Live data from Hacker News

Chromium unconditionally downloads binary blob

bugs.debian.org

11–20 of 180 posts

Re: Chromium unconditionally downloads binary blob

#11
post #8

The binary blob is targeted at Native Client and so only runs in the google chrome sandbox. There is no security issue here.

"Don't worry, it's running as restricted windows user, there is no way it could possibly ever... oh"

Sandboxed unknown code is still better than non-sandboxed unknown code.

Re: Chromium unconditionally downloads binary blob

#12

From the comments on the debian bug, this appears to have been fixed in Chromium. https://code.google.com/p/chromium/issues/detail?id=491435

Strange how they "fixed" it by making it opt-out rather than opt-in, given the culture collision here. Google really likes NaCl a lot for being a feature with almost no third party adoption.

Re: Chromium unconditionally downloads binary blob

#15
post #11
post #8

Earlier quoted context omitted.

"Don't worry, it's running as restricted windows user, there is no way it could possibly ever... oh"

Sandboxed unknown code is still better than non-sandboxed unknown code.

Agreed, but it is not the same thing as saying there is no security issue.

Re: Chromium unconditionally downloads binary blob

#16
post #5
post #3

I advise not reading that bug, some of the later comments will give you brain cancer. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909#51 Downvotes? So you agree with this? "I seriously consider the good faith of an such upstream which does these kinds of things" "But basically secretly downloading it leads to the question of possible malicious intent (and everyone knows that Google&Co. do voluntarily and/or…

This guy is actually perfectly right. Google doesn't do thing like that by accident. I'm glad there are some sharp guys around to disclose such potentially malicious behavior.

Do what by accident? Of course the intent was to include the blob. If Debian wants to get rid of it it should patch Chromium or request it to be made configurable (which is what happened).

But the tinfoil hattery is completely baseless.

Re: Chromium unconditionally downloads binary blob

#17

From the comments on the debian bug, this appears to have been fixed in Chromium. https://code.google.com/p/chromium/issues/detail?id=491435

Unfortunately, that fix disables the functionality completely, rather than making it so that the sandboxed hotwording module can be used if enabled by the user.

Re: Chromium unconditionally downloads binary blob

#18
post #5
post #3

I advise not reading that bug, some of the later comments will give you brain cancer. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909#51 Downvotes? So you agree with this? "I seriously consider the good faith of an such upstream which does these kinds of things" "But basically secretly downloading it leads to the question of possible malicious intent (and everyone knows that Google&Co. do voluntarily and/or…

This guy is actually perfectly right. Google doesn't do thing like that by accident. I'm glad there are some sharp guys around to disclose such potentially malicious behavior.

Even if malice instead of incompetence is involved, it goes pretty far to call Chromium a "rootkit-downloader" just because it downloads a binary blob.

It could theoretically be a rootkit, but without any evidence to support it this is like calling someone a murderer because he went to the same high school as a murderer.

Re: Chromium unconditionally downloads binary blob

#19
post #16
post #5

Earlier quoted context omitted.

This guy is actually perfectly right. Google doesn't do thing like that by accident. I'm glad there are some sharp guys around to disclose such potentially malicious behavior.

Do what by accident? Of course the intent was to include the blob. If Debian wants to get rid of it it should patch Chromium or request it to be made configurable (which is what happened). But the tinfoil hattery is completely baseless.

But you do understand that Chromium is supposed to be open source, right? So, if the intent was to include a binary, closed source blob into an open source project, that could be called malicious.

Re: Chromium unconditionally downloads binary blob

#20

Another reason to switch to Iridium Browser. It has Google search disabled by default and even if you switch search to Google, Voice search and hot-words stay off until you manually enable it. https://iridiumbrowser.de/

I didn't know about Iridium. I'll give it a try.
Post reply on HN