Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Is there anything like this going on on Linux? I don't really use it, but I have it in case I need to do dev testing.


I find it maddening when articles presume a specific operating system without ever explicitly mentioning it. This is not limited to a Mac - happens with Windows and Linux articles as well.


Fortunatelly on Linux it's just using standard repositories.


Yes... except the Chrome package adds updating itself to your cron scripts without telling you. :/


I used to be concerned about it. But so does Brave and other Chromium-based browsers. The script in `/etc/cron.daily/google-chrome` on Fedora ensures that the google chrome repository configuration file is correct, but it doesn't update Chrome itself. You still update Chrome manually with `dnf update`.


And it can update itself without sudo?


Yes, since the cron script automatically runs as root on a repeating schedule.

If you want to see what it does:

    mkdir junk
    cd junk
    wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
    ar x google-chrome-stable_current_amd64.deb
    tar xf data.tar.xz
    cat opt/google/chrome/cron/google-chrome
It's not nefarious - it's well-documented and explained.

It's just making a decision for me that, as an administrator, I need to be the one deciding instead.


That is very bad. With this they can easily and covertly target an ip and deploy automatically a rooted version to infiltrate a specific computer.

That looks like crazy theory, but tell me what they will do if the nsa request it?


% ls /opt/google/chrome/cron/google-chrome

ls: cannot access '/opt/google/chrome/cron/google-chrome': No such file or directory




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: