Oh, yes, we can totally trust the company:
Yes, Chromium is bypassing the entire source code auditing process by downloading a pre-built black box onto people’s computers. But that’s not something we care about, really. We’re concerned with building Google Chrome, the product from Google. As part of that, we provide the source code for others to package if they like. Anybody who uses our code for their own purpose takes responsibility for it. When this happens in a Debian installation, it is not Google Chrome’s behavior, this is Debian Chromium’s behavior. It’s Debian’s responsibility entirely.
Yes, we deliberately hid this listening module from the users, but that’s because we consider this behavior to be part of the basic Google Chrome experience. We don’t want to show all modules that we install ourselves.
If you think this is an excusable and responsible statement, raise your hand now.
Nothing evil about that at all. Nope.
I wonder if they’re pulling this stunt on the Fedora packages as well?
I don’t normally have a camera on my desktop, or a mike plugged in. I keep the camera taped on my laptop. Not sure if I can physically disable the mike, though.
[Update a while later]
I apologize for any confusion. The “quote” above is not a literal one. I just put it in quotes to distinguish from the blogger’s own commentary. It is his paraphrase of what Google says. I’ve changed it to italics.
Rand, this article is filled with many factual inaccuracies. In fact, the ‘quote’ you reference above is not an actual quote, but rather a loaded ‘paraphrase’ of what the Google engineer actually said (see https://code.google.com/p/chromium/issues/detail?id=500922#c6 for the exact quote).
Besides all that:
1) Google does not build Chromium for Debian, Fedora, etc. Debian and Red Had respectively build Chromium. The Chromium codebase contains an option for downloading this plugin, but it is the responsibility of those building the package for Debian, etc. to have the proper flags set to include it or not. In these cases the flag should be turned off, and in fact now is for Debian installs.
2) The plugin isn’t sending everything you say to Google. It listens for “OK Google” locally, and if it gets that, it sends what comes after to the server. It *only* is activated if your current focused tab is the Google homepage *or* a blank tab in Chrome/Chromium. This is provable (and has been proven) by using wireshark or other packet-capture software.
3) It is plainly visible to the user when the microphone is activated and sending data to Google.
4) It can be disabled, and in fact isn’t activated unless the user *opts-in* explicitly.
In general there’s a lot of misinformation out there on how this tech works, how it’s packaged, and how users get it. Google may or may not be trustworthy, but an article from someone who fabricates a quote to fit his or her narrative isn’t the best way to judge that.
Yes, it is a paraphrase. I put it in quotes to distinguish it from his commentary. I didn’t mean to imply that it was a literal quote.
This is the least of my troubles with Chromium. As for Google, I’ve never paid them a dollar (in fact, they’ve sent me money!) and so I have very low expectations and I’m regularly amazed at how much value they’ve added to my life. Imagine if McDonalds (which I already consider great value) had a bigger ad-supported model. Happy Meals for adults could feed the poor.