41–50 of 180 posts
Another reason to switch to Iridium Browser. It has Google search disabled by default and even if you switch search to Google, Voice search and hot-words stay off until you manually enable it. https://iridiumbrowser.de/
Earlier quoted context omitted.
Isn't the blob downloaded from Google's servers over a HSTS and cert-pinned TLS connection?[0] If someone has MitM'd Google, it's gonna be a bad day for a lot of people. From my POV, the thing that's actually bothersome about this issue is that a closed-source blob is automatically inserted into a project that I -and others- had understood to be completely open-source. The fact that the Chromium Google Hotword code w…
Since it doesn't use the normal ways to download extension, I would assume it does not use TLS connection. Secret downloads has the problem to display certification errors and similar things to the users, so they would likely have to reimplemented quite a few code paths to make that work properly. https and tls is also not mentioned in either bug threads, which is a worrying sign. If it uses TLS, then the bug is less…
I'd be more concerned that the only thing the patch seems to do is not activate the hotword extension. It seems to still download and install it. I mean, maybe I'm wrong here. I think that checking through https://chromium.googlesource.com/chromium/src/+/f269d3b5482... for ENABLE_HOTWORDING is the right thing to do if one wants to understand the change that was made.
Earlier quoted context omitted.
I've gotta raise an eyebrow on that one. If it's a major rewrite to support a new plugin authoring language, your plugin architecture was a terrible mess to begin with. Given that we're supposed to believe that New Internet Explorer was pretty much a from-the-ground-up rewrite, I can't imagine that their plugin architecture is a terrible mess.
NaCl isn't simply a plugin architecture. It is effectively the entire Chrome sandbox and large parts of Chrome architecture made available to binary plugins. You aren't pulling it into your project without also pulling in half of Chrome.
[0] https://www.chromium.org/nativeclient/getting-started/gettin...
[1] Indeed, in a vaguely-recent Chrome, about:plugins has this to say about NaCl:
Native Client
Name: Native Client
Version:
Location: /opt/google/chrome/internal-nacl-plugin
Type: PPAPI (in-process)
Earlier quoted context omitted.
Firefox doesn't support NacCl, Mozilla has show no intention of integrating it and they even criticized the technology.
Yeah but that's because Mozilla loves javascript and NaCl provides a working alternative.
Earlier quoted context omitted.
NaCl isn't simply a plugin architecture. It is effectively the entire Chrome sandbox and large parts of Chrome architecture made available to binary plugins. You aren't pulling it into your project without also pulling in half of Chrome.
According to this [0], NaCl is a Pepper plugin. [1] This would strongly imply that all you'd need to do to use NaCl is to implement PPAPI. Care to point out how I'm wrong about that? [0] https://www.chromium.org/nativeclient/getting-started/gettin... [1] Indeed, in a vaguely-recent Chrome, about:plugins has this to say about NaCl: Native Client Name: Native Client Version: Location: /opt/google/chrome/internal-nacl-p…
Check https://developer.chrome.com/native-client/c-api for a list of currently supported features.
For other browsers to support PPAPI, they'd have to implement all of this, which, btw, also is a moving target that moves forward in lockstep with chrome releases.
Earlier quoted context omitted.
But you do understand that Chromium is supposed to be open source, right? So, if the intent was to include a binary, closed source blob into an open source project, that could be called malicious.
It was very much the intent: https://code.google.com/p/chromium/issues/detail?id=491435 Chromium is and has always been an open source project in name only.
Earlier quoted context omitted.
This guy is actually perfectly right. Google doesn't do thing like that by accident. I'm glad there are some sharp guys around to disclose such potentially malicious behavior.
Even if malice instead of incompetence is involved, it goes pretty far to call Chromium a "rootkit-downloader" just because it downloads a binary blob. It could theoretically be a rootkit, but without any evidence to support it this is like calling someone a murderer because he went to the same high school as a murderer.
I advise not reading that bug, some of the later comments will give you brain cancer. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909#51 Downvotes? So you agree with this? "I seriously consider the good faith of an such upstream which does these kinds of things" "But basically secretly downloading it leads to the question of possible malicious intent (and everyone knows that Google&Co. do voluntarily and/or…
Whether we agree or not is not really relevant. Advising people to not read a bug report because one of the comments in the discussion associated with the report doesn't appeal to you is... strange, to say the least.
How do you manage any kind of discussion format if opinions (however wrong they may be) you don't like make you leave the discussion entirely?
Earlier quoted context omitted.
The tone was inflammatory but the sentiment is valid. Quoting: Since no one really know which binaries have been downloaded there and what they actually do, and since it cannot be excluded that it was actually executed, such systems are basically to be considered compromised A closed source binary being silently downloaded and executed without explicit action by the user or notification to the same is a security inci…
"A closed source binary being silently downloaded and executed without explicit action by the user or notification to the same is a security incident." Whereas source code being downloaded, compiled and run is not? Or a script being downloaded and run?
In this context (Chromium on Debian) having a closed source binary downloaded and executed is an additional problem to the security incident and that's the reason it is mentioned in the statement. There are two problems conflated in the same sentence:
1. A binary was downloaded and executed without explicit user intervention or consent.
2. A closed source binary was downloaded and executed by a primarily free and open source software in a free and open source distribution without explicit user intervention or consent.
So, answering the questions, having the source available would not make it ok but being closed source in this context is a problem on its own.