Hacker News Reader

Hacker News

Comment by wila | Hacker News Reader

Full thread

wila

Figured to try Brave as it keeps popping up.

Installed it and then noticed in my firewall that it is

- trying to connect to a number of IPs owned by google, umm OK

- sending a multicast SSDP UDP request on port 1900 to 239.255.255.250

So googled that and got this page: https://community.brave.com/t/why-is-brave-issuing-upnp-disc...

Which basically tells you that the first thing Brave does is to try and detect what devices are in your local network.

... and that's where my Brave experiment ends.

edit:

Also note that uninstall is completely silent, no confirmation that it actually completed.

The uninstaller also leaves behind the updater utility AND the Windows Task scheduler tasks that run the updater.

View on HN

Hi, we have logging-based auditing but missed UPnP -- it won't happen again, sorry for this oversight and thanks for pointing it out. What "number of IPs owned by google" did you see? We do not see but you may be in a different region. Thanks for any info.

https://github.com/brave/brave-browser/issues/5057

Just tell them to fix that since it doesnt need to be looking for Chromecast devices

The end

What kind of a Mickey Mouse (tm) operation providing a private and secure web browser wouldn't have fixed such issues from the start? Doesn't help me trust them.

They just pull from the Chrome repository before adding their own things, I dont know what you are expecting

Its like you never heard of Brave

You can just ask them to disable it and now you have your fictional higher standard team shrug emoji

I guess you did mention that you dont use Chrome, so this level of distrust is going to be foreign for most of us to relate to

I think your comment is a bit misleading as they aren't doing anything nefarious as you suggest. My guess is this is a carryover from Chrome and not something Brave decided to build; if that's the case your not getting more secure by staying with Chrome.

In evaluating Brave, you have to give it apples to apple comparison anyway. Brave vs. Chrome as its directly built on chromium. For compatibility, it shares the chrome app store too. I like to think of Brave as Chrome without most of Google but with all the benefits.

Anecdotally, I switched a colleague to Brave about 3 months ago. He decided to switch back to Chrome. Chrome was so much slower than Brave and added battery drain that he came back. I assume it was all the additional requests cut out (Google) or blocked by Brave (Adblocker).

I'm not claiming they are doing something nefarious.

Trust is something you have to earn. I do not install Chrome as I do not trust google. They have too much of my data already.

Brave claims at their main page:

"Brave is open source and built by a team of privacy focused, performance oriented pioneers of the web."

OK well they failed my 5 minute test.

Not having removed the SSDP parts is one thing.

Not uninstalling your updater after running uninstall is straight out sloppy.

You are implying that they are doing something nefarious by omission. Because it’s implied, you also gave yourself the escape hatch to say “Where did I say that?” When called out on it.

A reasonable person reading your comment would think you are claiming the Brave team added code to surveil your network. If they dig deeper through the link you provided, they learn that the reality is that they inherited code from the Chrome team that exists only to support Chromecast. The problem has been found, a bug has been filed and the feature will be removed.

But, most people won’t dig. They’ll take your comment at face value and walk away with a very different story than the reality.

Now I sound like I’m accusing you of being nefarious :p But, I don’t think you planned out spreading FUD. I think you were dissatisfied and wanted to share a strong version of your user story. Unfortunately, your story is so strongly worded that is ended up resembling techniques used by trolls.

They're the ones who are spamming with their marketing blogposts about just how great their product is. Calling them out with a strongly worded reply in the comments (after actually trying out the product might I add) is about the only counterattack for this spam.

You are trying to make me say things I never said.

What I did was try Brave out. I _want_ to like the product. On top of that I have a lot of respect for most of the people behind the project. As a security conscious person I looked at what kind of network activity there was on start.

After installing Brave, I notice things that IMO should not be there. After that I even spent the time to search what it was. The link mentioned by me in my post looks to me like it is a post at a forum from Brave. As someone who is not familiar to the project it is not clear that there is any bug report or bug filed, where do you see that?

There is also no indication to me that somebody from the Brave team replied to the post. There's 1 reply 6 days later, by an anonymous user, which explains what is going on, then 24 days later the thread is closed.

The reason I did not reproduce the text from the link is that it is pretty clearly stated down there. If I wanted to spread FUD I would not have provided the link.

You never said it. A reasonable person would infer it.

I spend too much time arguing with trolls on the internet for fun. I don't think you intended to, but your post uses a lot of techniques widely used by trolls such as: linking to the complicated, full explanation while telling an edited, "technically true" version that can be misinterpreted by a low-effort reader. Having an escape hatch is very important to them.

Again, I don't think you are trolling. You just ticked off the checklist of a troll by accident. I'm only being a pest in the hopes that in the future you'll put more consideration into how your writing is interpreted by low-effort readers.

Text is such a crappy medium for casual conversation. It's amazing the internet hasn't burned itself down.

This is preposterous. This kind of tone-policing doesn't belong here. A charitable read of what he said doesn't "tick off a checklist of a troll". The time to back down was a few posts ago.

I was over-sensitive. Dancing with highly refined trolls on other platforms does that to a person.

>most people won’t dig

Calling out us HNers as mindless with your 4 month old account is a bad look.

Most of us that do not use Brave at this point do not necessarily use Chrome. In fact, those of us that care about the issues raised by the OP probably use Firefox and/or Chromium.

It doesn't matter if Brave is nefarious or not. Extra data transmission means extra possibility for third parties to gain access to it... hackers, governments, etc.

Reply on news.ycombinator.com