Bare 1.0.0-alpha.1 RC2

Bare 1.0.0-alpha.1 RC2

Second release candidate for the first alpha. RC2 adds twenty-eight patches on top of RC1. Most came
from feature requests and bug reports shared by the Reddit and GitHub communities, along with
problems I found through daily use and testing.

Bare is Chromium with the Google parts taken out, maintained as a patch series rather than a fork so
every change stays readable. It is still alpha. Treat it as something to test, not something to
depend on.

What's new in RC2

• Dark AMOLED theme.
• Bare checks for its own updates on GitHub — automatic, manual, or manual with a weekly
  reminder. You pick during setup.
• Roughly 20 MB smaller.
• Fewer background requests to Google. Account lookups at startup and in the address bar are
  gone, and no push-messaging tokens are registered any more.
• Google sign-in and sync are now unreachable rather than just hidden, and "Send to your
  devices" is gone.
• Removed the "Sign in to Chrome" password row from Safety Check.
• Fixed the welcome screen on Android 12, where it could show up as an empty circle.
• Fixed the Start button overlapping the footer on shorter screens.
• Crash fixes in settings search and Safety Check, and the bottom-bar buttons no longer
  misbehave on a long press.

The rest of this page is the detail behind each of those, plus what has not changed.

Highlights

Already using RC1? This section has not changed.

• Real extensions, including Manifest V2. Chrome Web Store extensions install and run, MV2
  included, with an extensions toolbar on phone layouts and working context-menu items.
• uBlock Origin is built in. Shipped inside the apk exactly as its author publishes it —
  unmodified, not repackaged, not re-signed, keeping its original extension id and signature.
• DuckDuckGo by default, with DuckDuckGo (No AI) available and support for adding your own
  search engine.
• Bottom toolbar. Address bar, tab switcher and an incognito toggle within thumb reach.
• Send downloads to your own download manager, or keep the built-in one.
• Background media playback on sites that support it, plus a Video autostart site setting.
• Save media from a page, including audio and video the page streams rather than links to.
• Third-party password managers work — Bitwarden, 1Password, Proton Pass and similar, once
  Android autofill is switched on.
• No telemetry, no AI features, no sign-in prompts.

What's changed in RC2

Privacy

• Removed an unnecessary background Google account request that Chromium made during startup. On a
  fresh profile this fired about a tenth of a second in, before you had answered the welcome screen.
  Two internal components were asking for the browser's Google cookie state purely to report
  metrics, and reading that state went to the network. It now comes from the local cache.
• Removed the same account lookup from the address bar, which previously ran while assembling
  suggestions.
• Stopped Chromium registering push-messaging tokens with Google at startup. Two of these were being
  created on a fresh profile and kept on disk as long-lived identifiers; they are no longer created
  at all.
• Made Google sign-in and sync unreachable rather than merely hidden, and removed "Send to your
  devices", which only ever led to a Google account prompt.
• Cut twelve component registrations that reported this install to Google's update service without
  buying anything in return, including the Privacy Sandbox set, the shopping and checkout
  heuristics, and the on-device AI history strings.
• Turned off the Gemini integration.

Honesty about what Bare does not do

• Removed the Safe Browsing settings, the Safety Check module and the promotional cards. Safe
  Browsing does not work in Bare. Public Chromium Android builds do not have the handler used for
  these lookups; Google supplies it only in its own builds. The settings claimed protection that was
  not running, so they have been removed. Bare does not show phishing or malware interstitials.
• Removed the Safety Check row that reported it could not check passwords in your Google Account and
  offered a "Sign in to Chrome" button that went nowhere. The update, permissions and notification
  checks are untouched and still run.

Updates

• Bare now looks for its own updates on GitHub. You choose during the welcome screen: automatic,
  manual, or manual with a weekly reminder. Automatic mode checks a public release feed at most once
  a day and sends nothing but a user agent — no identifier, no cookies. Manual mode sends nothing
  until you tap Check for updates.
• Tapping an available update now opens that release's page. Bare never downloads or installs an
  apk for you.
• The update dot no longer comes back every day once you have looked at it.

Appearance and usability

• A Dark AMOLED theme.
• The launch splash no longer flashes white on a dark theme, and switching themes no longer shows
  the activity restarting underneath.
• The current-page row in the address bar drop-down now reaches the omnibox properly on phones.
• Night mode is read from the browser's own setting rather than from whatever the system says.
• The link-cleaning filter list is now named, so you can see what is stripping tracking parameters.

Fixes

• Fixed the welcome screen on Android 12. It could appear as a bare circle with no text or
  options at all, which is what several Pixel 3 testers saw. It can also no longer commit choices
  you were never shown.
• Fixed the Start button overlapping the footer on shorter
  screens. The options list scrolls now when it has to.
• Fixed a crash when opening settings search, and two more in Safety Check, all left over from
  removing the Safe Browsing rows.
• Long-pressing the incognito, new tab or menu buttons on the bottom bar no longer raises a label
  that repeats the icon, and no longer falls through and opens a tab.

Size

• The apk is about 20 MB smaller — roughly 296 MB, down from about 316 MB. Android XR, ARCore
  and their rendering runtime were being packaged even though XR was already disabled in this build.
  Removing those libraries does not remove a working feature.

Upgrading from RC1

Install RC2 over RC1. Do not uninstall first.

Your data is kept: tabs, history, bookmarks, extensions and settings all survive, and your existing
search engine and address bar position are preserved.

RC2 will show the welcome screen again, and that is deliberate. It appears once after upgrading
so Bare can ask about update checks. Existing choices are filled in, and pressing Start leaves
anything you did not touch unchanged.

One thing to know if you have been running Bare since before the DuckDuckGo default landed: an
existing profile keeps whichever search engine it already had. Change it in Settings → Search engine
if you want the default.

Known limitations

• Alpha software. Expect rough edges.
• arm64 only. No build for armeabi-v7a or x86, so older phones and most emulators cannot install
  it. Android 10 or newer.
• Passkeys work only through a third-party password manager, and only after you trust Bare once.
  Google's own passkey path is restricted to Google-signed browsers, so passkeys held in Google
  Password Manager are out of reach and no patch here can change that. With Bitwarden, 1Password or
  Proton Pass, the first attempt fails with "browser is not recognized" — choose Trust when
  prompted.
• Password managers need one setting turned on. Chromium uses its own autofill by default and
  never asks Android's autofill framework. Turn on Settings → Autofill options → use another
  service. Third-party autofill has also been seen to go quiet mid-session until you navigate away
  and back.
• External downloads lose your sign-in. With an external download manager on, a file that
  requires you to be signed in will fail in the other app.
• Web Push does not work, as a consequence of removing the Google messaging channel.
• Extension popups can be cropped, and the address bar gets squeezed when several extensions are
  pinned. Unpinning all but one works around it.
• Some links no longer hand off to other apps. All http(s) navigations stay in Bare, which means
  a few OAuth flows and deep links that expect an app handoff will not get one.
• The New Tab Page still has Discover.
• The first incognito tab of a session is slow to appear.
• One host is still contacted on its own, deliberately: Chromium's component updater, which carries
  certificate revocation, Certificate Transparency, TLS interstitial quality, download danger
  classification and Widevine. Bare is not completely free of Google and does not claim to be.

Download

Bare-1.0.0-alpha.1-rc2.apk

SHA-256  719d923429247a2f90c49f3fbc8d5d1b602e7cfc1124334460e6a96e6db011a8

Verify before installing:

sha256sum Bare-1.0.0-alpha.1-rc2.apk

Feedback

If something breaks, open an issue at
the issue tracker with your device, Android
version, and what you were doing. Crash reports are especially useful.