Baidu Browser

» see liulanqi.baidu.com as it lived, on the wayback machine

~ the eulogy ~

My browsers went IE 6 until Firefox arrived, then Chrome for everything after. Baidu Browser was never in the running for that slot and it was nothing to do with quality. A browser in that decade was downstream of a search engine, and a search engine was downstream of a language. I searched in Turkish and English, so I got the browser that came attached to Google, and several hundred million people who searched in Chinese got the one that came attached to Baidu.

That is the part of browser history the market share charts flatten. The Chinese desktop through the 2010s was not a smaller version of the Western one running the same four programs. It ran browsers built by the local portals, tied to the local search, wrapped around the local bank websites, and each of them was a real product with real users who never appear in the graphs anyone in Europe looked at.

Baidu Browser launched in July 2011 and its most telling design decision was there from the start. It carried two rendering engines. WebKit handled anything modern, and Trident, the engine inside Internet Explorer, was kept on board because a large part of Chinese online banking and government services still refused to work in anything else. The browser was a diplomatic object, negotiating between where the web had gone and where the local infrastructure still was.

~ the dossier ~

~ the origin ~

Baidu had the search box and the search box was the whole funnel. The browser came bundled with other Baidu software, arrived preinstalled on machines through distribution deals, and defaulted to Baidu search in a country where Baidu search was the search. None of that required the browser to be better than Chrome. It only required it to be in front of you first.

By 2016 it had enough users on Windows and Android that the Citizen Lab at the University of Toronto thought it worth pulling apart, which is a form of significance. Nobody audits software nobody runs.

~ the unraveling ~

The audit was published on 23 February 2016 under the title Baidu's and Don'ts, and it was not a close call. The Android build sent a user's search terms, GPS coordinates and the URLs they visited to Baidu servers with no encryption at all. The device IMEI and a list of nearby wireless networks went out under encryption weak enough to unwrap. The Windows build did the same with search terms, the hard drive serial number, the wireless MAC address and the title of every page visited.

Worse than the leaking was the updating. The researchers found the software update path open to a man in the middle, which meant anyone positioned on the network could feed the browser code and have it run. A browser is the most privileged program on a normal person's computer. This one would take instructions from strangers.

~ how it actually ended ~

It went out in pieces rather than at once. On 3 April 2019 Baidu posted a notice that parts of the PC browser would be suspended, and on 30 April those features went. Operations and maintenance stopped in May. The final notice came on 29 September 2019, ending basic web browsing, and its stated reason was that continuing to use the browser presented a security risk, so users should move to something else.

Read that again as a corporate document. The company was not saying the product had failed commercially. It was saying that software it had stopped maintaining was now dangerous to run, which is true of every abandoned browser and almost never written down. The Android version was left alive.

~ what came after ~

The desktop browser war in China ended the way it ended everywhere, with Chromium winning by being the thing everyone else built on top of. What Baidu lost was not a browser business but the last place it controlled the whole path from the operating system to the answer. Everything after that ran through a phone, and on a phone the browser stopped being where anyone searched.

The Citizen Lab report has outlived the product it was about. It gets cited in arguments about mobile data collection that have nothing to do with Baidu, because it was one of the clearest published demonstrations that the transport layer matters as much as the privacy policy. The browser is gone. The finding that unencrypted telemetry is a design choice and not an accident stayed.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »