Ruthenium: Custom Chromium Build for Android Adds Russian Trusted Root CA Support
Ruthenium is a custom build of Chromium for Android that adds support for the Russian Trusted Root CA certificate from the Ministry of Digital Development without modifying the system certificate store.
Many Russian banks and government services use TLS chains ending at this root. Standard Google Chrome on Android rejects these chains with NET::ERR_CERT_AUTHORITY_INVALID because the root is absent from Chromium’s built-in store. The author wanted to keep using Chrome’s interface and therefore created a separate APK that includes the root with strict DNS constraints limited to .ru and .рф zones.
Why Chrome rejects the chain
The browser receives the site certificate and intermediates, validates names, validity periods and signatures, then attempts to build a path to a trusted root. Because Russian Trusted Root CA is not present in Chromium, verification fails. Existing solutions either require switching to another browser or installing the root into Android’s system store, which affects all applications.
Technical implementation of the patch
The certificate is converted from PEM to DER and embedded as a byte array in chrome/browser/net/profile_network_context_service.cc. The patch creates a CertWithConstraints object that adds the root with permitted_dns_names set to {“.ru”, “.xn--p1ai”}. This constraint applies to all DNS names listed in the certificate’s Subject Alternative Name, preventing misuse outside the allowed TLDs. The build scripts verify the DER SHA-256 against a lock file before compilation.
Four C++ files are modified in total: the network context service for the constrained root, primary_account_manager.cc to disable browser-level sign-in by default, and two omnibox/searchbox files to replace unavailable XR icon methods on Android builds without VR support.
Build configuration and distribution
The release uses is_official_build=true with ThinLTO enabled but external PGO profiles disabled. VR and AR features are turned off via GN flags. Each APK is published with a release tag that incorporates the Chromium revision, certificate digest, and build arguments, enabling traceability. Checksums, ABI information, and apksigner verification results accompany every binary.
Ruthenium installs under the package name app.ruthenium.browser and keeps its data separate from Chrome. No auto-update mechanism is provided; users must install new versions manually. The browser behaves identically to upstream Chromium on non-Russian domains.
Related articles
VK Shares Rise 7.62% as Market Assesses Data Center Developments and Yandex Cloud Challenges
VK shares climbed sharply on October 12, reaching a peak increase of 7.62% to 134.2 rubles before moderating to a 6.6% gain at 132.95 rubles by evening. Analysts from Freedom Global linked the movement partly to the Ministry of Digital Development's announcement of joint measures with the Ministry of Defense to protect Russian data centers. Other observers at Finam suggested investors were pricing in potential client shifts from Yandex Cloud to competitors such as VK Cloud, which has already begun accelerated infrastructure placement for affected Yandex customers. The surge was also attributed to broader capital rotation away from the energy sector toward previously lagging technology stocks. While the confirmed price movement is clear, the exact drivers remain analytical interpretations rather than verified revenue impacts. The episode highlights how regulatory and infrastructure news can quickly influence valuations in the Russian cloud services market.
Passphrases vs. Leetspeak Passwords: Why Four Random Words Outperform P@ssw0rd!2026
The article explains why a passphrase made of four randomly selected words provides far greater resistance to offline attacks than a complex-looking password constructed with substitutions and appended symbols. It details how password strength is measured in bits of entropy rather than visual complexity, showing that four words drawn from a 50,000-word list yield approximately 62 bits while common leetspeak transformations add almost none. The piece contrasts fast legacy hashing with modern slow algorithms such as Argon2 and emphasizes the protective effect of per-password salting. It criticizes registration forms that reward predictable patterns and highlights NIST guidance favoring length over mandatory character rotation. The author recommends diceware-style generation for master passwords and password managers for everything else, noting that passkeys ultimately eliminate the need for memorizable secrets altogether.
Building the Foundation of Digital Trust: Why Identity Security Remains Undervalued
Identity Security is presented as one of the most underestimated pillars of cybersecurity because granting access involves trusting individuals with sensitive information and systems. The article examines the deep intersection of IT and security functions, the costs of manual access errors, and the need to align business processes with technical controls. It references a 2026 Identity Conf study showing 43.5% of organizations experienced errors in manual rights assignment and 33.5% left access for former employees. Recommendations draw on NIST Human-Centered Cybersecurity concepts, SP 800-53, and Russian FSTEC Order No. 117 to design lifecycle processes covering account provisioning, privilege reviews, and continuous monitoring. Models such as RBAC and ABAC are discussed alongside IGA and IdM solutions to ensure business permissions map correctly to application rights. The piece stresses that successful projects require joint IT and security efforts from the initial survey through pilot and acceptance phases while measuring both risk reduction and operational efficiency.
VK Files Lawsuit in EU Court Seeking to Overturn Sanctions Imposed in July
Russian internet company VK has submitted a formal challenge to the European Union's sanctions regime by filing a case with the Court of Justice of the European Union. The company argues that the restrictions placed on VK and its subsidiary Communication Platform LLC are both unjustified and unlawful. The lawsuit, registered under case number T-664/26 on 7 October, directly contests the July sanctions that targeted the developer of the MAX messenger. Earlier restrictions had already led to the removal of multiple VK ecosystem applications from Apple App Store and Google Play, forcing users toward alternative distribution channels such as RuStore, Huawei AppGallery, Samsung Galaxy Store and Xiaomi GetApps. While installed Android applications continue to function and receive updates, iOS users face disrupted push notifications after the apps were delisted. The legal action itself does not automatically restore app availability in the affected stores.