Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium unconditionally downloads binary blob

bugs.debian.org

Post reply on HN
Print view View original

61–70 of 180 posts

Re: Chromium unconditionally downloads binary blob

#61

Post by mortehu »

pilif wrote: post #45
simoncion wrote: post #43

Earlier quoted context omitted.

According to this [0], NaCl is a Pepper plugin. [1] This would strongly imply that all you'd need to do to use NaCl is to implement PPAPI. Care to point out how I'm wrong about that? [0] https://www.chromium.org/nativeclient/getting-started/gettin... [1] Indeed, in a vaguely-recent Chrome, about:plugins has this to say about NaCl: Native Client Name: Native Client Version: Location: /opt/google/chrome/internal-nacl-p…

the PPAPI is very closely tied to chrome's inner workings and is extremely complicated to implement as, compared to the old plugin api's, it doesn't allow native code any access to the local system. So it needs to provide plugins with all the possible hooks they will ever need. Check https://developer.chrome.com/native-client/c-api for a list of currently supported features. For other browsers to support PPAPI, they'…

> the PPAPI is very closely tied to chrome's inner workings and is extremely complicated to implement

I've looked at the API, and can't agree with your statement. The API is similar to a typical game engine API. There are classes for handling input devices, audio, OpenGL, hardware video decoding, filesystem access, and basic networking. The PPAPI does not even touch the DOM, so it's not tied to being in a web browser.

Re: Chromium unconditionally downloads binary blob

#62

Post by Tobani »

rmc wrote: post #52
simoncion wrote: post #30

Earlier quoted context omitted.

Isn't the blob downloaded from Google's servers over a HSTS and cert-pinned TLS connection?[0] If someone has MitM'd Google, it's gonna be a bad day for a lot of people. From my POV, the thing that's actually bothersome about this issue is that a closed-source blob is automatically inserted into a project that I -and others- had understood to be completely open-source. The fact that the Chromium Google Hotword code w…

> If someone has MitM'd Google, it's gonna be a bad day for a lot of people. Didn't foreign government agencies already do that? (e.g. NSA?)

As far as we know only on insecure channels. Google had "private" pipes that they thought they didn't need to encrypt between datacenters and they didn't think they needed to encrypt that data. That was the MITM we knew about. I don't believe we know of them MITM'ing a cryptographically secure channel.

Re: Chromium unconditionally downloads binary blob

#63

Post by Flenser »

rmc wrote: post #52
simoncion wrote: post #30

Earlier quoted context omitted.

Isn't the blob downloaded from Google's servers over a HSTS and cert-pinned TLS connection?[0] If someone has MitM'd Google, it's gonna be a bad day for a lot of people. From my POV, the thing that's actually bothersome about this issue is that a closed-source blob is automatically inserted into a project that I -and others- had understood to be completely open-source. The fact that the Chromium Google Hotword code w…

> If someone has MitM'd Google, it's gonna be a bad day for a lot of people. Didn't foreign government agencies already do that? (e.g. NSA?)

They spied on unencrypted data as it was transferred between data-centers. They can't decrypt or MITM anything because they don't have google's keys, and chrome using HSTS cert-pinning means that the cert is fixed and can't be faked with one for google from another top-level CA.

Re: Chromium unconditionally downloads binary blob

#64

Post by mortehu »

jug wrote: post #12
AndrewDMcG wrote: post #2

From the comments on the debian bug, this appears to have been fixed in Chromium. https://code.google.com/p/chromium/issues/detail?id=491435

Strange how they "fixed" it by making it opt-out rather than opt-in, given the culture collision here. Google really likes NaCl a lot for being a feature with almost no third party adoption.

While there's "almost no third party adoption", there are two pretty significant uses: The Flash player and the PDF viewer. Browsers that rely on NPAPI for these get all of Adobe's security bugs on top of their own. You may say that Flash and PDF doesn't exist in your view of the web, but it definitely does for many people.

Re: Chromium unconditionally downloads binary blob

#65

Post by pilif »

mortehu wrote: post #61
pilif wrote: post #45

Earlier quoted context omitted.

the PPAPI is very closely tied to chrome's inner workings and is extremely complicated to implement as, compared to the old plugin api's, it doesn't allow native code any access to the local system. So it needs to provide plugins with all the possible hooks they will ever need. Check https://developer.chrome.com/native-client/c-api for a list of currently supported features. For other browsers to support PPAPI, they'…

> the PPAPI is very closely tied to chrome's inner workings and is extremely complicated to implement I've looked at the API, and can't agree with your statement. The API is similar to a typical game engine API. There are classes for handling input devices, audio, OpenGL, hardware video decoding, filesystem access, and basic networking. The PPAPI does not even touch the DOM, so it's not tied to being in a web browser…

By "tied to chrome's inner workings" I meant the implementation itself which can't be lifted off of Chrome because of that. So PPAPI would need to be re-implemented by other browsers which is difficult as it's very much a moving target without an official standards process.

Basically what happens is that their flash plugin or some internal chrome app needs feature X at which point they extend PPAPI to have feature X. Trying to play catch-up with this kind of development is frustrating and difficult.

And aside of that, browser vendors don't like the fact that PPAPI is more or less re-implementing other existing web technologies. Here's a writeup by Robert O'Callahan from 2010 that goes into this reasoning: https://mail.mozilla.org/pipermail/plugin-futures/2010-April...

Re: Chromium unconditionally downloads binary blob

#66

Post by _ea1k »

fluidcruft wrote: post #55
marrs wrote: post #46

Earlier quoted context omitted.

You mean, you couldn't compile it from source, modify the source code and distribute your modifications freely to others?

No, he means Chromium (like Android) in practice are read-only, hostile projects that respond only to Google's needs. Yes, you are free to create a fork. In reality, it's nearly impossible to keep up with Google's development pace and their behavior of dumping huge changesets and lack of documentation and communication wears everyone out. If you have some exposure to biology/ecology you'll recognize the behavior as v…

Oh ok. So it would be more open source if the upstream vendor contributed less.

Re: Chromium unconditionally downloads binary blob

#67

Post by mavhc »

vbezhenar wrote: post #32
roel_v wrote: post #27

Earlier quoted context omitted.

"A closed source binary being silently downloaded and executed without explicit action by the user or notification to the same is a security incident." Whereas source code being downloaded, compiled and run is not? Or a script being downloaded and run?

You can't realistically audit binary blob. But you can audit source code. So if download is protected by the digital signature, it's OK.

You can't realistically audit the Chromium source code either.

Re: Chromium unconditionally downloads binary blob

#69

Post by mavhc »

rockdoe wrote: post #22
buster wrote: post #19

Earlier quoted context omitted.

But you do understand that Chromium is supposed to be open source, right? So, if the intent was to include a binary, closed source blob into an open source project, that could be called malicious.

It was very much the intent: https://code.google.com/p/chromium/issues/detail?id=491435 Chromium is and has always been an open source project in name only.

Open source vs FLOSS vs Open development vs Open leadership

Chromium seems more open development than Android anyway.

Re: Chromium unconditionally downloads binary blob

#70

Post by spdustin »

So, if the article was titled "Chromium downloads and activates closed-source eavesdropping software on all its devices, bypassing any OS alerts", would that be too wordy? It's meant to be a little tongue-in-cheek, admittedly, but it seems to me that's exactly what they did.

Isn't Chromium behind the enterprise chromebox/chromebook stuff too? And does this mean that Chrome itself may, or has already, install eavesdropping software and activate it without my knowledge?

Edit: I see from a sibling comment that OS X has this eavesdropping software installed, so that leads me to believe that everyone running chromium devices will have this activated, and that it's going to be part of Chrome soon, if it isn't already.

I know it's hyperbole to call it "eavesdropping software", but I also know how many people here were unsettled by "OK Google" and "Alexa!" (Amazon Echo), and I really do want to understand how folks here feel about the intrusion.

Post reply on HN