Hacker News new | ask | show | jobs
Kiwi Browser - Android Chrome based browser with extensions support (github.com)
73 points by goldfix 2258 days ago
8 comments

I learned about this from a user of my Chrome extension who was having some issues. Most of the features actually worked out of the box, though the UI isn’t quite right. Very cool that it works this well!

I understand Brave will be adding extension support this year as well.

?? Brave already has chrome extension support. I do not get why this is highlighted as something special for chromium based browsers.
We’re talking about mobile browsers. Even mobile Chrome does not support Chrome extensions.
Wow, it used to be closed source before. I am surprised that it eventually went open source.
a website that showcased software that survived that transition would be entertaining, if it doesn't already exist somewhere.
If you find (or build) anything like that, I'm sure HN would love it. Personally, I'm concerned about my favorite reference manager, Qiqqa, which was open sourced when retired by the company that made it. As far as I can tell, there is 1 (maybe 2) coders maintaining and improving the software and maybe a few people catching and reporting bugs. It seems like a razor's edge, but the most active contributor is doing a great job. It would be interesting to see different projects succeeding and where others stagnated or fell apart.
Would you be less concerned if they had retired it without publishing the source code?
Of course not. I'm a little confused as to how you might think that if the case. I use it daily, and I'm invested in its continued improvement. I ask because I'd like to know how projects best succeed in the kind of situation.
A very important project because it is one of the two browsers on Android that support extensions (the other one is Firefox Mobile). I didn't know it was closed source.
It had a GitHub repo (https://github.com/kiwibrowser/android) described as "source code used in Kiwi", but it was just a Chromium codebase thrown there without the actual patches.

Glad to see it's open source now however there is no commit history (thus no individual patches) and it's not possible to see which version of Chromium this was forked from.

Yandex mobile does chrome extensions.
Thanks for letting me know. It is good to be aware of alternatives.
If you trust yandex enough to allow them to possibly gather all your browsing activity, passwords, ... It's like trusting tencent.
How about Google?
Do you have proof for this.?
I'm using this simply because it still has the address bar at the bottom.
It's interesting to see the different user preferences. For example, I can't stand the address bar at the bottom. But I find folks such as yourself who can't stand it at the top.

Very few browsers I've found let you choose.

Firefox Preview (why don't they brand it with the awesome code name Fenix?) does.
Because as a name it will die anyways. They just just rolled it out as Firefox Beta.

I wonder if Preview will remain at all than.

I use brave as my browser on an android mobile and I find that this has the perfect balance.

I hate reaching to the top of my phone to create a new tab.

coming back with the next firefox on mobile :)

beta already has it, but lost extension support (for now, slowly coming back)

I've been using this specifically for its extension support, and I'm just waiting until Firefox Preview can get extension support fully as I use Firefox on the desktop and I'd like for them to sync. I looked at other browsers like Brave but I just cannot trust them.
Firefox on mobile has extension support, I am using it right now?
It's gonna be replaced during this year with a complete rewrite.

Extension support is coming, but at the moment only uBlock Origin is available.

So to be clear, the existing Firefox on Android which has broad extension support is going to be replaced with a version with less extension support? Why? One of the biggest value adds of Firefox on Android is broad extension support.
It sucks? I switched from Chrome last year and am nothing but happy. Who decided it sucks?
That article doesn't explain anything about it. The previous Firefox runs (almost?) all extensions impressively well, with little required optimization.
That link doesn't seem to address why plugins need to be restricted to a whitelist? (Which might not be the end-goal, but Mozilla is quite cagey about it)
> So to be clear, the existing Firefox on Android which has broad extension support is going to be replaced with a version with less extension support?

Probably not. By the time the switch for release (non-nightly/beta) Firefox comes, I expect all the currently supported extensions will still be supported.

In the long-run, since the new architecture will be generally easier to develop, I hope that some of the WebExtension APIs supported on Desktop, but currently not on Android (on Fennec), will also become available on Android (on Fenix).

> Probably not. By the time the switch for release (non-nightly/beta) Firefox comes, I expect all the currently supported extensions will still be supported.

I think you're being too optimistic - the fact that the regular Nightly and Beta release channels have already been transitioned to the rewrite means that at the same time you've lost all large-scale capacity of doing any pre-release testing on the old version. While that one has been getting ESR-style bug fixes only for quite a while anyway, even those still need some amount of testing. So barring some major hold-ups, they're now committed to transitioning the Release channels in the near future as well, even if that means mediocre add-on support and quite a few other missing things.

And it's been clear for quite a while that they've decided on a https://www.joelonsoftware.com/2000/04/06/things-you-should-... -style rewrite for better or for worse...

I suppose that is why the replacement is called Firefox Preview, for the time being.
I'm using the nightly preview and it has:

- uBlock Origin

- NoScript Security Suite

- Dark Reader

- HTTPS Everywhere

- Privacy Badger

- Search by Image

I like the new UI: quick and intuitive. When you open a new tab, you see your most-visited sites, open tabs, and collections.

Liking collections, currently have 'Web dev' for my in-progress projects & servers and '{My city}' for local (health) news and other resources.

When I tried it a couple months ago, I remember being impressed but put off by missing features - downloads didn't work, etc. But it's looking better, good enough to use daily with Brave as a backup.

Ah, I'm on Preview stable, looking forward to some of these landing there.
They released a few more
The parent meant Firefox preview, the new version of Firefox on android, which only supports ublock origin as of now. Firefox preview will become the main Firefox browser on android as of now.
Oh, I thought it's some alpha version of the one I am using. My bad
Not for much longer. Future versions of Firefox Mobile (i.e. what is Firefox Preview now) will, as far as I know, at best have support for the Mozilla "Recommended" extensions, which is only a small fraction (e.g. no Greasemonkey/Tampermonkey).
The new one has very limited support
And you trust instead a closed-source browser which has not been updated in months? Aside from the trust component I suggest you to use an up-to-date browser because of the security vulnerabilities which affect them.
What are you referring to, Firefox? If not, Kiwi is open source, and I trust Firefox a lot more than Brave.
Kiwi: it is severely outdated and you installed it before it was open source.
csagan5: I give all the code of a large project, for anyone to use, with detailed and functional build instructions.

I don't ask for anything in return, and you can do basically what you want with it.

Ok, you repeat on this thread that your own browser (Bromite) is better and so on essentially spreading FUD, but for what result ?

We both have something else to do than spending time on that.

I did not mention Bromite at all, what are you talking about?

There is no FUD here, let me write down some facts for you:

* users install Kiwi which does not contain all the security fixes of upstream stable Chromium (v81); this is been going on for several months now

* users do the same for Bromite and the Bromite SystemWebView

I warn everyone equally about this problem, nobody should run an outdated browser because of all the security issues, look at 2019 alone here: https://www.cvedetails.com/vulnerability-list/vendor_id-1224...

More facts:

* the current version of Kiwi, in Play Store and in source form, still is not up to date and covering the security issues fixed by upstream Chromium

* Kiwi was not open source until now and its repository was plain lying about it (https://web.archive.org/web/20190719191635/https://github.co...), making people think it was open source while you published only a few unusable patches

* even now there is no commit history making the source code unusable and unauditable

* you included trackers at some point in Kiwi and visits were going to some search server of yours

Did I miss anything? I am glad you decided to open source it but it does not change the above facts.

How is it outdated when the versions on the Play Store are automatically built with the open source version, which got an update 7 hours ago? Even if I had used a previous version, my current version is up to date by now.
He is referring to the fact that Kiwi is based on a mix of different Chromium versions of 2019. Chromium does new release almost every month. It's difficult to keep track of Chromium modifications with such large forks (and Chromium had lot of performance issue at the end of 2019 too with stuttering and lags).

UCBrowser for example is an engine of 2017, Samsung Internet from 2019, etc

Why can’t you trust Brave?
Brave seems well-intentioned but really dodgy to me. In addition to the other issues that have already been raised, they were initially collecting money on people's behalf without their consent or knowledge [0]. The problem has since been resolved but their handling of it at the time put me off them for good.

[0]: https://finance.yahoo.com/news/prominent-youtuber-claims-bra...

Replacing ads with their own ads, running a cryptocurrency within the browser. I don't want microtransactions to view sites which I feel like is what Brave is hoping for in the future. I mean, microtransactions are the name of the game in cryptocurrency but doing so for online content is especially egregious.
Isn't it opt-in? I simply don't enable those features. You can even hide the Brave Rewards button in the settings.
Even if it's opt-in I still think it's shady and reflects on what the company thinks the future of its browser is.
When able to do so, many choose products based on principles regardless of how they use them specifically (hypocrisy and comparison of evils notwithstanding).
I love Kiwi Browser! If it was able to Save "Webpage, Complete", I'd use it as my mobile daily driver.
Send a PR... It would probably be easy enough to add...
Bromite needs more love from this community!
Beware, the binary .apk's have unreleased patches you can't get from compiling yourself.
On their Github page they say

> This code is up-to-date and is matching the build on the Play Store.

which seems to be in conflict with your statement.

How did they check and verify that?
Since there is no commit history I would also like to know which Chromium version this is based on, so that a diff can be made.
That sounds shady. Thank you for the warning. How does one determine that?

Also not found on F-droid. Hard pass.

F-Droid has the same potential tampering issue: apps there are signed by the F-Droid key, not the developer’s key.

An F-Droid compromise could backdoor every app.

Any history of this?

For anyone: Why don't they cross-sign with their key+dev key?

Because the builds are (generally) not reproducible
I think cross-signing implies adding a second signature (notarization) to an existing dev-signed build, not doing a rebuild.

Does apk support such a thing?

Check out Bromite, they have an F-Droid repo that you can add to F-Droid!

Not affiliated with Bromite, just cycling accounts, can point toward my last one if anyone's concerned about this acct's greenness.

You got my hopes up but Bromite doesn't support extensions according to their FAQ https://github.com/bromite/bromite/blob/master/FAQ.md
My chosen threat model does not allow for significantly less security in exchange for extensions.

Also, they may very well take PRs for extension support (haven't looked through their Issues/roadmap), but, I'm sure it's not on the top of a security-first project's to-do list.

Evidence