Hacker News Reader

Comment by darklajid | Hacker News Reader

» When Chrome starts up, it fetches a list of feature flags from a Chrome server using a system called Finch which is independent of the normal upgrade system.

I'm not a Chrome user. But that sounds awful at first. What is the idea behind this service? Is there any documentation about the 'features' these flags can enable/disable?

I understand that I'm paranoid at times AND I really dislike Google, but why would you have an extra channel to influence deployments, other than offering a global update file?

View on HN

I fail to see this as any more harmful than the auto updating feature. I understand the concern of multiple avenues to phone home as being worse than one, but it's negligible considering it's the same company. Coupled with all of their other services for security incidents, prediction, auto correct, spelling, usage stats, dangerous page warnings, etc, I think it's just another log on the fire and not worth being concerned about specifically.

It actually is almost nothing like the auto updating feature.

Finch is mainly used for A/B testing. It doesn't push actual updates, all it does it turn existing features (flags) on and off. It's used for quickly A/B testing or incremental rolling new features and is designed to be more agile.

That means it uniquely identified you to Google every day then, right?

Always assume so with Google products.

What about Chromium?

Chromium never uses Finch except if you specify it in the command line flags.

Thanks!

> using a Google browser

> not wanting to be tracked

here's a hint: ad impression for unknown user is 0.01$ and for logged in user 2$. guess why Google has a browser now...

Do you mean logged into Chrome (e.g. profile sync)? or just logged into Gmail?

does not matter at all.

if you have a logged-off cookie, and the publisher can associate you with a logged-in user at a near point in time, they can charge you as logged in impression.

Does it? Does the request actually provide enough to uniquely identify you?

Source code: https://chromium.googlesource.com/chromium/src/+/master/comp...

The biggest difference I see is the speed. You're right, it doesn't make a difference from a technical point of view but it illustrates again just how much power they have over chrome - and thereby over the web: They can push a policy update to the bigger part of Chrome's userbase in 24 hours.

It should be entertaining when car makers use the same strategy: "Oh yeah, we have this system where everytime you turn the ignition, your car polls us and updates its assistant, motor, steering and airbag settings. Don't worry though, we mostly just use it for randomized tests and field trials."

Update actually changes the binary/code of chrome. It pushes new features and content to you.

Finch only turns certain features on/off. It's used for A/B testing and incremental rollouts.

You can see a list of flags in chrome://flags

Mostly experimental stuff that will become full features soon, but until then they are behind a flag.

The two systems fulfill very different roles.

For one: https://chromium.googlesource.com/chromium/src.git/+/master/...

Also look for base::FieldTrialList in Chromium source. In this case, it seems to be: https://chromium.googlesource.com/chromium/src/net/+/master/...

because Google don't know bugs on your (their) browser affecting their revenue.

interesting, if you're a victim of mitm attacks, i wonder if attackers can abuse that to disable some certificate check features to make spoofing ssl sites easier.

I think they use TLS and they use cert pinning for Google domains.

If you "really" dislike Google, then why are you using Chrome?

> I'm not a Chrome user.

Oops, dang it.

I'm not the GP, and even though I personally really dislike Google too, I'm forced to use Chrome because Firefox fucking sucks.

Reply on news.ycombinator.com