Paid / Premium support

[jamchowder]

I'm using Cromite a little different to most users (programmatically, business use) and would love to be able to pay for support and potentially fund / create a bounty for particular features. Is this possible?

[uazo]

I'm using Cromite a little different to most users (programmatically, business use)

interesting, how?

to pay for support

do you mean to pay me? thank you but no, I am not interested. cromite must remain free of any commercial commitment.
if I can, I do it for free like now.

and potentially fund / create a bounty for particular features.

what do you mean? I would remind you that the code for any product derived from cromite/bromite must remain open.
if the feature is privacy-related, I would be happy to evaluate it (for free).

Concerning a financial contribution to the project, and only to the necessary technical infrastructure, I am thinking about it, but it is not easy to manage, because I would like that to be public as well and not linked to me personally. but I don't know how to do it.

[jamchowder]

The business does a form of fraud detection and we automate most of the usage of Cromite using puppeteer. If you want to drop me an email (see profile) I'm happy to share many more details privately.

Cromite is really great but we have a few annoyances/workarounds for things in it, and it's worth it for us to pay you (or any other contributors) to add new features to the core codebase (i.e. public and under GPL3) that would benefit us. I am happy to pay in any form: promise of future payment when you have a contribution program set up, cash slipped under your door, paid directly to a charity of your choice, if any contributors freelance professionally then I can pay for their time to work on Cromite, etc.

Right now, we frequently change the following settings using an android automation app (Tasker/Autoinput) but it is error-prone. The feature we would LOVE is the ability to set the following settings programmatically:

• proxy settings
• timezone
• languages
  I'm not particularly fussed about how this work - we can send an intent or edit a config file in shared storage quite easily.

Lower priority because our mitigations work okay, but several of the anti-fingerprinting methods in Cromite make it too obvious that the browser is not a vanilla Chrome (maybe fine for privacy but not for our purpose) - i.e. we need webrtc active but to still not leak the IP, the canvas fingerprinting mitigation is easily detected, etc. I would be happy to tell you what we know about these and / or fund improvements.

[uazo]

your request is special, and I won't deny that I have already thought about how to externally automate the change of some settings, aimed at creating a test site.
it scares me a little what your company's goal is, it sounds to me so much like one of those software that changes browser fingerprints for bot automation. and I wouldn't want cromite to be used for that, although I cannot deny it.
Is that your goal?

[jamchowder]

We're essentially attempting to appear as a real user for fraud prevention, although there are parallels with what happens in the blackhat/bot automation world.

I'm happy to share all details about who we are and what we're doing privately - we're a legit company based in the UK, VC-funded, blue chip clients.

[uazo]

I'm happy to share all details about who we are and what we're doing privately

no sorry, nothing private with me.

we're a legit company based in the UK, VC-funded, blue chip clients.

Sorry, I didn't mean to question it.

I tell you what I would like to do, then you decide how to fit in.

for years now in reality, I would like to set up a test site on the feature of cromite, starting with the anti-fingerprint and then on the other features.
the idea, however, is not to use the internal framework already present in chromium, because it would force me to develop test code in c++ and java, but above all because, a few years ago, i had tried it and the infrastructure setup was unreliable and complex. i would like something that can be easily reproduced by others and also at low cost.

Moreover, I would like to use as a basis the tests that the chromium team (but also mozilla) does in wpt, also because there is a framework already available in javascript that seems to be able to do everything already (i.e., setup of workers, exchange of information between iframes, etc.). they use that to test the browser (blink side), so I think it is the best available.
if necessary, I was thinking of adding specific js api for data retrieval, under content setting and specific flag, allowing me, for instance, to retrieve browser-side logs:

my assumption is that such a code:

browser side
if ( should pass through here ) {
   write in the retrievable log that he passed through here, together with this XXX information
}

because that's what, for better or worse, I do when I test one of my change, so it's already natural for me to do that.
Extending those api in allowing the modification of settings is feasible, already the desktop settings pages work this way. all the code is already present in chromium, it just needs to be adapted but I don't have anything to find out because I have already analysed it.

however, it is a matter of doing:

• list all the features to be checked, what to check and, if possible, the code of other tests already on the Internet to be used as a template
• verify the necessary server infrastructure, considering that it must be easily reproducible (and low-cost) by whoever wants it
• do some testing to see if the hypotheses hold up
• Understand whether it is possible to use tools such as browserstack for verification on different devices
• figure out what's really needed on the browser side, considering it would be nice if it worked with other browsers that wouldn't have those api

only afterwards begin to develop.
you understand me because I consider it a project within a project...

[uazo]

I would add, but this is a relatively young thought, that I could also enable android-side extensions and take advantage of those to add specific api, I would kill two birds with one stone, plus I would start to see how extensions work in chromium, which I don't know about at all and could do the most anti-privacy things in the world.

[jamchowder]

That all makes sense! It's a big job, but let me know how i can help. Although in the interest of moving forward without overloading you, we are experimenting with rooting our devices to change the relevant settings directly. Early experiments are looking promising.

Question: We want to change some of Chrome's code directly to be able to use custom apks with some tweaked behaviour. It looks like the only thing we need to do is fork the repo, add the relevant patches, and run the "Build cromite" github action - is that right? Is there something we're missing?

[uazo]

we are experimenting with rooting our devices to change the relevant settings directly.

I'm glad you found a workaround.
in reference to changing settings via root, yes, I am aware of it, it is a nice security bug that I would like to fix with #76 but i'm waiting for chromium team to finish https://issues.chromium.org/issues/40227925 to see if they introduce something in android that doesn't have direct support for encryption via os (c++ side)

and run the "Build cromite" github action - is that right? Is there something we're missing?

that action only works with my runner because it supports docker on docker. the choice is due to the fact that I wanted the build phase to be public as well (and in safety).
you can use this script #617 (comment) for infrastructure setup

[Xisrr1]

no sorry, nothing private with me.

😇