<story><title>Chromium unconditionally downloads binary blob</title><url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909</url></story><parent_chain></parent_chain><comment><author>jimrandomh</author><text>The binary blob in question is hotword-x86-64.nexe with sha256sum 8530e7b11122c4bd7568856ac6e93f886bd34839bd91e79e28e8370ee8421d5a.&lt;p&gt;This is labelled as being a &amp;quot;hotword&amp;quot; implementation, ie, something that will monitor the microphone until someone says &amp;quot;OK google&amp;quot;, then start listening and transmitting the following words for a search. However, there is no guarantee that it does what it says it does; in particular, it might instead accept instructions to transmit audio from particular parties that Google wants to spy on.&lt;p&gt;I understand there are likely to be many uninvolved engineers within Google who have access to the source code. It would do a lot to restore trust if a few such engineers could take a look through the source code and find out whether it has a remote trigger, and whether the source code in Google&amp;#x27;s repo matches the file that&amp;#x27;s being distributed.&lt;p&gt;This is not the first time Google has taken an open-source project and added closed-source components to it. They did the same thing to Android, twice: once with the &amp;quot;Play Service Framework&amp;quot;, which is a collection of APIs added to Android but theoretically independent of it, and again with Google Glass, which ran an entirely closed-source fork. In the case of Glass, I did some reverse-engineering and found that it would send all photos taken with Glass, and all text messages stored on a paired phone, and transmit them to Google, with no feasible way to stop it even with root. This was not documented and I don&amp;#x27;t think this behavior was well understood even within Google.</text></comment>
<story><title>Chromium unconditionally downloads binary blob</title><url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909</url></story><parent_chain></parent_chain><comment><author>belorn</author><text>A bit surprised that there is no security CVE report attached. Debian policy is that binaries are vetted by a debian developer, sorted into Main, Contrib and Non-free, cryptographically signed and later verified by the client package system. The bug could allow arbitrary code to be installed and run without any of the above process if someone MitM the connection between the binary file and the client.</text></comment>