Slimium: Debloating the Chromium Browser with Feature Subsetting
dl.acm.org
dl.acm.org
[1] https://fgiesen.wordpress.com/2012/04/08/metaprogramming-for...
For example, allow access to the geolocation API, but give it a fake location. Allow access to third-party cookies, but shove garbage back at the server. Allow access to the camera and microphone but play a specified pre-recorded video back for both.
This helps get past websites that evilly require access to these permissions to function.
It also would help in the case of e.g. store websites that want your location permission to give you the closest store website, and in which I am okay with giving them a city-level accuracy (because I'd be entering the city name anyway in a manual search) but don't want my exact coordinates going to them.
Just keep a pool of a hundred million of them, and send some at random with each request.
I also wonder how many database backends this will trip up due to invalid IDs, though that's not really my intention.
The moment someone makes a one-click browser that lets the average person spoof all these things, then sites are going to start building captcha-style verification mechanisms like having to "wink three times" in your video to get it to proceed.
Deepfakes are already here, we have that cat (or mouse) taken care of.
You can try the demo https://demo.browsergap.dosyago.com/
and you want to go to the "Browser Geolocation" link at this site https://mylocation.org/
[0]: https://github.com/c9fe/ViewFinder
[1]: https://chromedevtools.github.io/devtools-protocol/tot/Emula...
Wow, what website is that evil?
Technically speaking, at least in German jurisdiction the way to completely be in compliance with GDPR is to not even load a single library or other asset from any third party servers (the point being that the third party receives the datum of the user's visit timestamp, their IP address, and the referrer) without the user's explicit consent. Anything else opens you up for issues.
I do believe in privacy and the general intent of GDPR, but EU laws shouldn't take effect outside their jurisdiction any more than Iranian laws or Chinese laws.
I haven't yet seen a website do that, but they conceivably could.
Is there a docker POC anywhere I can check out?
https://github.com/cxreet/chromium-debloating seems empty at the moment.
Selenium implies you have quite a bit of a developer stack, runtimes and SDKs installed too. It would be unfair to attribute all that usage to Chrome alone.
You can probably slim that down a bit if you needed, but installing your software on top might only take a few MB. So cutting chrome down from 60MB could well be a good goal.
Most of it is from this killer 266MB line, but unfortunately we need all these things:
apt-get update -qq && \
apt-get install -qq -y --no-install-recommends \
wget curl chromium git ffmpeg youtube-dl \
fontconfig fonts-ipafont-gothic fonts-wqy-zenhei fonts-thai-tlwg fonts-kacst fonts-symbola fonts-noto fonts-freefont-ttf && \
rm -rf /var/lib/apt/lists/*
Any 10MB here or there will help, whether it's from Chrome core or something else. If you have any suggestions I'm all ears!
In particular, the JavaScript engine could be modified in ways that would allow it to be tailored to the user's requirements such as to improve the speed of the rendering of web pages by having it ignore the huge amounts of dross/bloat that's now found in a large percentage of of web pages. Same would apply to user privacy, JS could be tweaked to either ignore certain requests for privacy-sapping info or where necessary spoof them with quasi-random junk ('quasi-random' here refers to data that's inaccurate but its format and structure still satisfies any validity checks the server may perform). The same philosophy applies to other aspects of browser operation that I won't bother to cover here.
To do this clearly requires a detailed understanding of the browser's complex operations and that's not easy for someone—even a good programmer—who only approaches a browser's internal functions as a means to an end to quickly change some facet of its operation.
It seems from what I've read so far, this paper could initiate new more detailed work and or lead to the development of tools that would make browser tailoring much easier and simpler.
For others, no, they do allow the minifier to break some sites: they analyze the Alexa top 1000 and check which functions get called and how often by those sites.
Edit: Or maybe the error handling can avoid killing a process? This is what the paper says, but I feel like a child process would almost certainly be killed:
> Code elimination is trivial because we nullify unused code with illegal instructions based on known binary function boundaries. Once the instructions triggers a Chromium’s error handling routine that catches an exception, an error page shows an “Aw, Snap!” message by default instead of crashing a whole Chromium process. (section 5, p467)
Code only gets pulled off disk and into memory, and out of memory and into the cache if it actually gets called yes? So the initialisation code for something like WebUSB would get called as the browser wakes up, but then never called again and the majority of it would never even make it off the disk. Are there really gains to be made here?
Having said that, the executable size in RAM is tiny compared to the runtime ram usage.
This needs a (pdf) in the title, because it's a pdf file, not an web page.
I agree about the parent point of marking PDF as such but still feel compelled to point out that a 4 MB PDF is not significantly bigger than a lot of regular pages that are posted to HN.
In this very moment the currently highest ranked link, which is just a regular web page, on the HN front page had a total network payload of 3,937 KiB according to Google PageSpeed.
I sympathize with what you are saying though in general, and I think it is sad that so much mobile bandwidth is needed in order to read stuff.
The way that I personally get around this is that when I am on mobile I mostly restrict myself to reading HN comments instead of clicking through on any of the featured links themselves. But depending on how you like to use your phone I realize this might not be feasible to switch habit into.
I think most people do not do this on mobile. Even among the HN crowd. For example, on iPhone that I use, Safari does not support extensions. So for most people on mobile the site will download everything.
Kinda makes you wonder why browsers don't have a built in (content based) deduping feature. I'm sure some users actually desire this behavior now that they're used to it.
Can anyone recommend a Firefox extension that can dedupe and clean your downloads for you?
Almost all of my storage used on my phone other media are PDFs, but I can't split them up like I would on a PC e.g. I want to keep the textbooks and datasheets but I don't need every paper I've ever read.
This worked well because the JVM code only ever called the native API I exposed and did not need to access the dependencies' APIs.
and a pony