10 ms·

Is Google Locking Down Chrome to Resist the Rise of Chromium Based Browsers?

85 points by hirundo 6y ago

MikeUt 6y ago
> Google is framing this change as an attempt to limit third-party access to Google services. Apparently accessing your own data using unapproved software makes you a 3rd party.
- prepend 6y ago
  It’s not our data, it’s Google’s. They are looking at this as a third party to their data and don’t want us granting access to the data we give them. I think this all falls down to information and data not really being ownable in a physical sense, so it’s just different legal structures and company policies.
  - solosoyokaze 6y ago
    I’m sure that’s how Google sees it, but it’s most definitely the users’ data. Google’s “company policy” is to be user hostile and leverage their monopolies for maximum anti-competitiveness.
    - prepend 6y ago
      Good point, I was trying to state Google’s position. I want control over my data, the data I “own.” But practically speaking this is impossible and I assume that anything I interact with produces data that’s owned by someone else. So while I want to own my data, if I use Chrome then Google makes their own data from my behavior and it’s theirs, not mine. To stop this, I have to stop the data being transmitted. That’s hard, but not impossible. Once it leaves my control (laptop, computer, whatever) it’s no longer mine. That’s what I mean about it being so squishy. And there’s lots of scenarios trying to understand what’s right. If I take a picture of you in the grocery store, it’s not your data. It is certainly rude. It might violate privacy. But the data is mine even though you are the subject. If I am a private eye and follow you around noting everywhere you go, the data isn’t yours, the data is mine. This is why I think that laws need to define ownership and privacy and use. So we can better regulate as a society. I still want some control on data about me, even if I don’t own it. In the US the consumer lost almost every case and that’s why stuff like 1970’s Fair Credit Reporting Act [0] allows credit bureaus to collect information about people and do stuff with it even though many people don’t like it. Effectively merchants “sell” data on people to credit agencies who collate it, analyze it, and sell insight (eg, FICO scores) and all that data are owned by people who aren’t the subjects. [0] https://en.wikipedia.org/wiki/Fair_Credit_Reporting_Act https://en.wikipedia.org/wiki/Fair_Credit_Reporting_Act
      - solosoyokaze 6y ago
        I agree that once you give someone your data, it becomes "theirs" and they can do what they want with it (logistically speaking). Interestingly enough, the executable that runs Chrome is also data that the end user "owns" once they put it on their system. This is the argument for bypassing DRM. The system is setup to screw the consumer. Most people probably do consider the data they're giving to Google's cloud services to be theirs, most may even assume that Google isn't doing anything nefarious with it, or using access to build up anti-competitive moats. Sadly, most people probably won't care that much if they do find out the truth as the service and frictionless flow are more valuable that privacy.
- swiley 6y ago
  I'm so glad google locked me out of my account. Every day their service just looks more and more abusive. Rip the band-aid off, your life will be better for it.
- technofiend 6y ago
  >Apparently accessing your own data using unapproved software makes you a 3rd party. That's been pretty clear since Google rather stridently informed me a third party app had access to my data during a security check: the app was Chromium.
- Arnt 6y ago
  No, it makes the maintainers of the unapproved software a third party, able to access your account using source code that does whatever they want. You didn't even try to review the millions of lines of code you installed, did you? And if you found out after the fact that those maintainers were using your password to do bad things, what legal recourse do you have? Running "apt-get install foo" or "npm install bar" gives you a variety of disclaimers, but no contracts with the maintainers and no rights.
  - MikeUt 6y ago
    I didn't review the millions of lines of vim code either, yet notepad.exe lets me use it to edit passwords.txt and banking_details.txt just fine.
    - Arnt 6y ago
      There are two differences. 1. NPM is being actively exploited and IMHO remarkably often; some of the third parties that are blocked by this policy are known to be malevolent. 2. I'm afraid my familiarity with Windows is somewhat limited. As far as I know Notepad has no responsibility for carrying out any sort of access control. That it carries out no access control is somewhat irrelevant if it is not intended to do so in the first place.
      - candiodari 6y ago
        But you can firewall (in 10 different ways) notepad.exe. You control what notepad has access to. You can access anything notepad.exe can bypassing notepad.exe. You cannot effectively firewall your browser, because you don't control the backend. You cannot bypass the backend of a piece of cloud software. This is a generic problem with cloud software. Any cloud software has access to your data AND YOU DO NOT. To a certain extent it even has access to your data in other apps (e.g. getting your mail address). It's a way to (currently usually partially) transfer ownership of everything you make with software, and your own data from the user to the creator of the software. This obviously an extremely negative development in the long run, but people seem quite keen on just accepting it ...
- notatoad 6y ago
  no, the "unapproved software" accessing your data is third-party access. that's like the definition of third-party.
jsnell 6y ago
https://news.ycombinator.com/item?id=25886218 https://news.ycombinator.com/item?id=25886218
jlkuester7 6y ago
This seems to track pretty close to Google's recent moves in the Android ecosystem to move more and more functionality into Google Play Services packages and not in the AOSP. As it is a corporation in the business of providing value to its shareholders, I can understand why Google is trying to maximize its profit potential in these projects. However, I think it is really important to give visibility to these moves and for developers (particularly of open source projects) to understand that Google maintains these projects for its own benefit and not for the good of any perceived "community". Once again, this is the status-quo for for-profit businesses, so I am not exactly trying to criticize Google for this. That being said, I do think that Google's (increasingly tarnished) reputation as a champion of open source work is largely undeserved because of their tendency to pull stuff like this. This whole episode is also an example of why it is important to pay attention to the licensing and availability of the whole tech stack for a project. If functionality relies on a central server (that cannot be easily replaced/self-hosted that should be a huge red flag for anyone contributing to the ecosystem. (Looking at you, Canonical, and your Snap Store shenanigans...)
- johncena33 6y ago
  > Once again, this is the status-quo for for-profit businesses, so I am not exactly trying to criticize Google for this. That being said, I do think that Google's (increasingly tarnished) reputation as a champion of open source work is largely undeserved because of their tendency to pull stuff like this. This seems like "damn if you do damn if you don't" situation. Android OS and security upgrade is a mess just because OEMs are not willing to provide upgrades to customer in timely manner. That's one of the reasons a lot of functionalities have been moved to Google Play where customers can easily get updates of different components of Android even if the OEMs are unwilling to do so. Sure, this also serves business purpose of Google. But it's not the whole truth if we omit the OEMs and Android OS upgrade situation.
  - kuschku 6y ago
    It’s easily possible to provide updates and keep it open source. Google did that in the past just fine with many AOSP apps, and even the android webbrowser parts are updated that way, and still open source. Google just used it as an excuse to make these parts of the OS proprietary.
rvz 6y ago
Well it's Google. So yes.
crazygringo 6y ago
This article makes no sense, and Google isn't "locking down Chrome". Google is removing proprietary Google services like sync from Chromium. Which honestly makes 100% sense. Chromium is supposed to be a bare-bones open-source browser. Other browsers can build on it, and they do. They can provide their own sync capabilities and everything else. If you want to use Google services, wouldn't you already just be using Chrome? So this seems like a positive development, untangling Google-specific features from the Chromium project.
- MikeUt 6y ago
  > If you want to use Google services, wouldn't you already just be using Chrome? Would you make the same argument if those services were Google search, Gmail, or Youtube?
  - fctorial 6y ago
    Those are just websites.
  - stu2b50 6y ago
    Yes, if Chrome had Gmail, etc integration built into the client I would prefer that not be in Chromium.
- est31 6y ago
  First, many people log into non-Google services using their Google account. If you can't log into it from a third party browser, you'd have to keep using Chrome even if you didn't want to. Also there is speculation that with browsers blocking third party cookies, Google might eventually perform ad tracking via the browser, via your Google account. Websites that live from ads like news websites will notice this and block users who are not logged into Google, as they don't add revenue. So eventually it might be possible that large parts of the web become inaccessible to you.
  - fctorial 6y ago
    > If you can't log into it from a third party browser, you'd have to keep using Chrome even if you didn't want to. Oauth is browser agnostic, right?
gsich 6y ago
Short answer: Yes.
ajkdhcb2 6y ago
Building the whole browser ecosystem on Google code is absurd. Even while Chromium is usable for now, they can lead the project in whatever direction they want. If you don't want that, you should be supporting Firefox. The paragraph at the end of this article saying Firefox is in favour of censorship comes from one badly worded article afaik and has nothing to do with development. So you use browsers based on Google? Seems like terrible logic
- deleted 6y ago
  [deleted]
Communitivity 6y ago
The problem is that Google is removing services that are key to Chromium use for many users. I wouldn't consider this locking down, or removing services (though it is technically that). Instead I would consider it cutting Chromium off at the knees. I suspect, but have no evidence, that this is in reaction to Microsoft basing the newest version of their browser on Chromium. The solution is to use an Open Source browser, such as Firefox or some other alternative. That's going to require more developers though to pitch in and help get feature parity in their favorite Open Source browser. I also have some concerns there, as the Firefox CEO Mitchell has said Mozilla tends to focus more on money. We've seen indicators of that recently with sponsored search. I remember the old AOL Browser and AOL Email, and the ads. I hope not, but could see Mozilla implementing ads in the Firefox UI area. What I'd like to see is a browser that is built of swappable components working around a browser microkernel consisting of a web engine (Servo?), a JavaScript engine (Deno?), a plugin framework that works via messaging and can support various msg protocols (with two ref impls:ZeroMQ and Matrix). Think something like the Eclipse RCP, but for the Browser and Web browsing. If this sounds interesting, send me a message. That's not an ad, I am interested in gauging the interest in a project like that.
- davidfstr 6y ago
  > The problem is that Google is removing services > The solution is to use an Open Source browser Seems to me the solution is to use 3rd party services that are not tied to the browser at all. For example I manage passwords with 1Password, not Chrome's or any other browser's sync services. And I use bookmarking services like Pocket which aren't tied to any browser. Using independent services made by companies that care about their reputation (and therefore the quality of their product) makes a lot more sense to me then putting all your eggs into a single browser basket.
  - Communitivity 6y ago
    I agree, and I'd like to see a unified way of connecting to those services. These services are in a way plugins, so I could see it being handled by having a plugin framework that's capable of handling in-app plugins via something like ZeroMQ, as well as external plugins (remote services or from other apps) via something like Matrix. Essentially, a key part of the idea is to create an Open Source project that is a browser construction kit rather than a browser. Then anyone can choose what components they use. Big brands can release branded sets of components that include proprietary components if they want - but users won't need to use those to have a safe, secure, and rich browsing experience.
draklor40 6y ago
Good riddance. I hate Big$G creepily tracking all of my internet search history from Chromium by default unless I explicitly turned it off. But its cute that people still think that Big companies contribute to Open Source because they want to "give back". Hell no ! It has been about reaping free, complex technical labour, monopolies (chrome, kubernetes) and marketing for hiring devs.
commandlinefan 6y ago
I wish we had less corporate-owned alternatives to Chromium and WebKit. I’m surprised there’s less in the true open source space along these lines.
- londons_explore 6y ago
  Chromium is actually a far more open project than most people imagine. As well as being open source, it also accepts outside contributions (android does not for example), developers talk in public mailing lists, and even leadership positions in the project can, and often are, taken by non-Google people.

85 points by hirundo 6y ago

> Google is framing this change as an attempt to limit third-party access to Google services. Apparently accessing your own data using unapproved software makes you a 3rd party.

prepend 6y ago
It’s not our data, it’s Google’s. They are looking at this as a third party to their data and don’t want us granting access to the data we give them. I think this all falls down to information and data not really being ownable in a physical sense, so it’s just different legal structures and company policies.
- solosoyokaze 6y ago
  I’m sure that’s how Google sees it, but it’s most definitely the users’ data. Google’s “company policy” is to be user hostile and leverage their monopolies for maximum anti-competitiveness.
  - prepend 6y ago
    Good point, I was trying to state Google’s position. I want control over my data, the data I “own.” But practically speaking this is impossible and I assume that anything I interact with produces data that’s owned by someone else. So while I want to own my data, if I use Chrome then Google makes their own data from my behavior and it’s theirs, not mine. To stop this, I have to stop the data being transmitted. That’s hard, but not impossible. Once it leaves my control (laptop, computer, whatever) it’s no longer mine. That’s what I mean about it being so squishy. And there’s lots of scenarios trying to understand what’s right. If I take a picture of you in the grocery store, it’s not your data. It is certainly rude. It might violate privacy. But the data is mine even though you are the subject. If I am a private eye and follow you around noting everywhere you go, the data isn’t yours, the data is mine. This is why I think that laws need to define ownership and privacy and use. So we can better regulate as a society. I still want some control on data about me, even if I don’t own it. In the US the consumer lost almost every case and that’s why stuff like 1970’s Fair Credit Reporting Act [0] allows credit bureaus to collect information about people and do stuff with it even though many people don’t like it. Effectively merchants “sell” data on people to credit agencies who collate it, analyze it, and sell insight (eg, FICO scores) and all that data are owned by people who aren’t the subjects. [0] https://en.wikipedia.org/wiki/Fair_Credit_Reporting_Act https://en.wikipedia.org/wiki/Fair_Credit_Reporting_Act
    - solosoyokaze 6y ago
      I agree that once you give someone your data, it becomes "theirs" and they can do what they want with it (logistically speaking). Interestingly enough, the executable that runs Chrome is also data that the end user "owns" once they put it on their system. This is the argument for bypassing DRM. The system is setup to screw the consumer. Most people probably do consider the data they're giving to Google's cloud services to be theirs, most may even assume that Google isn't doing anything nefarious with it, or using access to build up anti-competitive moats. Sadly, most people probably won't care that much if they do find out the truth as the service and frictionless flow are more valuable that privacy.
swiley 6y ago
I'm so glad google locked me out of my account. Every day their service just looks more and more abusive. Rip the band-aid off, your life will be better for it.
technofiend 6y ago
>Apparently accessing your own data using unapproved software makes you a 3rd party. That's been pretty clear since Google rather stridently informed me a third party app had access to my data during a security check: the app was Chromium.
Arnt 6y ago
No, it makes the maintainers of the unapproved software a third party, able to access your account using source code that does whatever they want. You didn't even try to review the millions of lines of code you installed, did you? And if you found out after the fact that those maintainers were using your password to do bad things, what legal recourse do you have? Running "apt-get install foo" or "npm install bar" gives you a variety of disclaimers, but no contracts with the maintainers and no rights.
- MikeUt 6y ago
  I didn't review the millions of lines of vim code either, yet notepad.exe lets me use it to edit passwords.txt and banking_details.txt just fine.
  - Arnt 6y ago
    There are two differences. 1. NPM is being actively exploited and IMHO remarkably often; some of the third parties that are blocked by this policy are known to be malevolent. 2. I'm afraid my familiarity with Windows is somewhat limited. As far as I know Notepad has no responsibility for carrying out any sort of access control. That it carries out no access control is somewhat irrelevant if it is not intended to do so in the first place.
    - candiodari 6y ago
      But you can firewall (in 10 different ways) notepad.exe. You control what notepad has access to. You can access anything notepad.exe can bypassing notepad.exe. You cannot effectively firewall your browser, because you don't control the backend. You cannot bypass the backend of a piece of cloud software. This is a generic problem with cloud software. Any cloud software has access to your data AND YOU DO NOT. To a certain extent it even has access to your data in other apps (e.g. getting your mail address). It's a way to (currently usually partially) transfer ownership of everything you make with software, and your own data from the user to the creator of the software. This obviously an extremely negative development in the long run, but people seem quite keen on just accepting it ...
notatoad 6y ago
no, the "unapproved software" accessing your data is third-party access. that's like the definition of third-party.

jsnell 6y ago

https://news.ycombinator.com/item?id=25886218 https://news.ycombinator.com/item?id=25886218

jlkuester7 6y ago

This seems to track pretty close to Google's recent moves in the Android ecosystem to move more and more functionality into Google Play Services packages and not in the AOSP. As it is a corporation in the business of providing value to its shareholders, I can understand why Google is trying to maximize its profit potential in these projects. However, I think it is really important to give visibility to these moves and for developers (particularly of open source projects) to understand that Google maintains these projects for its own benefit and not for the good of any perceived "community". Once again, this is the status-quo for for-profit businesses, so I am not exactly trying to criticize Google for this. That being said, I do think that Google's (increasingly tarnished) reputation as a champion of open source work is largely undeserved because of their tendency to pull stuff like this. This whole episode is also an example of why it is important to pay attention to the licensing and availability of the whole tech stack for a project. If functionality relies on a central server (that cannot be easily replaced/self-hosted that should be a huge red flag for anyone contributing to the ecosystem. (Looking at you, Canonical, and your Snap Store shenanigans...)

johncena33 6y ago
> Once again, this is the status-quo for for-profit businesses, so I am not exactly trying to criticize Google for this. That being said, I do think that Google's (increasingly tarnished) reputation as a champion of open source work is largely undeserved because of their tendency to pull stuff like this. This seems like "damn if you do damn if you don't" situation. Android OS and security upgrade is a mess just because OEMs are not willing to provide upgrades to customer in timely manner. That's one of the reasons a lot of functionalities have been moved to Google Play where customers can easily get updates of different components of Android even if the OEMs are unwilling to do so. Sure, this also serves business purpose of Google. But it's not the whole truth if we omit the OEMs and Android OS upgrade situation.
- kuschku 6y ago
  It’s easily possible to provide updates and keep it open source. Google did that in the past just fine with many AOSP apps, and even the android webbrowser parts are updated that way, and still open source. Google just used it as an excuse to make these parts of the OS proprietary.

rvz 6y ago

Well it's Google. So yes.

crazygringo 6y ago

This article makes no sense, and Google isn't "locking down Chrome". Google is removing proprietary Google services like sync from Chromium. Which honestly makes 100% sense. Chromium is supposed to be a bare-bones open-source browser. Other browsers can build on it, and they do. They can provide their own sync capabilities and everything else. If you want to use Google services, wouldn't you already just be using Chrome? So this seems like a positive development, untangling Google-specific features from the Chromium project.

MikeUt 6y ago
> If you want to use Google services, wouldn't you already just be using Chrome? Would you make the same argument if those services were Google search, Gmail, or Youtube?
- fctorial 6y ago
  Those are just websites.
- stu2b50 6y ago
  Yes, if Chrome had Gmail, etc integration built into the client I would prefer that not be in Chromium.
est31 6y ago
First, many people log into non-Google services using their Google account. If you can't log into it from a third party browser, you'd have to keep using Chrome even if you didn't want to. Also there is speculation that with browsers blocking third party cookies, Google might eventually perform ad tracking via the browser, via your Google account. Websites that live from ads like news websites will notice this and block users who are not logged into Google, as they don't add revenue. So eventually it might be possible that large parts of the web become inaccessible to you.
- fctorial 6y ago
  > If you can't log into it from a third party browser, you'd have to keep using Chrome even if you didn't want to. Oauth is browser agnostic, right?

gsich 6y ago

Short answer: Yes.

ajkdhcb2 6y ago

Building the whole browser ecosystem on Google code is absurd. Even while Chromium is usable for now, they can lead the project in whatever direction they want. If you don't want that, you should be supporting Firefox. The paragraph at the end of this article saying Firefox is in favour of censorship comes from one badly worded article afaik and has nothing to do with development. So you use browsers based on Google? Seems like terrible logic

deleted 6y ago
[deleted]

Communitivity 6y ago

The problem is that Google is removing services that are key to Chromium use for many users. I wouldn't consider this locking down, or removing services (though it is technically that). Instead I would consider it cutting Chromium off at the knees. I suspect, but have no evidence, that this is in reaction to Microsoft basing the newest version of their browser on Chromium. The solution is to use an Open Source browser, such as Firefox or some other alternative. That's going to require more developers though to pitch in and help get feature parity in their favorite Open Source browser. I also have some concerns there, as the Firefox CEO Mitchell has said Mozilla tends to focus more on money. We've seen indicators of that recently with sponsored search. I remember the old AOL Browser and AOL Email, and the ads. I hope not, but could see Mozilla implementing ads in the Firefox UI area. What I'd like to see is a browser that is built of swappable components working around a browser microkernel consisting of a web engine (Servo?), a JavaScript engine (Deno?), a plugin framework that works via messaging and can support various msg protocols (with two ref impls:ZeroMQ and Matrix). Think something like the Eclipse RCP, but for the Browser and Web browsing. If this sounds interesting, send me a message. That's not an ad, I am interested in gauging the interest in a project like that.

davidfstr 6y ago
> The problem is that Google is removing services > The solution is to use an Open Source browser Seems to me the solution is to use 3rd party services that are not tied to the browser at all. For example I manage passwords with 1Password, not Chrome's or any other browser's sync services. And I use bookmarking services like Pocket which aren't tied to any browser. Using independent services made by companies that care about their reputation (and therefore the quality of their product) makes a lot more sense to me then putting all your eggs into a single browser basket.
- Communitivity 6y ago
  I agree, and I'd like to see a unified way of connecting to those services. These services are in a way plugins, so I could see it being handled by having a plugin framework that's capable of handling in-app plugins via something like ZeroMQ, as well as external plugins (remote services or from other apps) via something like Matrix. Essentially, a key part of the idea is to create an Open Source project that is a browser construction kit rather than a browser. Then anyone can choose what components they use. Big brands can release branded sets of components that include proprietary components if they want - but users won't need to use those to have a safe, secure, and rich browsing experience.

draklor40 6y ago

Good riddance. I hate Big$G creepily tracking all of my internet search history from Chromium by default unless I explicitly turned it off. But its cute that people still think that Big companies contribute to Open Source because they want to "give back". Hell no ! It has been about reaping free, complex technical labour, monopolies (chrome, kubernetes) and marketing for hiring devs.

commandlinefan 6y ago

I wish we had less corporate-owned alternatives to Chromium and WebKit. I’m surprised there’s less in the true open source space along these lines.

londons_explore 6y ago
Chromium is actually a far more open project than most people imagine. As well as being open source, it also accepts outside contributions (android does not for example), developers talk in public mailing lists, and even leadership positions in the project can, and often are, taken by non-Google people.