9 ms·

The GNU completely ignores the value that you get from Google. For instance this point: > Google Chrome contains a key logger that sends Google every URL typed

The GNU completely ignores the value that you get from Google. For instance this point: > Google Chrome contains a key logger that sends Google every URL typed in, one key at a time They are describing the auto complete feature... I get that people should be making informed choices about what data they share, but for the FSF to so intentionally mis-describe what is going on does not help inform anyone.

BryantD 7y ago
I think it's useful to describe the features in terms that make it very clear what's going on. On the other hand, I disagree with the assumption that users should not be willing to make the tradeoff of using the software anyway.
ChrisSD 7y ago
Wait but that's literally what the auto complete feature does. Most users understand the value of the feature (they use it!) but there's a good reason to spell out the cost too. I agree with the criticism that they should draw a clearer line between the cost and the benefit but there's nothing to be gained by softening the language used to describe the cost.
- jammygit 7y ago
  Years ago I used to assume autocompletions were performed on device, not sent to a server
- chucksmash 7y ago
  I'd naively consider a keylogger to be software that captures your keypresses universally. I use Firefox and have search suggestions disabled there so I am somewhat sympathetic to their point. That said, calling server-side autocomplete on a field you explicitly are typing in strikes me as about as sensible and forthright as calling an Amazon text field that takes my credit card number a card skimmer.
  - aflag 7y ago
    There are keyloggers targeted to specific fields too. It depends on what vulnerability is being exploited to install a keylogger. I think the description of autocomplete as a keylogger is a good fit from the security perspective.
    - hutzlibu 7y ago
      No, as a keylogger is the term for a malware to capture ALL your keystrokes in secret (to usually later fish out the interesting ones like passwords). It is misleading, to mix it up with a software, that captures your textinput from a textfield, even though it is not communicated clearly to the average user that his text goes to a server.
  - davvolun 7y ago
    > calling server-side autocomplete on a field you explicitly are typing in strikes me as about as sensible and forthright as calling an Amazon text field that takes my credit card number a card skimmer Exactly, and waters down the impact of the termminology. If "card skimmer" is anything that can read a credit card, than the term is meaningless for security. If "keylogger" is anything connected to the web that responds to a keypress... GNU is risking turning into the boy who cried wolf here.
    - gregknicholson 7y ago
      > GNU is risking turning into the boy who cried wolf here. As with a lot of the FSF's messaging, I think the substance of the message may be correct, but the way they convey it just isn't effective. If this is for a general audience(!), no-one was ever convinced by the 48th item in a list who wasn't already convinced by the 47th. You don't persuade people just by being right, and certainly not by banging on about the very many subtly-different ways in which you're right. Pick few strong examples and prosecute those decisively. If this is a resource for campaigners, set out the audience and intent before you start. Preface it with something like “Here are various ways that certain aspects of Google's software can be seen as indistinguishable from malware. They may be useful counterarguments if someone suggests Google's software is trustworthy.”
- tylerl 7y ago
  The costs? Are you joking? Of to the 2 Billion people using Chrome, point out just one for whom the privacy implications around autocomplete have imposed a non-theoretical cost. There's the cost you impose on yourself for paranoia, but lay THAT at the feet of the FSF. And if you say bandwidth you're fired. It's privacy the FSF is grumbling about. And for that it's been rhetoric and theoretical suffering, but no actual real-world damage. And not for lack of adoption. Put that cost in your pipe and smoke it.
  - jmkb 7y ago
    If your browsing history is of value, than giving it (or even just the portions of it that are manually typed into the url bar) away is a cost to you. You can't point to a dollar amount on an invoice, so in that sense it's not "non-theoretical." But if you believe that personal information can be valuable -- and it's pretty clear that it can, especially in the aggregate -- then calling this a "cost" is not a joke.
    - shrimp_emoji 7y ago
      Unquantifiable externalities. At the end of the day, serverside autocomplete is useful, and coal is cheap!
      - ariwilson 7y ago
        My thermometer is a pretty clear indicator of a quantifiable externality of coal.
        greyhair 7y ago
        Your thermometer is only a good indicator if it provides a comparison of the current temperature to the average temperature for that moment plus windowed samples over the last one hundred years. Otherwise, it just tells you the current temperature. </s>
    - adjkant 7y ago
      Google already stores your browsing history in the cloud if you're signed in, which most users are. The "keylogging" wouldn't really add any value to the data, and thus I don't really buy that cost. If you're not logged in, as I'm sure FSF people are, then this is a much bigger deal, but it doesn't apply to the vast majority of people. All that said, the keylogger would take a good deal of interpretation to get a complete or even partial history, since autocomplete choices would likely be chosen anyways, not fully typed out URL's. If they send that history anyways on any time you press enter, the autocomplete feature again doesn't matter because they have it with our with.
mighty_bander 7y ago
If only there were some middle ground between "not having autocomplete" and "ruthlessly data mining the everliving fuck out of everything I do in order to sell me shit." Oh well, nothing we can do, I guess, except shut up and take it.
- tripzilch 7y ago
  With Google Maps the choice is even between "simply remembering your past few searches" (incredibly easy to do locally) and ruthlessly data mining the everliving shit of everything you do. That's basically holding my privacy hostage for what is stupidly basic UX functionality. And it's not like I was given a choice about it. Maps used to remember your search history just fine, until they pulled that a few years ago, and I "just" had to give them my location history, so they would remember my fucking search queries. You might recognize these tactics from heroin dealers and similar scum. It's amazing how unnecessarily less useful Maps is, if you have to retype the addresses every. single. time. But you don't want Google to keep a log of everywhere you've been.
esotericn 7y ago
Yes, this is a keylogger. Autocomplete with a remote backend is too. The Overton window has moved so far in the last ten years. A while back we (and by we I don't mean me, I mean hackers collectively) would consider a piece of software that opened a TCP socket unless it had a real reason to malware. Now? It's fairly common for like, webpages to send back every keystroke you might accidentally make whilst a tab is focused. The fact that this is frequent, possibly even 'normal' behaviour does not make it sane.
- solipsism 7y ago
  The Overton window describes what the public will accept as "sane" (to use your term). You're free to disagree with the rest of the world, of course. But you might want to focus on trying to shift the Overton window. What you're doing in this comment is simply asserting that you disagree with everyone else.
  - TeMPOraL 7y ago
    That's literally what FSF is doing - desperately pulling one edge of the window to prevent it from sliding into madness.
    - esotericn 7y ago
      Indeed.
  - tripzilch 7y ago
    The disagreement is not that autocomplete with a remote backend is a keylogger, that's factual. It's about calling it malware right? Because you seem to be asserting what "everyone else" thinks. If I ask non-technical people about this autocomplete feature and whether they would like to disable it (assuming they have this option), after explaining it sends every keystroke to Google, they (generally) will reluctantly agree to have it enabled, why? It's not because they believe sending every keystroke to Google is a super reasonable sacrifice for having the benefit of autocomplete on search queries. No, ask them, they will invariably sigh "Well, Google knows everything about me already, anyway, so ...". That's NOT the reasoning of someone making a well thought-out decision, it's the reasoning of someone beaten into submission. And we know this is true, because we feel it too, every time you read a comment about somebody trying to escape the Google Ecosystem, but not yet having a satisfying replacement for this one service .. You don't get to make a fair choice about it. That is why they say Google mistreats their users, because they made them give up, not just giving up their privacy, but giving up on their belief they even have a choice about it.
amatecha 7y ago
It might ignore the value, but it's not incorrect. If Chrome is sending to Google every character typed into the URL bar, that's literally a networked keylogger and can presumably be used for all the same nefarious purposes as a "malicious" keylogger. The perceived value this feature provides is meaningless in the context of privacy/security. I bet all those keypresses are stored permanently, associated with your Google account, but that's another issue altogether.

BryantD 7y ago

I think it's useful to describe the features in terms that make it very clear what's going on. On the other hand, I disagree with the assumption that users should not be willing to make the tradeoff of using the software anyway.

ChrisSD 7y ago

Wait but that's literally what the auto complete feature does. Most users understand the value of the feature (they use it!) but there's a good reason to spell out the cost too. I agree with the criticism that they should draw a clearer line between the cost and the benefit but there's nothing to be gained by softening the language used to describe the cost.

jammygit 7y ago
Years ago I used to assume autocompletions were performed on device, not sent to a server
chucksmash 7y ago
I'd naively consider a keylogger to be software that captures your keypresses universally. I use Firefox and have search suggestions disabled there so I am somewhat sympathetic to their point. That said, calling server-side autocomplete on a field you explicitly are typing in strikes me as about as sensible and forthright as calling an Amazon text field that takes my credit card number a card skimmer.
- aflag 7y ago
  There are keyloggers targeted to specific fields too. It depends on what vulnerability is being exploited to install a keylogger. I think the description of autocomplete as a keylogger is a good fit from the security perspective.
  - hutzlibu 7y ago
    No, as a keylogger is the term for a malware to capture ALL your keystrokes in secret (to usually later fish out the interesting ones like passwords). It is misleading, to mix it up with a software, that captures your textinput from a textfield, even though it is not communicated clearly to the average user that his text goes to a server.
- davvolun 7y ago
  > calling server-side autocomplete on a field you explicitly are typing in strikes me as about as sensible and forthright as calling an Amazon text field that takes my credit card number a card skimmer Exactly, and waters down the impact of the termminology. If "card skimmer" is anything that can read a credit card, than the term is meaningless for security. If "keylogger" is anything connected to the web that responds to a keypress... GNU is risking turning into the boy who cried wolf here.
  - gregknicholson 7y ago
    > GNU is risking turning into the boy who cried wolf here. As with a lot of the FSF's messaging, I think the substance of the message may be correct, but the way they convey it just isn't effective. If this is for a general audience(!), no-one was ever convinced by the 48th item in a list who wasn't already convinced by the 47th. You don't persuade people just by being right, and certainly not by banging on about the very many subtly-different ways in which you're right. Pick few strong examples and prosecute those decisively. If this is a resource for campaigners, set out the audience and intent before you start. Preface it with something like “Here are various ways that certain aspects of Google's software can be seen as indistinguishable from malware. They may be useful counterarguments if someone suggests Google's software is trustworthy.”
tylerl 7y ago
The costs? Are you joking? Of to the 2 Billion people using Chrome, point out just one for whom the privacy implications around autocomplete have imposed a non-theoretical cost. There's the cost you impose on yourself for paranoia, but lay THAT at the feet of the FSF. And if you say bandwidth you're fired. It's privacy the FSF is grumbling about. And for that it's been rhetoric and theoretical suffering, but no actual real-world damage. And not for lack of adoption. Put that cost in your pipe and smoke it.
- jmkb 7y ago
  If your browsing history is of value, than giving it (or even just the portions of it that are manually typed into the url bar) away is a cost to you. You can't point to a dollar amount on an invoice, so in that sense it's not "non-theoretical." But if you believe that personal information can be valuable -- and it's pretty clear that it can, especially in the aggregate -- then calling this a "cost" is not a joke.
  - shrimp_emoji 7y ago
    Unquantifiable externalities. At the end of the day, serverside autocomplete is useful, and coal is cheap!
    - ariwilson 7y ago
      My thermometer is a pretty clear indicator of a quantifiable externality of coal.
      - greyhair 7y ago
        Your thermometer is only a good indicator if it provides a comparison of the current temperature to the average temperature for that moment plus windowed samples over the last one hundred years. Otherwise, it just tells you the current temperature. </s>
  - adjkant 7y ago
    Google already stores your browsing history in the cloud if you're signed in, which most users are. The "keylogging" wouldn't really add any value to the data, and thus I don't really buy that cost. If you're not logged in, as I'm sure FSF people are, then this is a much bigger deal, but it doesn't apply to the vast majority of people. All that said, the keylogger would take a good deal of interpretation to get a complete or even partial history, since autocomplete choices would likely be chosen anyways, not fully typed out URL's. If they send that history anyways on any time you press enter, the autocomplete feature again doesn't matter because they have it with our with.

mighty_bander 7y ago

If only there were some middle ground between "not having autocomplete" and "ruthlessly data mining the everliving fuck out of everything I do in order to sell me shit." Oh well, nothing we can do, I guess, except shut up and take it.

tripzilch 7y ago
With Google Maps the choice is even between "simply remembering your past few searches" (incredibly easy to do locally) and ruthlessly data mining the everliving shit of everything you do. That's basically holding my privacy hostage for what is stupidly basic UX functionality. And it's not like I was given a choice about it. Maps used to remember your search history just fine, until they pulled that a few years ago, and I "just" had to give them my location history, so they would remember my fucking search queries. You might recognize these tactics from heroin dealers and similar scum. It's amazing how unnecessarily less useful Maps is, if you have to retype the addresses every. single. time. But you don't want Google to keep a log of everywhere you've been.

esotericn 7y ago

Yes, this is a keylogger. Autocomplete with a remote backend is too. The Overton window has moved so far in the last ten years. A while back we (and by we I don't mean me, I mean hackers collectively) would consider a piece of software that opened a TCP socket unless it had a real reason to malware. Now? It's fairly common for like, webpages to send back every keystroke you might accidentally make whilst a tab is focused. The fact that this is frequent, possibly even 'normal' behaviour does not make it sane.

solipsism 7y ago
The Overton window describes what the public will accept as "sane" (to use your term). You're free to disagree with the rest of the world, of course. But you might want to focus on trying to shift the Overton window. What you're doing in this comment is simply asserting that you disagree with everyone else.
- TeMPOraL 7y ago
  That's literally what FSF is doing - desperately pulling one edge of the window to prevent it from sliding into madness.
  - esotericn 7y ago
    Indeed.
- tripzilch 7y ago
  The disagreement is not that autocomplete with a remote backend is a keylogger, that's factual. It's about calling it malware right? Because you seem to be asserting what "everyone else" thinks. If I ask non-technical people about this autocomplete feature and whether they would like to disable it (assuming they have this option), after explaining it sends every keystroke to Google, they (generally) will reluctantly agree to have it enabled, why? It's not because they believe sending every keystroke to Google is a super reasonable sacrifice for having the benefit of autocomplete on search queries. No, ask them, they will invariably sigh "Well, Google knows everything about me already, anyway, so ...". That's NOT the reasoning of someone making a well thought-out decision, it's the reasoning of someone beaten into submission. And we know this is true, because we feel it too, every time you read a comment about somebody trying to escape the Google Ecosystem, but not yet having a satisfying replacement for this one service .. You don't get to make a fair choice about it. That is why they say Google mistreats their users, because they made them give up, not just giving up their privacy, but giving up on their belief they even have a choice about it.

amatecha 7y ago

It might ignore the value, but it's not incorrect. If Chrome is sending to Google every character typed into the URL bar, that's literally a networked keylogger and can presumably be used for all the same nefarious purposes as a "malicious" keylogger. The perceived value this feature provides is meaningless in the context of privacy/security. I bet all those keypresses are stored permanently, associated with your Google account, but that's another issue altogether.