Skip to content

Bare 1.0.0-alpha.1

Choose a tag to compare

View all tags
@Shshtwy Shshtwy released this 20 Aug 21:32
· 30 commits to main since this release
v1.0.0-alpha.1
30097ef

Bare 1.0.0-alpha.1

The first release under the Bare name, and the first signed with Bare's own key.

This is an alpha. It has been built and used daily on one phone, a Pixel 10 Pro XL, and
tested nowhere else. Expect to find things that are broken. The list further down is what is
already known to be broken; please report anything that is not on it.

Read this before installing

If you have Chromium Extend installed, uninstall it first. A Bare release cannot update it,
and Android will refuse the install with INSTALL_FAILED_UPDATE_INCOMPATIBLE. This is deliberate.

Every Chromium Extend release, v1.0 through v1.4, was signed with chromium-debug.keystore,
which is checked into Chromium's source tree and is therefore public. Anyone can build an APK
that installs as an update over one of those. Bare now has a private key of its own, so the
signing identity changed, and Android correctly refuses to treat the two as the same app.

Uninstalling loses that app's data: tabs, history, settings and extension configuration. There
is no migration path, and there could not be one without keeping the compromised key.

Requirements

  • Android 10 or newer (API 29)
  • arm64 device. There is no build for armeabi-v7a or x86, so most emulators will not take it.
  • 302 MB download, and roughly the same again once installed. Chromium is large and this
    build is a single APK rather than a split, because it is distributed here and not through a
    store.

Verify what you downloaded

sha256  4e796a53c7dcc6ce2825fe163a8ba5a9b8e07cb710f88f81293b7db73b833efe
size    316,466,634 bytes

That confirms the file arrived intact. To confirm it is actually Bare, check who signed it:

apksigner verify --print-certs Bare-1.0.0-alpha.1.apk
SHA-256  ae:2a:0e:7f:b7:a1:32:ec:51:7d:26:a8:e7:c8:3d:27
         5e:83:74:7b:0a:77:7d:4a:42:22:5b:1d:34:32:71:a0
subject  CN=Bare Browser, O=Bare Browser, OU=Release

Nothing signed by any other key is Bare. You can also rebuild this release from source and
compare everything except the signature; see the README.

What you get

  • Real browser extensions, the desktop ones, with a toolbar you can pin them to
  • uBlock Origin pre-installed, the full version and
    not Lite, because Bare keeps Manifest V2 working
  • No Google check-ins, no telemetry, no AI features, no sign-in prompts anywhere
  • DuckDuckGo from first launch, with a No AI variant available
  • Save the media a page is playing, including from sites that only stream it
  • Video keeps playing when you lock the phone or switch apps
  • Hand downloads to another app such as 1DM, or keep them in the browser
  • Links stay in the browser instead of being thrown to an app

Sixty-eight patches against Chromium 153.0.7999.0. The full list is in
docs/patches.md.

Known issues

Media saving

  • An adaptive stream downloads as two files, video and audio, because nothing joins them yet.
  • Segmented HLS and DASH offer nothing. A playlist is not a video, and a lone segment is not
    playable, so neither is offered rather than handing over a file that disappoints.
  • On a feed that never reloads the page, the video offered may be one you already scrolled past.
  • DRM-protected media is never offered, and nothing here attempts to decrypt anything.

Elsewhere

  • Protected streaming is unproven. Widevine is detected but paid playback has not been exercised
    end to end, so treat Netflix and similar as untested rather than working.
  • The first incognito tab of a session is slow to appear, showing a blank panel or a fade.
  • Third-party autofill occasionally stops being offered until you navigate away and back.
    Bitwarden has been seen to go quiet mid-session.
  • Passkeys do not work. The API is restricted to Google-signed browsers, so any self-built
    Chromium is refused. Not caused by anything here.
  • Web push is gone, as a consequence of removing the Google Cloud Messaging channel.
  • Extension popups can be cropped, and the address bar gets squeezed when several extensions
    are pinned.

The README carries the full list with the reasons.

Reporting a problem

Bare has no crash reporting. Nothing is sent anywhere, which also means nothing reaches us on
its own. If something breaks, please open an issue with the site, what you did, and what
happened. If the browser closed itself, this captures the reason:

adb logcat -b crash -d > crash.txt

Please read it before attaching it. It can contain URLs and other things from your session.

Credits

uBlock Origin is by Raymond Hill and contributors, licensed under the GPL-3.0. It ships
here exactly as its author publishes it: downloaded from the Chrome Web Store, unmodified, not
repackaged and not re-signed, so it keeps its original extension id and his signature. Bare is
not affiliated with or endorsed by the uBlock Origin project.

Cromite and ungoogled-chromium were used as reference for finding the call sites that
reach Google services, which is the hard part of this work.

Full credits and licences are in the
README.

Assets 3
Loading