7 ms·

Chromium will no longer download/install the Hotword Shared Module

154 points by kekebo 11y ago

Aqua_Geek 11y ago
> An extension that is enabled is not the same as an extension that is actually running. To see the list of Chrome processes that are actually running, use Chrome's task manager. Hotword Triggering, as well as many other extensions will run briefly at startup. Those that are not actually being used will quit in about 10-15 seconds. I'm sorry, what?! So I still have to trust that it's not doing anything malicious for 10-15 seconds?
- cremno 11y ago
  Apparently but only if you're using Chrome and not Chromium (v45).
- JonnieCache 11y ago
  No, you can just use the open source build which doesn't include any of the google components, like the ticket says. I don't see how they can do any more for you than that.
  - Aqua_Geek 11y ago
    Re-reading the ticket: > Chromium builds from r335874 (version 45) onwards will have hotwording disabled by default and will not download the module. There is no way to enable this feature at runtime. So as long as you compile from source or trust your package maintainer to not enable the compile-time flag you should be good. Sorry to raise undue alarm.
    - flebron 11y ago
      Do you also trust your package maintainer to not mismerge patches and leave you open to security bugs? Your argument is no bueno.
      - kekebo 11y ago
        This whole issue got raised by the package maintainers from debian[1], so yeah, there are sources and people you could consider to trust. But of course nothing beats compiling from source. [1]https://news.ycombinator.com/item?id=9724409 https://news.ycombinator.com/item?id=9724409
        cwyers 11y ago
        If you don't have the time, skillset or inclination to review the source you're compiling yourself, trusting a third party who you have reason to put faith in beats compiling from source yourself.
        dtech 11y ago
        > But of course nothing beats compiling from source. Did you assemble a bootstrap compiler yourself? Your binary compiler could be backdoored! [1] [1] https://en.wikipedia.org/wiki/Backdoor_(computing)#Compiler_backdoors https://en.wikipedia.org/wiki/Backdoor_(computing)#Compiler_...
        hahainternet 11y ago
        I've no idea why you've been downvoted. While it's not amazingly pertinent, it's worthy to note that security from source assumes your compiler is being honest.
      - kbenson 11y ago
        You have to extend trust out at some point. Your only other alternative is to manually type the machine code required for a C compiler and start from that. Additionally, it's fairly ironic this is about a browser. If you don't trust packages maintainers, yet you want to use a browser, which the whole point of is to download and interpret text, code and binaries which you have little in the way of actually controlling after pointing it at a site, then I think you've made some interesting security trade-offs in your mind.
        feld 11y ago
    - kekebo 11y ago
      You don't have to trust your maintainer, just go to chrome://voicesearch and check the status (but read up on it, it's badly labeled) or search for "hotword-x86-64.nexe" inside your chromium extensions folder and delete the extension containing it.
      - ytdht 11y ago
        using chrome://voicesearch, I get: Microphone No Audio Capture Allowed Yes Does audio capture has admin privileges over the microphone, or the speakers for that matter?
        r721 11y ago
        Flags are explained in comment #22: https://code.google.com/p/chromium/issues/detail?id=500922#c22 https://code.google.com/p/chromium/issues/detail?id=500922#c... >Microphone: Is a microphone detected? (Does not mean it is being used.) >Audio Capture Allowed: Can Chromium use the mic? (This is there for historical reasons, it's always "Yes".)
        smackfu 11y ago
        Those are some poorly labelled flags.
  - astazangasta 11y ago
    Release only open source products? Not sell our information to advertisers? Not collaborate with the government to spy on us? Not use their monopoly money to buy all of the smart people in the world? The list of how they could improve is endless.
    - albertoleal 11y ago
      They don't owe you anything.
      - astazangasta 11y ago
        No, they don't owe me. You also don't have to thank people who hold the door for you.
      - itg 11y ago
        That's great. And we don't owe Google anything and should be able to call out their bullshit practices. Fortunately open alternatives such as Firefox still exist.
    - exelius 11y ago
      > Release only open source products? Google open sources far more than most companies. They've also contributed greatly to building new open source projects, and they actually keep them open and are a generally benevolent maintainer. They're probably one of the best corporate citizens of the open source community. > Not sell our information to advertisers? It's their entire business model; if you don't like it, don't use their products. > Not collaborate with the government to spy on us? Google never willingly collaborated with the government. They were either hacked by the NSA (this isn't a mark of shame -- just read up on the Equation Group virus that went undetected for the better part of a decade) or they cooperated under a sealed court order. Corporations don't have the agency that individuals do in refusing to cooperate with a court order -- it's literally not possible for a company to refuse to comply with a court order because the feds can just keep arresting people until someone complies. Most companies refuse to put their employees in this position, so they comply under protest (which is exactly what Google did). > Not use their monopoly money to buy all of the smart people in the world? So they shouldn't hire under capitalist principles? Also note that this is beneficial for the smart people of the world, because it forces other companies to pay more as well.
- deleted 11y ago
  [deleted]
  - kekebo 11y ago
    Chromium ≠ Chrome http://www.howtogeek.com/202825/what%E2%80%99s-the-difference-between-chromium-and-chrome/ http://www.howtogeek.com/202825/what%E2%80%99s-the-differenc...
    - Smushman 11y ago
      I see the error...
victor9000 11y ago
apt-get purge google-chrome-stable apt-get install chromium-browser well, that was easy.
- magicalist 11y ago
  > google-chrome-stable uh, you were worried about your binary blob running a binary blob?
  - ryanlol 11y ago
    The chromium-browser package is also a binary blob.
  - ISL 11y ago
    The difference is the provenance of the binary-blob supplier. Would you be more likely to run a checksummed binary blob from your trusted Debian mirror, or one I send you via email?
    - coldtea 11y ago
      Of course the one you send me via email. It's all about acountability. I'd have someone to beat the shit out of if anything went wrong with that.
    - DannyBee 11y ago
      "Trusted debian mirror". Remind me the accountability on that one? vs a company you can sue for billions?
      - pyre 11y ago
        By this logic, no large company should ever end up on the wrong side of the law, ethics or morality...
        DannyBee 11y ago
        ???? This is a really extreme takeaway. My point was more "i don't think trusted debian mirror buys you much either" if your goal is to not ship binary blobs not "billion dollar company is great".
BuildTheRobots 11y ago
"Chromium silently stops installing binary blob" is probably just as good a headline...
- zfp 11y ago
  Thanks William Shatner for popularizing the split infinitive... to boldly go!
  - nazgul1 11y ago
    An infinitive verb is a to verb. There's no to above, thus no split infinitive.
    - jfb 11y ago
      Too, pedantry about splitting infinitives is agrammatical and dumb.
  - BuildTheRobots 11y ago
    somewhat even more off topic, but: Thanks to William Shatner for lots of things; least of all demonstrating how to deliver a line of dialogue without it sounding like you're reading off the back of a cereal packet and left your glasses at home. His cover of Common People (Pulp) is an immense example of this. https://www.youtube.com/watch?v=ainyK6fXku0 https://www.youtube.com/watch?v=ainyK6fXku0 Yes Doctor Who, I'm staring you out whilst shaking a fist at you....
- deleted 11y ago
  [deleted]
- kekebo 11y ago
  Public bug trackers tend to be less on the silent side
fweespeech 11y ago
Yaya, the march of progress. Seriously, the idea of open source projects downloading close sourced code "on your behalf" is bad in and of itself, regardless of the purpose.
- kekebo 11y ago
  the hotword flag existed for ages, it got changed from opt-in to opt-out about a week ago[1] and just has been reverted. Less evolution than things back to normal. [1]https://news.ycombinator.com/item?id=9724409 https://news.ycombinator.com/item?id=9724409
  - fweespeech 11y ago
    Yes, its progress based on the state it was in a couple days ago.
  - morganvachon 11y ago
    It should never have been flipped to opt-out in the first place. Google cares about open source only as long as it benefits them, and I wasn't surprised to see one of their flagship projects take a trip to the dark side for a few days. To paraphrase a Jurassic Park character, they are testing the waters, checking for weaknesses. They remember...
ryanlol 11y ago
Clicking this link will make your browser silently download and execute a binary blob http://ftp.netbsd.org/pub/NetBSD/misc/pooka/rump.js/ http://ftp.netbsd.org/pub/NetBSD/misc/pooka/rump.js/
- TazeTSchnitzel 11y ago
  JavaScript is securely sandboxed, however.
  - Jyaif 11y ago
    just like the nacl binary blob.
    - lawl 11y ago
      Which is allowed to use your microphone at any time without asking. In contrast to javascript executed on a website. Edit: To clarify, I'm only talking about the sandbox here, I'm aware that there is opt-in stuff and that there is open source code guarding the activation of that specific module, i'd argue that this isn't part of the sandbox though.
      - Oletros 11y ago
        Could the module use your microphone without asking?
        lawl 11y ago
        Yes, that's what I just said and what the bugtracker sais.
        Oletros 11y ago
        No the bug tracker doesn't say that
snaky 11y ago
There is a nice patchset for Chromium that turns off or strips (almost?) all of the controversial features. https://bbs.archlinux.org/viewtopic.php?id=198763 https://bbs.archlinux.org/viewtopic.php?id=198763
imslavko 11y ago
My mother uses her Dell laptop with an Ubuntu installed on it. It is usually great to maintain from my part, as all she uses is Chromium and the files explorer. I just update the software sometimes. But something that started happening in the latest versions of Chromium is driving me nuts. Every time I talk to my mother in my native language in front of the laptop, the "Ok, Google" functionality activates and starts the search of the "parsed" English sentence in Google. I tried to disable it but failed to find how.
- andor 11y ago
  At least in Google Chrome, "Enable Ok Google" is one of the few options in the settings that are not buried under "show advanced". It's very easy to find.

154 points by kekebo 11y ago

> An extension that is enabled is not the same as an extension that is actually running. To see the list of Chrome processes that are actually running, use Chrome's task manager. Hotword Triggering, as well as many other extensions will run briefly at startup. Those that are not actually being used will quit in about 10-15 seconds. I'm sorry, what?! So I still have to trust that it's not doing anything malicious for 10-15 seconds?

cremno 11y ago
Apparently but only if you're using Chrome and not Chromium (v45).
JonnieCache 11y ago
No, you can just use the open source build which doesn't include any of the google components, like the ticket says. I don't see how they can do any more for you than that.
- Aqua_Geek 11y ago
  Re-reading the ticket: > Chromium builds from r335874 (version 45) onwards will have hotwording disabled by default and will not download the module. There is no way to enable this feature at runtime. So as long as you compile from source or trust your package maintainer to not enable the compile-time flag you should be good. Sorry to raise undue alarm.
  - flebron 11y ago
    Do you also trust your package maintainer to not mismerge patches and leave you open to security bugs? Your argument is no bueno.
    - kekebo 11y ago
      This whole issue got raised by the package maintainers from debian[1], so yeah, there are sources and people you could consider to trust. But of course nothing beats compiling from source. [1]https://news.ycombinator.com/item?id=9724409 https://news.ycombinator.com/item?id=9724409
      - cwyers 11y ago
        If you don't have the time, skillset or inclination to review the source you're compiling yourself, trusting a third party who you have reason to put faith in beats compiling from source yourself.
      - dtech 11y ago
        > But of course nothing beats compiling from source. Did you assemble a bootstrap compiler yourself? Your binary compiler could be backdoored! [1] [1] https://en.wikipedia.org/wiki/Backdoor_(computing)#Compiler_backdoors https://en.wikipedia.org/wiki/Backdoor_(computing)#Compiler_...
        hahainternet 11y ago
        I've no idea why you've been downvoted. While it's not amazingly pertinent, it's worthy to note that security from source assumes your compiler is being honest.
    - kbenson 11y ago
      You have to extend trust out at some point. Your only other alternative is to manually type the machine code required for a C compiler and start from that. Additionally, it's fairly ironic this is about a browser. If you don't trust packages maintainers, yet you want to use a browser, which the whole point of is to download and interpret text, code and binaries which you have little in the way of actually controlling after pointing it at a site, then I think you've made some interesting security trade-offs in your mind.
      - feld 11y ago
  - kekebo 11y ago
    You don't have to trust your maintainer, just go to chrome://voicesearch and check the status (but read up on it, it's badly labeled) or search for "hotword-x86-64.nexe" inside your chromium extensions folder and delete the extension containing it.
    - ytdht 11y ago
      using chrome://voicesearch, I get: Microphone No Audio Capture Allowed Yes Does audio capture has admin privileges over the microphone, or the speakers for that matter?
      - r721 11y ago
        Flags are explained in comment #22: https://code.google.com/p/chromium/issues/detail?id=500922#c22 https://code.google.com/p/chromium/issues/detail?id=500922#c... >Microphone: Is a microphone detected? (Does not mean it is being used.) >Audio Capture Allowed: Can Chromium use the mic? (This is there for historical reasons, it's always "Yes".)
        smackfu 11y ago
        Those are some poorly labelled flags.
- astazangasta 11y ago
  Release only open source products? Not sell our information to advertisers? Not collaborate with the government to spy on us? Not use their monopoly money to buy all of the smart people in the world? The list of how they could improve is endless.
  - albertoleal 11y ago
    They don't owe you anything.
    - astazangasta 11y ago
      No, they don't owe me. You also don't have to thank people who hold the door for you.
    - itg 11y ago
      That's great. And we don't owe Google anything and should be able to call out their bullshit practices. Fortunately open alternatives such as Firefox still exist.
  - exelius 11y ago
    > Release only open source products? Google open sources far more than most companies. They've also contributed greatly to building new open source projects, and they actually keep them open and are a generally benevolent maintainer. They're probably one of the best corporate citizens of the open source community. > Not sell our information to advertisers? It's their entire business model; if you don't like it, don't use their products. > Not collaborate with the government to spy on us? Google never willingly collaborated with the government. They were either hacked by the NSA (this isn't a mark of shame -- just read up on the Equation Group virus that went undetected for the better part of a decade) or they cooperated under a sealed court order. Corporations don't have the agency that individuals do in refusing to cooperate with a court order -- it's literally not possible for a company to refuse to comply with a court order because the feds can just keep arresting people until someone complies. Most companies refuse to put their employees in this position, so they comply under protest (which is exactly what Google did). > Not use their monopoly money to buy all of the smart people in the world? So they shouldn't hire under capitalist principles? Also note that this is beneficial for the smart people of the world, because it forces other companies to pay more as well.
deleted 11y ago
[deleted]
- kekebo 11y ago
  Chromium ≠ Chrome http://www.howtogeek.com/202825/what%E2%80%99s-the-difference-between-chromium-and-chrome/ http://www.howtogeek.com/202825/what%E2%80%99s-the-differenc...
  - Smushman 11y ago
    I see the error...

victor9000 11y ago

apt-get purge google-chrome-stable apt-get install chromium-browser well, that was easy.

magicalist 11y ago
> google-chrome-stable uh, you were worried about your binary blob running a binary blob?
- ryanlol 11y ago
  The chromium-browser package is also a binary blob.
- ISL 11y ago
  The difference is the provenance of the binary-blob supplier. Would you be more likely to run a checksummed binary blob from your trusted Debian mirror, or one I send you via email?
  - coldtea 11y ago
    Of course the one you send me via email. It's all about acountability. I'd have someone to beat the shit out of if anything went wrong with that.
  - DannyBee 11y ago
    "Trusted debian mirror". Remind me the accountability on that one? vs a company you can sue for billions?
    - pyre 11y ago
      By this logic, no large company should ever end up on the wrong side of the law, ethics or morality...
      - DannyBee 11y ago
        ???? This is a really extreme takeaway. My point was more "i don't think trusted debian mirror buys you much either" if your goal is to not ship binary blobs not "billion dollar company is great".

BuildTheRobots 11y ago

"Chromium silently stops installing binary blob" is probably just as good a headline...

zfp 11y ago
Thanks William Shatner for popularizing the split infinitive... to boldly go!
- nazgul1 11y ago
  An infinitive verb is a to verb. There's no to above, thus no split infinitive.
  - jfb 11y ago
    Too, pedantry about splitting infinitives is agrammatical and dumb.
- BuildTheRobots 11y ago
  somewhat even more off topic, but: Thanks to William Shatner for lots of things; least of all demonstrating how to deliver a line of dialogue without it sounding like you're reading off the back of a cereal packet and left your glasses at home. His cover of Common People (Pulp) is an immense example of this. https://www.youtube.com/watch?v=ainyK6fXku0 https://www.youtube.com/watch?v=ainyK6fXku0 Yes Doctor Who, I'm staring you out whilst shaking a fist at you....
deleted 11y ago
[deleted]
kekebo 11y ago
Public bug trackers tend to be less on the silent side

fweespeech 11y ago

Yaya, the march of progress. Seriously, the idea of open source projects downloading close sourced code "on your behalf" is bad in and of itself, regardless of the purpose.

kekebo 11y ago
the hotword flag existed for ages, it got changed from opt-in to opt-out about a week ago[1] and just has been reverted. Less evolution than things back to normal. [1]https://news.ycombinator.com/item?id=9724409 https://news.ycombinator.com/item?id=9724409
- fweespeech 11y ago
  Yes, its progress based on the state it was in a couple days ago.
- morganvachon 11y ago
  It should never have been flipped to opt-out in the first place. Google cares about open source only as long as it benefits them, and I wasn't surprised to see one of their flagship projects take a trip to the dark side for a few days. To paraphrase a Jurassic Park character, they are testing the waters, checking for weaknesses. They remember...

ryanlol 11y ago

Clicking this link will make your browser silently download and execute a binary blob http://ftp.netbsd.org/pub/NetBSD/misc/pooka/rump.js/ http://ftp.netbsd.org/pub/NetBSD/misc/pooka/rump.js/

TazeTSchnitzel 11y ago
JavaScript is securely sandboxed, however.
- Jyaif 11y ago
  just like the nacl binary blob.
  - lawl 11y ago
    Which is allowed to use your microphone at any time without asking. In contrast to javascript executed on a website. Edit: To clarify, I'm only talking about the sandbox here, I'm aware that there is opt-in stuff and that there is open source code guarding the activation of that specific module, i'd argue that this isn't part of the sandbox though.
    - Oletros 11y ago
      Could the module use your microphone without asking?
      - lawl 11y ago
        Yes, that's what I just said and what the bugtracker sais.
        Oletros 11y ago
        No the bug tracker doesn't say that

snaky 11y ago

There is a nice patchset for Chromium that turns off or strips (almost?) all of the controversial features. https://bbs.archlinux.org/viewtopic.php?id=198763 https://bbs.archlinux.org/viewtopic.php?id=198763

imslavko 11y ago

My mother uses her Dell laptop with an Ubuntu installed on it. It is usually great to maintain from my part, as all she uses is Chromium and the files explorer. I just update the software sometimes. But something that started happening in the latest versions of Chromium is driving me nuts. Every time I talk to my mother in my native language in front of the laptop, the "Ok, Google" functionality activates and starts the search of the "parsed" English sentence in Google. I tried to disable it but failed to find how.

andor 11y ago
At least in Google Chrome, "Enable Ok Google" is one of the few options in the settings that are not buried under "show advanced". It's very easy to find.