Hacker News Reader

Comment by M4v3R | Hacker News Reader

This is a nice initiative, but I would like to see the source code of this browser. Without it, I cannot be 100% sure that what Epic devs say is true and it's not an elaborate NSA trick to get our data :). No hard feelings, just in the light of current events as reported by NY Times/Guardian about NSA backdooring popular apps and crypto implementations the paranoid inside me has gotten more active lately.

View on HN

Source Code coming soon. We've made changes to many chromium files & we're a small team, so haven't had a chance to open source it all in a manageable way. In the meantime, don't hesitate to write us if you want to see any code or know any changes we've made. Or use Wireshark to see requests going in/out! Our philosophy is exactly that -- we don't want you to "trust" us, it should be private by design -- that's how Epic works. So for example, address bar auto-fill is all done locally in your system because we don't believe all your browsing should be passing through anyone's servers.

You guys are using something like git right? You have a tag for the build you created right? Why not just release a read only github account or tarball of the source released with epic to give people audit peace of mind now. Add a bunch of disclaimers saying 'we are not ready yet, please only use this to audit for now, we'll have a proper open sourcing setup soon'.

Great suggestion - thanks! Meant to put that in the faq that all code and changes would be available soon. Will do that very very soon! We haven't slept much the past week so give us a bit of time!!

I can sense your suspicion, but I wouldn't overthink it just yet. I'd imagine there's profanity or something in the git history that needs to be cleaned up before publishing.

That said, I completely agree - before believing this browser to be completely secure, I need to see the source and be able to compile it myself.

...not that I'd necessarily personally do that, but I'd like to know that people have.

Hidden Reflex? something hidden in your company name

Additionally it's based on Chromium, so there's not much source code to hide as many of us have a good idea of what the source code would look like.

Coming soon!! Write us if you want to see anything now!!

Do you have a changelog with an overview of changes you've made?

I think this along with the source itself should be something really high on your todo list if you want to establish a trustful image

Good thought -- thanks!! Will work on a changelog and making all code available very very soon! In terms of other issues, we and everyone rely on the whole open source community to be watchful over chromium and report any possible "backdoors"! It's a massive codebase and we're still a small team!!

Isn't releasing the source code a condition of using the open source Chromium code? Putting your code out should be effortless. Just put it out there; cleaning it up can happen later.

Which wouldn't change the fact that there might be exploits nested in the code

Reply on news.ycombinator.com