T3dmium 1.0.0 — first official release

T3dmium 1.0.0 — first official release

T3dmium is a privacy-first web browser built on Chromium that sends nothing to Google — or anyone else — in the background. Real Chromium engine, real performance, real extension support, with every form of telemetry, analytics, and "phone home" traffic stripped out. The only network traffic it ever makes is traffic you start.

This is the first downloadable build: macOS, Apple Silicon (M1/M2/M3/M4).

Download

T3dmium-150.0.7871.46-arm64.dmg — Apple Silicon, macOS 12+

sha256  5f63ee55fe95851898afcfa342fe9b70fa4d94df3de6fd0307414c2328c017f8

Open the DMG and drag T3dmium to Applications. See INSTALL.md for full steps.

First launch: this is an independent, open-source build that is ad-hoc signed, not notarized by Apple. macOS will warn that it "cannot verify the developer" the first time. That's expected — right-click (Control-click) the app → Open → Open, once, and it runs normally afterward. The entire source is public, so you can verify exactly what it does rather than trust the binary blindly.

What makes it private

• No telemetry, analytics, or usage metrics — UMA/UKM, RLZ, all removed.
• No experiments/field trials (Finch/variations) — everyone runs the same code.
• No crash uploads, no component-updater pings, no "check-in" traffic.
• No Google account, Chrome Sync, or GAIA.
• No Safe Browsing pings, no Google Cloud Messaging, no translate pings, no spellcheck download service (dictionaries are local), no promos/nags.
• No baked-in Google API keys; the default search engine is not Google.
• Do Not Track + Global Privacy Control: ON by default.
• Third-party cookies: blocked by default.
• Referrer trimming, partitioned storage, and a user-agent that matches Chrome exactly so you blend into the crowd.

Full plain-English rundown: docs/privacy-features.md.

Verified, not promised

Any browser can claim it doesn't phone home. T3dmium ships an automated network-audit harness (mitmproxy-based, in audit/) that fails the build if any non-user-initiated request leaves the machine. It runs in CI, and you can run it yourself.

Honest notes

• Apple Silicon only for now. Intel macOS and Windows builds are planned.
• This build uses a non-official configuration (release LTO/PGO optimizations off) so it builds reliably on modest hardware. It is fully functional — just slightly larger and not as speed-tuned as a commercial release binary.
• On the roadmap, not yet shipped: a dedicated ad/tracker-blocking engine and a first-run DuckDuckGo search picker.

Built from Chromium 150.0.7871.46, on the ungoogled-chromium patch-set model. BSD-3-Clause. Maintained by Ted Roubour (@t3dboy).

v0.7.0 — T3dmium (phases 0–6 complete)

First complete pass of the T3dmium roadmap: a privacy-first Chromium fork maintained as a patch set, pinned to Chromium 150.0.7871.46. CI is green — the de-Google series, the network audit harness, and the sync server are all verified on every change.

What works and is verified (no build required)

• De-Google patch set — 109 patches (108 adopted from ungoogled-chromium + 1 T3dmium privacy default) apply cleanly to the pin, checked in CI by validate_patches.py (DEPS-aware: files in devtools-frontend/v8/etc. are validated from their own sub-repos).
• Network audit harness (audit/) — default-deny detection engine with a browserless self-test (24 cases) that flags planted leaks; runs in CI.
• Privacy defaults — Do Not Track + Global Privacy Control on by default (validated patch); third-party cookie blocking on via the adopted set.
• Ad/tracker blocking — engine decided (adblock-rust, ADR-0005); EasyList/EasyPrivacy pinned reproducibly; list updates are user-initiated only, enforced by an audit scenario.
• Self-hosted zero-knowledge sync (sync/) — client-side E2E encryption, server sees only ciphertext; 15 tests pass in CI, live round-trip proven.
• Branding + packaging — icon + generator, macOS DMG/signing/notarization and Windows NSIS tooling, reproducible-build notes.

What still needs a build host (hardware, not tooling)

Compiling the browser, producing signed installers, and running the audit harness against a real binary require ~100 GB free disk + full Xcode (macOS) or a self-hosted CI runner — see BUILDING.md. Everything up to that step is done and machine-verified.

Full history in CHANGELOG.md; every phase is individually tagged.

v0.7.0-phase6 — self-hosted encrypted sync

Phase 6: self-hostable, zero-knowledge encrypted sync.

• sync/ is a dumb encrypted blob store the user runs themselves; nothing hosted by the project. All key derivation and encryption are client-side (passphrase → PBKDF2 → HKDF → Kenc/Kmac/Kauth/group_id); the server only holds opaque ciphertext and a hash of the group auth token.
• Pure stdlib (http.server + sqlite3): server, reference client, and 15-test suite pass on Python 3.9 with no third-party packages. Live pair→push→pull round-trip verified; DB inspection confirms only ciphertext at rest.
• Endpoints authenticated with request-binding HMAC proofs + constant-time compare; last-writer-wins with tombstones. Dockerfile/compose included (TLS is the operator's job).
• Shipped AEAD is a documented encrypt-then-MAC construction (stdlib has no AES-GCM); PROTOCOL.md specifies the production upgrade path. Browser-side client integration deferred (ADR-0006).

v0.6.0-phase5 — branding + installers

Phase 5: branding and packaging.

• Branding: SVG master icon + generate_icons.sh (.icns/.ico/PNG). User-agent policy: left identical to Chrome — no unique token — for fingerprinting resistance (achieved by deliberately not patching the UA).
• macOS: build.sh, create_dmg.sh (ad-hoc signing for dev; Developer ID + notarytool/stapler for release), hardened-runtime entitlements, SIGNING.md, reproducible-build notes.
• Windows: build.ps1, NSIS installer.nsi, SIGNING.md.
• Compiling and signing real artifacts needs a build host (see BUILDING.md).

v0.5.0-phase4 — ad/tracker blocking + lists

Phase 4: ad/tracker blocking.

• ADR-0005: adopt Brave's adblock-rust (MPL-2.0) over declarativeNetRequest — fuller EasyList/EasyPrivacy syntax, no rule-count ceiling, in-release lists with user-initiated updates only.
• Reproducible list pinning: EasyList + EasyPrivacy pinned in downloads.ini to an immutable commit as type=file entries with real sha256; fetch.py gained verify-and-copy support. All five download entries resolve via fetch.py check.
• Audit coverage: new adblock_update scenario allows the pinned-list fetch only under an explicit user 'Update filter lists' action.
• Local Safe Browsing blocklist option documented (off by default). Engine integration + settings UI need a build host.

v0.4.0-phase3 — privacy defaults

Phase 3: privacy defaults.

• Do Not Track + Global Privacy Control on by default. New patch patches/privacy/enable-do-not-track-by-default.patch flips the kEnableDoNotTrack profile-pref default to true; Chromium reads it into the renderer preference that emits both DNT: 1 and Sec-GPC: 1. Validated against the pin (isolated + full 109-patch series).
• Third-party cookie blocking was found already covered by the adopted inox default-prefs patch (kCookieControlsMode → kBlockThirdParty); a DuckDuckGo default-search patch is deferred (needs a build to verify) rather than shipped as a guess. See patches/privacy/README.md.

v0.3.0-phase2 — network audit harness

Phase 2: the verification harness that makes the privacy guarantee testable.

• audit/checker.py: pure-stdlib, default-deny detection engine — a captured request is allowed only if an allowlist rule matches both the active scenario and the destination (subdomain-strict host globs, segment-aware path prefixes, mandatory reason per rule).
• audit/capture.py + scenarios/driver.py + audit.py: launch a Chromium binary behind mitmproxy (fresh profile, --disable-quic) and drive idle/navigation/bookmarks/history/downloads/settings/search.
• 24-case browserless self-test: a clean run passes; a leaky run (update ping, variations, safebrowsing, crash upload, lookalike host) is fully flagged. Wired into CI. Documents its honest limits (QUIC/raw UDP, OS DNS).

v0.2.0-phase1 — de-Google patch set

Phase 1: de-Google patch set.

• Adopted ungoogled-chromium's 108-patch set at tag 150.0.7871.46-1 under patches/degoogle/, preserving application order in patches/series; each patch carries a Description:/Origin: header. Adopted their pruning + domain-substitution lists.
• Made validate_patches.py DEPS-aware (tools/_deps.py): files under DEPS-managed sub-trees (devtools-frontend, v8, search_engines_data, …) are validated from their own repositories at the pinned commit.
• The full 108-patch series validates cleanly against Chromium 150.0.7871.46 (94 files from chromium/src, 14 from DEPS sub-repos).

v0.1.0-phase0 — repo scaffold & toolchain

Phase 0 of the T3dmium roadmap.

What's here

• Chromium pin 150.0.7871.46 (tracks ungoogled-chromium; ADR-0002), sha256-verified official tarball
• tools/: fetch (check/retrieve/unpack), apply_patches (quilt series + GNU patch), validate_patches (validates hunks against pinned sources fetched from chromium.googlesource.com — no 50 GB checkout needed), build (gn/ninja wrapper), check_conventions (lint, runs in CI)
• flags.gn adopted from ungoogled-chromium (BSD-3-Clause) with T3dmium additions
• Docs: README, BUILDING (macOS + Windows), PRIVACY (service-by-service table), CONTRIBUTING, ADRs 0001–0004
• CI: fast pr-check on every PR/push; release-build matrix for self-hosted runners

What's NOT here yet: patches (Phase 1), the network audit harness (Phase 2), and binaries. This is scaffolding — nothing to install.