Supermium – Chromium fork for Win 2003/XP and newer

Original Article ↗ Hacker News Discussion ↗

A new Chromium fork called Supermium aims to bring a modern web browser to legacy Windows systems such as XP and Server 2003 by backporting features and re-enabling older APIs like GDI font rendering. Commenters are split on whether this is a clever way to keep retro and legacy machines usable—especially for lab equipment, embedded systems, or nostalgia setups—or an inherently unsafe idea given the unpatched vulnerabilities of end-of-life operating systems. The thread also touches on how browser support now effectively dictates whether an OS is “alive,” raising broader questions about security, complexity, and long-term maintainability of modern software stacks.

How Supermium Works and What It Targets

  • Described as a Chromium fork that backports support to Windows XP/2003 and other legacy Windows versions.
  • Achieves this by re‑adding or adapting old code paths and APIs that upstream Chrome dropped (e.g., falling back to GDI font rendering instead of DirectWrite, which doesn’t exist on XP).
  • Uses Chromium’s own libraries for many formats (TLS, image, video, PDF), reducing reliance on old OS components; some discussion about how much OS rendering (GDI, DirectX) and hardware acceleration still expose attack surface.
  • Build effort is nontrivial but reportedly feasible on a single modern desktop; no clear mention of a dedicated build farm.

Use Cases and Performance on Old Systems

  • Motivations include nostalgia, keeping “retro” machines useful, and practical needs: lab machines, legacy Windows-only tooling (e.g., microcontroller dev boards), old servers, and users who prefer pre‑Windows‑10 UI.
  • Some argue modern web bloat will overwhelm truly period‑correct XP hardware; others report acceptable performance on Core 2–era machines if RAM/SSD and GPU acceleration are available, with ad blockers and H.264‑forcing extensions helping.
  • There is interest in trying it under Wine or ReactOS as a stress test.

Security Debates: Modern Browser on EOL OS

  • One side: if the browser sandbox is up to date and the machine is behind a router, web use is “reasonably safe” for low‑risk users, especially when the machine is isolated and used only for limited tasks.
  • Opposing side: unpatched OS kernels and drivers (fonts, graphics, TCP/IP, file handling) remain exploitable even with a new browser; any browser interaction that invokes OS APIs can be a path to RCE and botnets.
  • Disagreement over threat models: some see XP/7 internet use as reckless; others argue attackers prioritize widespread, current platforms and that niche setups are unlikely targets, beyond mass botnet sweeps.

HTTPS/TLS and Distribution Concerns

  • Project site intentionally does not enforce HTTPS; critics note this enables easy MITM and malicious binaries, emphasizing that TLS is also about authenticity, not just secrecy.
  • Others downplay HTTPS importance for “non‑sensitive” browsing, though this is challenged as exposing credentials and downloads.

Broader Reflections and Alternatives

  • Debate over vendors dropping old OS support: framed as security and resource constraints versus forcing hardware/OS churn and complexity.
  • Some advocate simpler, auditable stacks and even freezing/simplifying Chromium to run on minimal OSes.
  • Related tools mentioned: Chromium forks for old macOS, XP‑capable Mozilla forks, and modern lightweight Linux desktops as safer alternatives to running obsolete Windows online.