i am a really big fan of the Kiwi Browser, but i have issues with the whole project in terms of security and trust. the latest Kiwi Browser app in the Play Store has been out for more than half a year, and there is no warning about the security of the users, and people that use Kiwi are not aware of the security vulnerabilities that older versions of Chromium now have. I suggest to either put a clear warning in the description in the Play Store or just remove the app altogether.
This is also a criticism. this is NOT how you treat your users.
TheEvilSkeleton
All 17 comments
Software doesn't magically develop security problems just because there hasn't been a release in a few months. Kiwi is still being actively developed. If there were a significant problem, it would likely be addressed.
What specific vulnerability do you believe is currently present in Kiwi?
robsmith11
on 31 May 2020
the latest Kiwi Browser app in the Play Store has been out for more than half a year
An outdated browser could potentially be the source of various security problems. This is why browsers like Chrome have an automatic update facility.
resynth1943
on 31 May 2020
Software doesn't magically develop security problems just because there hasn't been a release in a few months. Kiwi is still being actively developed. If there were a significant problem, it would likely be addressed.
What specific vulnerability do you believe is currently present in Kiwi?
As Resynth has said.
Software doesn't magically develop security problems.
That's just wrong. Outdated software does. Security problems are FOUND. This isn't its own software, if's chromium based. Chromium is subject of attacks and needs to be maintained.
Kellegram
on 31 May 2020
Check #94
hjyoung1
on 31 May 2020
@TheEvilSkeleton Understood you.
Will be solved by rebasing to follow future Chromium-versions.
Stay tuned.
kiwibrowser
on 1 Jun 2020
thank you so much
TheEvilSkeleton
on 1 Jun 2020
Duplicate of #94
ghost
on 4 Jun 2020
What personally concerns me is just the current state. I understand that an update is in progress, and I don't doubt the difficulty of merging in changes with upstream Chromium is immense... However, as it stands, there is still an incredibly outdated and insecure version on the Play Store that many people are downloading and using every day, likely even for sensitive tasks.
refi64
on 5 Jun 2020
What personally concerns me is just the current state. I understand that an update is in progress, and I don't doubt the difficulty of merging in changes with upstream Chromium is immense... However, as it stands, there is still an incredibly outdated and insecure version on the Play Store that many people are downloading and using every day, likely even for sensitive tasks.
@refi64 You may see more Kiwi in the spotlight than others, because all Kiwi dev is public.
True, Kiwi has the same security bugs as many big browsers (no need to name them, but you take all the big browsers with an older Chromium) for the same reasons (forked away from Chromium).
It sucks.
So what's the plan ?
Write scripts that auto-rebase Kiwi. After that, the Kiwi updates (related to Chromium) are going to be mostly automatic.
Boring, but safe and functional.
It starts in few days only, in the meantime, I don't want to argue too much. I think we'll have a rebase faster than we think.
kiwibrowser
on 5 Jun 2020
For the people paranoid about Kiwi, just use Brave, Bromite or another more frequently updated browser. No need to bother the dev with the same questions and assumptions. It' his project and time. This programs comes without warranty like all other free and open-source programs.
bitsper2nd
on 6 Jun 2020
For the people paranoid about Kiwi, just use Brave, Bromite or another more frequently updated browser. No need to bother the dev with the same questions and assumptions. It' his project and time. This programs comes without warranty like all other free and open-source programs.
@bitsper2nd What's the point of your comment exactly? The issues tab exists for a reason. If the dev didn't want to be "bothered" with issues he wouldn't be working on an open source project on a public platform. We have every right to contact the developer with any issues we find with their program and we did. We also already got a response.
This whole situation doesn't affect you negatively in any way, it can only benefit you and others who use this browser.
This also shows we worry about other users, who are unaware of all the existing old chromium exploits. Again, do not understand the point of your comment, you are just being annoying.
Kellegram
on 6 Jun 2020
Let's focus on what can be done, all users have valid points and I do appreciate everyone who take the time to share their opinion and/or support (both ways, and obviously thanks a lot to those who take a time to dig into the issue and get the complete picture).
To all, please keep the discussions oriented around tech cases instead of focusing on individual opinions; we already reached consensus.
The question is more about how to get the new release to land and I'll report back here once there is progress.
kiwibrowser
on 6 Jun 2020
We have every right to contact the developer with any issues we find with their program and we did. We also already got a response.
You have access to contact the dev, and mention the issue, but you are not entitled to make any demands on his time or software.
This also shows we worry about other users, who are unaware of all the existing old chromium exploits.
You don't know what exploits are present in Kiwi. You are making a baseless assumption. Either way, if you care about users, tell them to install ublock origin, umatrix or noscript. Those can help mitigate any possible security threat when browsing. My comment is for those that are just using the _oh my outdated chromium build excuse_, because they can't live without their software having a number changed. So I recommend to switch to another browser. I understand there is a lack of clear communication, but this project got recently open-sourced, and I understand the dev still is learning and will make mistakes.
bitsper2nd
on 6 Jun 2020
Let's focus on what can be done, all users have valid points and I do appreciate everyone who take the time to share their opinion and/or support (both ways, and obviously thanks a lot to those who take a time to dig into the issue and get the complete picture).
To all, please keep the discussions oriented around tech cases instead of focusing on individual opinions; we already reached consensus.
The question is more about how to get the new release to land and I'll report back here once there is progress.
@bitsper2nd not sure if you read that or not lol
TheEvilSkeleton
on 6 Jun 2020
@TheEvilSkeleton
Oh yes I read it. I think you close this issue. You already got an answer from the dev.
bitsper2nd
on 6 Jun 2020
@bitsper2nd Good point :)
@TheEvilSkeleton I'll close the issue for now.
I'll work on a separate repo for experiments related to the rebase:
https://github.com/kiwibrowser/src.next
See you soon
kiwibrowser
on 6 Jun 2020
Thank you
TheEvilSkeleton
on 6 Jun 2020
Related issues
rururux
路
5Comments
marcusatiliusregulus
路
3Comments
xmax000
路
6Comments
Chaniug
路
3Comments
Deepak1202
路
4Comments
Most helpful comment
@TheEvilSkeleton Understood you.
Will be solved by rebasing to follow future Chromium-versions.
Stay tuned.