> By Brave's own confession, there are 70 requests it sends "home" on startup…
"Confession" is a curious choice of words. You're correct that Brave issues requests on startup; this is necessary for a secure application. If your browser isn't updating its internal list of suspected-malicious domains and more, it isn't doing "security" properly.
> There is plenty of opportunity for your data to be stored and used (not saying that it is).
To what "data" are you referring? You cited my review of our (Brave) network activity, and that of many other browsers; which data/requests do you find to be worrisome?
A similar review was conducted in 2020 by Trinity College Dublin, which also found Brave to be the "most private" browser tested (even with these startup requests): https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf.
> …each of them [network requests] contains your PII (IP address at the very least).
An IP address is rather unavoidable. But whether or not an IP address constitutes PII is debatable—many users can (and do) share common IP addresses.
That said, we drop the IP address when and where possible. For example, usage requests are routed through a CDN which replaces the user's IP address with their inferred country.
Brave has no interest in trying to remotely monitor anybody's browsing habits; if we did, you (and/or those who actively monitor our project, looking for faults) would see clear signals in our network activity.
Instead, everything we do is designed from the outset to preclude this type of abuse. That's the case with our Privacy-Preserving Product Analytics (https://brave.com/p3a), our Private CDN (https://brave.com/brave-private-cdn/), and more. Brave isn't interested in your personal information; we have built a business model that doesn't rely on the harvesting of user data.
> The only way to actually trust a browser from a privacy standpoint is to check if it is indeed not transmitting any data.
This is a great point. Please review our network requests, and let me know which items give you concern. We're genuinely interested in your feedback.
> Disclaimer: I am in the business of creating a privacy respecting, zero-telemetry, browser. This topic is near and dear to my heart.
I'm curious how your product handles security; do you not maintain a client-side list of suspected-malicious domains (so that you can warn a user who might be stumbling into something harmful), or check for updates to patch zero-day vulnerabilities in the wild, etc.? Both of these (and more) require routine network requests if they are to offer any effective defense for the user.