Slashdot Mirror

Use SRware Iron if you like, but don't fall for the hype. It's all about exploiting panic grab some bucks -- functionally speaking, Iron is the same as Chromium (not Chrome) except with some privacy-related settings (that are already user-configurable) removed entirely; using chromium and turning those settings off gives you every privacy advantage, without the slimy feeling that comes from reading

...
<mgreenblatt> Iron.. why not propose a patch based on preprocessor
                            defines that disables the sections you dislike without
                            forking the code?
<mgreenblatt> (assuming such a thing doesn't already exist)
<Iron> because a fork will bring a lot of publicity to my person and
              my homepage
<Iron> that means: a lot of money too ;)
<Kmos> rotflol
<Iron> what means rotful?
<mgreenblatt> Iron.. you're a large corporation that can dedicate the
                            time to support a fork of something as complicated as
                            chromium?
<Kmos> Iron: google about it
<Iron> yes there is enough time to support it
<jamessan> heh, you're expecting to make lots of money from making a
                      fork of chromium? that's quite amusing
<Iron> i dont take money for my fork
<Iron> but i have adsense on my page ;)
<Iron> a lot of visitor -> a lot of clicka > a lot of money ;) ...

Yeah -- the dude wants to use deceptive advertising (comparing his product to Chrome, not Chromium) to leverage Google's reputation as evil privacy-violator to make a mint with Google's ad network... and giving people a false sense of better privacy, reduces their incentive to try actual privacy measures like better search engine (ixquick/startpage), TOR, and the various extensions (available for Firefox and Chromium) that block various types of tracking and identifying information leakage.

As I said, keep using it if you like -- there's certainly no evidence it's backdoored or anything. But personally, I find the exploitative nature, and the recklessness regarding the effect of a false sense of safety, to be morally objectionable, and I feel people need to be informed about this to make their own choice.

The story of Iron: http://neugierig.org/software/chromium/notes/2009/12/iron.html where the developer confesses the motive for developing Iron.

Here's a blogpost dissecting the comparison: http://insanitybit.wordpress.com/2012/06/23/srware-iron-browser-a-real-private-alternative-to-chrome-21/

We managed to update running systems with package management for how long?

Yes, but we didn't actually manage to make it work with modern desktops. Firefox and Chromium both fail when the packages of libraries that they depend on are moved underneath the running process. It is fine to say that this is a package manager problem, but it has been a known problem for years and is still unfixed (telling the sysadmin that his users should all manually restart Firefox is not a seamless solution, even assuming that he notices the message and acts on it). You can hardly blame people for wanting a more robust desktop, with applications that don't start randomly crashing when the sysadmin (or an automated script) runs a background update.

I don't understand how FF/TB updates can happen flawlessly on Windows but they screw up every single time on Linux.

http://neugierig.org/software/chromium/notes/2011/08/zygote.html

On Windows, files are locked if any process is using them, which forces a design where updates install into a separate directory. But -- annoyingness of locking aside -- in fact I think that design is preferable. To start with, a given version of Chrome will know its files will remain unmolested by updates. Furthermore, when an update happens, the updater can write out a separate "update succeeded" sentinel after writing all the files out, making impossible for an aborted update to leave both the previous and next version in a half-working state. (On Mac, we take a similar approach; I don't know enough about Macs to know whether the versioned directories within bundles make this magically work.)

With all this in mind you might reasonably ask why Linux needs to be special: why we waste memory on this zygote process launcher and have extra buggy codepaths just to support an inferior update model. (Note that by using .deb files we also lose our tiny incremental updates.)

And to that I can only answer the thinking we had at the time: one, we wanted to be good citizens on Linux; one distinction between "lame port of a Windows app" and "real Linux software" is exactly whether you distribute as a tarball or as a package. Secondly, and more importantly, we knew that regardless of what we did for Google Chrome the Linux distros would attempt to stuff Chromium into their package manager even when they know it breaks the app, much like they've done to Firefox. Now that I've summarized it in these terms it sounds a little depressing, but there it is; with ChromeOS where we control the stack we have more intelligent updates.

Iron is a known scam. If there is a reason to use Iron, it is not for its privacy related offerings. You're better off just using Chromium.

I particular like the fact that the guy who forked Chrome into Iron, only did so to generate loads of traffic to his home page and hence get a bit more adsense revenue in. http://neugierig.org/software/chromium/notes/2009/12/iron.html

I've been wondering when /. would do a story on this. I've been using Iron as my secondary browser for when something doesn't work in Firefox. If you want more stable version of Chromium that protects your privacy better than Chrome Iron is a pretty good option.

Seriously, you should read the other guys post below who replied to this but he didn't quote his source.

Iron is just made by some sleazy german guy who can't understand code, he has just forked chrome to try and generate revenue. That is why he changes it to use his own extensions site laden with adverts instead of the default one as well.

Here is a very informative link:
http://neugierig.org/software/chromium/notes/2009/12/iron.html

This is probably the reason /. has never done a story on Iron before methinks. There are very reasonable issues with privacy and google, but Iron is hardly the solution.

Perhaps you should follow the links on his page, specifically this one: http://neugierig.org/software/chromium/notes/2009/12/iron.html

Not so gung-ho on supporting Iron after reading that, huh?

Is Iron a Scam? Yes

The article title appears to be too harsh, but basically somebody compared the Iron source code to the Chromium source code and found that the only real changes were to disable 3 items that were already user-configurable within Chromium.

Here's another article that suggests that the actual reason for the Iron fork was just to make money (using Google ads on their website) by taking advantage of peoples' fears about Google: The story of Iron

So if you really are worried about Google, you should also worry about the misinformation being spread by the creators of Iron. If you want to have access to the full source, I suggest installing Chromium instead of Iron.

There are issues with both the "open" and the "standard" part of a lot of what Google calls "open standards". Creating an implementation behind closed doors and then throwing it over the wall (even with the source open), then refusing to make any changes to it when people have legitimate criticism about it not being implementable in other settings due to fundamental flaws is neither "open" nor "standard". It's a bit better than what Microsoft was doing with IE in the late 90s, but only barely.

> Lastly, WebKit is not owned by Google.

They're working on it. As of a year ago, things looked like this graph: http://neugierig.org/software/chromium/notes/2010/02/webkit-commits.html and since then Google has been hiring more people to work on it. Give them a bit of time and they'll get there. ;)

> It's just an implementation of a standard, or a
> proposed standard

Except in many cases there is no standard involved, proposed or otherwise. Again, CSS Animations, which is more or less abandonware in standards terms (none of the feedback that has been submitted about the draft has actually resulted in any changes to the draft that I can see) is on the better end of some of the things Google is implementing in Chrome.

Again, I have no problem with them writing code. I have a problem with them calling random parts of the code they write "open standards".

Iron is really a scam, it just hardcodes turning off a checkbox in Settings->Under the hood that has the following title: "Use a prediction service to help complete searches and URLs typed in the address bar". See, there is a checkbox in Chrome for turning off the 'evil' communicating with google's servers. But if someone thinks it's easier to download a fork rather than bother to go and uncheck that checkbox, then more power to them.

I found an iteresting article from the Chromium blog (at http://neugierig.org/software/chromium/notes/2009/12/iron.html) where they post the logs the log of September 19, 2008 from their IRC channel where someone nicked <Iron> says he wants to make a 'privacy-oriented' fork of Chrome:

<Kmos> Iron: why not contribute to it, instead of forking ?
<Iron> because i removed all privacy-related code
<Iron> e.g. RLZ
<Iron> and URL tracking every 5 seconds after start
<Iron> the original chrome is heavily communitating to google...i
              hate that
<jamessan> all of those are supposed to have options to disable them,
                      iirc
<Iron> yes but they haven't options yet
<Iron> and nobody knows when the next beta is released
<jamessan> so work on getting the options added so they'll be there
                      for the next release
<mgreenblatt> Iron.. why not propose a patch based on preprocessor
                            defines that disables the sections you dislike without
                            forking the code?
<mgreenblatt> (assuming such a thing doesn't already exist)
<Iron> because a fork will bring a lot of publicity to my person and
              my homepage
<Iron> that means: a lot of money too ;)
<Kmos> rotflol
<Iron> what means rotful?
<mgreenblatt> Iron.. you're a large corporation that can dedicate the
                            time to support a fork of something as complicated as
                            chromium?
<Kmos> Iron: google about it
<Iron> yes there is enough time to support it
<jamessan> heh, you're expecting to make lots of money from making a
                      fork of chromium? that's quite amusing
<Iron> i dont take money for my fork
<Iron> but i have adsense on my page ;)
<Iron> a lot of visitor -> a lot of clicka > a lot of money ;)
<Kmos> and do you think google should support your fork
<Kmos> lol
<mgreenblatt> Iron.. it's always good to have dreams ;-)
<Iron> we are here in germany
<Iron> the press will love my fork
<Iron> i talked to much journalists already
<DrPizza> Why are you forking?
<DrPizza> to do what?
<Iron> to remove all things in source talking to google ;)
<jamessan> to get fame and fortune
<Iron> nobody here trusts google
<Iron> the german people say: google is very evil
<jamessan> yet you use google's adsense

I wonder why then Google now tops Apple in WebKit commits?

WebKit commit numbers

Hint: the green line is Google, the blue is Apple.

It adds free money for the guy that founded SRWare to get free money from repacking Chrome.

See: http://neugierig.org/software/chromium/notes/2009/12/iron.html

Why are you using Iron? It's a product the sole purpose of which is to produce AdSense clicks for its author, who has repeatedly spread FUD about "privacy issues" in Chrome to generate publicity around his project. It doesn't do anything that you can't do with vanilla Chrome by tweaking its options.

Anyway, you don't get the bug because you either don't log in, or (if you just posted as AC) your nickname is too short. It only manifests for longer names, which spread the sidebar to fit.

SRWare Iron was created for the sole purpose of earning the "creator" some money on ad revenue. To borrow from my previous post on the subject:

Everyone mentioning SRWare Iron should know about this little tidbit: The story of Iron. The article and the linked IRC log tell a very interesting story about a guy less concerned with having a good reason to fork and more concerned with making money off of adsense and publicity for creating a "privacy-respecting" Chrome which is basically a perpetually outdated Chromium with a few checkboxes in "Under the Hood" defaulting to off.

The guy who runs that blog does not try to hide the fact that he's a Chrome developer, and he admits that there is the highly unlikely possibility that the person who was asking these questions was not the person who went on to release Iron. I was skeptical as well until I checked out the log file itself and quite honestly it would have to be an incredible coincidence for this guy to be asking such questions and providing the information that he does in his attempts to glean information on the right way to advertise his product as well as how to go about renaming the executable. There's more that makes it very reasonable to believe this is the guy who went on to release Iron, so please don't dismiss it until you've checked out the log file in detail. If this was a supremely unnecessary and elaborate hoax it sure is pulled off convincingly.

Using Iron after reading this information made me feel like I was supporting the wrong guy here and I couldn't do it anymore, it was just too uncomfortable seeing that this guy was looking for adsense revenue and to make a name for himself. The attitude of this developer is not one I would encourage at all.

SRWare Iron was created for the sole purpose of earning the "creator" some money on ad revenue. To borrow from my previous post on the subject:

Everyone mentioning SRWare Iron should know about this little tidbit: The story of Iron. The article and the linked IRC log tell a very interesting story about a guy less concerned with having a good reason to fork and more concerned with making money off of adsense and publicity for creating a "privacy-respecting" Chrome which is basically a perpetually outdated Chromium with a few checkboxes in "Under the Hood" defaulting to off.

The guy who runs that blog does not try to hide the fact that he's a Chrome developer, and he admits that there is the highly unlikely possibility that the person who was asking these questions was not the person who went on to release Iron. I was skeptical as well until I checked out the log file itself and quite honestly it would have to be an incredible coincidence for this guy to be asking such questions and providing the information that he does in his attempts to glean information on the right way to advertise his product as well as how to go about renaming the executable. There's more that makes it very reasonable to believe this is the guy who went on to release Iron, so please don't dismiss it until you've checked out the log file in detail. If this was a supremely unnecessary and elaborate hoax it sure is pulled off convincingly.

Using Iron after reading this information made me feel like I was supporting the wrong guy here and I couldn't do it anymore, it was just too uncomfortable seeing that this guy was looking for adsense revenue and to make a name for himself. The attitude of this developer is not one I would encourage at all.

Iron is a joke. It's nothing more than a rebranded Chromium that some guy thought he could get rich off of.

Chromium Notes: The story of Iron
Is Iron a Scam? Yes

While Iron does not provide extra privacy compared to Chromium, it does disable some configurable Chromium features that could share information with third parties.

Iron really doesn't provide any advantage over Chrome with regard to privacy.

Finally, somebody who not just posts FUD but actually investigates. After reading parent's article though, I get the feeling that Iron does actually do exactly what it claims to do: improve the user's privacy by changing default settings that 99% of Chrome users never even heard about, let alone change them to appropriate values. Specifically the changes mentioned are:

privacy related:
- disables the Google suggestion service (which informs Google about what you're typing into the search bar before you trigger the search)
- disables a service called GoogleURLTracker (which informs Google about your location, so it can "localise" you)
- Chromium's built-in statistics recording and reporting functionality is shut off
- the Client ID of the browser is wiped out
- disables Google's alternate error pages (that invokes another Google service, that isn't really required for web browsing)
- disables a web resource service used to fetch new help tips for Chromium (another service that "phones home" is disabled)

other:
- changes the Chromium version number from 5.0.306 to 4.0.280 (Iron version number)
- number of thumbnails in the New Tab page is increased from 8 to 12
- number of days of history used to compile that data is increased from 90 to 180
- Chromium tips that are shown on the New Tab page to help users learn how to use Chromium are disabled
- dialog that Chromium shows new users when it is first run is disabled

To recap, this article headlines "Is Iron a Scam? Yes" actually lists Iron's diffs from the Chromium project (which btw is only the codebase for Chrome, which itself is not open source, thus we have no way to ascertain what the Chrome browser is actually doing in the background). These diffs contains modifications that ensure that most of the default behaviours of Chromium that "phone home" are disabled and can not be enabled through the options menu.

So no matter what kind of douchebags the developer(s) may be, they are actually delivering on what they promise - a browser that disables phoning home features. Again: these features can be disabled through Chromium's options menu, but most people won't because they don't know about them.

Furthermore they are doing this while also releasing their source code for everyone to see (and compile) so we not only see what changes they make to the privacy settings, but can also make sure they are not adding questionable features themselves. In any case, if you wanted to fork your own personalised "privacy enabled" browser from the Chromium project it looks as if forking from the Iron source will save you some work.

Iron really doesn't provide any advantage over Chrome with regard to privacy.

For what it's worth, I can confirm the logs that evmar posted. They begin at September 17, 2008, 3:00:30 PM EST in my logs for #chromium-dev on freenode. I idled in that channel since shortly after the Chromium release was announced. I'm not a Google employee or Chrome/Chromium developer, but I have used Chrome as my browser for over a year (IIRC).

Salient quotes from the log:

• <Iron> because a fork will bring a lot of publicity to my person and my homepage
• <Iron> that means: a lot of money too ;)
• ...
• <Iron> i dont take money for my fork
• <Iron> but i have adsense on my page ;)
• <Iron> a lot of visitor -> a lot of clicka > a lot of money ;)

Iron is a complete scam, avoid it. If you're worried about privacy, use Chromium compiled by your distro (don't want MS or Apple to get info about you, right?) and turn off everything that sends data to Google.

You're missing the main point. The changes made to Iron do not give you any additional privacy that downloading Chrome from Google and making a few configuration changes will give you. The point of offering Iron software is to drive visitors to the SRware site, which contains ads that give the developers revenue. The whole point was just a money making scam from the start, as The Story of Iron illustrates.

Or just use Chromium. SRWare Iron is nothing more than a rebranded Chromium build that some clueless scumbag wanted to use as his meal ticket.

Everyone mentioning SRWare Iron should know about this little tidbit: The story of Iron. The article and the linked IRC log tell a very interesting story about a guy less concerned with having a good reason to fork and more concerned with making money off of adsense and publicity for creating a "privacy-respecting" Chrome which is basically a perpetually outdated Chromium with a few checkboxes in "Under the Hood" defaulting to off.

The guy who runs that blog does not try to hide the fact that he's a Chrome developer, and he admits that there is the highly unlikely possibility that the person who was asking these questions was not the person who went on to release Iron. I was skeptical as well until I checked out the log file itself and quite honestly it would have to be an incredible coincidence for this guy to be asking such questions and providing the information that he does in his attempts to glean information on the right way to advertise his product as well as how to go about renaming the executable. There's more that makes it very reasonable to believe this is the guy who went on to release Iron, so please don't dismiss it until you've checked out the log file in detail. If this was a supremely unnecessary and elaborate hoax it sure is pulled off convincingly.

Using Iron after reading this information made me feel like I was supporting the wrong guy here and I couldn't do it anymore, it was just too uncomfortable seeing that this guy was looking for adsense revenue and to make a name for himself. The attitude of this developer is not one I would encourage at all.

Everyone mentioning SRWare Iron should know about this little tidbit: The story of Iron. The article and the linked IRC log tell a very interesting story about a guy less concerned with having a good reason to fork and more concerned with making money off of adsense and publicity for creating a "privacy-respecting" Chrome which is basically a perpetually outdated Chromium with a few checkboxes in "Under the Hood" defaulting to off.

The guy who runs that blog does not try to hide the fact that he's a Chrome developer, and he admits that there is the highly unlikely possibility that the person who was asking these questions was not the person who went on to release Iron. I was skeptical as well until I checked out the log file itself and quite honestly it would have to be an incredible coincidence for this guy to be asking such questions and providing the information that he does in his attempts to glean information on the right way to advertise his product as well as how to go about renaming the executable. There's more that makes it very reasonable to believe this is the guy who went on to release Iron, so please don't dismiss it until you've checked out the log file in detail. If this was a supremely unnecessary and elaborate hoax it sure is pulled off convincingly.

Using Iron after reading this information made me feel like I was supporting the wrong guy here and I couldn't do it anymore, it was just too uncomfortable seeing that this guy was looking for adsense revenue and to make a name for himself. The attitude of this developer is not one I would encourage at all.

http://neugierig.org/software/chromium/notes/2009/12/iron.html

Good choice. Iron is a very questionable project, and the developer has admitted that he's just spreading FUD about Google to drive traffic to his site to make money off ads.

Also, http://neugierig.org/software/chromium/notes/2009/12/iron.html

http://neugierig.org/software/chromium/notes/2009/12/iron.html

First of all, he is advocating pessimization of install on good operating systems (like BSDs or Linux) for the sake of the bad ones (like Windows). Second, and most important, is that the changes need not be so invasive as to change the entire APIs. If one must rely on a 3rd-party packages, one may provide that 3rd-party product — but without bundling it with one's own.

Most of the changes seem to be very small or necessary.

Look, for example, how pidgin installs itself on Windows — the GTK and spell-checker(s) are necessary and usually are installed during the pidgin install. But they aren't forked by the pidgin developers...

I don't think the comparison is valid. Pidgin is a Gnome project, so patches can go directly to the gnome source.

The extent, to which Google modifies the bundled 3rd-party stuff is also too great: go through the guy's own list and look for his own "fork severity" ratings...

Most severities are low, the ones that are high seem justified.

Not to mention, that things like JPEG, XML, and PNG, probably, didn't have to be installed on Windows at all — such basic building blocks are available from Microsoft themselves...

There certainly aren't any high-quality platform-independent libraries from Microsoft, otherwise Pidgin wouldn't require the GTK runtime.

Google could have picked GTK or Qt as the Framework, but I think they decided against it because they wanted to have more control over the libraries and maybe because of licensing issues.

Why aren't you convinced by their argument if I may ask?

First of all, he is advocating pessimization of install on good operating systems (like BSDs or Linux) for the sake of the bad ones (like Windows). Second, and most important, is that the changes need not be so invasive as to change the entire APIs. If one must rely on a 3rd-party packages, one may provide that 3rd-party product — but without bundling it with one's own.

Look, for example, how pidgin installs itself on Windows — the GTK and spell-checker(s) are necessary and usually are installed during the pidgin install. But they aren't forked by the pidgin developers...

The extent, to which Google modifies the bundled 3rd-party stuff is also too great: go through the guy's own list and look for his own "fork severity" ratings...

Not to mention, that things like JPEG, XML, and PNG, probably, didn't have to be installed on Windows at all — such basic building blocks are available from Microsoft themselves...

Google's own approach is to fork everything they use... Sure, they make their changes available, but, apparently, don't try very hard to just stick to the original versions of whatever they pick.

The more famous of recent examples are the forks in Chrome. The changes, that Google made to their own versions, are substantial enough for their forks to be incompatible with the stock versions in too many cases. Was that really necessary?.. Google thinks, it was, but I am not convinced by their argument. At all...

Hard to blame the device-makers for taking a particular snapshot of Android OS, forking it, and not wanting to retest everything for an upgrade six months later...

I always liked Sun's position, prohibiting forks of Java by the very license — for this exact reason. You may think, you need to fix this burning bug with "the fierce urgency of now", but, by creating your own slightly-incompatible fork, you are doing more harm than good. (Such local forks are only excusable, when the upstream project is dead or almost dead...)

Too many programmers, too few software engineers...

which is a perfectly good justification for releasing a fork. See SRWare Iron for an example.

Funny you should mention that, since it seems Iron was created just to make money like many other questionable app forks. If the author cared about privacy from the all-seeing google, he wouldn't put google adsense ads on his page.

I have Opera 8, and it supports greasemonkey scripts too. But, I was trying out unembed which parses your html page as an XML document and Opera didn't support that. Is Opera 9 any better?

I haven't a clue, but this guy or this guy might.

1. Draw a theme that "looks" like windows, with behaviour managed by Qt
2. Use system native drawing routines to draw widgets that look like native widgets, but whose behaviour is still managed by Qt
3. Use system native widgets (actually create an MFC button), gaining the look AND feel of the native platform

Specifically, Mono is working on Gtk#, which provides .NET bindings for Gtk+. Gtk# This effectively provides an elegant OO interface to Gtk+. There's also work being done to make Gtk+ fit into the Windows environment, using native Windows and Windows XP widgets.

With Mono, it's already possible to run the same binary on Windows, FreeBSD and Linux on multiple architectures (x86 and ppc are well-supported now, with others in the pipeline). Mono seems to slowly be achieving the write-once-run-anywhere mantra that Java never succeeded with on the desktop.