Chromium sends data to Google upon startup | Hacker News Reader

Chromium sends data to Google upon startup

groups.google.com

110 pointsfelideon16 comments

http://www.google.com/support/chrome/bin/answer.py?answer=11...

http://inari.aerdan.org/gallery/chromeopts.png

The initial request is the GoogleURLTracker class, which manages what Google TLD you're on. On the trunk, this won't happen if your default search engine is not Google, and even if it does happen, we won't save/update any cookies as a result of the update request.

Also, the reporter is using a binary downloaded from the continuous builder, that's why RLZ is included.

None of those settings seem to apply to the case in question:

It seems that on first request it query google for unique client ID (getting NID Cookie)

Requests to safebrowsing are not anonymous. All of them signed with cookie, getted on the first 2-3 requests

EDIT: You added those two sentences. The guy claims changing the default search engine didn't change this behavior.

Did he clear the browsing data, too? I don't use Chromium, but I've seen similar requests with other browsers. The only way I have found to get the browser to stop sending the requests is to zorch all the browsing history, saved cookies, cached garbage, burn the village to the ground and sacrifice small birds. Of course, as soon as you search for soemthing against google.com, the requests will happily start up again.

He specifically addresses the 'default search engine' possibility, and that's not it:

gulbrandr: Can you please redo your test with a different default search engine than Google?

Alexey: Already did it. Result is the same, nothing changed.

The grandparent indicates that this is corrected in trunk.

The blog post he links to:

http://blog.chromium.org/2010/06/in-open-for-rlz.html

says "Chromium will also continue to exist as it always has, without any RLZ library included. And, you can still download a Google Chrome with no RLZ behavior at www.google.com/chrome. But now that RLZ is open, Google Chrome distributed through promotional means will include this open-source implementation of RLZ.".

So what makes the continuous Chromium build a "Google Chrome distributed through promotional means"?

> What makes the continuous Chromium build a "Google Chrome distributed through promotional means"?

The continuous builders exist to compile and test all the code. Therefore they build with RLZ options enabled.

The continuous build binaries are literally whatever the state of the tree happened to be at the time. They're useful for bisection but people aren't expected to run them for non-development reasons.

Well that's very misleading, even Wikipedia thinks that : " Google confirmed that the RLZ tracking token [...] [is] not in versions of Chrome downloaded from the Google website directly or in any versions of Chromium."

http://en.wikipedia.org/wiki/Chromium_(web_browser)#Differen...

From the thread: "We think that the reported RLZ ping behavior (that request to "/tools/pso/ping...") is a regression -- RLZ pings should not be happening in Chromium or non-promotional Google Chrome builds, so this is not the intended behavior."

Is a separate ID generated for a porn mode session? What does Google do with that data?

This might be a good reason not to recommend Chrome of any stripe for banking.

It's a bug and they're working on it:

http://groups.google.com/a/chromium.org/group/chromium-discu...

http://www.chromeplus.org/ strips all that crap out. Cant stay as current but it's worth it.

The current version of Chrome is 5.0.375.99... Chrome Plus is at 5.0.375.38.

I'd be more worried about the vulnerabilities fixed in Chrome that aren't fixed in Chrome Plus:

http://googlechromereleases.blogspot.com/2010/06/stable-chan... http://googlechromereleases.blogspot.com/2010/06/stable-chan... http://googlechromereleases.blogspot.com/2010/05/stable-chan... http://googlechromereleases.blogspot.com/2010/07/stable-chan...

I'm more concerned about the opt-out "safe browsing" feature CCing Google on all your requests, complete with ID cookie. When did that cease to be a cardinal sin? Didn't Palm get reamed for that recently?

It doesn't do that on all your requests, does it? I thought everyone did that via local bloom table (or similar structure), and checking with a central backend only when it gets a potential hit.

My bad, it does not appear to be hitting the safe browsing service on every request but just a few times soon after the first request of a session. I guess it's probably just updating the bloom filter.

They're still not off the hook for doing autocomplete on the server by default. That effectively gives them every typed in URL.

Reply on news.ycombinator.com