6 ms·

» When Chrome starts up, it fetches a list of feature flags from a Chrome server using a system called Finch which is independent of the normal upgrade system.

» When Chrome starts up, it fetches a list of feature flags from a Chrome server using a system called Finch which is independent of the normal upgrade system. I'm not a Chrome user. But that sounds awful at first. What is the idea behind this service? Is there any documentation about the 'features' these flags can enable/disable? I understand that I'm paranoid at times AND I really dislike Google, but why would you have an extra channel to influence deployments, other than offering a global update file?

sbierwagen 10y ago
If you "really" dislike Google, then why are you using Chrome?
- shawkinaw 10y ago
  > I'm not a Chrome user.
  - sbierwagen 10y ago
    Oops, dang it.
- vuanotino 10y ago
  I'm not the GP, and even though I personally really dislike Google too, I'm forced to use Chrome because Firefox fucking sucks.
kodablah 10y ago
I fail to see this as any more harmful than the auto updating feature. I understand the concern of multiple avenues to phone home as being worse than one, but it's negligible considering it's the same company. Coupled with all of their other services for security incidents, prediction, auto correct, spelling, usage stats, dangerous page warnings, etc, I think it's just another log on the fire and not worth being concerned about specifically.
- Ph0X 10y ago
  It actually is almost nothing like the auto updating feature. Finch is mainly used for A/B testing. It doesn't push actual updates, all it does it turn existing features (flags) on and off. It's used for quickly A/B testing or incremental rolling new features and is designed to be more agile.
  - wfunction 10y ago
    That means it uniquely identified you to Google every day then, right?
    - phreack 10y ago
      Always assume so with Google products.
      - wfunction 10y ago
        What about Chromium?
        vurpo 10y ago
        Chromium never uses Finch except if you specify it in the command line flags.
        wfunction 10y ago
        Thanks!
    - gcb0 10y ago
      > using a Google browser > not wanting to be tracked here's a hint: ad impression for unknown user is 0.01$ and for logged in user 2$. guess why Google has a browser now...
      - 10y ago
yuhong 10y ago
For one: https://chromium.googlesource.com/chromium/src.git/+/master/content/public/common/content_features.cc https://chromium.googlesource.com/chromium/src.git/+/master/... Also look for base::FieldTrialList in Chromium source. In this case, it seems to be: https://chromium.googlesource.com/chromium/src/net/+/master/http/transport_security_state.cc https://chromium.googlesource.com/chromium/src/net/+/master/...
Ph0X 10y ago
Update actually changes the binary/code of chrome. It pushes new features and content to you. Finch only turns certain features on/off. It's used for A/B testing and incremental rollouts. You can see a list of flags in chrome://flags Mostly experimental stuff that will become full features soon, but until then they are behind a flag. The two systems fulfill very different roles.
gcb0 10y ago
because Google don't know bugs on your (their) browser affecting their revenue. interesting, if you're a victim of mitm attacks, i wonder if attackers can abuse that to disable some certificate check features to make spoofing ssl sites easier.
- yuhong 10y ago
  I think they use TLS and they use cert pinning for Google domains.

sbierwagen 10y ago

If you "really" dislike Google, then why are you using Chrome?

shawkinaw 10y ago
> I'm not a Chrome user.
- sbierwagen 10y ago
  Oops, dang it.
vuanotino 10y ago
I'm not the GP, and even though I personally really dislike Google too, I'm forced to use Chrome because Firefox fucking sucks.

kodablah 10y ago

I fail to see this as any more harmful than the auto updating feature. I understand the concern of multiple avenues to phone home as being worse than one, but it's negligible considering it's the same company. Coupled with all of their other services for security incidents, prediction, auto correct, spelling, usage stats, dangerous page warnings, etc, I think it's just another log on the fire and not worth being concerned about specifically.

Ph0X 10y ago
It actually is almost nothing like the auto updating feature. Finch is mainly used for A/B testing. It doesn't push actual updates, all it does it turn existing features (flags) on and off. It's used for quickly A/B testing or incremental rolling new features and is designed to be more agile.
- wfunction 10y ago
  That means it uniquely identified you to Google every day then, right?
  - phreack 10y ago
    Always assume so with Google products.
    - wfunction 10y ago
      What about Chromium?
      - vurpo 10y ago
        Chromium never uses Finch except if you specify it in the command line flags.
        wfunction 10y ago
        Thanks!
  - gcb0 10y ago
    > using a Google browser > not wanting to be tracked here's a hint: ad impression for unknown user is 0.01$ and for logged in user 2$. guess why Google has a browser now...
    - 10y ago

yuhong 10y ago

For one: https://chromium.googlesource.com/chromium/src.git/+/master/content/public/common/content_features.cc https://chromium.googlesource.com/chromium/src.git/+/master/... Also look for base::FieldTrialList in Chromium source. In this case, it seems to be: https://chromium.googlesource.com/chromium/src/net/+/master/http/transport_security_state.cc https://chromium.googlesource.com/chromium/src/net/+/master/...

Ph0X 10y ago

Update actually changes the binary/code of chrome. It pushes new features and content to you. Finch only turns certain features on/off. It's used for A/B testing and incremental rollouts. You can see a list of flags in chrome://flags Mostly experimental stuff that will become full features soon, but until then they are behind a flag. The two systems fulfill very different roles.

gcb0 10y ago

because Google don't know bugs on your (their) browser affecting their revenue. interesting, if you're a victim of mitm attacks, i wonder if attackers can abuse that to disable some certificate check features to make spoofing ssl sites easier.

yuhong 10y ago
I think they use TLS and they use cert pinning for Google domains.