Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium unconditionally downloads binary blob

bugs.debian.org

Post reply on HN
Print view View original

51–60 of 180 posts

Re: Chromium unconditionally downloads binary blob

#51

Post by acdha »

belorn wrote: post #37
simoncion wrote: post #30

Earlier quoted context omitted.

Isn't the blob downloaded from Google's servers over a HSTS and cert-pinned TLS connection?[0] If someone has MitM'd Google, it's gonna be a bad day for a lot of people. From my POV, the thing that's actually bothersome about this issue is that a closed-source blob is automatically inserted into a project that I -and others- had understood to be completely open-source. The fact that the Chromium Google Hotword code w…

Since it doesn't use the normal ways to download extension, I would assume it does not use TLS connection. Secret downloads has the problem to display certification errors and similar things to the users, so they would likely have to reimplemented quite a few code paths to make that work properly. https and tls is also not mentioned in either bug threads, which is a worrying sign. If it uses TLS, then the bug is less…

> Since it doesn't use the normal ways to download extension, I would assume it does not use TLS connection

If this was some random enterprise Java app, yes, that would be a reasonable assumption but you're talking about one of the most heavily audited codebases in existence, which has one of the best security teams in the world working on making TLS stronger and aggressively pinning certificates. Their track record would merit actually looking at the source rather than simply speculating.

Re: Chromium unconditionally downloads binary blob

#52

Post by rmc »

simoncion wrote: post #30
belorn wrote: post #28

A bit surprised that there is no security CVE report attached. Debian policy is that binaries are vetted by a debian developer, sorted into Main, Contrib and Non-free, cryptographically signed and later verified by the client package system. The bug could allow arbitrary code to be installed and run without any of the above process if someone MitM the connection between the binary file and the client.

Isn't the blob downloaded from Google's servers over a HSTS and cert-pinned TLS connection?[0] If someone has MitM'd Google, it's gonna be a bad day for a lot of people. From my POV, the thing that's actually bothersome about this issue is that a closed-source blob is automatically inserted into a project that I -and others- had understood to be completely open-source. The fact that the Chromium Google Hotword code w…

> If someone has MitM'd Google, it's gonna be a bad day for a lot of people.

Didn't foreign government agencies already do that? (e.g. NSA?)

Re: Chromium unconditionally downloads binary blob

#53

Post by codazoda »

zoner wrote: post #50

Switched to Firefox as the primary browser just to be sure :)

There's a comment there indicating that FF has done the same in the past with an H.264 blob.

The conspiracist in me wonders why both these major browsers have downloaded and maybe executed binary blobs. Is it purely a convenience feature in the browser? Is it a secret order? That last question would have been silly a decade ago but we all know it's entirely possible now.

Re: Chromium unconditionally downloads binary blob

#55

Post by fluidcruft »

marrs wrote: post #46
rockdoe wrote: post #22

Earlier quoted context omitted.

It was very much the intent: https://code.google.com/p/chromium/issues/detail?id=491435 Chromium is and has always been an open source project in name only.

You mean, you couldn't compile it from source, modify the source code and distribute your modifications freely to others?

No, he means Chromium (like Android) in practice are read-only, hostile projects that respond only to Google's needs.

Yes, you are free to create a fork.

In reality, it's nearly impossible to keep up with Google's development pace and their behavior of dumping huge changesets and lack of documentation and communication wears everyone out. If you have some exposure to biology/ecology you'll recognize the behavior as very effective at killing off diversity in ecosystems. It's like trying to co-exist on a lake with someone that keeps deliberately causing giant algal blooms.

Re: Chromium unconditionally downloads binary blob

#57

Post by icebraining »

codazoda wrote: post #53
zoner wrote: post #50

Switched to Firefox as the primary browser just to be sure :)

There's a comment there indicating that FF has done the same in the past with an H.264 blob. The conspiracist in me wonders why both these major browsers have downloaded and maybe executed binary blobs. Is it purely a convenience feature in the browser? Is it a secret order? That last question would have been silly a decade ago but we all know it's entirely possible now.

Firefox's blob is open source, though (OpenH264 is on Github and is BSD-licensed).

Re: Chromium unconditionally downloads binary blob

#58

Post by pgeorgi »

codazoda wrote: post #53
zoner wrote: post #50

Switched to Firefox as the primary browser just to be sure :)

There's a comment there indicating that FF has done the same in the past with an H.264 blob. The conspiracist in me wonders why both these major browsers have downloaded and maybe executed binary blobs. Is it purely a convenience feature in the browser? Is it a secret order? That last question would have been silly a decade ago but we all know it's entirely possible now.

the open h.264 blob thing is annoying, but it's supposed to be a reproducible build of open source software.

The reason why there's a blob is because for that binary, Cisco pays the patent licenses.

So you can verify the source for any issues, verify whether it matches the binary, and work around MPEG-LA licensing at the same time (there are caps, and Cisco seems to have calculated that even when running into them, they're still better off with having webrtc support h.264 everywhere).

Re: Chromium unconditionally downloads binary blob

#59

Post by castell »

longsleep wrote: post #10

Another reason to switch to Iridium Browser. It has Google search disabled by default and even if you switch search to Google, Voice search and hot-words stay off until you manually enable it. https://iridiumbrowser.de/

another one is "Iron browser"
Post reply on HN