Hacker News Reader

Comment by Garbage | Hacker News Reader

For clarification on most of the keys related concerns, please read the FAQ - http://git.chromium.org/gitweb/?p=chromiumos/platform/assets...

View on HN

I don't see that the whole source is published, exactly like the whole source of Chrome is not being published (Chromium is Chrome minus "the souce", e.g. additional code (for what?), installers etc). I haven't even seen any analysis of all the stuff Google does in the pieces of the code that aren't published. It can be done, somebody should just really want to do that.

Disclaimer: I avoid Chrome browser exactly because I don't have enough information to know if they really "aren't evil." I don't claim there isn't such information somewhere, just that I don't know about it. My worries are exactly because their installers install more like a malware than like clean projects ("no we aren't going to let you to simply download executables, just click here, give us administrative privileges and enjoy when we download what we want and change on your machine what we like").

Anybody who knows more?

Just use Chromium instead. You can audit every single line of code and build it from scratch on your own machine with your own reflections-on-trusting-trust-safe-compiler. Or you can install Debian's version.

[For the unaware, "Reflections on trusting trust" by Ken Thompson is a must read: http://cm.bell-labs.com/who/ken/trust.html ]

Never heard of this. I just read it twice to understand it. Great explanation of a widely unknown problem I guess. From now on I will never ever tell people an application is safe if you can look into the source code. Thank you so much!!

These days it is - as long as that source code is in a language with multiple independent implementations.

And yet having the ability to look at source-code yields the greatest level of safety there is.

Apps without source-code cannot be trusted by default, unless you have a contract with the company providing it that stipulates a relief agreement that's reasonable for you in case anything goes wrong. And only enterprise software does that, depending on how you negotiate nonetheless, otherwise for consumers the EULAs are doing the exact opposite. And even with enterprise software guarded by good contracts, even then you need the source-code.

There is some additional food for thought in it when you realize that all life forms* are basically self-replicating DNA compilers. That is, compilers compiling compilers, which in turn compile more compilers. Thus, there's a chance some crucial information is actually stored "nowhere", i.e. is bolted in by complier which builds another compiler.

For more abstract take on this topic, I direct to Gödel, Escher, Bach; Hofstadter elaborates there on the fact that the distinction between what is data storage (e.g. music CD) and reading device (e.g. music player) is somewhat arbitrary, and in fact the information itself is "stored" in the combination of "data storage" and "data reader".

* - or at least most, IANAB.

Your suggestion is exactly the opposite of the information I'm looking for. I'm interested what's there in the code that they don't publish but that is behind the "download now" links, that's what 99.99% of people are going to use anyway.

Here's the official answer:

https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoo...

It's certainly reasonable to admit that you lack the time and/or expertise to evaluate a piece of software, but I don't understand how you translate that into a justification for obvious FUD like "their installers install more like a malware than like clean projects."

The additional code for Chrome should be separated into plugins or otherwise dynamically loaded things. Again, if someone knows of cases where this is not true, let me know.

Reply on news.ycombinator.com