Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Ah, the old "no no, just trust us" defense.

This is just a thing Chrome has to live with, it's a browser developed by a company that makes money selling user behavior to advertisers. You'd have to be stupid not to think this is a possibility.

Must be frustrating to the developers who know what it does and doesn't do though.



The trouble with privacy comments like this blog post is always the same: no matter what the current situation is or how good the intentions of the person making the comment may be, unless they are an executive with the authority to legally bind the company in question to a privacy policy that has real repercussions if subsequently violated, in the end anyone can still be screwed over on the whim of whoever has the data.

In this case, that "whoever has the data" has been publicly dismissive of fundamental privacy concerns up to and including CEO level, and has a business model built around extracting as much value as possible from that private data without regard for the privacy concerns of any individual.


We put the source out there and try to be as transparent as we reasonably can. In the end though, people make their own decisions.


Open source != trustworthiness.

This is a very tough cookie to crumble. The counter-argument to "we are open source" is that the binaries can potentially be assembled from an altered source code. Ideally, the binaries should be assembled by multiple independent "build points" and compared against vendor's version. There was a secure smartphone OS vendor (the name escapes me ATM, it was several years ago) and they did just that - an open source project with audited build system - and it was a major hassle by the looks of it.

The only sure way to deal with the trust issue is to not have a conflict of interest to the first place, which is something that seems to be neigh impossible with Chrome.


One problem is that Chrome is not open source - Chromium is. But 99% of people use Chrome, and there is no way to build Chrome from source to be sure what code is running.

We have to take Google's word for it that Chrome is identical to Chromium as regards privacy, and as others stated, Google's business interest is clearly to track user information, not to respect their privacy.


I've already explained why this framing is incorrect: http://news.ycombinator.com/item?id=3034628

So, go ahead and check out a release branch, set the "Official" build flag yourself, wait anywhere from 2-8 hours for the binaries to get built, and verify it against the bits we ship.


Thanks for the information, I have never seen this stated officially anywhere.

So one can build Chromium with "Official", then add some DLLs (Flash, etc.), and get something 100% identical to Chrome?

Edit: And is there an official statement of this somewhere?


I went through it and there's still some ugly hackery involved on Windows. These are technical issues (e.g. how ffmpeg is compiled via MinGW), but they make it complicated to generate a non-branded, psuedo-official build. That said, all the pieces you need (minus the closed-source plugins) appear to be in the repository and can be built and compared against an official release. It could definitely be made easier, but would require some non-trivial engineering to do so.


Chrome source isnt out there AFAIK. Chromium source is. Not a small difference.





Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: