6 ms·

So you say your current position is to be rather carefully around anything by/from Google, but you trust Internet randos to build the binary of the browser you

by henvic 5y ago

So you say your current position is to be rather carefully around anything by/from Google, but you trust Internet randos to build the binary of the browser you use? Okay.

another-dave 5y ago
Wisdom of crowds though — there's enough eyes on the stuff built by "internet randos" over at Mozilla to have a larger level of trust in it Vs an unknown fork of Chromium
- deleted 5y ago
  [deleted]
throwntoday 5y ago
I trust a homeless person on the street more than I trust google.
tshaddox 5y ago
Do you trust Internet randos to build the binaries of the compilers you use to compile the Chromium source code? How deep do we need to go?
- spudlyo 5y ago
  If you really want to blow your mind you can go all the way back to stage0[0]. A more practical depth would be to bootstrap with GNU Mes, which is a source based bootstrapping path, that begins with a tiny scheme interpreter (~5000 LOC of simple C) and a C compiler written in scheme that are mutually self-hosting. These tools can compile a slightly patched version of TinyCC that is self-hosting. Using this C compiler you can bootstrap a bunch of gnutools (glibc, binutils, gcc) and using these tools you can bootstrap a full Guix Linux distro. [0]: https://github.com/oriansj/stage0 https://github.com/oriansj/stage0
  - not2b 5y ago
    The bootstrapping process that GCC uses is as follows: stage 1: build from source using your existing compiler stage 2: build again from source using the compiler you just built stage 3: (just for checking): build a stage 3 compiler from the stage 2 compiler. Verify that it is byte-for-byte identical. extra stages for the paranoid: repeat the process with a different starting compiler, as unrelated as possible. Again, verify that the output is bit-for-bit identical. You then know either that you're good, that the compiler reflects the source, or both starting compilers have the same devious hidden hack, perhaps courtesy of Ken Thompson himself. GNU Mes achieves that paranoid step: once you verify with GNU Mes that you get the same bits, you don't really have to do this ever again, because you can certify that the compiler you get is reproducible from source and has no tricks.
bryceacc 5y ago
i read that as "why bother with a hacked up chromium when i can just use firefox"
- smitty1e 5y ago
  Point being that you're always trusting somebody. "Reflections on Trusting Trust": https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref... And even if you go Full OpenBSD, you're still relying on some chip microcode and BIOS that you bought sight-unseen. So, unless the Free Software Foundation staffs its own fab staffed by angels, the best we can do is minimize risk.
wongarsu 5y ago
Firefox is a well-known project that I've followed for one and a half decade, with roots much older than that and an established an well-known governance structure. I'd certainly trust them as much if not more than Google. Unlike this project, which is very much from "internet randos"
- ekianjo 5y ago
  > with roots much older than that and an established an well-known governance structure such a well-known governance that keeps putting back telemetry and ads when users dont want them.
  - franga2000 5y ago
    The term "telemetry" can mean anything from automatic crash reports to click tracking to transmitting your browsing history along with your social security number. Google is far closer to the end of that spectrum, Mozilla is somewhere in the lower first half. As for ads - where? I haven't seen any and I've been using Firefox on multiple platforms for many years.
    - krageon 5y ago
      Both ends of the telemetry spectrum are evil, explicitly because the term means nothing except "data about you".
      - mkl 5y ago
        > the term means nothing except "data about you". No, crash reports are primarily data about the program, with very little if anything about you.
        krageon 5y ago
        Very few applications take pains to make sure no personal information is submitted in crash dumps. Generally it is just a bald memory dump that you're supposed to ship out - definitely not a good idea if you care about your privacy.
ipaddr 5y ago
Wouldn't you trust randos with nothing in common but trying to build an open browser vs a corporation who mission is to gather information from you via your browser? Sounds a little crazy not to trust them.
- minhazm 5y ago
  The trust is in different areas. The risk that Google would ship something that steals your passwords, addresses, or credit card information and does anything harmful with it besides ad targeting is basically zero. You know what you're getting with Google for the most part. The risk in the case of downloading random binaries is they may actually steal your information and cause real harm beyond ad targeting. If you want chromium without Google there are several options such as Edge, Opera, Brave and probably a dozen more I've never heard of.
- ineedasername 5y ago
  I trust that Google will abuse my personal information for monetary gain via advertising. I also trust that their compiled versions of Chrome will not be a ticking time bomb of ransomware. On the other hand, I simply don't trust internet randos, much less to install their binaries. And it seems like a third option of Firefox w/ uBlock is less bad than either of the above.
ineedasername 5y ago
No, unless I misunderstand them, they're saying they make do with Firefox and uBlock. They're not saying they will download the rando binary.
glitchc 5y ago
Why not? I trust internet randos to build the binaries of (linux) OSes I use. It’s not like I know the folks who compiled the Ubuntu or Manjaro LiveCD from Adam.
adar 5y ago
> So you say your current position is to be rather carefully around anything by/from Google, but you trust Internet randos to build the binary of the browser you use? How did you come to this conclusion when they stated that they'd rather use Firefox? Or are you saying Mozilla are the internet randos?

by henvic 5y ago

So you say your current position is to be rather carefully around anything by/from Google, but you trust Internet randos to build the binary of the browser you use? Okay.

another-dave 5y ago

Wisdom of crowds though — there's enough eyes on the stuff built by "internet randos" over at Mozilla to have a larger level of trust in it Vs an unknown fork of Chromium

deleted 5y ago
[deleted]

throwntoday 5y ago

I trust a homeless person on the street more than I trust google.

tshaddox 5y ago

Do you trust Internet randos to build the binaries of the compilers you use to compile the Chromium source code? How deep do we need to go?

spudlyo 5y ago
If you really want to blow your mind you can go all the way back to stage0[0]. A more practical depth would be to bootstrap with GNU Mes, which is a source based bootstrapping path, that begins with a tiny scheme interpreter (~5000 LOC of simple C) and a C compiler written in scheme that are mutually self-hosting. These tools can compile a slightly patched version of TinyCC that is self-hosting. Using this C compiler you can bootstrap a bunch of gnutools (glibc, binutils, gcc) and using these tools you can bootstrap a full Guix Linux distro. [0]: https://github.com/oriansj/stage0 https://github.com/oriansj/stage0
- not2b 5y ago
  The bootstrapping process that GCC uses is as follows: stage 1: build from source using your existing compiler stage 2: build again from source using the compiler you just built stage 3: (just for checking): build a stage 3 compiler from the stage 2 compiler. Verify that it is byte-for-byte identical. extra stages for the paranoid: repeat the process with a different starting compiler, as unrelated as possible. Again, verify that the output is bit-for-bit identical. You then know either that you're good, that the compiler reflects the source, or both starting compilers have the same devious hidden hack, perhaps courtesy of Ken Thompson himself. GNU Mes achieves that paranoid step: once you verify with GNU Mes that you get the same bits, you don't really have to do this ever again, because you can certify that the compiler you get is reproducible from source and has no tricks.

bryceacc 5y ago

i read that as "why bother with a hacked up chromium when i can just use firefox"

smitty1e 5y ago
Point being that you're always trusting somebody. "Reflections on Trusting Trust": https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref... And even if you go Full OpenBSD, you're still relying on some chip microcode and BIOS that you bought sight-unseen. So, unless the Free Software Foundation staffs its own fab staffed by angels, the best we can do is minimize risk.

wongarsu 5y ago

Firefox is a well-known project that I've followed for one and a half decade, with roots much older than that and an established an well-known governance structure. I'd certainly trust them as much if not more than Google. Unlike this project, which is very much from "internet randos"

ekianjo 5y ago
> with roots much older than that and an established an well-known governance structure such a well-known governance that keeps putting back telemetry and ads when users dont want them.
- franga2000 5y ago
  The term "telemetry" can mean anything from automatic crash reports to click tracking to transmitting your browsing history along with your social security number. Google is far closer to the end of that spectrum, Mozilla is somewhere in the lower first half. As for ads - where? I haven't seen any and I've been using Firefox on multiple platforms for many years.
  - krageon 5y ago
    Both ends of the telemetry spectrum are evil, explicitly because the term means nothing except "data about you".
    - mkl 5y ago
      > the term means nothing except "data about you". No, crash reports are primarily data about the program, with very little if anything about you.
      - krageon 5y ago
        Very few applications take pains to make sure no personal information is submitted in crash dumps. Generally it is just a bald memory dump that you're supposed to ship out - definitely not a good idea if you care about your privacy.

ipaddr 5y ago

Wouldn't you trust randos with nothing in common but trying to build an open browser vs a corporation who mission is to gather information from you via your browser? Sounds a little crazy not to trust them.

minhazm 5y ago
The trust is in different areas. The risk that Google would ship something that steals your passwords, addresses, or credit card information and does anything harmful with it besides ad targeting is basically zero. You know what you're getting with Google for the most part. The risk in the case of downloading random binaries is they may actually steal your information and cause real harm beyond ad targeting. If you want chromium without Google there are several options such as Edge, Opera, Brave and probably a dozen more I've never heard of.
ineedasername 5y ago
I trust that Google will abuse my personal information for monetary gain via advertising. I also trust that their compiled versions of Chrome will not be a ticking time bomb of ransomware. On the other hand, I simply don't trust internet randos, much less to install their binaries. And it seems like a third option of Firefox w/ uBlock is less bad than either of the above.

ineedasername 5y ago

No, unless I misunderstand them, they're saying they make do with Firefox and uBlock. They're not saying they will download the rando binary.

glitchc 5y ago

Why not? I trust internet randos to build the binaries of (linux) OSes I use. It’s not like I know the folks who compiled the Ubuntu or Manjaro LiveCD from Adam.

adar 5y ago

> So you say your current position is to be rather carefully around anything by/from Google, but you trust Internet randos to build the binary of the browser you use? How did you come to this conclusion when they stated that they'd rather use Firefox? Or are you saying Mozilla are the internet randos?