Hacker News Reader

Comment by Terretta | Hacker News Reader

In case you are interested in a wrapper for WebKit instead of for Chromium, but one that lets you use your favorite Chrome and Firefox extensions:

Orion Browser by Kagi: Very fast. Zero telemetry.

Lightweight, natively built with WebKit, made for you and your Mac. Industry-leading battery life, privacy respecting by design and native support for web extensions.

Orion supports Firefox and Chrome browser extensions natively. Whether you prefer getting them from the Chrome Web Store or Firefox Add-Ons... as well as bringing support for as many as we can to iOS…

https://browser.kagi.com/

View on HN

> Zero telemetry.

Q: Is Orion open-source?

A: We’re working on it!...[0]

Q: Is Orion truly safe if it’s not open-source?

A: The idea that "open-source = trustworthy" only goes so far...[1]

[0] https://browser.kagi.com/faq.html#oss

[1] https://browser.kagi.com/faq.html#ossprivacy

AKA they are 100% using telemetry.

Anyone, including you, can check that is not true. That is the beauty of a zero-telemetry claim.

its closed source...

yes, but you can analyze the traffic from the app if you cared too. the point is that you absolutely can verify their claims.

I’ve worked on projects that logged locally and only transmitted every ~60 days when they detected the right network (eg public wifi). So unless you monitor it continuously and permanently this isn’t true.

I know open source projects that update their code every 30 days. Unless you're continuously and permanently monitoring every patch of every library then this isn't true.

Run the Debian Stable version and you're spared such churn. The version you're running may lag the current one by a few points but that is a small price to pay for relative stability (as in 'know your daemons'). Security fixes are backported but new functionality is not. While not a perfect guarantee - remember the weak key debacle - this strategy does provide a stable baseline which, in contrast to proprietary software [1], can be audited for telemetry/data leaks/etc.

[12] yes, yes, yes, it is possible to run that proprietary tool through Ghidra (et al) to look for nasties as well but this is far harder, you don't just run a diff between two binaries.

but you can compile it and disable all those stuff with patch. With close source, we have to wait for 60 days, find the ip and block etc..?

Dealing with opensource project is way easy tbh.

Hopefully we can agree that even then, it still can be trivially caught by anyone serious into verifying the claim.

i mean, sure... but lets ignore whatever malware project you were working on. :)

lot of businesses live or die on the trust of their customers. don't they? arc's product is aimed at power users. surely if they were collecting telemetry and then trying to hide the fact they were transmitting it would be a critical blow when discovered.

so while i totally agree that they _could_ operate like that, in most cases there is very little to be gained and a lot to be lost by being intentionally deceptive.

so this will kind of diverge on what we consider as "proof", but i don't think that the software would need to be permanently monitored for a reasonable assurance.

the bar for proof would certainly vary though.

Imagine being more eager to review a thousand lines of code, which of course you can follow all the code paths, rather than just pull up the gui of a network monitor.

You can use a network capture util and will find that there is no telemetry. There’s an update check but you can disable it.

Don’t think it’s much different to use a closed source application than it is to use an open source app that somebody else compiled and put into your systems package repository.

Orion and Kagi (subscription search engine) are both great products, been using them for over a year, though I main FF.

>Don’t think it’s much different to use a closed source application than it is to use an open source app that somebody else compiled and put into your systems package repository.

What about the fact that in the case of the open source application, there are people not directly motivated to not mention problems for the good of the company, with the ability to look at the source code?

Can't wait for Orion to support Linux. As a Kagi subscriber it makes me feel salty, even though i understand focusing initial scope haha.

Try Palemoon - it is a decent multi-platform hard fork of Firefox with better privacy preserving options.

Try Falkon[0] by KDE.

[0] https://www.falkon.org/

It's really hard to see why would anyone use it. At least epiphany is getting a lot of new features.

This is great, with the one big annoyance that they don't use the actual native iCloud password keychain (and so, for example, can't interop with how that's also used to auto-fill passwords for apps on iOS, not just websites).

Orion does use native Keychain for passwords (and also uses iCloud to sync them).

It uses its own separate keychain entries (whatever the term is), not the stuff that's used by the iOS system level functionality.

That is by design of Keychain, apps can not access each others keychain, otherwise it would not be secure. There is no "iOS system level keychain" but all apps use a bucket in keychain - Safari uses one and Orion uses one.

The design of “passwords” on the Mac and iOS doesn’t make it seem like anything is a “safari” password.

You save a password to the keychain in safari, and then you go to the “passwords” system preferences panel and you see those passwords. Or the other way around—creating a password from system preferences makes it accessible in browser. It appears on the surface to just be a password app, not a safari bucket.

It also works this way if you use the iCloud passwords app from windows. All of your saved passwords show up there as well, despite the absence of safari.

I’m pretty sure the new Chrome extension also shares your existing passwords.

I think it’s a reasonable assumption that when an app claims to use the keychain that you will have access to all your previously saved passwords.

Safari uses the Apple bucket, that is also exposed through the Apple's Chrome extension and also when you go to System preferences Passwords pane.

When you view passwords in Orion, you are also viewing passwords saved on Keychain, just in this case Orion's bucket.

There are various system API's that allow apps to read from each other's bucket (obviously all Apple apps have access to Apple's keychain bucket). This is how you can autofill passwords from different keychains in Orion (for example Apple's - which I call Safari's because this is how typically passwords land in it).

While I started this by giving you the plug .. the lack of it being the same password bucket combined with not getting 1Password to play nice, is what prevents me from making daily use, or rolling it out across my engineering employee base. I really like it otherwise.

Actually 1pw should be working properly now, after an extremely long time

That is a deal breaker for me. I use auto-fill extensively and my browsing is 50/50 Mac and iPad so having a separate set of passwords on Mac and iPad is super annoying.

I use Orion on macOS, iOS and iPadOS and it is the same set of passwords everywhere.

I tried Orion a while ago: in that version background tabs with YouTube on pause made the bottom of my m1 air get very hot. I really liked that it supported chrome extensions but battery life was not great. I’ll give it another go now that I’ve been using arc for some time.

I use both actually, Arc and Orion. I love its support for tree-view of tabs and Chrome/firefox extensions. Arc is my main browser now.

Reply on news.ycombinator.com