ChaoticSi1ence/SlimBrave-Neo v2.3.3

v2.3.3 - Audit at Brave 1.98.60: two dead keys dropped, three new caveats

on GitHub

Stable Brave moved to 1.98.60 on Chromium 156, so every policy key was re-checked against it. Two settings that no longer do anything useful are gone, three carry a new caveat, and a dozen descriptions were corrected. The tool now has 76 rows over 72 keys.

Removed

• Disable Safe Browsing Reporting. Chromium 156 dropped this policy altogether; it had no effect since Chromium 145. Brave now lists it in brave://policy as Unknown policy on Windows and Linux. Removed from Telemetry & Reporting and from the Maximum Privacy, Balanced Privacy and Developer presets.
• Filter Adult Content (SafeSites). It never blocked anything in Brave. Brave ships no Google API key, so Google rejects every lookup and the page loads anyway, yet the address of every page and frame you opened was still sent to Google. Removed from Access Controls and from the Strict Parental Controls preset, whose DNS filter (Cloudflare for Families) does the blocking.

Windows: Apply and Reset now also delete these two settings, plus the long-removed MediaRecommendationsEnabled, wherever an older SlimBrave left them. Each goes only while it still holds the value SlimBrave wrote, so a different value someone else set is left alone. On Linux and macOS the policy file is rewritten on every Apply, so the old values go there anyway.

New caveats

• Force HTTPS Upgrades (Strict) is not enforced everywhere. Brave is moving to Chromium's HTTPS-First mode and has switched all of Beta and Nightly, and part of Release, over through a server-side rollout. On those installs the setting only presets the HTTPS-First option in brave://settings/security once, and you can change it afterwards. Limit Variations or Disable Variations keeps Brave's own upgrader, and this lock, in place. The Maximum Privacy preset, the only one that sets Strict, already sets Limit Variations.
• Disable Autofill (Addresses / Credit Cards): Chromium 156 deprecated both policies in favour of a newer one that doesn't work in Brave yet. They still work, but brave://policy lists them as Deprecated.
• Disable DNS Interception Probes — no effect in Brave. Chromium hasn't made these lookups by default since version 97. The row stays as a lock.

Descriptions corrected

• Disable Sync: applying it also removes the device from its sync chain. Once the policy is lifted, rejoin with a code from another device.
• Disable Default Browser Prompt: Brave's first-run welcome page still offers Set as default, and clicking it with this policy set crashes Brave (brave-browser#60038). Choose Skip instead.
• Disable QUIC: web requests fall back to TCP, but WebRTC calls and WebTransport still use UDP.
• Disable Network Prediction: says what it stops in current Brave: pages prefetched because a site's speculation rules or prerender hints ask for it, and the background connection to your search engine.
• Variations: both rows take effect after a browser restart. Disable Variations refuses every study, but the seed is still downloaded.
• Disable Brave Talk: hides Talk from the new tab page, sidebar and menus. The talk.brave.com website still works.
• Disable Browser Sign-in: in Brave this locks off "Allow Google login for extensions". Brave Account sign-in is not affected.
• Require HTTPS for Basic Auth: also breaks plain-HTTP proxies that use Basic authentication.
• Block Sideloaded Extensions: also removes extensions already added that way at the next launch, even ones you approved.
• Disable Local AI: now on for about half of Beta as well as Nightly; still off by default on Release.
• Disable Brave Rewards: a background fetch of the ads service's encryption key continues unless Limit or Disable Variations is also set.
• Disable Stats Ping: P3A sends its own copy of the search counts until P3A Analytics is disabled too.
• Cap Referrers: applies to every cross-origin request, not just cross-site ones.

README and SECURITY.md follow suit.

Known gaps, not changed in this release

Listed in AUDIT.md under What's next:

• the Windows and the Linux/macOS scripts handle the DoH template differently in automatic mode;
• a Linux machine with only Brave Origin Beta or Nightly also reports a stable Origin;
• the macOS script does not detect or write Brave Origin's own settings;
• import stays silent about keys that match no row.

Every key's evidence — the Brave and Chromium source lines at 1.98.60 / 156.0.8078.48 — is in AUDIT.md (PR #30).

Verifying this release

d745e9354a72ca2d17af763aa9e448e278b4298827e473be849e0c1df361a73a  SlimBrave.ps1
568b0ef4b3bdc11503a54bddb941c5b5297073d8f2f49c3945d57377001bc8bb  slimbrave-linux.py
fba31fc0db81b7ec816f42ce40b2e59686c39d06a36a9d992cbfcfa3b61ead7d  slimbrave-mac.py

Get-FileHash -Algorithm SHA256 .\SlimBrave.ps1

sha256sum slimbrave-linux.py     # Linux
shasum -a 256 slimbrave-mac.py   # macOS

These are the bytes GitHub serves, checked against the raw URL before publishing.