So when I've called Google Chrome for "spyware" in the past I can now add Chromium to that list.
Google's not even trying to not be evil these days.
Chromium unconditionally downloads binary blob
131–140 of 180 posts
Re: Chromium unconditionally downloads binary blob
#132Earlier quoted context omitted.
Arbitrary code controlled by a single organization (Google) is still arbitrary code.
In then sense of "arbitrary code [...] if someone MitM the connection" it certainly is not.
I missed that the parent comment added that conditional. I suppose I should have responded directly to them instead of under this comment then.
Re: Chromium unconditionally downloads binary blob
#133Earlier quoted context omitted.
Nothing is "secure".
It's more secure than JavaScript, which is a start. Dropping the need for just-in-time compilation while gaining performance is nice.
When has JavaScript itself (and not the APIs, unless it's a JS-specific problem) last enabled an exploit in a major browser? I can't remember it.
Meanwhile, here's a NaCl sandbox escape exploit from March: https://www.exploit-db.com/exploits/36311/
Re: Chromium unconditionally downloads binary blob
#134Earlier quoted context omitted.
Is this true of Chrome as well? If so, I will never run it again.
They are sandboxed "machine independent" binary blobs that chrome translates into the local architecture, see https://developer.chrome.com/native-client for details. Javascript isn't far off binary in terms of readability nowadays with the level of packing/minification, so legibility isn't a deciding factor. Therefore if you can't trust the native client sandbox, why trust javascript, or even HTML from third parties?…
I didn't even know this "native client sandbox" existed! Why the hell should I trust it, or anything executed inside it?
I'm tentatively willing to believe that Chrome is probably not trying to pwn my box, because I don't think Google has a compelling reason to do that which would outweigh the flak they would get if they were caught. Allowing them to run arbitrary compiled executables on my machine, however, would require me to transitively extend trust to everyone using their technology, and to do that I would have to be confident that there are not and never will be any security holes in their sandbox. That is an unlikely proposition to say the least and therefore I want nothing to do with NaCl.
Re: Chromium unconditionally downloads binary blob
#135Earlier quoted context omitted.
> They can't decrypt or MITM anything because they don't have google's keys Hard to prove a negative.
Then show an example that proves the NSA has Google's keys. If you want to do proofs, how about you put your money where your mouth is?
This isn't proof that the NSA has googles keys, but it outlines how the NSA uses stolen keys to decrypt information. I'd imagine google would be one of their main targets.
http://www.newyorker.com/tech/elements/how-the-n-s-a-cracked...
Re: Chromium unconditionally downloads binary blob
#136Earlier quoted context omitted.
There are other webkit browsers without Chromium's extended libraries such as Surf and Web (Epiphany). Konquorer was still kHTML last time I checked, but there are with webkit ports as well if that's really what you want. Then there's Opera, which on some platforms (eg Linux) is still using it's older renderer rather than Blink (see footnote); and Otter as well. There's quite a few Firefox forks too (eg Palemoon)....…
And as a last resort, one could always resort to telnet :)
Well... until http 1.x starts being deprecated :)
Re: Chromium unconditionally downloads binary blob
#137Note that although this bug report was forcibly closed, the fix is "This change adds an "enable_hotwording" build flag that is enabled by default, but can be disabled at compile time."
Consider what this backdoor does. It listens to any conversation in the vicinity of the phone and reports it to a remote site. You can't see its keyword list. You can't tell when it's transmitting to the mothership.
Has anyone filed a US-CERT report with Homeland Security on this?
Re: Chromium unconditionally downloads binary blob
#138Earlier quoted context omitted.
> Android is Google's project to begin with It wasn't always; it was an independent company that was acquired by Google in the mid 2000s.[1] > and the closed components which are part of the Play Service Framework have been a part of Android since it's initial release. No, Google Play Services was first released in 2012, whereas Google's first Android release was in 2008[2], so it most certainly has not been a part o…
> It wasn't always; it was an independent company that was acquired by Google in the mid 2000s.[1] Fair point, but AFAIK Android was never released as an open source project until it was Google owned. No, Google Play Services was first released in 2012, whereas Google's first Android release was in 2008[2], so it most certainly has not been a part of Android from the beginning. You were emphasising the wrong part of…
> Fair point, but AFAIK Android was never released as an open source project until it was Google owned.
Since we're both being pedantic here, I never said that it was. :) I believe the GP did though (the person you were initially replying to, that is).
> Many proprietary components that are now part of Google Play Services have existed seperately for longer than the "Play" brand had
You're right, and that's one of the things that bothers me about Android's reputation for being an "open" or "open source friendly" OS. Yes, AOSP is open source software (if you leave out the binary blobs necessary for the radios and GPU to work), but even plain vanilla Android as shipped by Google is far from open source. Google has steadily been moving towards a closed/locked down model in many of their projects.
Re: Chromium unconditionally downloads binary blob
#139Earlier quoted context omitted.
> I understand there are likely to be many uninvolved engineers within Google who have access to the source code. It would do a lot to restore trust if a few such engineers could take a look through the source code and find out whether it has a remote trigger, and whether the source code in Google's repo matches the file that's being distributed. That would prove nothing since there'd be no evidence to back up said s…
> Android is Google's project to begin with It wasn't always; it was an independent company that was acquired by Google in the mid 2000s.[1] > and the closed components which are part of the Play Service Framework have been a part of Android since it's initial release. No, Google Play Services was first released in 2012, whereas Google's first Android release was in 2008[2], so it most certainly has not been a part o…
It wasn't always; it was an independent company that was acquired by Google in the mid 2000s.[1]
true but Android was started as a Google project..Android INc never released anything
Re: Chromium unconditionally downloads binary blob
#140Earlier quoted context omitted.
You can't realistically audit binary blob. But you can audit source code. So if download is protected by the digital signature, it's OK.
You can't realistically audit the Chromium source code either.
? Why do you think people are discussing this, might it be because, gasp, the source code is being audited?