4 ms·

For clarification on most of the keys related concerns, please read the FAQ - http://git.chromium.org/gitweb/?p=chromiumos/platform/assets.git;a=blob;f=chromeap

by Garbage 14y ago

For clarification on most of the keys related concerns, please read the FAQ - http://git.chromium.org/gitweb/?p=chromiumos/platform/assets.git;a=blob;f=chromeapps/hterm/doc/faq.txt http://git.chromium.org/gitweb/?p=chromiumos/platform/assets...

acqq 14y ago
I don't see that the whole source is published, exactly like the whole source of Chrome is not being published (Chromium is Chrome minus "the souce", e.g. additional code (for what?), installers etc). I haven't even seen any analysis of all the stuff Google does in the pieces of the code that aren't published. It can be done, somebody should just really want to do that. Disclaimer: I avoid Chrome browser exactly because I don't have enough information to know if they really "aren't evil." I don't claim there isn't such information somewhere, just that I don't know about it. My worries are exactly because their installers install more like a malware than like clean projects ("no we aren't going to let you to simply download executables, just click here, give us administrative privileges and enjoy when we download what we want and change on your machine what we like"). Anybody who knows more?
- jrockway 14y ago
  Just use Chromium instead. You can audit every single line of code and build it from scratch on your own machine with your own reflections-on-trusting-trust-safe-compiler. Or you can install Debian's version.
  - vidarh 14y ago
    [For the unaware, "Reflections on trusting trust" by Ken Thompson is a must read: http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html ]
    - madethemcry 14y ago
      Never heard of this. I just read it twice to understand it. Great explanation of a widely unknown problem I guess. From now on I will never ever tell people an application is safe if you can look into the source code. Thank you so much!!
      - lmm 14y ago
        These days it is - as long as that source code is in a language with multiple independent implementations.
      - bad_user 14y ago
        And yet having the ability to look at source-code yields the greatest level of safety there is. Apps without source-code cannot be trusted by default, unless you have a contract with the company providing it that stipulates a relief agreement that's reasonable for you in case anything goes wrong. And only enterprise software does that, depending on how you negotiate nonetheless, otherwise for consumers the EULAs are doing the exact opposite. And even with enterprise software guarded by good contracts, even then you need the source-code.
      - TeMPOraL 14y ago
        There is some additional food for thought in it when you realize that all life forms* are basically self-replicating DNA compilers. That is, compilers compiling compilers, which in turn compile more compilers. Thus, there's a chance some crucial information is actually stored "nowhere", i.e. is bolted in by complier which builds another compiler. For more abstract take on this topic, I direct to Gödel, Escher, Bach; Hofstadter elaborates there on the fact that the distinction between what is data storage (e.g. music CD) and reading device (e.g. music player) is somewhat arbitrary, and in fact the information itself is "stored" in the combination of "data storage" and "data reader". * - or at least most, IANAB.
  - acqq 14y ago
    Your suggestion is exactly the opposite of the information I'm looking for. I'm interested what's there in the code that they don't publish but that is behind the "download now" links, that's what 99.99% of people are going to use anyway.
    - jrockway 14y ago
      Here's the official answer: https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoogleChrome https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoo...
- justinschuh 14y ago
  It's certainly reasonable to admit that you lack the time and/or expertise to evaluate a piece of software, but I don't understand how you translate that into a justification for obvious FUD like "their installers install more like a malware than like clean projects."
- DannyBee 14y ago
  The additional code for Chrome should be separated into plugins or otherwise dynamically loaded things. Again, if someone knows of cases where this is not true, let me know.

by Garbage 14y ago

acqq 14y ago

I don't see that the whole source is published, exactly like the whole source of Chrome is not being published (Chromium is Chrome minus "the souce", e.g. additional code (for what?), installers etc). I haven't even seen any analysis of all the stuff Google does in the pieces of the code that aren't published. It can be done, somebody should just really want to do that. Disclaimer: I avoid Chrome browser exactly because I don't have enough information to know if they really "aren't evil." I don't claim there isn't such information somewhere, just that I don't know about it. My worries are exactly because their installers install more like a malware than like clean projects ("no we aren't going to let you to simply download executables, just click here, give us administrative privileges and enjoy when we download what we want and change on your machine what we like"). Anybody who knows more?

jrockway 14y ago
Just use Chromium instead. You can audit every single line of code and build it from scratch on your own machine with your own reflections-on-trusting-trust-safe-compiler. Or you can install Debian's version.
- vidarh 14y ago
  [For the unaware, "Reflections on trusting trust" by Ken Thompson is a must read: http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html ]
  - madethemcry 14y ago
    Never heard of this. I just read it twice to understand it. Great explanation of a widely unknown problem I guess. From now on I will never ever tell people an application is safe if you can look into the source code. Thank you so much!!
    - lmm 14y ago
      These days it is - as long as that source code is in a language with multiple independent implementations.
    - bad_user 14y ago
      And yet having the ability to look at source-code yields the greatest level of safety there is. Apps without source-code cannot be trusted by default, unless you have a contract with the company providing it that stipulates a relief agreement that's reasonable for you in case anything goes wrong. And only enterprise software does that, depending on how you negotiate nonetheless, otherwise for consumers the EULAs are doing the exact opposite. And even with enterprise software guarded by good contracts, even then you need the source-code.
    - TeMPOraL 14y ago
      There is some additional food for thought in it when you realize that all life forms* are basically self-replicating DNA compilers. That is, compilers compiling compilers, which in turn compile more compilers. Thus, there's a chance some crucial information is actually stored "nowhere", i.e. is bolted in by complier which builds another compiler. For more abstract take on this topic, I direct to Gödel, Escher, Bach; Hofstadter elaborates there on the fact that the distinction between what is data storage (e.g. music CD) and reading device (e.g. music player) is somewhat arbitrary, and in fact the information itself is "stored" in the combination of "data storage" and "data reader". * - or at least most, IANAB.
- acqq 14y ago
  Your suggestion is exactly the opposite of the information I'm looking for. I'm interested what's there in the code that they don't publish but that is behind the "download now" links, that's what 99.99% of people are going to use anyway.
  - jrockway 14y ago
    Here's the official answer: https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoogleChrome https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoo...
justinschuh 14y ago
It's certainly reasonable to admit that you lack the time and/or expertise to evaluate a piece of software, but I don't understand how you translate that into a justification for obvious FUD like "their installers install more like a malware than like clean projects."
DannyBee 14y ago
The additional code for Chrome should be separated into plugins or otherwise dynamically loaded things. Again, if someone knows of cases where this is not true, let me know.