Hacker News Reader

ChromeOS seems very interesting to me because it has managed to achieve a degree of security that no other desktop OS (Windows, macOS, and of course other desktop Linux, which are the least secure of the bunch) can even approach. It has been designed from the ground up to be secure: https://chromium.googlesource.com/chromiumos/docs/+/HEAD/sec...

- Verified boot backed by TPM.

- System services are heavily sandboxed: https://chromium.googlesource.com/chromiumos/docs/+/HEAD/san...

- New userspace is written in Rust: https://chromium.googlesource.com/chromiumos/docs/+/HEAD/dev...

- Web pages loaded on Chrome have no access to the device's filesystem, nor to user files.

- Android apps run inside a restricted container.

- Linux apps run inside a VM, which leverages KVM and a custom Rust VM monitor.

I think it'd be great if someone made a de-Googled fork of ChromeOS without all the Google telemetry and bloatware, because it'd be the perfect Linux distro for security-conscious individuals.

akyuuon Firefox has surpassed Chrome on Speedometer

In the Firefox Nightly blog, there is some discussion of the performance improvements they've delivered in each release: https://blog.nightly.mozilla.org

For example: https://blog.nightly.mozilla.org/2023/04/14/dropping-the-ban...

> The two big jumps are from these two fixes. Great job, Performance Team!

https://bugzilla.mozilla.org/show_bug.cgi?id=1444491

https://bugzilla.mozilla.org/show_bug.cgi?id=1815069

akyuuon Firefox has surpassed Chrome on Speedometer

Speedometer is one of the primary benchmarks used by the Chromium team as a proxy for real-world use of popular JavaScript frameworks: https://v8.dev/blog/speedometer-2

akyuuon RunInSandbox: Run/extract files in Windows Sandbox with a right-click

You can more or less get around this by using shared folders and logon commands on the .wsb configuration file [1].

For example, suppose you want to sandbox your torrent client. You can create a .wsb file to give the sandbox access to the torrent client application folder as well as your downloads folder, and specify a logon command like "C:\Shared\Torrent client\torrent.exe". When you click the .wsb file, a sandbox will spawn and the torrent client will automatically start, but it will only have access to the two folders you shared, not all the filesystem. And once you close it, the sandbox will be wiped, but the data on the shared folders will remain.

This can work for many programs, especially portable applications, games, and other software that doesn't interact with the broader OS. Just by sharing the program folder, you can get "persistence" in a way.

[1] https://learn.microsoft.com/en-us/windows/security/applicati...

akyuuon Tech Workers Aren’t as Rich as They Used to Be

https://archive.is/nshRv

akyuuon Mullvad VPN was subject to a search warrant – customer data not compromised

That's also surprisingly hard. Even assuming that every feature you need will work (which won't probably be the case), many popular websites as well as nearly all banking/shopping sites are behind Cloudflare, captchas or something else that doesn't like non-standard browsers at all. You will be automatically flagged as a suspicious user or a bot and will be prevented from accessing the site or be presented with tons of captchas. Google won't even let you access your account or Gmail.

At least that's been my experience. In fact, I've even encountered problems while using Chromium and Firefox on Linux, just because some sites didn't like the user agent.

In short, to use the modern web you need a modern browser, and modern browsers are very leaky and fingerprintable by design.

> Maybe VPNs should start to offer “browser anonymization” as a service.

The problem is that they'd need to render the website server-side and then serve it to you. That has their own problems, as the VPN provider now has total control of all web content you see.

That already exists, by the way: https://www.puffin.com/secure-browser

I'd say the most realistic options to avoid browser fingerprinting is either using Apple hardware or sandboxing the browser inside a virtual machine. And it's better to use Chrome because it has the most users by a large margin. Firefox, Brave and the new Mullvad browser do implement some anti-fingerprint mitigations, but they have few users so you'll stick out more.

akyuuon Mullvad VPN was subject to a search warrant – customer data not compromised

Not really. Modern web browsers expose a lot of information, such as your language, time zone, screen resolution, CPU and GPU details (number of cores, vendor, model...), etc. There's even <canvas> fingerprint which depends on your GPU driver version.

If you use a custom built desktop computer, you're going to have a pretty unique browser fingerprint because few people will use the same exact hardware configuration. On the other hand, if you use Apple hardware you'll look the same as other Mac/iPhone users. The other option is to use Tor Browser or Tails OS, but I don't think that's feasible for everyday browsing.

As other people have said, it's suprisingly difficult to have privacy on everyday browsing today. Personally, I blame Google. I believe they purposefully pushed modern web standards into maximum user data exposure for their own profit.

akyuuon Chrome Never-Slow Mode Prototype

It's probably in Google's interest to limit web bloat that degrades UX. AMP might be one strategy (with many negative aspects that many here will be familiar with), leveraging Chrome's browser share to impose limits might be another one.

Also reminds me on https://news.ycombinator.com/item?id=19038092 . I wonder if in the future we'll look at excessive JS bloat as we look at annoying pop-ups today.