HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
cookiengineer
retrokit
C++2021–2026
cookiengineer / retrokit

retrokit

:joystick: Bring back the old Web(Kit) and make it secure

2Distinct people
16Mentions
0Explicit recommenders
56GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

:joystick: Bring back the old Web(Kit) and make it secure

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 8:03:49 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year16 dated mentions

Observed mentions: 2021-12-27 21:38:45 UTC to 2026-01-10 07:31:10 UTC.

024682021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20212022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 8 mentions; 0 submissions, 8 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments20232024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC101
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC808
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC303
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC101
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC202
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC101

What Hacker News says

8 sources
I don't understand why this is news? Spyware watchdog posted about this years ago. It's been in there at least since 2016, and every time you open Firefox (not start!) it will happily broadcast its geo position information to their geolocation backend. The same goes for the WebRTC related STUN servers, which are always connected to when Firefox starts. I mean, come on folks. Never trust any software blindly. Use MITM proxy to verify. Use a host firewall like opensnitch. For the moment the best alternative is ungoogled chromium with ublock origin, even though the CSP headers cannot influence the DNS resolver mechanics in the CEF code. I am still busy forking webkit into retrokit and it's a shitload of work to remove these tracking features. [1] But a project like this needs more privacy like minded people. I mean, even the TOR people kind
Read the rest
of gave up on this. Just look at their codebase, trying to stub everything anew with upstream changes. There's no point in trying to race against chrome in "whose browser has the most features", you can't win anyways. I don't care about WebGL or WebGPU, I don't care about WebRTC, I just want privacy back. [1] https://github.com/tholian-network/retrokit
In Each Firefox download has a unique identifier
OP's setup looks actually pretty similar to my one, though where the pinephone really - really - shines is pentesting. The compatibility with external Wifi USB adapters and BT hardware like the ones from scott's gadgets make it an amazing pentesting device. For serious mobile-friendly usage I don't think that we can build UIs the way they're built on Linux systems anymore. I challenge every defender of that GTK/QT crap to build a swipeable sidebar into their native and responsive UI. If it takes more than 10 minutes, you lost, cause that's what it takes to use CSS, even without any IDE or toolkit. I wish GTK wasn't built inhouse and would focus on using established toolchains instead of reinventing their own programming language ecosystem with every new release. Nobody wants to use vala. Nobody wants to use glade. Nobody wants to use any
Read the rest
of the ecosystem, because it's much more pain than any established UI framework's methodology. There's a reason why everyone uses electron, and the reasons are not the same why you think your GNOMey toolchains matter. And this has to stop. Otherwise everybody will hop on QT at some point. I still hope that webkit, javascriptcore and nodejs can be combined into something that allows to easily call C-ABI compatible libraries without 300MB of build size like electron. [1] [1] https://github.com/tholian-network/retrokit
In My Pinephone Setup
Yep, I did the same. Currently, I am still building my own fork of WebKit (RetroKit [1] ) that removes all attack surfaces it still has (e.g. canvas, webgl, webaudio, applet and embed support, pdf plugins...you name it). I realized at some point that all bridge concepts are super buggy, in Gecko, in WebKit, in Blink...and the only way to reduce the attack surface is to remove the featureset. Tried to do the same with chromium and gecko before...but arguably both projects come with so much overhead (repo tools, hardcoded git urls everywhere, custom clone scripts for each platform and environment etc) that they're inforkable. Take a look at projects like nwjs, where the maintainer has to go almost insane trying to keep up to date with upstream...and he basically didn't change anything else than the public headers to be able to embed chromiu
Read the rest
m more easily. I don't need WebGL to browse websites. If I want to visit a web experiment I can still use ungoogled chromium --user-data-dir=/tmp/... As for the alternative in the meantime: I'm using ungoogled chromium with my own Browser Extension [2] to block off all tracking and filtering/rewriting the actual content. [1] Still WIP. Would love to get more people on board: https://github.com/tholian-network/retrokit [2] https://github.com/cookiengineer/defiant
In Ask HN: Which browser should I migrate to, away from Firefox?
I think that in order to increase privacy and - more importantly - reduce the attack surface of a Web Browser more efficiently, there will have to be two modes of web browsing. Regular browsing - in my opinion - should default to privacy and security first, whereas trust to web apps should be granted on a per-domain basis. This is basically what I'm doing in a crappy manner in Chromium and Firefox, where I have all my Browser Extensions in regular browsing mode with uBlock Origin, Cookie Autodelete and whatnot... and where I use Incognito Mode to use Web Apps. Additionally, I believe that a Web Browser that's decentralized has an almost infinite amount of advantages when it comes to bypassing censorship, increasing trust and the ledging aspect of (temporary) online resources. My idea of building a sane architecture of a Web Browser is tha
Read the rest
t the Browser itself is actually a locally running peer-to-peer web scraper service, and the "frontend or GUI" is a bundled webview that's pointing to localhost:someport. Web Apps can then be used by spawning a new webview instance that's sandboxed with its profile in a temporary folder, so it cannot infect/spread across the regular profile folder that's being used for the "regular private browsing" mode. This architecture allows all kinds of benefits, as everything can be filtered, cleaned, verified (, and shared with other peers) at the network level before it reaches the webview - whereas Browser Extensions currently cannot filter any HTTP responses because there's no API for that. AdBlockers currently are based on a disallow-list based concept, which means the advantage is always on the advertising side, and by default nothing is filtered; and scammers/blackhats have always the advantage. Once you add it to a filter list, lots of people's machines have been compromised already. But what if AdBlockers change instead to an allow-list based concept - meaning that the Browser maintains a list of resources that are allowed to load per-domain, and the default being just text and images? If you want to take a look at where it's at right now [1] [2], my Browser is open source; and I hope to fund development via a access fees for a peer-to-peer "Knowledge Tracker" that allows to share automations for the web with other peers, aka macros, reader-mode like extraction beacons, and other awesome treats (p2p search and recommendations are basically included in this concept). [1] https://github.com/tholian-network/stealth [2] https://github.com/tholian-network/retrokit
In Ask HN: How you would redesign a web browser?
Did you try to breakout using pwnat to get a public port? In enterprise grade environments it usually works :D I think I'd also try to run a UDP tunnel or try to use an amplification redirect on a UDP relaying proxy to get an open port that you can send requests through. Sometimes public DNS resolvers can help to punch a hole through the NAT because their IPs are allowlisted to unbreak secure browsing modes. > re: stealth I forked webkit into retrokit [1] these days and am gradually removing all APIs that could be abused for tracking purposes ... with the idea to create a minimalistic webview that is embeddable in a browser and still is able to parse/lex/render modern HTML5 and CSS4. This way I can later bundle nodejs with the retrokit webview that just displays the Browser UI that's served locally. [1] https://github.com/tholian-network/
Read the rest
In Nike.com's robots.txt
Note that among a sea of tracked browsers, the untrackable browser shines like a bright star. Statistical analysis of these values over time (matched with client hints, ETags, If-Modified-Since, and IPs) will make most browsers uniquely identifiable. If the malicious vendor is good, they even correlate the size and order of requests. Because that's unique as well and can identify TOR browsers pretty easily. It's like saying "I can't be tracked, because I use Linux". Guess what, as long as nobody in your town uses Linux, you are the most trackable person. I decided to go with the "behave as the statistical norm expects you to behave" and created my browser/scraper [1] and forked WebKit into a webview [2] that doesn't support anything that can be used for tracking; with the idea that those tracking features can be shimmed and faked. I perso
Read the rest
nally think this is the only way to be untrackable these days. Because let's be honest, nobody uses Firefox with ETP in my town anymore :( WebKit was a good start of this because at least some of the features were implemented behind compiler flags...whereas all other browsers and engines can't be built without say, WebRTC support, or say, without Audio Worklets which are for themselves enough to be uniquely identified. [1] https://github.com/tholian-network/stealth [2] https://github.com/tholian-network/retrokit (both WIP)
In No-JavaScript Fingerprinting
> Not Safari, WebKit. Not WebKit, WebCore. WebCore's API client is broken and leaked IndexedDB transactions into the ObjectStore of the WebInspectorUI. This was kind of bound to happen, as WebCore's InjectedBundle [0] for cross-process communication exposes all kinds of APIs for debugging, which are all dependent on the JavaScriptCore VM's memory/heap and callstack. Things like HitTestResult in order to be able to select an element in the DOM via the WebInspectorUI, for example. InspectorInstrumentations are littered all over the codebase, in the UI Process, Web Process and GPU process. WebGL and Media Codecs could probably result in a similar persistent state across the sandboxes if abused correctly. Source: Forked WebKit into RetroKit, trying to get rid of everything security-relevant that a locally embedded WebView shouldn't need [1].
Read the rest
In Safari and iOS users: Your browsing activity is being leaked in real time
What kind of features of electron are you using in the UI? If it's only http/websockets and the UI, you could try webkit2gtk or other alternatives. It's actually quite easy to build a gjs or Qt wrapper on Linux. WebKit(Legacy) from webkitgtk also builds on Windows. I am currently in the process of making WebKit into a webview that only includes websockets as an API, so the long term goal is to have a minimalistic webview that doesnt have everything that a browser has. [1] Maybe it makes sense to combine development efforts? [1] https://github.com/tholian-network/retrokit
In Portmaster – Open-source network monitor and firewall

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.