Chromium interceptor app is being Noisy (generating requests on startup)

[iTrooz]

Here is the kind of requests I get when I open Chromium:

I think it would be nice to clear them up eventually. I've made some tests, and it seems that the way Burpsuite does it is with a custom Chrome build. Maybe some of the requests are removable without doing that though ?

Other alternatives considered:

• support https://github.com/ungoogled-software/ungoogled-chromium
• support Firefox/another browser, which may have less built-in requests

[pimterry]

Good idea @iTrooz! You'll be glad to hear I pushed a commit just yesterday that cleans up a couple of these already.

I've seen the PR relating to the gcm case, I'll look into that in a sec. Any ideas where the others are coming from?

We do already support Firefox, so you can use that if you prefer, along with quite a few other options. PRs for more browsers are very welcome, but they need to be added first to https://github.com/httptoolkit/browser-launcher with appropriate mechanisms to detect them.

[iTrooz]

No idea where the others are coming from, but in all honesty I didn't look much yet.

But this repository https://github.com/CybercentreCanada/kangooroo seems to have done a lot of research about it, it might be worth looking into it if we want to remove these calls

PS: I just tested the Firefox interceptor, and got 1500 requests logged just by launching it O.o

[pimterry]

PS: I just tested the Firefox interceptor, and got 1500 requests logged just by launching it O.o

The problem is that some of these will be required for the browser to work properly unfortunately. There's lots of cases where these internal component updates are part of normal function, or are required for important security functionality (which we don't want to disable). They're not just doing them for fun. Inconvenient UX we don't need (like first-run pages) or definitely UX-irrelevant requests (like telemetry) are good to drop, but otherwise we do want to match the normal & secure behaviour of a browser on your machine.

Guaranteeing that is more important than whether there's some extra requests by default. If that's an issue for you though, it's very easy to filter & hide these requests, or to use a custom script to launch a custom browser setup instead with whatever options you like - the debate here is just about the defaults, not what's possible.

How do you feel about disabling search autocomplete requests like Burpsuite ? [question from your other PR]

Personally, I think I'd rather keep this - autocomplete for searching in a browser is a useful feature to actually use the thing effectively.

Honestly sometimes it's just quite interesting & useful to understand what the browser itself is doing anyway, even if it's noisy, and even for debugging specific webpages the behaviour of other browser features (like loading sourcemaps or similar) can offer useful context. Plenty of people (especially students) are using HTTP Toolkit to learn about HTTP and how browsers work in general, and hiding normal behaviour from them is problematic. I feel less strongly about this, but it really doesn't seem like a huge problem. Happy to leave that question open and see if anybody else chimes in though, in either direction.

[iTrooz]

Happy to leave that question open and see if anybody else chimes in though, in either direction.

Agreed.
If that feature is requested by others, I'd love to add another button to open a fully "silent" web browser, as personally it's what's keeping me from switching from Burpsuite

it's very easy to filter & hide these requests

I guess I could do that yeah, indeed