gngr

> and/or have a lighter browser (without canvas, webgl, webrtc etc.) with better defaults (ie. no hardware access, location, notifications, cookies, history, etc.) for opening links, private browsing etc We are building one [1]. Contributions are welcome! In the meanwhile, the ungoogled-chromium project in combination with uMatrix is I think a great way to transition away from Chromium. [1] https://github.com/UprootLabs/gngr

There is one more called Firefox Debloat: https://github.com/amq/firefox-debloat/ ... though it hasn't been recently updated. We are developing `gngr` in the belief that privacy should be engineered into the browser, not worked around: https://github.com/UprootLabs/gngr

We are designing a solution in gngr here: https://github.com/UprootLabs/gngr/issues/219 In essence, the resolved address of a request will be checked if it lies in a reserved block. If so, further policy checks will be made for the resolved address, and the IP address will be pinned for that HTTP request. Would appreciate feedback here, or on the issue.

gngr[1] is a browser that champions privacy. It is a complete written-from-scratch project, and not just a wrapper around existing layout engines. Our current logo and website design, if you can call it that, is a developer created, few days effort. We would be very happy with some professional design help. Notes: * gngr is short for ginger, the spice. * The theme would be "spicy, but not shiny". [1]: https://gngr.info and https://github.com/uprootlabs/gngr

We are building one in Java https://github.com/UprootLabs/gngr

We do want to take an approach like this in gngr(1). We already have fine-grained permission control in the Request Manager (inspired by uMatrix, nee httpSwitchBoard). But your question is about even more finer control. Some thoughts: * I believe some of these APIs shouldn't be implemented at all, or should have very limited precision. Eg, Battery Status need not be implemented at all, or if implemented, should return just two values: [high, low]. * In our Request Manager, we could add an extra column for advanced APIs. This would include, for example, Canvas, WebRTC, etc. * @captainmuon's idea of having two different profiles (document/app) is interesting. Though the choice of profile should be on client side. The default should be conservative (document) and the user should get to choose if a site should be promoted to app or not. [1] :

> It should also be noted, for some time similar attacks have been possible via html/css [1] As it happens, this particular attack doesn't work in gngr [0]. The example uses an absolute positioned div to put extra text out of viewport, which is not picked up by gngr when selecting text. gngr also doesn't enable Javascript by default, so attacks such as that described in OP are not possible from random site visits. (I recommend uBlock / uMatrix for other browsers). However, the attack surface is really quite large here. CSS directives such as `opacity: 0.001` could be easily used to mask extra text. [0]: https://gngr.info/ and https://github.com/UprootLabs/gngr [1]: https://thejh.net/misc/website-terminal-copy-paste

> they'd take my work under my name and bundle their crap into it. Oh, is that a thing? I was surprised when the Lobo project's admin rights were handed over to some relatively unknown developer. I had a long and confusing discussion with the new project admin here: https://github.com/UprootLabs/gngr/issues/87#issuecomment-86...

Great point. Lately we have been reconsidering the request manager matrix shown in gngr. It was inspired by HTTPSwitchBoard's matrix, that has a separate column for XHR. However, like you pointed out, there are other ways than XHR to leak data if JS is enabled. If JS is not enabled, the kinds of data that can be leaked is fewer (perhaps screen resolution and size). Would welcome expert comments on our issue tracker: https://github.com/UprootLabs/gngr/issues/90

Thanks to @JetSpiegel I just became aware of Policeman. And I am not sure why you are nervous about RPContinued. So, I went ahead and created a wiki for this: https://github.com/UprootLabs/gngr/wiki/List-of-request-bloc... If there are any known issues with RPContinued or there are other extensions that are not listed, please feel free to add them. Thanks.

That's an interesting thought. Have created an [issue in our browser](https://github.com/UprootLabs/gngr/issues/54) to investigate our implementation further.