Zen browser had a backdoor enabled by default
github.com
github.com
For those not aware, Zen browser markets itself as privacy conscious browser however a serious backdoor has been found and multiple topics regarding its lack of privacy has been practically ignored.
It think it’s important to raise awareness of this as the browser is gaining popularity and it’s clear the devs lack the experience to secure the browser.
Edit Other github issues with lack of interest from devs https://github.com/zen-browser/desktop/discussions/5907#disc... https://github.com/zen-browser/desktop/issues/5947
(totally unbiased opinion from having just switched to it after apparently not enough research and not wanting to continue the browser hunt)
Current title made it seem like it's an active issue, when clicking on the link it leads to a discussion forum about "Telemtry and privacy issues", so even the title and the link does not match.
Sure, soon enough a decent non-chromium based desktop browser will come along, be it Zen or something else, but what about the mobile world?
Right now firefox is perfect for me: It makes the web browsable by allowing ublock origin, it syncs my tabs, history and bookmarks, it's great.
Moving to a scenario that we have a different browser on the desktop and a different one on the phone or, worse, the same on the phone but without adblocking sounds like a huge regression.
P.S. Regarding Zen: If you want to be taken seriously, or at least as something more than a toy project, teaching your maintainers how to talk to your (potential) users will go a long way. Telling them off will not gain you any friends. (I'm referring to the github discussion mentioned in a sibling comment: https://github.com/zen-browser/desktop/discussions/5907)
When Zen browser was posted here first I saw that the people behind it mostly seemed to be uni students in their early 20s so on their side I'd cut them some slack for inexperience but on the other hand it's why I'd never recommend anyone to run a browser fork like this, you might as well start buying birth control off Craigslist.
Lots of people recommending "forks of forks of forks" browsers and also linux distros these days largely maintained like this, but from a security standpoint it's kind of crazy.
> Zen Browser has Remote Debugger enabled by default (2024)
to reduce confusion (as issue title was updated)
> It was enabled due that zen was still a toy project and we needed people to easily open the debugger for easier bug fixing. This was due because zen was not in a daily drivable state and didn't gain any sort of popularity yet.
While the fix was merged promptly in this instance, they don't appear to have undertaken any kind of systematic reform.
Your premise that people should be able to market their project with promises and not live up to them, especially privacy in this day and age, is the real cancer. And people like yourself pushing the acceptance of this behaviour is cancer too.
And he is 100% right on this. The whole thread, or even that it got posted here on in shows the problem. It was just a bug. The maintainer fixed it. Open source works. You can't throw the whole project under the bus just because maintainer made a mistake, that happened to he a security problem.
What about the people who believe them that the browser is private when its not? What if genuinely someone relied on its privacy for their important work but in reality its not? This isnt about the developer. Its bigger than that and your ignorance on this is kind of part of the problem.
I wrote my post, because there is a strange thing happening when security bugs are discovered: Everyone seems to panic. And in every discussion on such threads people will throw in their alternatives that should be used because this one is clearly not up for the job...
Threads like this are actively hurting the project and the cause. The bigger picture is, that this behavior hurts all alternative projects. There is a constant barrage of problems that the maintainera are dealing with and everyone thinks, his problem should be solved first. This is not how building software works. As a maintainer you can't help everyone every time. And people like you, that run around on the Internet and create the feeling that the maintainer is careless, can kill the project. The mega corps have PR teams, that deal with problems like this. Because they know how dangerous this can get. Even Firefox isn't big enough that they can absorb all the shit that is thrown at them. How can some little project on GitHub deal with people like you? They can't and they can loose their project because of this.
I don't want that. I want alternatives to rise and thrive. I want an internet where sixteen browser engines are competing against each other, not two, or three. So please stop shitting on the little projects, that try to do better. Instead contribute, fill issues, and enjoy that it is possible to build together better software.
You dont know how many PRs Ive submitted to open source projects. So maybe dont make shitty claims yourself. I think holding people accountable for the statements they make is pretty much whats happening here. Yet people like yourself think its ok that companies or products say one thing but then do another.
But: this doesn't change the validity of my points.
Also: I assumed good faith, when I engaged with you. That was a mistake. After I posted my stuff here, I saw that you opened another thread on hn about Zen browser. If I had seen this earlier, I wouldn't have engaged with you at all. You are throwing around FUD about zen browser. I don't know why you are doing this, and I don't need to find out. As I said elsewhere, I don't care about zen browser.
Posting FUD (Fear, Uncertainty and Doubt) is the most useless type of content that gets posted. It gets upvotes, mostly because our brains are pretty much hardwired to engage with such content. I've sadly walked into that trap today.
Going to do a pretty thorough tidying-up of my PC after this. thanks for posting, OP.
How secure is the actual browser for example?
There was apparently another issue that could be described as a backdoor, and afaict this issue was fixed.
Now, if you are concerned about the privacy of Telemetry, that's an entirely valid concern. But we're techies, can we please at least use the right vocabulary?
And he is 100% right on this. The whole thread, or even that it got posted here on in shows the problem. It was just a bug. The maintainer fixed it. Open source works. It makes no sense to throw the whole project under the bus, just because one maintainer made a mistake, that happened to he a security problem. The last day this project closed 12 issues. Why is one issue, that was closed 7 months ago, such a problem, that we discuss this here? This is FUD against the project.