4 ms·
It's "just" an automatic update, like Chrome, etc. It's one entry-point among others for RCE. If tomorrow NSA wants to gather any files on your computer, all t
by rvnx 1y ago
It's "just" an automatic update, like Chrome, etc.
It's one entry-point among others for RCE. If tomorrow NSA wants to gather any files on your computer, all they need to do is to ask Google to push an update for you through Google Omaha.
https://epic.org/wp-content/uploads/privacy/nsa/foia/NSA-Google_FOIA_Request.pdf https://epic.org/wp-content/uploads/privacy/nsa/foia/NSA-Goo...
Google and NSA have a "partnership".
Valve could also have such partnership in theory, through VAC, though unlikely in practice.
- snickerdoodle12 1y agoI get chromium & firefox from my distro's repos
- bflesch 1y agoLinux distros are vulnerable to the same supply chain attacks. Did you ever do a background check on your distro maintainers? How many of them have email addresses from non-democratic TLDs?
- snickerdoodle12 1y agoIf they want to publicly publish their exploit chain for everyone who uses the distro that's their choice.
- gruez 1y ago>If tomorrow NSA wants to gather any files on your computer, all they need to do is to ask Google to push an update for you through Google Omaha. They could in theory, but has this actually happened in practice? Pushing a rogue update isn't exactly a novel idea, but despite decades of government document leaks and APTs being analyzed, there's scant evidence that any government pressured a company to push a rogue update. Same goes for other threat models like "government pressuring CAs into issuing a certificate".
- the8472 1y agoFor CAs that'd likely get them kicked out of browser trust stores if someone detects it. And if it becomes known that a corporation pushes government-malware updates then that corporation would lose trust too. So playing that card means moving the entire planet into a lower-trust equilibrium where everyone has to defend against that. In a better-coordinated world the conclusion from that would be "let's not do that", alas on this Earth TLAs have shown that they're willing to burn the commons, forcing a response like RFC 7258.
- andrecarini 1y agoI'm really curious about this but searching for "Google Omaha" doesn't return anything related and the linked FOIA request is... just a request, which I assume anyone can write whatever they want in the request.
- gruez 1y agoThe request itself isn't very damning either. It just make references to vaguely worded "partnerships", and apparently uses that to imply that Google is handing over data. Even if we take that at face value, it says nothing about OP's claim, which is that NSA can ask google to serve backdoored updates.
- tonyhart7 1y agohow is this any different than the Google sells your data to Ads centre????
- bflesch 1y agoValve has the same feature - it is deployed on more .ru machines than chrome.