Skip to content

Oblada 0.5.1

Choose a tag to compare

View all tags
@callb4ck callb4ck released this 28 Oct 12:13
0.5.1
6557d7d

Oblada 0.5.1 makes Safe Browsing work, with Google Safe Browsing's lists of phishing and malware sites, and fixes security holes an audit of Oblada's own code found: in Firefox add-ons' installs and updates, in pages opened again in containers, and in the Barrier. Firefox add-ons now install only from addons.mozilla.org.

Oblada is a Chromium web browser with Zen's sidebar, Firefox's containers and add-ons from both the Chrome Web Store and Firefox Add-ons. Its design follows Zen's: if you like it, consider supporting Zen. For Macs with Apple Silicon, macOS 13 or later.

What's new

Added

  • Settings > Oblada > Privacy can turn off each protection Oblada applies as it starts: HTTPS memory (HSTS) and connections kept apart for each site, web features that mostly serve to recognize you, shorter referrers, cookies kept 6 months at most.

Changed

  • Firefox add-ons install and update only from addons.mozilla.org.
  • Certificate Transparency is on, as in Chrome: sites' certificates must be in public logs.
  • Sites' wish to always be opened over HTTPS (HSTS) is kept apart for each site when it comes from inside another site's pages, as in Brave, rather than holding for pages only.

Fixed

  • Safe Browsing works: Oblada warns before opening sites Google lists as phishing or malware, and before downloading files from addresses on its lists. Settings showed it on, but without a key for Google's Safe Browsing API it never got its lists.
  • Security: another site could offer a Firefox add-on, or change where an installed one took its updates from, even if you said no.
  • Security: a page sending a tab to a container, AMP pages left for the original and peeks opened sites as if you had typed their address, so other sites could act on them as you.
  • Security: pages in containers could be prerendered, and searches prefetched, outside the container.
  • Security: only uBlock Origin's and Brave's own filter lists can run their most powerful scripts, lists come over HTTPS only, and their rules can't have pages report where you are.
  • Security: the Barrier checks where redirects lead, its questions (sensitive sites, Google sign-ins, blocked sites) can't be answered by the sites themselves, and only the page you picked an element on can add a filter.

Installing

If you have Oblada 0.1.2 or later, it updates itself: it looks for new versions once a day, or right away when you open About Oblada, and installs this one when you quit or from About Oblada's Relaunch button.

Otherwise:

  1. Open Oblada-silicon.dmg and drag Oblada to Applications. If you have an earlier Oblada, replace it: your tabs, workspaces, containers and extensions stay.
  2. Oblada isn't signed by a registered Apple developer or notarized yet, so macOS stops it the first time you open it. Go to System Settings › Privacy & Security and click "Open Anyway". If macOS says the app is damaged, run this in Terminal instead: 
    xattr -dr com.apple.quarantine /Applications/Oblada.app

Known limitations

  • After each update, macOS asks once for your Mac's password before Oblada can read its saved passwords and cookies: choose "Always Allow".
  • Firefox add-ons installed from somewhere else than addons.mozilla.org no longer update.
  • Passkeys work from a phone (QR code) or a security key. Passkeys kept in iCloud Keychain, or on the Mac with Touch ID, need a build signed by a registered Apple developer.
  • No Google sign-in or sync.
  • In full screen, the layouts with the address bar at the top lay the tabs and the toolbar out as Chromium does.

Source

Oblada's edits to Chromium are in chromium/patches/, one patch per file: PATCHES.md says what each one does and what it depends on. What changed in this version, in detail, is in its devlog. The README and CONTRIBUTING.md explain how to build Oblada. Safe Browsing's lists are Google Safe Browsing's. The Barrier is built on Brave's work: adblock-rust, brave-core's protections, which it follows, and Brave's lists, with uBlock Origin's scriptlets and the EasyList authors' lists. Updates are made with Sparkle. Releases are official builds, with Google's profile-guided optimization profiles, as Chrome's, Brave's and Helium's are.

Built on Chromium 156.0.8078.48.

SHA-256 of Oblada-silicon.dmg: 2d6c50c95b1e4fff2936661e78bbbd46fa290c2beb85cd6bc3fa344279f2c2b1

Assets 5
Loading