Chromium calls home

[Drygar]

Hey!

Do you happen to know something new about this security/privacy bug or "feature" :
https://bugs.debian.org/cgi-bin/bugrepo ... bug=792580
https://code.google.com/p/chromium/issu ... ?id=498272

It is about v43 but newer ones were released after that . Is it fixed ? Still in triage as per the site, but I'm still wondering.

[axel668]

It's not a bug, it's what Chromium does.
If you want a Google- free version of Chromium you have to use a fork, like e.g. https://iridiumbrowser.de/
It offers better security but also lacks some Google features (e.g. Sync / Signing in to Google)

[xenopeek]

On your second link read comment #19, #20, and #21.

#19
GCM Channel status syncer only runs when GCM does (meaning starts when there is at least one application/web page/component needing GCM, and stops when last one of these is gone, at which point GCM stops as well.

#20
The gstatic request is probably to https://www.gstatic.com/generate_204 , which is used to check for a working network connection as well as captive portals, if I remember correctly.

#21
#19: Ok, if this is only started on demand, that sounds good to me. Thanks.

GCM is Google Cloud Messaging, see here: https://en.wikipedia.org/wiki/Google_Cloud_Messaging. As described, only when something needs GCM is it loaded. And the call to http://<any Google website>/generate_204 is I think a test to see if Internet is reachable.

In short, it all sounds like functionality. Not "calls home".

[rek]

I understand that Iridium browser is chromium without the google call home feature. They have downloads for ubuntu listed and I would like someone to detail, how to install in 17.3 mate. REK

[rek]

I should add, I've copied/pasted the directions for installing in ubuntu 14 and it doesn't download and installation can't find it. Since it is supported by redhat and several other reputable organizations, I really want to try it. Any help would be greatly appreciated. REK

[xenopeek]

Just copy and run (one by one) the 4 commands listed for Ubuntu on their download page (https://iridiumbrowser.de/download) in a terminal. Note that when asked for a password on the terminal, you don't get any visual feedback as you type it.

Iridium vs Chromium: https://github.com/iridium-browser/irid ... d-Chromium. That mentions it disabled the GCM status check.

Iridium does lag behind Chromium. Chromium 47 was released 2 weeks ago but Iridium is still stuck on 46 for Linux and 44 for Windows/OSX it looks like. Iridium isn't free of criticism either: https://news.ycombinator.com/item?id=9482689

[Drygar]

On your second link read comment #19, #20, and #21.

#19
GCM Channel status syncer only runs when GCM does (meaning starts when there is at least one application/web page/component needing GCM, and stops when last one of these is gone, at which point GCM stops as well.

#20
The gstatic request is probably to https://www.gstatic.com/generate_204 , which is used to check for a working network connection as well as captive portals, if I remember correctly.

#21
#19: Ok, if this is only started on demand, that sounds good to me. Thanks.

GCM is Google Cloud Messaging, see here: https://en.wikipedia.org/wiki/Google_Cloud_Messaging. As described, only when something needs GCM is it loaded. And the call to http://<any Google website>/generate_204 is I think a test to see if Internet is reachable.

OK,

Thanks. But still it calls Google servers which is privacy issue in my opinion. Why should it connect to Google server(s) to check Internet connection ?
I am not aware of other browsers doing the same. Please, correct me if I am wrong.

[Drygar]

It's not a bug, it's what Chromium does.
If you want a Google- free version of Chromium you have to use a fork, like e.g. https://iridiumbrowser.de/
It offers better security but also lacks some Google features (e.g. Sync / Signing in to Google)

Thanks!

Isn't Chromium supposed to be free from Google's closed source / proprietary features ? At least free from most ? Just like they removed the binary blob from few months ago .

I made some search/investigation and it seems that Google does release the Chrome source code into Chromium and they seem to claim that it is Debian's fault (they are the maintainers of the package, then Canonical) because they can get the Chromium source code and modify it to their preference and views. Then why didn't Debian did it? Don't Debian maintainers or Canonical's see an issue for a browser package to call home its vendor upon every program start (even though it might be for something considered benign for the majority of people). This "benign" connection is still kind of calling Mars/ calling home, here I am signal sending IP and possible location.

[Drygar]

Re. Iridium, generally I do not install packages from outside the official built-in repositories, PPAs, etc. for security reasons. So I'd prefer to have something from the official Ubuntu or LM repos.

Currently I use Firefox and sometimes Midori, but I am not such a big fan of Firefox as it seems to be slower, sluggish, it seems to crash occasionally especially on HTML5 videos content. Midori is better in speed terms than FF but still it lacks some features.