cookiengineer

retrokit

C++2021–2026

cookiengineer / retrokit

retrokit

:joystick: Bring back the old Web(Kit) and make it secure

Web Development Security & Privacy

Explore on GitHub Read Hacker News discussions

2Distinct people

16Mentions

0Explicit recommenders

56GitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

:joystick: Bring back the old Web(Kit) and make it secure

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

tholian-network/stealth · linked in 4 of the same discussions
webkit/webkit · linked in 3 of the same discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 8:03:49 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year16 dated mentions

Observed mentions: 2021-12-27 21:38:45 UTC to 2026-01-10 07:31:10 UTC.

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Comments
2021	2021-01-01 00:00:00 UTC	2022-01-01 00:00:00 UTC	1	1
2022	2022-01-01 00:00:00 UTC	2023-01-01 00:00:00 UTC	8	8
2023	2023-01-01 00:00:00 UTC	2024-01-01 00:00:00 UTC	3	3
2024	2024-01-01 00:00:00 UTC	2025-01-01 00:00:00 UTC	1	1
2025	2025-01-01 00:00:00 UTC	2026-01-01 00:00:00 UTC	2	2
2026 (partial)	2026-01-01 00:00:00 UTC	2027-01-01 00:00:00 UTC	1	1

What Hacker News says

3 sources

cookiengineer·Sep 22, 2023

That's what I did with WebKit [1] because it turns out servo is not as modular as it was before. And Gecko is the definition of monolith, so removing the attack surfaces is impossible, even TOR has a crappy replace-with-stubs approach that breaks with every internal API or bridge change. Need contributors and other maintainers though, because keeping up with upstream is impossible as a single dev. I tried to document the attack surfaces [2] from my cyber security perspective as good as possible, with tasks left to do and which need to be eventually removed. It's probably pretty opinionated because I want to use RetroKit as the webview for my own Browser Stealth which acts as a filtering proxy, scraper and decentralized cache [3] [1] https://github.com/tholian-network/retrokit [2] https://github.com/tholian-network/retrokit/blob/main/SECUR

Read the rest

I... [3] https://github.com/tholian-network/stealth (ongoing rewrite in golang)

In I'm fed up with it, so I'm writing a browser

cookiengineer·Aug 7, 2023

The sad state behind KaiOS is that the dev docs are basically useless. There is this guy who maintains bananahackers.net which was a google page for most of the time with all kinds of instructions to get debugging other webapps going, but if you have a device without the GSM code unlock support then it's kind of useless. The Firefox debugging support from old ESR versions (pre ~42 versions) are super outdated and don't work anymore if the rest of the system is updated, because they heavily rely on the android-tools, so making them work with a snapshot of an 8 years outdated linux distro is also very painful. I had a nokia 800 tough for a while, and I was having a gaia fork which you could install on it, together with the system apps. Backups of it still there in case anyone is interested to reboot a fork, I gave up fighting against the DM

Read the rest

CA bullshit takedown requests coming from everywhere, because it's just not worth my time anymore. WhatsApp support was kind of weird because they built a custom web client which somehow worked, but not inside Europe and only globally (e.g. when traveling abroad), so I'd assume there was some kind of geo-regional deal with them being allowed to support KaiOS while maintaining their own web app for it. Oh, before I forget it: most unlock procedures rely on the Android kernel rooting technique that has a MediaTek chipset, because the SDK app and root backdoor was leaked a while back. So if you plan on developing anything, you should choose a MediaTek chipset which is a little older (pre-2018 ish). Note that all the FirefoxOS based WebIDE-reliant workflows require a Mozilla Firefox from before the Certificate Authority fuckup in 2020 when they bricked _all_ extensions irreversibly, including the ADB helper extension which you have to fork and modify to get it to run again. This also means that any time your system is having a date time set to post 2020, you're done and nothing works again. I wrote them together on the blog, not gonna link it though because of DMCA bots. As feasible alternatives there's a bunch of other projects which started using WebKit, Servo and others; but either are dead by now or are unmaintained. I'm gonna link them here just in case you're interested in those. I did my own fork called RetroKit a while back, with a different focus on Privacy; which was coupled on my Pinephone with an ArchLinuxARM kernel and autostarted to host the webapp/"app screen" of my pentesting tools. This was done using a simple systemd service that autostarts the web service for controls and the UI as a fullscreen GUI window process with Restart=always. [1] (unmaintained boot2servo) https://github.com/fabricedesre/servonk [2] (electron based) https://github.com/webianproject/shell [3] (unmaintained boot2gecko based) https://gitlab.com/nuinalp/open-source/icewolfos [4] (KaiOS hacking page of Ivan) https://sites.google.com/view/bananahackers/home [5] (Not maintained on GitHub anymore due to 4/8chan raids, moved my stuff to my own local instance) https://github.com/tholian-network/retrokit

In Ask HN: Are there any FirefoxOS revival projects, except for KaiOS?

cookiengineer·Jul 12, 2023

The current CVE-2023-37450 seems to be related to the InjectedBundle API, which also allows IndexedDB access. Back in 2021 there was the "history leaking" bug where you could write a little JS code to access the devtools whose window shared the IndexedDB with the rest of all tabs (and cookies, and userdata etc). If you take a look at the recent WebKit commits, it seems like there were a bunch of bugs related to the InjectedBundle, that's why I am assuming it might be a critical RCE that results in yet another use after free in the IndexedDB or related code. Back when I forked off RetroKit as a WebKit fork, I also decided to reduce the attack surface in terms of what is shared across the web contexts. I decided to remove a lot of APIs that I thought were too unsafe, both in terms of tracking and exploitation. [3] [1] https://googleprojectz

Read the rest

ero.github.io/0days-in-the-wild/0day-R... [2] https://github.com/WebKit/WebKit/commits (see also the other release versions, not only main branch) [3] https://github.com/tholian-network/retrokit/blob/main/SECURI...

In Ask HN: What happened to Apples “rapid response” security updates