Chrome, Debian Linux, and the secret binary blob download riddle

jeremy · 06-18-2015, 10:28 AM

Quote:

Browser snuck proprietary voice-snoop code into distro

The Debian Project thinks it's fixed an issue where Google's Chromium web browser snuck proprietary code into the fiercely Free Software oriented Debian Linux distro. That hasn't stopped Debian users from wondering how the issue got past project maintainers in the first place.

Debian user Yoshihito Yoshino first raised the red flag on the project's bug report mailing list in May, after noticing suspicious network activity from Chromium 43, the most recent stable release of the open source version of the Chrome browser.

"After upgrading chromium to 43, I noticed that when it is running and immediately after the machine is on-line it silently starts downloading 'Chrome Hotword Shared Module' extension, which contains a binary without source code," Yoshino wrote. "There seems no opt-out config."

Under the Debian Social Contract, distributing software without accompanying source code is a serious no-no. The fact that an important software package from an eminent contributor has distributed code sans source, without anyone noticing, has left some Debian users asking whether the project needs stricter controls.

Even worse for some users was the nature of the proprietary code that Chromium downloaded. It was reportedly a library that supported Google's "OK Google" voice recognition feature, which some security researchers have pointed out is a potential open door for invasion of privacy.

More at The Register...

What do LQ members think of this recent development?

--jeremy

neonsignal · 06-20-2015, 11:12 PM

Chromium is sourced from a company which, while it has been supportive of free software projects, has also been ambivalent in its own philosophy about software. I wouldn't necessarily put this problem down to malice on Google's part, but still it is another reason to trust Firefox more than Chromium.

descendant_command · 06-21-2015, 03:48 AM

Well the 'bug' was found, reported, and fixed.
As a "process" issue, I don't see a problem, any more than with any other security bug.

There has never been any promise or guarantee that any particular package has been audited or is free of malicious or unintended behaviour, only that the source the package has been built from is available for review and the package maintainers changes and actions are documented.

No doubt this will bring about greater scrutiny of future contrbutions from that vendor, possibly a change of classification to contrib, but at the end of the day it's really still 'user beware' for what yiu choose to install - Google outgrew it's famous motto a long time ago.

jeremy · 06-24-2015, 10:57 AM

As an update, from https://code.google.com/p/chromium/i...id=500922#c30:

Quote:

commit 0366a5184a70b3eefb5fcef2c2e13721669f00d8
Author: mgiuca
Date: Wed Jun 24 05:41:33 2015

Disable "Ok Google" hotwording in open source builds by default.

The compile-time flag "enable_hotwording" is now tied to
branding=Chrome (false by default unless making a Google Chrome build).

Note: Chromium will no longer download/install the Hotword Shared
Module, and will automatically remove the Hotword Shared Module on
startup if it was previously installed. To keep this functionality, add
"enable_hotwording=1" to GYP_DEFINES.

BUG=500922

and

Quote:

In light of this issue, we have decided to remove the hotwording component entirely from Chromium. As it is not open source, it does not belong in the open source browser.

Chromium builds from r335874 (version 45) onwards will have hotwording disabled by default and will not download the module. There is no way to enable this feature at runtime. Google Chrome users will be unaffected (although, as always, will have to opt in using settings before the hotword module will activate).

If you want a version of Chromium with hotwording, you have to build it from source, with the GYP define "enable_hotwording=1" (or equivalently, the GN arg "enable_hotwording = true"). This will produce a custom build of Chromium that downloads the proprietary hotword component.

I have also added a field in the chrome://voicesearch page (in 45 onwards) to show you whether the hotword module is installable. If that says "No", then it is not possible to opt in to hotwording (either because the language is unsupported, or because it is a Chromium build).

--jeremy