Chromium Browser for Kicksecure Discussions (not Whonix)

Development
, ,
75

Asked upstream.

1 Like
76
77

Thats should be better to not link it to google.

Counter measures In response to a report that a tracker was using CNAMEs to circumvent privacyblocklists4, uBlock Origin released an update for its Firefox version that thwarts CNAME cloaking [23]. The extension blocks requests to CNAME trackers by resolving the domain names using the browser.dns.resolve API method to obtain the last CNAME record (if there is any) before each request is sent. Subsequently, the extension checks whether the domain name matches any of the rules in its block lists, and blocks requests with matching domains while adding the outcome to a local cache. Although uBlock Origin also has a version for Chromium-based browsers, the same defense cannot be applied because Chromium-based browser extensions do not have access to an API to performDNS queries. As such, at the time of this writing, it is technically impossible for these extensions to block requests to trackers that leverage CNAME records to avoid detection

1 Like
78

Indeed. This is good news. The transition isn’t nice for users but from Freedom Software viewpoint, it is good that Open Source code interacting with proprietary API has been removed.

79
80

Related:

81

Security bummer:

1 Like
82

Viewing the situation as of 14 March 2021:

More details in wiki:
Remotely Exploitable Chromium Security Vulnerability CVE-2021-21193 exploited in the wild

Chromium is basically all independent upstream. The relevant ones available for Kicksecure all lag behind with security critical updates.

2 Likes
83

Viewing the situation as of 03 April 2021:

1 Like
84
  • Both, FlatHub and Snap Store had a more than 2 weeks gap between Google reporting a security vulnerability being exploited in the wild and these software stores pushing an upgrade.
  • Debian chromium package is still vulnerable.

Exploited in the wild is a crucial difference here. That’s the line between theoretic considerations and security in the real world.

03 April 2021

Due to my above two posts and this post…

Firefox and Chromium | Madaidan's Insecurities may I suggest to replace Chromium with Chrome? @madaidan

It sounds right in theory but all the security mitigation in Chromium didn’t help to avoid this vulnerability being exploited in the wild. We should prioritize security in the real world over theoretic considerations. Despite all security innovations in Chrome / Chromium, that didn’t actually help users in the real world if Chromium maintenance (new releases with security fixes) lags behind Chrome. Maintenance is unfortunately something that cannot be excluded from the security comparison.

Now for more than 2 weeks Kicksecure would have had the choice to either install by default:

  • Firefox: No security vulnerabilities reported being exploited in the wild.
  • Chromium: At least 1 vulnerability reported being exploited in the wild.

More theoretic considerations…

Additionally, users on the Linux platform [1] had to choice:

Kicksecure Freedom Software doesn’t have the chance to install Chrome by default because it would then become non-freedom software. Even when mixing Freedom Software with non-freedom software, I wouldn’t know if Chrome could be legally re-distributed. I haven’t found license agreement for Chrome yet.

The question of the Kicksecure default browser, Debian’s Firefox ESR (or from any other Firefox from alternative sources) versus any Chromium unfortunately now got less clear to me.

[1] Leaving out Windows from considerations since this is about what to do in Kicksecure, Freedom Software, Linux based.

85

Everything in the article still applies to Chromium. Independent parties packaging it insecurely doesn’t affect the security of it upstream.

Looking into Flatpak more, it appears they disable Chromium’s Layer-1 sandbox and replace it with the much weaker Flatpak sandbox for seemingly no reason: https://github.com/flathub/org.chromium.Chromium/blob/master/patches/0005-flatpak-Add-initial-sandbox-support.patch

I’ve also heavily updated my Firefox article recently and I’m going to push another update soon.

1 Like
86

madaidan via Whonix Forum:

Everything in the article still applies to Chromium. Independent parties packaging it insecurely doesn’t affect the security of it upstream.

Worth mentioning distribution issues, though. Since it makes a big
difference for theory/practice.

Then Chromium upstream doesn’t really act like a usual upstream. No
stable releases. That link goes to Chrome instead. As mentioned earlier.
No (gpg) signed releases.

Since Chromium doesn’t really maintain a stable release upstream, that
results in this insecure situation in downstream Debian.

1 Like
87

I find too many unresolved vulnerabilities in Debian’s Chromium security tracker. For now, is it better to use Firefox instead?
I don’t think Chromium from Debian will get any better soon, is it better to switch to a decent Chromium stable upstream? (I’m not aware of any stable upstream though) Maybe use Brave?

88

Firefox isn’t much better. Even assuming that Debian’s packaging of Firefox is flawless (it almost certainly is not), it’s still using an ESR build which inherently has many public, unfixed vulnerabilities upstream that can’t be patched even if Debian were to keep the package updated.

89

We might have to use another upstream, Chromium from Debian is even worse than Firefox (and Firefox-ESR) from Debian.

90

Discussed earlier. Doesn’t exist.
Chromium Browser for Kicksecure Discussions (not Whonix) - #27 by Patrick

91

Switched out chromium for firefox-esr because as things stand, chromium on Linux has very big problems with stale bug fixes compared to Mozilla.

https://gitlab.com/whonix/kicksecure-meta-packages/-/merge_requests/1/diffs?commit_id=7ba985581cfd02092186bc8cbe584ac4c0f086f9

1 Like
92

Not reverted.
You only added to dummy-dependency.
For such changes, you need to search the whole file for chromium, better the whole source code, best all source code. In this case, whole file would have been enough.
Meta package kicksecure-desktop-applications-recommended wasn’t changed.

93

That should do it for chromium, but it doesn’t add firefox. Should firefox-esr be added everywhere chromium was mentioned?

1 Like
94

When appropriate. It can be seen from the context. From the package name as well as the description and the other fields.

There is:

  • Package: kicksecure-desktop-applications-recommended
  • Package: dummy-dependency

Still missing firefox-esr under Package: kicksecure-desktop-applications-recommended in the Depends: list.