Chrome and other Google softwares, by default will install a system-wide auto updater (Google Keystone[1]) set to run every 5 hours. The Keystone Agent cannot easily be removed, and will reinstall itself on every updates. There has also been an exploit[2] of this auto updater service.

If what you need is Chrome developer's tools, installing Chromium (or building your own, for the paranoid) seems like a much better choice to me.

[1]: Note that it has nothing to do with the google/keystone project on GitHub

[2]: https://bugs.chromium.org/p/project-zero/issues/detail?id=14...

Is the Keystone Agent run by cron? Modifying crontab is just a few keystrokes.

Keystone Agent is running by launchd on macOS, usually modifying defaults can stop it from running:

    defaults write com.google.Keystone.Agent checkInterval 0

However, this won't remove the agent from the system, and I think there's no way to be sure Google won't change this configuration key in an update (or even overriding its value).

What happens if you chmod the plist for the launch agent to 000?

I have never tried, but presumably launchd won't run the Keystone agent (although using defaults command can archive the same, if we were to just disable it from running).

The issue is when we want to keep Chrome and maybe other Google apps installed, while _not_ have Keystone, and not letting any Google software reinstall Keystone. In that case, it involve uninstalling Keystone agent, creating GoogleSoftwareUpdate directory then chmod that directory to 000 both in ~/Library/Google and /Library/Google

Is there a component to Keystone I'm missing aside from the agent? Because if launchd can't run it, presumably Keystone wouldn't work.

I believe Chrome itself do invoke Keystone when visiting chrome://chrome to manually check for updates, as it looks like from a forum post[1] (Chrome unable to check for updates after chmod 000'ing GoogleSoftwareUpdateAgent)

[1]: https://www.jamf.com/jamf-nation/discussions/14162/google-ch...

Safari is my daily driver, but for Dev work I switched to FireFox because almost 100% of Devs I know just use Chrome for both dev and everything, which is a good way to miss things breaking elsewhere and falling into an IE-like monoculture.

This. I keep Chrome only to test and sometimes use their dev tools though I am also productive with the ones from Firefox. They both have different things to offer.

having chrome installed is pretty bad even if you don't use it, because google has binaries running at all times on you computer if you do.