search

ungoogled-software / ungoogled-chromium

Google Chromium, sans integration with Google
BSD 3-Clause "New" or "Revised" License
20.35k stars 825 forks source link

Option to disable webassembly and webgl for security reasons : implement patch of Javascript JIT (block JIT and webassembly) , Webgl, Webrtc, viewport size protection, timezone override #2604

Open trimechee opened 10 months ago

trimechee commented 10 months ago

Description

Impossible to disable completely risky webassembly wasm

Who's implementing?

The problem

EDIT : We are happy to learn about the addition in Ungoogled-Chromium of the option : V8 optimizer JavaScript and WebAssembly engine used to improve site performance option ! Thank you ! 💯 🥇

So if I understand correctly the : chrome://settings/content/v8 option allows you to disable wasm webassembly? If so, it’s so wonderful, thank you!

All that remains is please add an option to hide our IP address when using webrtc or option to completely deactivate webrtc because webrtc reveals our ip address even when using a vpn, thank you very much!

microsoft edge browser has a flag : Anonymize local IPs exposed by WebRTC. Conceal local IP addresses with mDNS hostnames. – Mac, Windows, Linux

and opera and brave browsers have an option to hide the ip address when using webrtc....

Hello, webgl and webassembly may be dangerous and risky :

https://github.com/stevespringett/disable-webassembly#security-considerations

https://security.stackexchange.com/questions/13799/is-webgl-a-security-concern

and I tested open source "Cromite browser" last version

https://github.com/uazo/cromite

and I discover these important settings in site settings : chrome://settings/content :

Javascript JIT(block JIT and webassembly) Webgl, Webrtc viewport size protection timezone override

Si, i can finallly disable easily and quickly webassembly and webgl without digging into the various complicated flags....

I hope these important patches will be added to our beloved Ungoogled-Chromium Browser please ! Thank you so much :)

Possible solutions

Implement features patches from cromite browser to disable risky webassembly and webgl

Alternatives

No response

Additional context

No response

PF4Public commented 10 months ago

and I tested open source "Cromite browser" last version

License might be incompatible with ungoogled-chromium.

trimechee commented 10 months ago

@PF4Public We understand , thank you for the clarifications :) the major problem, is webgl, it is easy to disable webgl with custon arguments, but webassmbly it is much more complex complicated operation ti disable completely wasm and we don't even know it is possible to disable wasm in chromium browsers, that's why the only solution is to modify code source upstream of the browser....

PF4Public commented 10 months ago

You can apply those patches while building yourself. In that case licensing issue might arise only if you start distributing the resulting binary. I actually made this a possibility for Gentoo users if you're curious: https://github.com/PF4Public/gentoo-overlay/blob/a93fcfcfbf6d763b91e9a9230ae49effd65a09cf/www-client/ungoogled-chromium/ungoogled-chromium-119.0.6045.123_p1.ebuild#L420-L469

trimechee commented 10 months ago

Unfortunately I'm not a developer, I don't know anything about software development...I'm a literary person but thank you for your help :) 👍 💯