Well brave still uses 300MB per tab on linux and almost 700MB per tab on Windows. So they do have a long way in front of them.
They're crushing it on ad-blocking. I love it for that reason.
Brave overhauled its Rust adblock engine with FlatBuffers, cutting memory 75%
61–70 of 289 posts
Re: Brave overhauled its Rust adblock engine with FlatBuffers, cutting memory 75%
#62Brave's adblocking engine is a neat example of open source and the ease of sharing lbraries in Rust. It uses Servo crates (also used by Firefox) to parse CSS and evaluate selectors, and is then itself published as a crate on crates.io where it can be pulled in by others who may want to use it.
At risk like node/npm with all the supply-chain attacks then? Or is there something that cargo does to manage it differently (due diligence?).
Edit: I misremembered a Rust crates capability (pre- and post-install hooks), so my comment was useless and misleading.
Re: Brave overhauled its Rust adblock engine with FlatBuffers, cutting memory 75%
#63Re: Brave overhauled its Rust adblock engine with FlatBuffers, cutting memory 75%
#64Earlier quoted context omitted.
There is quite a lot of costs associated with running a browser (at scale). Brave is looking to offer something that does what you mention called Brave-origin. Brendan talks about this a bit more here: https://x.com/BrendanEich/status/2006412918783619455
This is good news, but I am confused by the following: """ Brave Origin is: 1/ new, optional, separate build (stripped down, no telemetry/rewards/wallet/vpn/ai); 2/ free on Linux, one time buy elsewhere. """ So the stripped down version (at least the non-Linux one) will not be open source?
open-source ≠ gratis binaries
Rules that require the distribution of source code don't require the distribution of binaries.
Re: Brave overhauled its Rust adblock engine with FlatBuffers, cutting memory 75%
#65Earlier quoted context omitted.
Unlike other reply, I do not work at Brave, and I can also confirm that Brave never did that. They do have their own ads but those have always been opt in (you are not opted in by default), and they do pay some small amount of USD in their crypto token for opting in to those - it's pennies. People scoff at the pennies but guess who pays out nothing to show you ads against your will - literally everyone else. What you…
Important part missing here, they didn't tell anyone about the affiliate URL rewriting and only removed it when caught.
[deleted]
Re: Brave overhauled its Rust adblock engine with FlatBuffers, cutting memory 75%
#66Earlier quoted context omitted.
> auditing your dependencies is How do you do that practically? Do you read the source of every single package before doing a `brew update` or `npm update`? What if these sources include binary packages? The popular Javascript React framework has 15K direct and 2K indirect dependencies - https://deps.dev/npm/react/19.2.3 Can anyone even review it in a month? And they publish a new update weekly.
> The popular Javascript React framework has 15K direct and 2K indirect dependencies - https://deps.dev/npm/react/19.2.3 You’re looking at the number of dependents . The React package has no dependencies. Asides: > Do you read the source of every single package before doing a `brew update` or `npm update`? Yes, some combination of doing that or delegating it to trusted parties is required. (The difficulty should info…
> You’re looking at the number of dependents. The React package has no dependencies.
Indeed.
My apologies for misinterpreting the link that I posted.
Consider "devDependencies" here
https://github.com/facebook/react/blob/main/package.json
As far as I know, these 100+ dev dependencies are installed by default. Yes, you can probably avoid it, but it will likely break something during the build process, and most people just stick to the default anyway.
> Reproducible builds, or don’t use those packages.
A lot of things are not reproducible/hermetic builds. Even GitHub Actions is not reproducible https://nesbitt.io/2025/12/06/github-actions-package-manager...
Most frontend frameworks are not reproducible either.
> don’t use those packages.
And do what?
Re: Brave overhauled its Rust adblock engine with FlatBuffers, cutting memory 75%
#67I am surprised there does not exist a community fork of Brave yet that strips out all of the commercial stuff (rewards, AI, own updates), making it suitable for inclusion in the repos of mainstream free/libre Linux distros.
You can hide bat with one click as soon as you install brave
Re: Brave overhauled its Rust adblock engine with FlatBuffers, cutting memory 75%
#68Earlier quoted context omitted.
> auditing your dependencies is How do you do that practically? Do you read the source of every single package before doing a `brew update` or `npm update`? What if these sources include binary packages? The popular Javascript React framework has 15K direct and 2K indirect dependencies - https://deps.dev/npm/react/19.2.3 Can anyone even review it in a month? And they publish a new update weekly.
Normally it would omly be the diff from a previous version. But yes, it's not really practical for small companies or individuals atm. Larger companies do exactly this. We need better tooling to enable crowdsourcing and make it accessible for everyone.
> Larger companies do exactly this.
Someone committed malicious code in Amazon Developer Q.
AWS published a malicious version of their own extension.
https://aws.amazon.com/security/security-bulletins/AWS-2025-...
Re: Brave overhauled its Rust adblock engine with FlatBuffers, cutting memory 75%
#69Earlier quoted context omitted.
At risk like node/npm with all the supply-chain attacks then? Or is there something that cargo does to manage it differently (due diligence?).
Edit: I misremembered a Rust crates capability (pre- and post-install hooks), so my comment was useless and misleading.
Rust crates can run arbitrary code at build time: https://doc.rust-lang.org/cargo/reference/build-scripts.html
Re: Brave overhauled its Rust adblock engine with FlatBuffers, cutting memory 75%
#70Is Brave still a front for a cryptocurrency pump-and-dump scheme?
Never was.