Modifications to Google Chromium for removing Google integration

Re:Modifications to Google Chromium for removing Google inte... by vemv on Sunday September 23, 2018 @07:02PM (#18053822)

Generally as a software developer I can assess which projects' source to trust, else I wouldn't be running thousands of transitive dependencies in my machine.

Binaries which are unofficial to even ungoogled-chromium itself surpass my threshold of trust.

But yes, one could take a further step and extract the interesting bits from this project and apply them to the official Chromium trunk.

[ Parent | on HN ]

Re:Modifications to Google Chromium for removing Google inte... by User23 on Sunday September 23, 2018 @07:55PM (#18054043)

How do you assess the trustworthiness of thousands of transitive dependencies with a far greater number of code contributors in a way that scales? This is a serious question, and it would be great if you shared the solution you found. Thanks.

[ Parent | on HN ]

Re:Modifications to Google Chromium for removing Google inte... by vemv on Sunday September 23, 2018 @10:05PM (#18054529)

I should admit that my procedures are only marginally better than an average developer's.

Sadly I have no arbitrarily deep audit in place. I just try to pick solid projects, and assume / quickly check that their dependencies don't suck.

Also I'm particularly cautious with npm (as opposed to rubygems or clojars).

I should be looking into either (or both of):

- setting up a multi-user macOS ('me' + 'admin' + 'dev'. I normally operate under 'me'. sudo is only ever executed under 'admin'. Developer tooling is installed for 'dev', an account which cannot access the rest of the filesystem)

- using Docker and/or a VM for all dev activity, as a sandbox.

[ Parent | on HN ]