What do you do when your web browser on your phone hasn't received an update for over 5 months?
This is the situation myself and thousands more are in. Bromite has been my mobile web browser of choice for around 2 years. It's a modified version of Chromium - the open source foundation of Google Chrome - but with additional privacy features, built-in ad blocking, and dark mode for websites. These make it an easy choice for people who want a safe browser without any compromises.
But since browsers are software that most people use every day, security needs to be a top priority for users. They are most people's gateway to the entire internet, and when security issues arise, fast updates are the only thing standing between users and malicious sites.
This brings us back to Bromite, which had its last release on GitHub in December 2022. This puts it five major versions behind Chromium, at the time of this writing. As Bromite continues to miss out on over 100 security fixes [1], risk to users is snowballing by the day.
These problems appear to stem from the absence of the project's maintainer and biggest contributor, Carl Sagan. His last committed changes to the project were in late January of this year. On February 19, he posted his most recent public correspondence, addressing concerns about a repository going down and rumors of abandonment: "[The repository] will be restored probably on Monday. [...] Nobody quit anything," he wrote. He seemingly has not reached out to any of his fellow Bromite developers either. "I have no contact with Carl other than public contact via GitHub," writes Uazo, the second biggest contributor to the project. "I know as much as you do."
Despite these challenges, Bromite development may press onward. Amid concerned messages, many users have expressed willingness to get involved with development, as well as appreciation for the hard work that has gone into the Bromite project. Uazo has begun developing a new browser on a Bromite CI branch that picks up where it left off, but it seems like there's a lot of ground work to be done before a new stable release can come out. The project would also likely benefit from more contributors to keep pace with previous Bromite updates.
The Bromite situation raises questions about how open source projects should respond when big contributors or maintainers take leave unexpectedly. If it were possible, communication from Carl could have prevented months of confusion. The lack of updates on the Bromite website suggest that Carl is the only person with access to the page, as well as the Patreon fund and crypto wallets, which receive donations to offset development costs. Having a second trusted project maintainer with access to these resources could have warned prospective users about the state of the project, and prevented any donated funds from being lost.
In the meantime, Bromite users should use Bromite builds from Uazo's buildtools repo, or look for alternative browsers for security. Bromite is a drop in the bucket of open source software that millions of people use daily, and Carl Sagan's absence from the project demonstrates the value that these developers and maintainers provide for free.
112 security fixes and counting, according to SkewedZeppelin's table brought up in this Bromite issue discussion. ↩︎
Liked this article? Sharing it or subscribing via RSS would be highly appreciated!
What do you think about this? Reach out and let me know!