Firewalls, protection for older devices?

TidBITS Talk
21

My statement was specifically directed at those still using the outdated version of Google Chrome on macOS 10.13 (High Sierra) or 10.14 (Mojave). However, it should include any other Chromium-based browsers that are out of date (ie. running on macOS before 10.15 Catalina).

The current version of Google Chrome now requires macOS 10.15 (Catalina) or higher. Currently the macOS 10.15+ requirement is the same for Brave, Microsoft Edge, Vivaldi and Opera (even though their download page claims it works on macOS 10.13).

Interestingly, ARC browser requires macOS 12+ (Monterey), so if you are able to run it you should be getting current updates anyway.

While I admit to sometimes using out-of-date browsers for specific purposes, the unfortunate timing of Google Chrome’s pair of CRITICAL security issues with WebP and WebM at the exact time they moved from v116 (compatible with macOS 10.13 and 10.14) to v117, made using the old versions so much more dangerous than it might have been. When they list something as “Critical” it is generally because of the kind of vulnerability and that it is being found exploited “in the wild”, meaning attackers are using it now. This of course does not account for all other security fixes in Chromium/Chrome that may become greater hazards over time.

I edited my post above to clarify things and add reference to older Chromium-based browsers.

1 Like
22

Yes, but it’s important to note that the Chromium project, as a popular open source project, gets audited by quite a lot of people all the time. I would like to think that these problematic features don’t exist there, because some of the maintainers are more concerned about security than you and I am.

But unless you’re running Chromium itself (nightly download, compile it yourself, or one that come bundled with an OS distribution like Debian Linux), then your actual browser (Chrome, brave, Arc, Edge, Opera, etc.) is going to be the Chromium base with other stuff bolted on.

So MS Edge won’t be phoning home to a Google server. But it might phone home to a Microsoft server. (And I know it also has a pretty aggressive auto-update).

In other words, don’t write off everything based on Chromium just because there are things you don’t trust in Google Chrome. It is likely that some other Chromium-based browser doesn’t do that (but it may do something else you don’t like). You should evaluate them independently when doing your research.

1 Like