Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Goodbye Brave

arunmozhi.in

Post reply on HN
Print view View original

241–250 of 252 posts

Re: Goodbye Brave

#241

Post by jonathansampson »

jonathansampson wrote: post #209
richardfey wrote: post #73

I think any other browser would also need a server with the hosted extension packages, so the point here is misguided: you did not get an error related to Brave servers while *not* using Brave services.

Generally speaking, other Chromium-based browsers simply load the CRX (extension file) directly from Google's server. This puts the user's device in direct contact with the advertising and data-harvesting giant. In Brave's case, we proxy the requests to prevent direct contact. As such, when a user attempts to install an extension in Brave, the browser sends the request through a *.brave.com endpoint, which relays it…

Resolved: User had a very out-of-date build of Brave. See https://news.ycombinator.com/item?id=29471236 for more details.

Re: Goodbye Brave

#242

Post by jonathansampson »

jonathansampson wrote: post #208
leodriesch wrote: post #123

Earlier quoted context omitted.

As far as I understood the backend issue was on Braves end, while the Chrome Web Store was fine. So installing the extension worked in Chrome, but not in Brave, because they had some backend problems, while the installing of an extension should not need the Brave servers at all.

Brave proxies Google-endpoints to prevent users from unintentionally making contact with Google servers. If our proxy receives a bad request, or has some other unlikely, transient issue, it will respond with a 403 Status (which results in the "Access Denied" message being displayed). In this instance, the user may have been on an out-of-date build of Brave; it's not clear from the report. Sampson (Brave Team)

Resolved: User had a very out-of-date build of Brave. See https://news.ycombinator.com/item?id=29471236 for more details.

Re: Goodbye Brave

#243

Post by jonathansampson »

jonathansampson wrote: post #186
krisrm wrote: post #2

Seems a little ironic to call out a piece of software whose literal job it is to connect to the internet for... Connecting to the internet. Tongue in cheek aside, I don't know much about Brave - is there some specific reason that it needs an always-on server to call home to?

The user attempted to install an extension; this results in a request to Google's Servers (which Brave proxies to prevent users from making unintended contact with Google). If Brave's proxy happened to return a 401 response (requesting authentication), then the user would see the "Access Denied" message shown in their screenshot. It's also possible that this message could have come from Google's own server (via the B…

Resolved: User had a very out-of-date build of Brave. See https://news.ycombinator.com/item?id=29471236 for more details.

Re: Goodbye Brave

#244

Post by jonathansampson »

jonathansampson wrote: post #177
oakfr wrote: post #146

This article seems to spawn many threads on online advertising, but the initial comment from the author seems to be more around a system/architecture issue (i.e. why should a browser require backend servers). I am writing this comment here to see what people think about this question specifically.

Brave proxies Google endpoints (see https://github.com/brave/brave-browser/wiki/Deviations-from-... for a list). This is to prevent users from making unintended contact with Google. This particular error ("Access Denied") encountered by the author could be from Google, but could also be from a transient issue with the Brave proxy serving a 401 response (or similar). Sampson (Brave Team)

Resolved: User had a very out-of-date build of Brave. See https://news.ycombinator.com/item?id=29471236 for more details.

Re: Goodbye Brave

#245

Post by jonathansampson »

jonathansampson wrote: post #173
i13e wrote: post #29

This title seems a little clickbaity to be honest and I'm not sure how accurate the author's portrayal of Brave's server side is. Based on intuition I imagine the inability to install extensions has something to do with Chrome's locked down web store forcing Brave to make it's server-side act as a middle man to the chrome web to download and install extensions. Therefore this would be a google/chromium/intentional de…

The problem is definitely a bit more complicated. While it's possible this issue did not involve an issue with Brave at all, it's also possible that it did. The behavior observed (inferring from the screenshot) suggests the user's access to this extension was denied at the time. A 401 response (Unauthorized) from Brave's proxy-endpoint (go-updater.brave.com in this case, I believe) would result in this message being…

Resolved: User had a very out-of-date build of Brave. See https://news.ycombinator.com/item?id=29471236 for more details.

Re: Goodbye Brave

#246

Post by pdimitar »

sharps1 wrote: post #217
pdimitar wrote: post #192

Earlier quoted context omitted.

What about PrivacyBadger and Disconnect? Are they even needed at this point? I have a PiHole with a fairly huge block list (~1.2M entries) and uBlock Origin and I keep wondering if I stay only with them, will it be enough?

Pi-Hole and uBO are enough by themselves. > To benefit from uBlock Origin's higher efficiency, it's advised that you don't use other content blockers at the same time (such as Adblock Plus, AdBlock). uBlock Origin will do as well or better than most popular ad blockers. Other blockers can also prevent uBlock Origin's privacy or anti-blocker-defusing features from working properly. https://github.com/gorhill/uBlock

Thank you. Uninstalled everything else, let's see how it goes.

Re: Goodbye Brave

#247

Post by jonathansampson »

freediver wrote: post #232
jonathansampson wrote: post #230

Earlier quoted context omitted.

If the user navigates to Google, the user is handing themselves to Google. If the user wishes to block first-party content on Google (which doesn't amplify their risk in any way), Brave supports that option via Aggressive Mode . Brave blocks, by default, that which is harmful. If you're willingly typing data into Google, their SERP ads aren't increasing or adding-to your risk in any way. Brave supports the option to…

> If you're willingly typing data into Google, their SERP ads aren't increasing or adding-to your risk in any way. How are you sure? I would assume that a more likely scenario is one where clicking a first party ad on Google.com helps build a profile about the user. > If you wish not to see the first-party SERP ads on Google, I would suggest you not use Google. Recommending to avoid a site that has ads is not how ad-…

I'm not suggesting you avoid Google _because it has ads_; the ads aren't the problem. The problem is Google being the first-party domain. I'm telling you not to walk into the dragon's den at all; you're wanting to discuss the cleanliness of the dragon's toe-nails :)

Re: Goodbye Brave

#248

Post by bostik »

nkurz wrote: post #194
bostik wrote: post #52

Earlier quoted context omitted.

It is possible to do ads acceptably, but pre-loading a list of offenders who get around your choices is not it. If you want to do ads online, here are the initial rules of engagement: https://bostik.iki.fi/aivoituksia/random/no-stalking.html

FYI, when I tried to follow your link, Safari on Mac blocked your link with a warning that the certificate is invalid. Oddly, the "details" section (which helpfully cannot be cut-and-pasted) mentioned that "the website's certificate will be valid 0 days from now". I'm guessing this means there is a clock or timezone error, either on your end or my laptop. Ignore or look into at your option.

Well that's funny, the cert is valid until 2022-01-16.

It might have something to do with the LE intermediate root rotation - Chrome variants and Firefox are happy with the chain, but Safari's CA trust store may not have the new intermediate CA in place.

I'll upgrade the system over the holidays in any case, and the new lighttpd finally has native support for CA chain inclusions. That should make all the clients happy again.

Re: Goodbye Brave

#249

Post by paulcarroty »

ntp85 wrote: post #238
pmlnr wrote: post #45

Earlier quoted context omitted.

Setting can be disabled, and for example the debian build comes without telemetry.

Is this also true for Debian-based distributions? Anyways, users on Mac and Windows usually download Firefox directly from Mozilla and are therefore affected by the aforementioned telemetry. Seeing the market share of Desktop Linux I'd hazard a guess that those users are in the majority.

Guess nope, 'cause Mozilla doesn't allow patching at all.

Edit: tried to download debian package to check their patches, but failed: https://packages.debian.org/sid/firefox

So proofs are welcoming.

Re: Goodbye Brave

#250

Post by detaro »

paulcarroty wrote: post #249
ntp85 wrote: post #238

Earlier quoted context omitted.

Is this also true for Debian-based distributions? Anyways, users on Mac and Windows usually download Firefox directly from Mozilla and are therefore affected by the aforementioned telemetry. Seeing the market share of Desktop Linux I'd hazard a guess that those users are in the majority.

Guess nope, 'cause Mozilla doesn't allow patching at all. Edit: tried to download debian package to check their patches, but failed: https://packages.debian.org/sid/firefox So proofs are welcoming.

Debian's Firefox is patched.
Post reply on HN