Show HN: We launched a new web browser

Your strong wording is interesting here, and I'm curious about what this is implying about how you approach security.

The implication here is "not compromised by independent actors that wouldn't already be capable", right? You're delegating trust to closed source megacorp products or open-but-insanely-complex megacorp dependents (firefox/chromium babies?), all of which will naturally create a strong incentive to find or hide exploits, once they have some traction. Discussion on HN makes me think it's impossible to really trust a browser to be secure atm. The alternative is to hope there are no wide-sweeping exploits, and to try to remain anonymous.

I guess the real additional issue added by something like this is this introduction of another actor which you need to be inherently suspicious of since they're attempting to funnel you towards their system, which they have some control over. Just like other corps, but you've given them your trust already. It's not crazy, I don't know if it's even wrong.

But I'd say maybe we can reframe your issues adopting something like this. Would it be something you would trust to use daily if the following become true? :

- The team at Impervious, develop a sufficient reputation for being stewards of open software with healthy communities over the coming years. (I'm implying that's a good approach to get security researchers giving time to your project, maybe it'd be sufficient to have a really good bugbounty program, or just develop a sufficient security team)

- A large audience adopts this browser, so you're not one of the hundred beacon users that's easily picked out throughout the web (I assume fingerprinting techniques make this an issue though I admit I've little knowledge on the topic)

I'd love to hear what I'm missing, and if this conflicts with your approach to assessing security maybe you can help me see your perspective :)

Except you have your ownership in the blockchain allowing you to mutate the IP address. I don’t know if you can get a guaranteed for life IPv6. And who dishes them out. It is centralised.

Since everybody including you, can own as many top level domains as your heart desires, this should be no problem.

So (like everything in security) it depends on your threat model. Open source has significant advantages over closed source, from the perspective of allowing the possibility of review (although that can be a false sense of security as we've seen several bugs in high profile projects live for decades)

Where closed source might work better is where you are a large company with a smaller supplier. There you can use contractual controls to require a level of review to be done alongside other controls and have meaningful financial penalties if those requirements are not met.

At the moment honestly the idea of fully trusting any large project seems like a tricky one as most projects/products are comprised of large quantities of 3rd party open source libraries, which are trusted. Whilst there's work to address that (e.g. the OpenSSF) there's a looong way to go.

That's why defence-in-depth/segregation/detective controls are so important, relying on any one control is likely not to end well :)

As to trusting Google, again threat model. I have a gmail account, could a google staff member access that? yep they could. Do I think I'm likely to be a target for that, not really :)

Do any of the Chrome forks explicitly work together?

The standard IT pattern seems to be a dominant corporation vs a ragtag of small groups.

The browsers wars have already gone through this cycle and the ragtag group won the last time.

But there were also lots of speciality browsers built on IE and it's hard to tell where any new Chrome fork browser stands.