modern browsers(in this case both Firefox and Chrome) have their Web Content Processes sandboxed. In which case if an unknown vulnerability is being used to exploit the browser, it still have to combine with sandbox escaping technology in order to make an effective attack.

For your point on that never ending game, there IS an ultimate solution. Everyone knows, but no one wants.

Disable JavaScript.

I will not argue with you if you are trying to turn this into a flaming war. Every adult should know how to talk with the others with respect. Go ahead and do what you want. And now I kind of understand why Monero left i2pd and started their own I2P implementation.

— You are receiving this because you were mentioned. Reply to this email directly, [1]view it on GitHub, or [2]mute the thread.

Reverse link: [3]unknown

References

Visible links

  1. https://github.com/PurpleI2P/i2pdbrowser/issues/6#issuecomment-348655746
  2. https://github.com/notifications/unsubscribe-auth/AAefxeF98RNVoCnUVzrJi3JoA72LZvOIks5s8KVJgaJpZM4P6jCc
  3. https://github.com/PurpleI2P/i2pdbrowser/issues/6#issuecomment-348655746
elypter commented 6 years ago

if you give up fingerprinting then you can give up anonymity in the first place. the ip is just one of a myriad of identifiers and it happens to be the one that is the most difficult to keep private so it only makes sense to tackle the ip if all other fingerprinting methods are already impossible.

majestrate commented 6 years ago

Anonymity isn't boolean. I don't think that it's possible to fully anonymize the web because of how irreducibly complex the web browsers are. This is probably a good reason to make a new protocol IMO.

On Sun, Dec 03, 2017 at 03:54:34AM -0800, elypter wrote:

if you give up fingerprinting then you can give up anonymity in the first place. the ip is just one of a myriad of identifiers and it happens to be the one that is the most difficult to keep private so it only makes sense to tackle the ip if all other fingerprinting methods are already impossible.

— You are receiving this because you were mentioned. Reply to this email directly, [1]view it on GitHub, or [2]mute the thread.

Reverse link: [3]unknown

References

Visible links

  1. https://github.com/PurpleI2P/i2pdbrowser/issues/6#issuecomment-348758889
  2. https://github.com/notifications/unsubscribe-auth/AAefxVSv4uCptGfoW9bM_lgQyjscv_L_ks5s8ov6gaJpZM4P6jCc
  3. https://github.com/PurpleI2P/i2pdbrowser/issues/6#issuecomment-348758889
elypter commented 6 years ago

the tor browser does a pretty decent job. if you could have the same for the i2p network many people would be happy. this is by no means an easy job but being a lot of work does not make things impossible. anonymity in browsers is not really complex, its just a huge number of switches. the browsers itself are quite complex but for the settings needed for anonymity you do not need to dive into any algorithms. this is not a job for a single person but its also far from impossible.

majestrate commented 6 years ago

The very nature of the web (w3c) is that it's an ever expanding standard that doesn't take privacy or "fingerprinting" into consideration. For this project I think it's out of scope initially to take into consideration the insanity that comes with protecting against "fingerprinting". Not explicitly out of scope for the future, I just don't trust mozilla's heaping pile of technical debt they have with firefox, it's so huge they felt compelled to invent an entirely new programing language to address it.

What is in scope:

Out of scope for now:

Probably out of scope forever:

This is just my opinion on the topic, feel free to ignore it.

On Sun, Dec 03, 2017 at 02:52:06PM +0000, elypter wrote:

the tor browser does a pretty decent job. if you could have the same for the i2p network many people would be happy. this is by no means an easy job but being a lot of work does not make things impossible. anonymity in browsers is not really complex, its just a huge number of switches. the browsers itself are quite complex but for the settings needed for anonymity you do not need to dive into any algorithms. this is not a job for a single person but its also far from impossible.

— You are receiving this because you were mentioned. Reply to this email directly, [1]view it on GitHub, or [2]mute the thread.

Reverse link: [3]unknown

References

Visible links

  1. https://github.com/PurpleI2P/i2pdbrowser/issues/6#issuecomment-348778405
  2. https://github.com/notifications/unsubscribe-auth/AAefxTxKF7qAMezFNpj_9mnIvKwn3LyXks5s8rWVgaJpZM4P6jCc
  3. https://github.com/PurpleI2P/i2pdbrowser/issues/6#issuecomment-348778405
ghost commented 6 years ago

@elypter @majestrate @futursolo I think we can deal fingerprinting issue with extensions as an easy solution. There are lots of available options, like Disconnect.Me or Privacy Badger, even any others. They are open sourced, so it would be easy to hack with them if there are missing features or unexpected something.

@futursolo Out of the subject but I love your website man 😄

futursolo commented 6 years ago

Some personal thoughts on this conflict:

Politeness and Respectfulness

Is it polite or even proper to ask somebody quit/give up something with contempt?

Is it polite or even proper to call something suck depending on one's subjective belief(i.e.:faith) when thousands of people spent thousands of hours on building it?

Belief and faith

How much does one's faith valued by the others?

Invention

Does someone invent something new just because it sucks at the old ones?

Purpose of this project

What problems is this project intended to solve? Or, in other words, is this a Tor browser equivalent for I2P?

The never ending topic

Is preventing "fingerprinting" a never ending topic?

Is being "secure" a never ending topic?

The "secure" browser

Is the "secure" browser really a sliver bullet in solving vulnerabilities?

Do people have to keep their "secure" browser "up-to-date" in order to be "secure"?

Pwn2Own

Why Firefox is the first one to patch the zero day found in 2017 when pwn2own does not accept Firefox as a target any more?

Out of scope

Is the browser the most vulnerable component in this bundle?

It made me concerning that how would I trust the code quality of i2pd when one of the core developers has such a manner towards the criticism from the rest of the community.

Stop rendering an image trying to convince the rest of the world that Firefox is fragile. It's not. As of Nov 2017, it is still the second most popular browser on the world.

majestrate commented 6 years ago

On Sun, Dec 03, 2017 at 06:51:27PM -0800, Kaede Hoshikawa wrote:

Some personal thoughts on this conflict:

Politeness and Respectfulness

Is it polite or even proper to ask somebody quit/give up something with contempt?

Is it polite or even proper to call something suck depending on one's subjective belief(i.e.:faith) when thousands of people spent thousands of hours on building it?

This is not a moral argument or a judgement of mozilla's character. I am being real about their technical debt and how it affects people that use their browser.

Belief and faith

How much does one's faith valued by the others?

See above.

Invention

Does someone invent something new just because it sucks at the old ones?

Do people write i2pd because they suck at Java I2P and/or Java?

I2PD was made for several reasons, the biggest one is that Java I2P is slow and the project is rather mismanaged in some people's view.

Purpose of this project

What problems is this project intended to solve? Or, in other words, is this a Tor browser equivalent for I2P?

I2PD browser is eventually a Tor Browser Equiv but initially it needs to work at all. I think it's better to "do it right" the first time around.

 * If so, take a look at [1]Tor FAQ and [2]this page. It explained in
   detail the reason why Tor Project chose Firefox over Chromium.
 * If not, do we really need another 200MB on our disk in order to use
   I2P if we do not need to modify anything from the original? Why not
   just create a separate profile in the "secure" browser and write an
   extension to handle network connections? I am pretty sure that at that
   point of time when I was still a user of the "secure" browser, it was
   particularly good at [3]these kinds of jobs.

I understand your frustration with using another browser that isn't based off Tor Browser. I have weighed the pros and cons and I think it's worth spending time to gut chromium.

The never ending topic

Is preventing "fingerprinting" a never ending topic?

 * If so, should we make any effort to solve it?
 * If not, what should we do on it?

Is being "secure" a never ending topic?

 * If so, should we make any effort to solve it?
 * If not, what should we do on it?

We'll get to it eventually, if we ever get this project off the ground and stop arguing about if we're going to do it or not.

The "secure" browser

Is the "secure" browser really a sliver bullet in solving vulnerabilities?

 * If so, why the "secure" browser still has procedures on reporting
   security bugs?
 * If not, why people still call it "secure"?

Do people have to keep their "secure" browser "up-to-date" in order to be "secure"?

 * If so, is this project going to update their "secure" to the latest
   version at the same time the original "secure" browser comes out? If
   they just provide a vanilla "secure" browser with some configuration
   modified that can be simply achieved by extensions and they cannot
   catch up with the HEAD branch, why people are still using this
   project?
 * If not, what keeps it "secure" as time goes by?

I am of the opinion that a secure web browser is an oxymoron.

Pwn2Own

Why Firefox is the [4]first one to patch the zero day found in 2017 when pwn2own does not accept Firefox as a target any more?

Probably luck or circumstance, I really can't say for sure as I do not keep up with pwn2own or firefox.

Out of scope

Is the browser the most vulnerable component in this bundle?

 * If not, according to the bucket theory, the limit of one is depending
   on the shortest piece of wood, does it even matter to use which
   browser in order to be "secure"?

      * Does discuss being "secure" out of scope if the browser is not
        the weakest part?

It is without a dobut the most vulnerable component because of the level of complexity.

 * If so, does it imply that the codebase of i2pd is more "secure" than
   Firefox?

      * Does i2pd have any third party audit? [5]Firefox has it.
      * Does i2pd have any procedures to deal with security bugs without
        being disclosed to the public? [6]Firefox has it.
      * Will i2pd respond and patch the vulnerability as fast as
        [7]Firefox?
      * If any of the above is no, why i2pd is still more "secure" than
        Firefox?

I2PD is not comparable to Firefox it's more comparable to CTor if at all.

I think someone at monero is doing an audit on their fork and we have been fixing a few things.

Next release has security fixes. Should be out today.

Considering the circumstances we're lucky to get so much developer eyes.

It made me concerning that how would I trust the code quality of i2pd when one of the core developers has such a manner towards the criticism from the rest of the community.

Trust but verify, i2pd isn't the best but we're not in the position that firefox is in with their mountain of technical debt.

Again, this is not a moral judgement of the individuals of the community, please do not conflate this.

Do not conflate Criticisms of software with insults to individuals, the world does not work like that, please understand.

Stop rendering an image trying to convince the rest of the world that Firefox is fragile. It's not. As of Nov 2017, it is still [8]the second

All software is fragile to some degree, unless it's a coreutil like grep, but even then they still have bugs.

The bigger it is the more fragile it becomes from complexity alone.

most popular browser on the world.

This sounds like Argumentum ad populum but whatever.

— You are receiving this because you were mentioned. Reply to this email directly, [9]view it on GitHub, or [10]mute the thread.

Reverse link: [11]unknown

References

Visible links

  1. https://www.torproject.org/docs/faq.html.en#TBBOtherBrowser
  2. https://blog.torproject.org/google-chrome-incognito-mode-tor-and-fingerprinting
  3. https://chrome.google.com/webstore/detail/proxy-switchyomega/padekgcemlokbadohgkifijomclgjgif
  4. https://www.esecurityplanet.com/browser-security/mozilla-firefox-is-the-first-pwn2own-2017-victim-to-be-patched.html
  5. https://gitweb.torproject.org/tor-browser-spec.git/tree/audits
  6. https://www.mozilla.org/en-US/security/
  7. https://www.esecurityplanet.com/browser-security/mozilla-firefox-is-the-first-pwn2own-2017-victim-to-be-patched.html
  8. https://www.netmarketshare.com/browser-market-share.aspx?options=%7B%22filter%22%3A%7B%22%24and%22%3A%5B%7B%22deviceType%22%3A%7B%22%24in%22%3A%5B%22Desktop%2Flaptop%22%5D%7D%7D%5D%7D%2C%22dateLabel%22%3A%22Trend%22%2C%22attributes%22%3A%22share%22%2C%22group%22%3A%22browser%22%2C%22sort%22%3A%7B%22share%22%3A-1%7D%2C%22id%22%3A%22browsersDesktop%22%2C%22dateInterval%22%3A%22Monthly%22%2C%22dateStart%22%3A%222016-12%22%2C%22dateEnd%22%3A%222017-11%22%2C%22segments%22%3A%22-1000%22%7D
  9. https://github.com/PurpleI2P/i2pdbrowser/issues/6#issuecomment-348847528
    1. https://github.com/notifications/unsubscribe-auth/AAefxVl2-7Yi-rdls8YZ_YxTwGc0Xr3nks5s814vgaJpZM4P6jCc
    2. https://github.com/PurpleI2P/i2pdbrowser/issues/6#issuecomment-348847528

Bottom line, I think what is best for OUR use case here is to start gutting chromium, if you don't want to use it that's fine.

I want a Tor browser fork that works with i2pd but I think we can do better than that.

I welcome any contribution you have, perhaps you can maintain a tor browser fork that supports i2pd? that would be cool and I'll send all the support you need your way. For us I think that the way forward is to try out a chromium fork, if it fails to work out eventually we'd love to have something to fall back on.

l-n-s commented 6 years ago

Everybody seems to have an opinion, but doing the actual thing is too hard. I've seen a lot of attempts to create TBB build for I2P here at github, but people loose interest in maintaining it quickly.

dimzon commented 6 years ago

Well, my opinion is to fork TorBrowser. This is the best possible effort since tor developers already perform security/anonimity review so no-need to re-invent the wheel...

Another end-user wish is to have combined Tor & I2P browser all-in-one. Maybe the best way is to collaborate with TorBrowser team?

Keep in mind - since you(end everyone who read this page) is a geek you can tweak mostly ANY preferred browser to browse over i2p. I2PDbrowser (like TorBrowser) is not for "geeks". It's for low-level users. They must be able to download it and run with single click (like TorBrowser do). It's extremely important to have such browser to populate i2p over peoples...

majestrate commented 6 years ago

if someone is going to fork tor browser then do it, i'll close this issue for now.