6 ms·

No, you can just use the open source build which doesn't include any of the google components, like the ticket says. I don't see how they can do any more for yo

No, you can just use the open source build which doesn't include any of the google components, like the ticket says. I don't see how they can do any more for you than that.

Aqua_Geek 11y ago
Re-reading the ticket: > Chromium builds from r335874 (version 45) onwards will have hotwording disabled by default and will not download the module. There is no way to enable this feature at runtime. So as long as you compile from source or trust your package maintainer to not enable the compile-time flag you should be good. Sorry to raise undue alarm.
- flebron 11y ago
  Do you also trust your package maintainer to not mismerge patches and leave you open to security bugs? Your argument is no bueno.
  - kekebo 11y ago
    This whole issue got raised by the package maintainers from debian[1], so yeah, there are sources and people you could consider to trust. But of course nothing beats compiling from source. [1]https://news.ycombinator.com/item?id=9724409 https://news.ycombinator.com/item?id=9724409
    - cwyers 11y ago
      If you don't have the time, skillset or inclination to review the source you're compiling yourself, trusting a third party who you have reason to put faith in beats compiling from source yourself.
    - dtech 11y ago
      > But of course nothing beats compiling from source. Did you assemble a bootstrap compiler yourself? Your binary compiler could be backdoored! [1] [1] https://en.wikipedia.org/wiki/Backdoor_(computing)#Compiler_backdoors https://en.wikipedia.org/wiki/Backdoor_(computing)#Compiler_...
      - hahainternet 11y ago
        I've no idea why you've been downvoted. While it's not amazingly pertinent, it's worthy to note that security from source assumes your compiler is being honest.
  - kbenson 11y ago
    You have to extend trust out at some point. Your only other alternative is to manually type the machine code required for a C compiler and start from that. Additionally, it's fairly ironic this is about a browser. If you don't trust packages maintainers, yet you want to use a browser, which the whole point of is to download and interpret text, code and binaries which you have little in the way of actually controlling after pointing it at a site, then I think you've made some interesting security trade-offs in your mind.
    - feld 11y ago
      It's easier to trust that the maintainer compiled upstream properly instead of backported/mismerged because of a stupid OS policy preventing you from incrementing version numbers
      - ackalker 11y ago
        Ergo: use a distribution like Arch Linux or Gentoo. Arch Linux has the advantage that you don't have to build everything from source yourself. Both have the advantage that the build scripts are easy to understand (Arch PKGBUILDs more so, IMHO). In the end you will always arrive at a chicken and egg situation, you will ultimately need to trust the engineers who designed your CPU and chipset, the VLSI design software which they used, the developers who wrote the compiler and toolchain, the tools used to bootstrap it, external libraries, etc. The world ultimately runs on trust, no matter how you slice it.
    - runjake 11y ago
      And even then, who knows? http://wccftech.com/intel-possibly-amd-chips-permanent-backdoors-planted-nsa-updated-1/ http://wccftech.com/intel-possibly-amd-chips-permanent-backd...
      - kbenson 11y ago
        Okay, so the only other alternative is to create your own processor[1], manually type the machine code required for a C compiler, and then start from that. Sheesh. Really, this is what everything in life is like. Every time you cross a bridge, you are implicitly trusting the builders who built it, the engineers who designed it, the mechanical engineering processes they used, and the mathematical disciplines that they rely on, all the way down to their fundamental axioms. You have to extend trust at some point there as well, otherwise you can start by proving there exists a class of numbers we will call integers... 1: https://news.ycombinator.com/item?id=9755742 https://news.ycombinator.com/item?id=9755742
- kekebo 11y ago
  You don't have to trust your maintainer, just go to chrome://voicesearch and check the status (but read up on it, it's badly labeled) or search for "hotword-x86-64.nexe" inside your chromium extensions folder and delete the extension containing it.
  - ytdht 11y ago
    using chrome://voicesearch, I get: Microphone No Audio Capture Allowed Yes Does audio capture has admin privileges over the microphone, or the speakers for that matter?
    - r721 11y ago
      Flags are explained in comment #22: https://code.google.com/p/chromium/issues/detail?id=500922#c22 https://code.google.com/p/chromium/issues/detail?id=500922#c... >Microphone: Is a microphone detected? (Does not mean it is being used.) >Audio Capture Allowed: Can Chromium use the mic? (This is there for historical reasons, it's always "Yes".)
      - smackfu 11y ago
        Those are some poorly labelled flags.
astazangasta 11y ago
Release only open source products? Not sell our information to advertisers? Not collaborate with the government to spy on us? Not use their monopoly money to buy all of the smart people in the world? The list of how they could improve is endless.
- albertoleal 11y ago
  They don't owe you anything.
  - astazangasta 11y ago
    No, they don't owe me. You also don't have to thank people who hold the door for you.
  - itg 11y ago
    That's great. And we don't owe Google anything and should be able to call out their bullshit practices. Fortunately open alternatives such as Firefox still exist.
- exelius 11y ago
  > Release only open source products? Google open sources far more than most companies. They've also contributed greatly to building new open source projects, and they actually keep them open and are a generally benevolent maintainer. They're probably one of the best corporate citizens of the open source community. > Not sell our information to advertisers? It's their entire business model; if you don't like it, don't use their products. > Not collaborate with the government to spy on us? Google never willingly collaborated with the government. They were either hacked by the NSA (this isn't a mark of shame -- just read up on the Equation Group virus that went undetected for the better part of a decade) or they cooperated under a sealed court order. Corporations don't have the agency that individuals do in refusing to cooperate with a court order -- it's literally not possible for a company to refuse to comply with a court order because the feds can just keep arresting people until someone complies. Most companies refuse to put their employees in this position, so they comply under protest (which is exactly what Google did). > Not use their monopoly money to buy all of the smart people in the world? So they shouldn't hire under capitalist principles? Also note that this is beneficial for the smart people of the world, because it forces other companies to pay more as well.

No, you can just use the open source build which doesn't include any of the google components, like the ticket says. I don't see how they can do any more for you than that.

Aqua_Geek 11y ago

Re-reading the ticket: > Chromium builds from r335874 (version 45) onwards will have hotwording disabled by default and will not download the module. There is no way to enable this feature at runtime. So as long as you compile from source or trust your package maintainer to not enable the compile-time flag you should be good. Sorry to raise undue alarm.

flebron 11y ago
Do you also trust your package maintainer to not mismerge patches and leave you open to security bugs? Your argument is no bueno.
- kekebo 11y ago
  This whole issue got raised by the package maintainers from debian[1], so yeah, there are sources and people you could consider to trust. But of course nothing beats compiling from source. [1]https://news.ycombinator.com/item?id=9724409 https://news.ycombinator.com/item?id=9724409
  - cwyers 11y ago
    If you don't have the time, skillset or inclination to review the source you're compiling yourself, trusting a third party who you have reason to put faith in beats compiling from source yourself.
  - dtech 11y ago
    > But of course nothing beats compiling from source. Did you assemble a bootstrap compiler yourself? Your binary compiler could be backdoored! [1] [1] https://en.wikipedia.org/wiki/Backdoor_(computing)#Compiler_backdoors https://en.wikipedia.org/wiki/Backdoor_(computing)#Compiler_...
    - hahainternet 11y ago
      I've no idea why you've been downvoted. While it's not amazingly pertinent, it's worthy to note that security from source assumes your compiler is being honest.
- kbenson 11y ago
  You have to extend trust out at some point. Your only other alternative is to manually type the machine code required for a C compiler and start from that. Additionally, it's fairly ironic this is about a browser. If you don't trust packages maintainers, yet you want to use a browser, which the whole point of is to download and interpret text, code and binaries which you have little in the way of actually controlling after pointing it at a site, then I think you've made some interesting security trade-offs in your mind.
  - feld 11y ago
    It's easier to trust that the maintainer compiled upstream properly instead of backported/mismerged because of a stupid OS policy preventing you from incrementing version numbers
    - ackalker 11y ago
      Ergo: use a distribution like Arch Linux or Gentoo. Arch Linux has the advantage that you don't have to build everything from source yourself. Both have the advantage that the build scripts are easy to understand (Arch PKGBUILDs more so, IMHO). In the end you will always arrive at a chicken and egg situation, you will ultimately need to trust the engineers who designed your CPU and chipset, the VLSI design software which they used, the developers who wrote the compiler and toolchain, the tools used to bootstrap it, external libraries, etc. The world ultimately runs on trust, no matter how you slice it.
  - runjake 11y ago
    And even then, who knows? http://wccftech.com/intel-possibly-amd-chips-permanent-backdoors-planted-nsa-updated-1/ http://wccftech.com/intel-possibly-amd-chips-permanent-backd...
    - kbenson 11y ago
      Okay, so the only other alternative is to create your own processor[1], manually type the machine code required for a C compiler, and then start from that. Sheesh. Really, this is what everything in life is like. Every time you cross a bridge, you are implicitly trusting the builders who built it, the engineers who designed it, the mechanical engineering processes they used, and the mathematical disciplines that they rely on, all the way down to their fundamental axioms. You have to extend trust at some point there as well, otherwise you can start by proving there exists a class of numbers we will call integers... 1: https://news.ycombinator.com/item?id=9755742 https://news.ycombinator.com/item?id=9755742
kekebo 11y ago
You don't have to trust your maintainer, just go to chrome://voicesearch and check the status (but read up on it, it's badly labeled) or search for "hotword-x86-64.nexe" inside your chromium extensions folder and delete the extension containing it.
- ytdht 11y ago
  using chrome://voicesearch, I get: Microphone No Audio Capture Allowed Yes Does audio capture has admin privileges over the microphone, or the speakers for that matter?
  - r721 11y ago
    Flags are explained in comment #22: https://code.google.com/p/chromium/issues/detail?id=500922#c22 https://code.google.com/p/chromium/issues/detail?id=500922#c... >Microphone: Is a microphone detected? (Does not mean it is being used.) >Audio Capture Allowed: Can Chromium use the mic? (This is there for historical reasons, it's always "Yes".)
    - smackfu 11y ago
      Those are some poorly labelled flags.

astazangasta 11y ago

Release only open source products? Not sell our information to advertisers? Not collaborate with the government to spy on us? Not use their monopoly money to buy all of the smart people in the world? The list of how they could improve is endless.

albertoleal 11y ago
They don't owe you anything.
- astazangasta 11y ago
  No, they don't owe me. You also don't have to thank people who hold the door for you.
- itg 11y ago
  That's great. And we don't owe Google anything and should be able to call out their bullshit practices. Fortunately open alternatives such as Firefox still exist.
exelius 11y ago
> Release only open source products? Google open sources far more than most companies. They've also contributed greatly to building new open source projects, and they actually keep them open and are a generally benevolent maintainer. They're probably one of the best corporate citizens of the open source community. > Not sell our information to advertisers? It's their entire business model; if you don't like it, don't use their products. > Not collaborate with the government to spy on us? Google never willingly collaborated with the government. They were either hacked by the NSA (this isn't a mark of shame -- just read up on the Equation Group virus that went undetected for the better part of a decade) or they cooperated under a sealed court order. Corporations don't have the agency that individuals do in refusing to cooperate with a court order -- it's literally not possible for a company to refuse to comply with a court order because the feds can just keep arresting people until someone complies. Most companies refuse to put their employees in this position, so they comply under protest (which is exactly what Google did). > Not use their monopoly money to buy all of the smart people in the world? So they shouldn't hire under capitalist principles? Also note that this is beneficial for the smart people of the world, because it forces other companies to pay more as well.