SRWare.net

ironic wrote:Is it really that hard to answer if this is supported on OS X?

Support for OS X is coming very soon

Ok — finally an adequate answer.

I won't bother testing this on Linux.

For now I'm just not using/testing Iron any further on OS X until it supports the Backup & Config Tool.

Re annoucements, I suggest you make a new thread sticky with all the new releases one can subscribe to by email, so users can start testing Iron on their or even on multiple platforms as soon as something is released. If someone's seeking to use Iron it's probably not on the fb/tw bandwagon.

I just tested 48.0.2550.0 on OS X with 'Extended Privacy' enabled and it still calls ssl.gstatic.com:443. Oh well...dev, are you actually auditing it?

ironic wrote:I just tested 48.0.2550.0 on OS X with 'Extended Privacy' enabled and it still calls ssl.gstatic.com:443. Oh well...dev, are you actually auditing it?

You have to turn off "Safe Browsing" in the Options ("Protect you and your device from dangerous sites")

I couldn't find that option anywhere, neither in Iron nor in the config/backup application.

If I start Iron and change the default page and search engine, with no activity whatsoever, it still calls home the following hosts

alt1-safebrowsing.google.com:443
dl.google.com:443
encrypted-tbn2.gstatic.com:443
http://www.gstatic.com:443
http://www.google.com:443

Embarrassing, to say the least...I had high hopes for Iron...

ironic wrote:I couldn't find that option anywhere, neither in Iron nor in the config/backup application.

If I start Iron and change the default page and search engine, with no activity whatsoever, it still calls home the following hosts

alt1-safebrowsing.google.com:443
dl.google.com:443
encrypted-tbn2.gstatic.com:443
http://www.gstatic.com:443
http://www.google.com:443

Embarrassing, to say the least...I had high hopes for Iron...

Ok, now I disabled 'Safe Browsing' altogether and it stopped trying to connect to those hosts, but it now calls translate.google.com:443, which it didn't before.
I did turn off 'Offer to translate pages...' though.

If you're touting this as the best browser in town (and of your company 'SRWare Software: Security, reliability and Usability'), you could at least explain, why on earth it calls almighty G, even after enabling the so-called 'Extended Privacy'.

These are the sites called before disabling 'Protect you and your device from dangerous sites'

sb.l.google.com
clients.l.google.com
alt1-safebrowsing.google.com
dl.google.com
encrypted-tbn2.gstatic.com
http://www.gstatic.com

These are the sites called even after disabling 'Protect you...'

clients4.google.com
clients6.google.com
cse.google.com
gg.google.com
feedburner.google.com
plus.google.com
i1.ytimg.com
clients.l.google.com
translate.google.com
stats.l.google.com

And counting..., because if I leave it open long enough, new domains appear, which don't always resolve to the same IPs. Btw, of course, all go to 443.

Why don't you just put the source over at GitHub and let your peers collaborate and audit it? It seems like the right thing to do.

ironic wrote: These are the sites called before disabling 'Protect you and your device from dangerous sites'

Safebrowsing service is based on external databases in every browser - but that's no secret and known since the first version. It's disabled by default on Windows and very simple to turn off in OS X, too.

ironic wrote: clients4.google.com
clients6.google.com
cse.google.com
gg.google.com
feedburner.google.com
plus.google.com
i1.ytimg.com
clients.l.google.com
translate.google.com
stats.l.google.com

That connections have nothing to do with Iron. ytimg.com is e.g. from Youtube.... I can not tell where they are from on your PC (maybe you have other browsers or some webpages open or extensions installed ) - but definitely not from Iron.

Please also get sure that you use the latest Iron version (51 is acutual, 52 will come very soon)

Do you know Little Snitch? It's an application firewall and intercepted all the above outgoing connections coming from Iron only.

I ask you again — why don't you just put the source over at GitHub and let your peers collaborate and audit it? It seems like the right thing to do.