Hacker News Reader

Comment by GuB-42 | Hacker News Reader

It has a pretty bad set of permissions, which are necessary for it to function, but still scary for Google algorithms. Google doesn't know that its GET request doesn't get orders from a botnet and leaks sensitive data the app has access to.

Also, if the app hasn't been updated for years, chances are that it targets and outdated version of Android, which works, but is considered suspicions by Google as it is also a way to bypass some security checks in recent Android versions.

There are probably many other criteria but I think these are the most likely.

Not saying it is a good thing, but it explains the reasoning. I wish Google did human reviews and not rely that much on their bots, but then that's what Apple does, and it is even more locked down. Maybe try F-Droid, it is an alternative app store dedicated to open source.

View on HN

> Google doesn't know that its GET request doesn't get orders from a botnet and leaks sensitive data the app has access to.

And yet the only reason Google won't add internet access as a revocable permission is their ad business.

Chrome constantly scans your harddrive in a way you can't easily turn off, and it's not for your safety: it's for the safety of their ad business to try to catch malware that engages in click fraud. If you have media or backup drives it just constantly adds wear to them.

>Chrome constantly scans your harddrive in a way you can't easily turn off, and it's not for your safety: it's for the safety of their ad business to try to catch malware that engages in click fraud. If you have media or backup drives it just constantly adds wear to them.

Is this true? Chrome is open source so someone should be able to point out the code that is doing that. What is the source of this info if not the code?

I second this. This is a very strong accusation to have no proof.

Linked above, they apparently removed it last March but it was there for years and years.

Chrome isn't open source.

Chromium is open source, Google adds some secret magic sauce to make Chrome.

I don't know but chromium is the base of chrome. Does google release chrome in an open way?

Can't they (at least in principle) apply whatever patches they want before build and release?

https://blog.google/products/chrome/cleaner-safer-web-chrome...

https://www.google.com/chrome/privacy/whitepaper.html#unwant...

> Chrome periodically scans your device to detect potentially unwanted software. In addition, if you have opted in to automatically report details of possible security incidents to Google, Chrome will report information about unwanted software, including relevant file metadata and system settings linked to the unwanted software found on your computer.

> System information includes metadata about programs installed or running on your system that could be associated with harmful software, such as: services and processes, scheduled tasks, system registry values commonly used by malicious software, command-line arguments of Chrome shortcuts, Windows proxy settings, and software modules loaded into Chrome or the network stack.

This is interesting, I didn't know Chrome did this. But it doesn't back up the claim that "[i]f you have media or backup drives [Chrome] just constantly adds wear to them." Does anyone have anything on that?

As pointed out above, Chrome no longer does this... but adding wear is a natural consequence of any hard drive scanning process. SSDs are rated for a certain number of read/write cycles, and every time a block is read, it adds wear.

Even spinning rust wears out eventually. Not knowing any details about how often Chrome did this, it is hard to say just how significant this wear would be compared to other normal uses of the media. But it is clear that wear would occur to some degree.

Not only does it add wear, it slows down other processes. People notice this after OS updates where the system re-indexes the volume after the update completes. It's also why most indexing processes do it late night or while the system is idle. For an app like a browser to do it is just rude.

> SSDs are rated for a certain number of read/write cycles, and every time a block is read, it adds wear.

Only write cycles cause wear, read cycles don't cause any meaningful wear.

Thank you for clarifying that! I should have known that. So perhaps it wouldn't cause any meaningful drive wear, if the system didn't do a lot of writes. Still consumes CPU and power, though.

Yeah, I mentioned media/backup drives since those are usually HDD rather than SSD. I didn't realize Chrome had stopped doing it now though. To disable it was a crazy number of steps with admin permissions.

Right, I understand about wear, but my point is that the behavior described in the links doesn't indicate that Chrome was scanning backup or media drives - only things like the registry, files directly related to Chrome, etc. If I have a drive with a bunch of random files on it, Chrome wasn't scanning those, was it?

I only found out about it from noise from my media/backup HDDs, it was grinding them constantly when idle, chrome and windows were on SSD.

Wow. Thanks for the info. Glad that feature has been removed...

It no longer exists.

https://security.googleblog.com/2023/03/thank-you-and-goodby...

Glad to hear it. Interesting that the latest privacy whitepaper still includes the section on it.

When I realized that Microsoft Defender sends sample files for further inspection without keeping a history of the files I opted to just install Linux and move on. This alone gives me more reason to just only use Firefox exclusively like I always have been.

Anecdotally, Chrome used to pin my hard drive at 100% usage until I killed a process called "software_reporter_tool.exe." I still have a version of the binary located at "%localappdata%\Google\Chrome\User Data\SwReporter\107.294.200" last modified 2022-11-02.

Reply on news.ycombinator.com