4 ms·

We put the source out there and try to be as transparent as we reasonably can. In the end though, people make their own decisions.

azakai 15y ago
One problem is that Chrome is not open source - Chromium is. But 99% of people use Chrome, and there is no way to build Chrome from source to be sure what code is running. We have to take Google's word for it that Chrome is identical to Chromium as regards privacy, and as others stated, Google's business interest is clearly to track user information, not to respect their privacy.
- justinschuh 15y ago
  I've already explained why this framing is incorrect: http://news.ycombinator.com/item?id=3034628 http://news.ycombinator.com/item?id=3034628 So, go ahead and check out a release branch, set the "Official" build flag yourself, wait anywhere from 2-8 hours for the binaries to get built, and verify it against the bits we ship.
  - azakai 15y ago
    Thanks for the information, I have never seen this stated officially anywhere. So one can build Chromium with "Official", then add some DLLs (Flash, etc.), and get something 100% identical to Chrome? Edit: And is there an official statement of this somewhere?
    - justinschuh 15y ago
      I went through it and there's still some ugly hackery involved on Windows. These are technical issues (e.g. how ffmpeg is compiled via MinGW), but they make it complicated to generate a non-branded, psuedo-official build. That said, all the pieces you need (minus the closed-source plugins) appear to be in the repository and can be built and compared against an official release. It could definitely be made easier, but would require some non-trivial engineering to do so.
huhtenberg 15y ago
Open source != trustworthiness. This is a very tough cookie to crumble. The counter-argument to "we are open source" is that the binaries can potentially be assembled from an altered source code. Ideally, the binaries should be assembled by multiple independent "build points" and compared against vendor's version. There was a secure smartphone OS vendor (the name escapes me ATM, it was several years ago) and they did just that - an open source project with audited build system - and it was a major hassle by the looks of it. The only sure way to deal with the trust issue is to not have a conflict of interest to the first place, which is something that seems to be neigh impossible with Chrome.
zobzu 15y ago
Chrome source isnt out there AFAIK. Chromium source is. Not a small difference.
- js2 15y ago
  That's not correct - http://news.ycombinator.com/item?id=3034824 http://news.ycombinator.com/item?id=3034824

azakai 15y ago

One problem is that Chrome is not open source - Chromium is. But 99% of people use Chrome, and there is no way to build Chrome from source to be sure what code is running. We have to take Google's word for it that Chrome is identical to Chromium as regards privacy, and as others stated, Google's business interest is clearly to track user information, not to respect their privacy.

justinschuh 15y ago
I've already explained why this framing is incorrect: http://news.ycombinator.com/item?id=3034628 http://news.ycombinator.com/item?id=3034628 So, go ahead and check out a release branch, set the "Official" build flag yourself, wait anywhere from 2-8 hours for the binaries to get built, and verify it against the bits we ship.
- azakai 15y ago
  Thanks for the information, I have never seen this stated officially anywhere. So one can build Chromium with "Official", then add some DLLs (Flash, etc.), and get something 100% identical to Chrome? Edit: And is there an official statement of this somewhere?
  - justinschuh 15y ago
    I went through it and there's still some ugly hackery involved on Windows. These are technical issues (e.g. how ffmpeg is compiled via MinGW), but they make it complicated to generate a non-branded, psuedo-official build. That said, all the pieces you need (minus the closed-source plugins) appear to be in the repository and can be built and compared against an official release. It could definitely be made easier, but would require some non-trivial engineering to do so.

huhtenberg 15y ago

Open source != trustworthiness. This is a very tough cookie to crumble. The counter-argument to "we are open source" is that the binaries can potentially be assembled from an altered source code. Ideally, the binaries should be assembled by multiple independent "build points" and compared against vendor's version. There was a secure smartphone OS vendor (the name escapes me ATM, it was several years ago) and they did just that - an open source project with audited build system - and it was a major hassle by the looks of it. The only sure way to deal with the trust issue is to not have a conflict of interest to the first place, which is something that seems to be neigh impossible with Chrome.

zobzu 15y ago

Chrome source isnt out there AFAIK. Chromium source is. Not a small difference.

js2 15y ago
That's not correct - http://news.ycombinator.com/item?id=3034824 http://news.ycombinator.com/item?id=3034824