5 ms·

Chrome and other Google softwares, by default will install a system-wide auto updater (Google Keystone[1]) set to run every 5 hours. The Keystone Agent cannot e

by sirn 8y ago

Chrome and other Google softwares, by default will install a system-wide auto updater (Google Keystone[1]) set to run every 5 hours. The Keystone Agent cannot easily be removed, and will reinstall itself on every updates. There has also been an exploit[2] of this auto updater service. If what you need is Chrome developer's tools, installing Chromium (or building your own, for the paranoid) seems like a much better choice to me. [1]: Note that it has nothing to do with the google/keystone project on GitHub [2]: https://bugs.chromium.org/p/project-zero/issues/detail?id=1486 https://bugs.chromium.org/p/project-zero/issues/detail?id=14...

saagarjha 8y ago
What happens if you chmod the plist for the launch agent to 000?
- sirn 8y ago
  I have never tried, but presumably launchd won't run the Keystone agent (although using defaults command can archive the same, if we were to just disable it from running). The issue is when we want to keep Chrome and maybe other Google apps installed, while _not_ have Keystone, and not letting any Google software reinstall Keystone. In that case, it involve uninstalling Keystone agent, creating GoogleSoftwareUpdate directory then chmod that directory to 000 both in ~/Library/Google and /Library/Google
  - saagarjha 8y ago
    Is there a component to Keystone I'm missing aside from the agent? Because if launchd can't run it, presumably Keystone wouldn't work.
    - sirn 8y ago
      I believe Chrome itself do invoke Keystone when visiting chrome://chrome to manually check for updates, as it looks like from a forum post[1] (Chrome unable to check for updates after chmod 000'ing GoogleSoftwareUpdateAgent) [1]: https://www.jamf.com/jamf-nation/discussions/14162/google-chrome-auto-update https://www.jamf.com/jamf-nation/discussions/14162/google-ch...
copperx 8y ago
Is the Keystone Agent run by cron? Modifying crontab is just a few keystrokes.
- sirn 8y ago
  Keystone Agent is running by launchd on macOS, usually modifying defaults can stop it from running: defaults write com.google.Keystone.Agent checkInterval 0 However, this won't remove the agent from the system, and I think there's no way to be sure Google won't change this configuration key in an update (or even overriding its value).

by sirn 8y ago

saagarjha 8y ago

What happens if you chmod the plist for the launch agent to 000?

sirn 8y ago
I have never tried, but presumably launchd won't run the Keystone agent (although using defaults command can archive the same, if we were to just disable it from running). The issue is when we want to keep Chrome and maybe other Google apps installed, while _not_ have Keystone, and not letting any Google software reinstall Keystone. In that case, it involve uninstalling Keystone agent, creating GoogleSoftwareUpdate directory then chmod that directory to 000 both in ~/Library/Google and /Library/Google
- saagarjha 8y ago
  Is there a component to Keystone I'm missing aside from the agent? Because if launchd can't run it, presumably Keystone wouldn't work.
  - sirn 8y ago
    I believe Chrome itself do invoke Keystone when visiting chrome://chrome to manually check for updates, as it looks like from a forum post[1] (Chrome unable to check for updates after chmod 000'ing GoogleSoftwareUpdateAgent) [1]: https://www.jamf.com/jamf-nation/discussions/14162/google-chrome-auto-update https://www.jamf.com/jamf-nation/discussions/14162/google-ch...

copperx 8y ago

Is the Keystone Agent run by cron? Modifying crontab is just a few keystrokes.

sirn 8y ago
Keystone Agent is running by launchd on macOS, usually modifying defaults can stop it from running: defaults write com.google.Keystone.Agent checkInterval 0 However, this won't remove the agent from the system, and I think there's no way to be sure Google won't change this configuration key in an update (or even overriding its value).