This is an old revision of the document!


Chromium's Flaws

As free software activists, we all enjoy using the latest and greatest in free software, but we need to make sure that the software we are using really does respect our freedom. Many users have expressed to us their desire to run Chromium web browser, since it appears to be fully free software, but it still fails in several ways.

Chromium, by default, has a number of issues that are of concern for free software users - even if all the source code is licensed properly.

What are the issues?

Queries to Google

By default, Chromium source code still has many lines of code that makes direct internet connections to Google. When building the software unpatched, much of the users browsing experience is under the control of Google's online web services. As mentioned in the article Who does that server really serve?, free and libre software is only free when you are in control and should not be depending on third-parties. Some work has already been done to free Chromium from this problem, including the removal of its so-called “speech assistant”.

Pre-built Binaries

By default, Chromium still includes some pre-built binaries to aid in faster compiling. In order to have fully free software, it is required that all software can be built from source.

DRM and Proprietary Codecs

Chromium supports the use of Widevine DRM, Adobe Pepper Flash, and third-party codecs which are non-free. Building the software is therefore complicated and users must ensure that these are removed from the source code prior to compiling in order to be called free software. To disable them is not enough. It is required to remove (support and references about it) from the source as per the FSDG.

Privacy problems

Users should always have full control over their private information. Chromium has a number of reported privacy concerns which made it ineligible for use with Tor. Issues include outstanding proxy bugs which leak an user's IP address, fingerprinting issues that leak the computers hostname and hardware, and timing issues that enable timing attacks even in the browser's “Incognitio” mode. Free software users should be aware of these issues.

The Bigger Picture

Chromium is also being used as an embedded framework in various projects.

Users should be aware that Qt WebEngine is based on Chromium and therefore contains many of the same flaws. Proprietary codecs and other anti-features must be removed at compile time to ensure user's freedom is respected. Due to Qt being a primary component of KDE and many applications, ensuring it is compiled correctly and removing nonfree software is of even greater importance to the Free Software Movement.

For our freedom's sake, free software projects should take care about all kinds of freedom issues when deciding what components to depend on.

We are hopeful that the various projects currently working with Chromium source code will make Chromium fully respect both users' freedom and users' privacy, making the internet safer, as well as more freedom respecting, for everyone.

Licensing

This is Free work, you can redistribute it and/or modify it under the terms of either:

The Creative Commons Attribution-ShareAlike 4.0 International License as published by Creative Commons; either version 4.0, or (at your option) any later version, or

The GNU Free Documentation License as published by the Free Software; either version 1.3, or (at your option) any later version; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.

Acknowledgement

Most of this documentation was originally written by Luke .R.