Leaderboard

Let me understand this correctly -- you're concerned about security implications of a protocol currently used by the majority of the world, this in the context of Windows XP (an OS that hasn't received security updates for roughly a decade)?

No need to add any firewall rules, it's not a routable address. I did not add any specific rules. In Windows 10 Firewall Control, Thorium is restricted to the standard web browser zone as all other browsers, too. The connection to the posted address was not allowed in this zone. Therefore, it was blocked automatically. No more, no less.

... Over the course of several previous years, "we" (UXP-users) have witnessed how the platform, in agony, struggled to cope with whatever new Javascript "feature" Google devs came up with, the most notorious of them being the non-polyfillable "operators" ("?.", "??"; read this excellent write-up by @InterLinked); at the time, I was semi-convinced that JS operators such as those would deal the final blow to UXP; thankfully, some talented UXP coders came up with own implementations of these operators, thus UXP was "saved" - but for how long? I'll have to side with NHTPG and, to a good extent, AstroSkipper that the last nail on UXP's coffin will be a "new" CSS-related "improvement" (sprinkle with a generous dose of sarcasm here ), implemented in a mixture of CSS code inside/alongside JS code (which seems to be the trend recently ); in the case of UXP, MCP's upstream (Mozilla) have CSS features implemented in Servo/Rust, so MCP can't backport easily, if at all, Mozilla code for these and get away with it; CSS-related UXP issues will keep piling up inside their tracker, with very dim prospect ... Case in point is a CSS bug that has been affecting GitHub in particular for many months now, it was acknowledged exactly one year ago, but so far no activity at all towards a resolution ... This particular "feature" was implemented only in Chromium 99, so it does "invalidate" the popular 360EEv13 and/or KafanMiniBrowser variants on XP/Vista x86; only implemented in Firefox 97, thus putting Mypal68 out of the game, too; if it weren't for the new "additions" (Supermium and its semi-fork Thorium) that appeared at a most opportune time , "we" retro-OS-ers (I just devised this term, ) would have run out of options...

Seems to be switched off by default. At least, in my installation for testing.

On my weak machine, these unnecessary connections do have an impact to my CPU and are counterproductive for smoother browsing. So, I am glad to have got rid of them.

Knocking on UDP, trying to make connections via QUIC, broadcasting to literally everything and everyone is the default chrome behaviour. The question is, why (if both @win32 and Alexi are trying to implement at least something similar to Ungoogled) didn't cut it out first. Seems like a very logical (and rather simple) first step.

why use some many filters and then use a smart phone that spies on you hundred of times a day ?

Librewolf appears to be a little better in that regard but I could not care less so long as they have no access to my bank $$$ Some people suffer from a notorious paranoia with google and other trackers LOL.

I think you mean the BPC filter list.

Saying they don't, in any perceptible way, would be a waste of breath, wouldn't it? Right! And the reason is crystal clear. On my machine, they definitely do. Otherwise, I wouldn't write something like that. Besides that, I don't like connections that have not been authorised by me.

My single-core laptop goes through 1.8 BILLION clock cycles a second. Take a few, they're small Because it matters not at all? And no, current Thorium and Supermium builds are *not* trying to be "ungoogled." For instance, vanilla Chromium doesn't have functional Google account/Sync(what can be more googled than that?), both Supermium and Thorium do. Think "Googled Chromium" Saying they don't, in any perceptible way, would be a waste of breath, wouldn't it?

Try this - without quotes! Despite what other users/user may tell you. --disable-features=WebUsbDeviceDetection

Could it be "WebUsbDeviceDetection"?

If I'm not mistaken, someone here still tries to tell it's all open source, so no problem to apply the ungoogled patches yourself, what stops you?

Thorium surely does add tracking parameters to your search. &newwindow=1&sca_upv=1&hl=en#ip=1 What's this "ip=1", especially interesting. Looks very much like a command to record/collect your IP adddress.

Usually, I do not use any Chrome or Chromium browsers under Windows XP. My daily drivers under Windows XP are New Moon 28, Mypal 68 and Serpent 52. And there is no such behaviour.

As I already mentioned in my Antimalware thread, Windows 10 Firewall Control is great and is doing a perfect job in controlling all system and application connections like, for example, Thorium.

This is actually very important since the browser scans GPU on startup. Your GPU and Driver may be blacklisted for acceleration, hence the delay.

Yes, there's such kind of behaviour in Win 7.

See what it looks like if you use the scaling switches I'm using. /high-dpi-support=1 /force-device-scale-factor=1 That fixed a lot of font issues for me.

OT. Last Vista one was probably based on Chrome 85, if I'm not mistaken. XP, most likely from 2016.

They say you need to launch from a specially created icon (shortcut), did you do that? https://github.com/win32ss/supermium/issues/531#issue-2275990442

A new public release of Supermium by win32 showed up a few hours ago, still on the M122 Chromium core: https://github.com/win32ss/supermium/releases/tag/v122-r4 As always, read first very well all the associated Release Notes and finer details ... FWIW, take note of: https://github.com/win32ss/supermium/issues/531 that is, if you're gonna use the provided installer to perform an "on-top update" (update a previous Sm installation), better reboot your OS before doing so (registry-entries related issue ...).

Sorry guys, this is all getting way off-topic again. General security and privacy issues are off-topic here unless they specifically relate to the Thorium browser, and only the Thorium browser. Thank you.

True that - but I prefer sp52 to pm. My rule is: for work related websites (unless unnecessarily scripted) sp2, for social mypal68. For sites that don't work in those two, supermium, or else tablet or linux mint laptop.

Guess I'm lucky I'm not everyone and Pale Moon still manages all "important" sites. The latter have certainly gotten worse, though I don't care about GitHub, X (Twitter), Facebook, Instagram, DRM encumbered media...pretty much don't care for 99% of the internet. Don't care about Firefox either, it has become a (buggy) monstrosity I don't recognize anymore and I have no time nor interest for seeking workarounds for stuff that recently worked as expected. I've set it up quite some time ago for the family member, assuming it will be "safer" option than Pale Moon...well that was a mistake, Firefox doesn't play videos properly anymore on a humble 5 years old laptop with Intel HD 610, it either lags and the sound is screwed up (with HW acceleration) or it lags and the sound is OK (without HW acceleration). Put Pale Moon on it and it's been smooth sailing ever since.

I would say security updates to the public because the large corps still pay for security updates up until 2025 at least for WinXP you can't believe how much I hate the crap W7 not only because they removed essential XP functions but there are things that get me angry

Of course, I meant BPCF. Just a typo. The additional but of course optional F stands for Filters

yeah, just not cheap. https://shop.tattiebogle.net/product/prod_EkTnv3Tk2Trxhf another one: http://www.zuluide.com/ and there is a thread in vogons: https://www.vogons.org/viewtopic.php?t=67897

QUIC via UDP works as a direct connection, including bypassing VPN. Those IPs Chrome pings at the start is only what you see, and only the tip of the iceberg. Most firewalls (to this date) don't know how to deal with QUIC's UDP connections, QUIC was meant and developed to pass through firewalls unnoticed. There is a topic regarding those sneaky connections. https://msfn.org/board/topic/186094-google-quic-is-vulnerable-to-cyber-criminal-activity-creates-a-‘black-hole’-that-hackers-can-exploit/

Oh, just found this! It's indeed Google tracking. Someone even asked ChatGPT. "The sca_esv parameter is a piece of data in the URL that's likely internal to Google's system for tracking, sorting, or customizing search results. URL parameters like these are often used for various purposes including analytics, session identification, and to tweak the behaviour of the search. " "Asking ChatGPT to brainstorm what sca and esv could stand for in the context of a Google search:" https://webapps.stackexchange.com/questions/172215/google-videos-search-sca-esv-query-parameter-possible-tracking

I am very satisfied with the efficiency of uBlock Origin Legacy when it comes to filtering and blocking unwanted content. Especially when you consider how old the original extension actually is. However, the decisive factor is the correct configuration and sensible selection of effective filter lists that are still compatible with uBlock Origin Legacy. And of course, the filters and rules you create yourself are also crucial, as they make everything even more interesting and effective. If the user proceeds in this way, then the combination of BPCF filter list and user script is the icing on the cake.

I see `ip=1` here in Firefox as well (it appears after clicking on "more results".

give it a chance

Slay

Crap

In my not-so-humble-opinion - "good". "Turnaround is fair play" - I remember the day when web developers developed for Firefox and did not care about other browsers! Especially nested tables and column widths, at least that's the one that comes to mind. You'd ask for assistance with something in IE (more so than Chrome back in the Firefox "and nobody else" era) on a web site like RyanVM or WinCert (perhaps even MSFN, was not here at the time) and you would have a HUNDRED "switch to Firefox" replies before your IE enquiry was even SEEN by anybody willing to offer assistance. St52 is my secondary (to Ungoogled Chromium v114) and I also keep a NM28 profile updated. So not "dissing" Firefox-based or Mozilla-based or UXP-based, not even sure what to call 'em, lol. I'm just *beside myself* when I recall the thousands upon thousands of "switch to Firefox" posts I've read over the last couple of decades. It's not exactly like Firefox / Mozilla has really "cared" about their userbase (ie, extension support). But hey, maybe Manifest V3 will be Chrome / Chromium shooting itself in the foot. The more choices we have, the better. Tough one, to be honest. Too many Linux distros didn't exactly help that cause. So just how many brower choices is "good" and how many is "bad"? No clue.

Many thanks for taking this "upstream" ; indeed, I now fully recollect that martok was/is responsible for creating that pref and the underlying code that is behind it (UXP #2030) ; actually, I had that pref toggled (to false) in my St52 "dirty" profile, but not in my "minimal" NM28 profile... Toggling that pref was necessary for me (in St52) for GitHub's "sake"; prior to Dec 2023, when a GH repo was being displayed in "Commit List View" (e.g. like that), a button is provided to the right of each commit entry to easily copy (with one click) the commit's HASH: Read more in a now closed Palefill issue ... However, after the mid-December 2023 "massacre" , GitHub have replaced their previous code (in many places, including the "Commit List View" mode) with "legacy-web-engines-excluding", "heavily-CPU+GPU+RAM-taxing" ReactJS scripts and, under the new status quo, toggling the referenced pref is no longer required for GH's re-iteration of the "Copy-SHA-button" ...

I already have! Most of the methods used in 360Chrome carry over. I am not the end-user and I do not have GitHub account for discussing on GitHub. The Official UNGOOGLED patches can be found here - https://github.com/ungoogled-software/ungoogled-chromium/blob/master/patches/series

... IIANM , the last (stable) version of Mozilla Firefox that has "official" native support for Windows 7 SP1 (both 32 & 64-bit) is the ESR channel of v115, currently at version 115.10.0 ... ... Release channel Fx-115.0 does indeed lack that fix, however that's NOT the case for the ESR channel of 115 (patched version was 115.2.1): https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/

Disallow UDP connections. It doesn't need them. Lookups can be done via https. Precise explanations. https://www.digitalcitizen.life/dns-over-https-secure-dns-lookups/

I'm trying the same, but in "go and write to the registry & wherever else you want" mode. Just installed the latest Supermium, pretty dramatic difference between the two (on a single core): Thorium's painfully slow but usable, Supermium pegs the CPU at 100% (just like the previous version) & has to be killed with Task Manager (which also freezes, so rebooting now). That explains it.

Hardware specs?

Thorium still has a dedicated website (not sure how old it is), but I don't advise to link to it, it has loads of Windows cr-cks, including his own, so don't get banned for posting his site! Or this topic might be locked, too! Thorium is still a distributor of highly illegal content.

8800GT is a very hot running card. You'd need a good cooling solution in a well ventilated case.

Some laptops, not all, have a BIOS function to leave only the nVidia GPU.

8800 GT to flash Quadro FX 3700 https://www.insanelymac.com/forum/topic/134631-8800-gt-to-quadro-fx-3700/