> Google Chrome contains a key logger that sends Google every URL typed in, one key at a time

They are describing the auto complete feature...

I get that people should be making informed choices about what data they share, but for the FSF to so intentionally mis-describe what is going on does not help inform anyone.

I agree with the criticism that they should draw a clearer line between the cost and the benefit but there's nothing to be gained by softening the language used to describe the cost.

I use Firefox and have search suggestions disabled there so I am somewhat sympathetic to their point.

That said, calling server-side autocomplete on a field you explicitly are typing in strikes me as about as sensible and forthright as calling an Amazon text field that takes my credit card number a card skimmer.

Exactly, and waters down the impact of the termminology. If "card skimmer" is anything that can read a credit card, than the term is meaningless for security.

If "keylogger" is anything connected to the web that responds to a keypress...

GNU is risking turning into the boy who cried wolf here.

As with a lot of the FSF's messaging, I think the substance of the message may be correct, but the way they convey it just isn't effective.

If this is for a general audience(!), no-one was ever convinced by the 48th item in a list who wasn't already convinced by the 47th. You don't persuade people just by being right, and certainly not by banging on about the very many subtly-different ways in which you're right. Pick few strong examples and prosecute those decisively.

If this is a resource for campaigners, set out the audience and intent before you start. Preface it with something like “Here are various ways that certain aspects of Google's software can be seen as indistinguishable from malware. They may be useful counterarguments if someone suggests Google's software is trustworthy.”

There's no warning that a text field autocompletes, and no reason to assume all users are tech savvy enough to realize that google has to see every character typed to send back recommendations.

I think the description of autocomplete as a keylogger is a good fit from the security perspective.

Autocompleting doesn't change that.

The Amazon text field would have to send your credit card number for a credit check without telling you to compare.

It can also be turned off extremely easy, not exactly what we know as "malware" if it allows you to turn off its "malicious" activities.

On Windows asking for a handler for all key presses will often trigger the antivirus, while asking for a single application often will not.

And if you say bandwidth you're fired. It's privacy the FSF is grumbling about. And for that it's been rhetoric and theoretical suffering, but no actual real-world damage. And not for lack of adoption.

Put that cost in your pipe and smoke it.

If you're not logged in, as I'm sure FSF people are, then this is a much bigger deal, but it doesn't apply to the vast majority of people.

All that said, the keylogger would take a good deal of interpretation to get a complete or even partial history, since autocomplete choices would likely be chosen anyways, not fully typed out URL's. If they send that history anyways on any time you press enter, the autocomplete feature again doesn't matter because they have it with our with.

Also, your aggregate value argument is quite apt: It's valuable to know what percentage of a city speaks English, but the fact that you personally do or don't is of no real value at all, specifically because it's "your" individual data, not despite the fact. And insisting that you've been hypothetically robbed of your entitled half penny for disclosing your language preference to the McDonalds cashier is precisely as sensible as complaining about the value of your half-typed URLs.

At the end of the day, serverside autocomplete is useful, and coal is cheap!

Type "p" in the address bar at work?

Don't visit sites on work computers you don't want others to know about!

You've never accidentally typed a password in a URL bar? You've never accidentally focussed the browser window when typing something you don't want Google or anyone else to know?

The Overton window has moved so far in the last ten years.

A while back we (and by we I don't mean me, I mean hackers collectively) would consider a piece of software that opened a TCP socket unless it had a real reason to malware.

Now? It's fairly common for like, webpages to send back every keystroke you might accidentally make whilst a tab is focused.

The fact that this is frequent, possibly even 'normal' behaviour does not make it sane.

You're free to disagree with the rest of the world, of course. But you might want to focus on trying to shift the Overton window. What you're doing in this comment is simply asserting that you disagree with everyone else.

Because you seem to be asserting what "everyone else" thinks.

If I ask non-technical people about this autocomplete feature and whether they would like to disable it (assuming they have this option), after explaining it sends every keystroke to Google, they (generally) will reluctantly agree to have it enabled, why?

It's not because they believe sending every keystroke to Google is a super reasonable sacrifice for having the benefit of autocomplete on search queries.

No, ask them, they will invariably sigh "Well, Google knows everything about me already, anyway, so ...".

That's NOT the reasoning of someone making a well thought-out decision, it's the reasoning of someone beaten into submission. And we know this is true, because we feel it too, every time you read a comment about somebody trying to escape the Google Ecosystem, but not yet having a satisfying replacement for this one service .. You don't get to make a fair choice about it.

That is why they say Google mistreats their users, because they made them give up, not just giving up their privacy, but giving up on their belief they even have a choice about it.

That's basically holding my privacy hostage for what is stupidly basic UX functionality.

And it's not like I was given a choice about it. Maps used to remember your search history just fine, until they pulled that a few years ago, and I "just" had to give them my location history, so they would remember my fucking search queries.

You might recognize these tactics from heroin dealers and similar scum.

It's amazing how unnecessarily less useful Maps is, if you have to retype the addresses every. single. time. But you don't want Google to keep a log of everywhere you've been.

If Chrome is sending to Google every character typed into the URL bar, that's literally a networked keylogger and can presumably be used for all the same nefarious purposes as a "malicious" keylogger. The perceived value this feature provides is meaningless in the context of privacy/security.

I bet all those keypresses are stored permanently, associated with your Google account, but that's another issue altogether.

It's questionable whether Google deserves similar trust as a bank since they aren't regulated in a similar way. But it isn't unusual for people to trust companies over friends for some things, such as their life savings.

The other thing to remember is that trust can be partial. For example, I wouldn't trust a bank not to be looking for legal ways to charge me fees and I wouldn't trust their investment advice, but I'd trust them to keep their ATM's working and not to lose my money.

I do not believe that this is a thing that is true. There is no well-known history of ethical unregulated banks.

I expect we will see more regulation of the companies storing personal data, along the lines of the GDPR. I don't expect people will stop using the big tech companies to store personal data.

If you start an argument with a false premise (like the above), then sure, you can come to just about any kind of conclusion you want.

The GNU perspective is very distrustful of the idea that anyone else should be administrating their devices [etc etc]

Which is a perfectly reasonable position to have, and no one takes issue with GNU for having it.

What one takes issue with is the consistent use of manipulative language, egregious omission of context (e.g. like what was just said about Google in the post above) and other generalized mindfuckery that GNU folks seem to routinely resort to in order to get you to buy into their shtick. As exemplified in the article referred to in the original post for this thread.

And which has gotten to be way beyond old. For like, multiple decades now.

- Multinational corporations care little about their reputation - the public has very short memory, and it's rare that a reputational issue outweighs considerations like sunk costs, network effect, or lack of better alternative on the market. See literally almost every scandal involving a corporation ever.

- The larger the organization, the less individual ethical and reputational concerns of bottom-line workers matter. See literally every corporation. For particular recent examples, see e.g. Volkswagen emissions scandal or Boeing 737 Max fiasco, both cases involving actual engineers with actual careers on the line, and not just software devs risking unemployment for 10 minutes.

Note that both statements are explainable even without attributing malice to any corporation. They're side effect of scale and market power.

I'll never ask my friends to memorize my schedule and remind me on time. I'll also never ask Google to take care of my cat. Sounds pretty straightforward to me.

from wikipedia "A backdoor is a method, often secret, of bypassing normal authentication or encryption in a computer system, a product, or an embedded device "

Seems to fit.

> - They describe parental controls as "censorship"

"Censorship is the suppression of speech, public communication, or other information, on the basis that such material is considered objectionable, harmful, sensitive, or "inconvenient"."

Also seems to fit.

I could go on about the other points, but most of it is true almost by definition.

Was Martin Luther King a criminal? A criminal is someone who breaks the law, and King knowingly broke a law against peacefully protesting against segregation, so yes.

Is it sexist to only hire women for a lingerie ad? Discrimination on the basis of sex is sexist, so yes.

Is it murder for a doctor to euthanize someone who wishes to die, even if it's not allowed in their area? Murder is the unlawful premeditated killing of one human being by another, so yes.

But for all these things, if you just describe them as "criminals", "sexists", and "murderers", you're saying "we agree x is bad, y is an example of x, so y is bad", even if the reason x is bad doesn't really apply to y.

parental controls are good (?), so this functionality to suppress what-we-define-as-objectionable content is good.

autocomplete is good, so this keylogger is good.

Google Assistent is good (?), so having it just pop up unprompted and just start recording is good (It managed to record me a few times, even though I have zero interest in voice controlling my phone--I have NO idea what triggered it, so yeah that's malware).

True by definition, but not by intent.

If anything, being outraged at calling parental controls censorship is what's bullshit. "Censorship is bad and protecting children is good, therefore parental controls are not censorship". We could instead call spade a spade, and then talk about when its use is justified.

Of course I already know the standard counter-arguments, but those don’t change the visceral annoyance I have with a system that considers all full-frontal nudity to be a bigger problem than watching someone being shot, stabbed, or poisoned. I am also annoyed that the rules of these parental filters seem to copy American sociopolitical norms by default.

[1] reality depends on your jurisdiction, and I am not a lawyer in any case, but people still get to say that if they mistakenly think it’s true :-)

If we agree that there are ethical ways to use censorship, providing censorship tools cannot be inherently unethical and companies shouldn't be faulted for doing so.

Of course there is no alternative as long as consumers accept it. And consumers don't care since it all seems to work.

There are plenty of issues with DRM from a practical and philosophical level. But I think calling it malware is disingenuous. Alice doesn't cede her rights over her data by transmitting it to Bob, and DRM is how Alice protects the data when Bob is a malicious actor. If Bob wants to gain more privileges over all his data, he doesn't need to accept communication from Alice.

That said, buggy DRM can be atrocious and cost more money than it saves. I know plenty of folks who pirate software they own because it's easier than an legal install. But that's a UX problem, not a DRM problem.

The copy is essence of what a computer does. A computer can essentially only do some math and copying.

If you ask me to install some DRM software (or maybe even some hardware containing DRM stuff as in HDMI) you are asking me to run additional complex software where the only purpose is to restrict the functionality of my computer.

I do that, since I like some movies and other things I get this way. However the software serves no purpose to me as the user. It is there to do Digital Restriction Management.

Meanwhile however we have Spotify and are back in the walled garden.

Movie industry unfortunately went directly from physical media (with stupid DRM restrictions - my favorite one is that on a "legal" DVD player I am forced to watch a short sequence on how bad pirates are, on my "illegal" DRM free player I can skip that part) to streaming. Making sure I don't "own" a thing and making sure my computer runs software limiting what I can do with my computer.

I don't disagree with your assessment, except I'd say DRM doesn't exist to restrict the machine - the goal is to restrict the user. Which is necessary, when users aren't trustworthy.

But I'd disagree that DRM doesn't serve you a purpose. It serves the purpose of establishing trust and enforcing conditional exchanges of information. The alternative, like you imply, is no communication, or communication through a different medium that doesn't involve your hardware at all.

Here in meatspace, we have this notion of ownership and property rights. DRM is a mechanism to protect those rights. They may not be perfect, and they might not always make much business sense but that is their intent.

If you look for a comparison: DRM is like a book publisher printing books on special paper which prevents copying and which can only be read in a specific angle so I can't easily take notes containing quotes from the book. All to protect those rights. (Edit: actually that example is missing a piece - you need special reading glasses to be able to read it, that's what DRM is doing on my machine)

And yes - Napster was an issue for the music industry. Suddenly their content was there for free and easily accessible. But then there was Apple, giving music away DRM-free with even better usability and for an acceptable fee.

That's a nice way of phrasing it from the business point of view. From the customer point of view, it's degrading the product and artificially limiting the ways one can interact with it. It goes against the fundamental principle of general-purpose computing: as a computer owner, I get to tell what the computer can and cannot do with the data it has.

DRM in its most general form exists as a way to (try to) make some data follow a different set of rules than the rules of the medium. It's an attempt of making bits have colour[0]. Since bits don't, and can't, have colour, you have to simulate this by changing the rules of the universe in which those bits are processed. It's practically impossible to do correctly, hence the product degradation that always accompanies DRM schemes.

Adding insult to injury, DRM is usually employed to force a recurring revenue stream in a context where it fundamentally doesn't make sense.

--

[0] - https://ansuz.sooke.bc.ca/entry/23

Barring quantum technology, I don't think this is possible.

I have no idea what you mean by that. I really need you to elaborate, because it sounds like a perfect description of DRM. It's there to stop you from playing/copying files, and nothing else.

This is exactly why DRM is malware. It's not your device. You don't get to say what it may or may not do. That's for the device's owner to decide.

malware: Software that is specifically designed to disrupt, damage, or gain unauthorized access to a computer system. <https://www.lexico.com/en/definition/malware>

Your explicit intention is to disrupt the operation of the computer running the DRM software. This disruption is not authorized by the owner of the device. Ergo: malware.

If you're going to claim control over my computer in the process, I would prefer that you not send me the file. If the price is accepting DRM then it would be better for everyone if the file never existed.

I'm not complaining that you won't give me the file unless I run your DRM code. I'm complaining that your insistence on DRM is creating negative externalities for me and others even if we don't want the file.

And as a practical matter, while many services require DRM when it's easy to do so, in a world without DRM almost none would shut down.

So instead of "It is extra software with the only purpose to limit what I can do." we have "It is extra software with the only purpose to limit what I can do, on the bidding of someone else."

That's basically the same definition. The "someone else" part was already implied by the first half, obviously some party wants it or there would be no conflict. So we've reached a clearer and more explicit definition, but we've also shown that the original definition is not insincere at all!

I understand why someone could view this as limiting, but saying DRM is malware and it's only purpose is to limit you is intentionally ignoring other information about DRM to make it sound even worse then it is.

Any kind of security, authentication, or encryption software ever written was done so to "limit what you can do", so I don't think that is enough to constitute maliciousness.

That being said, many DRM software implementations have been known to go beyond just protecting the rights of the content creators, and that's a different story.

You're seriously trying to argue that people who commit copyright infringement do so maliciously, i.e. with the intent of harming the copyright holder? That seems... novel. And not very plausible. If true, however, it would be much more effective to ignore the work altogether, thus denying the copyright holder both direct income and free publicity.

> Any kind of security, authentication, or encryption software ever written was done so to "limit what you can do", so I don't think that is enough to constitute maliciousness.

The point of security, authentication, and encryption software is to protect the interests of the owner of the device. Defending yourself from malicious attacks by others is not an act of malice. DRM is malicious because it perverts the owner's computing resources to thwart the owner's interests and subverts their control over their own device.

Your incredulity seems intellectually dishonest.

If not malicious, how would you describe enjoying a {book, movie, song, program, ...} that someone has offered for sale without paying for it?

Granted, it's not as clear cut as theft. You aren't depriving anyone of an item that they own.

Granted, the author may in some cases benefit indirectly from copyright infringement, e.g., when you go tell your more honest friends about it, and they go off and buy a copy for themselves.

But in a world where the vast majority of the folks who create these kinds of works need to get paid, and the way they get paid is by selling copies, consuming their work without paying for it seems really fundamentally unfair to them.

The natural state of the world? There is no natural right to control the distribution of things that you publish. Copyright is an artificial privilege created for the sake of social engineering.

If one thing is certain it's the fact that there is no actual malice in the act, so calling it "malicious" is intellectually dishonest. Even labeling it as freeloading would be incorrect since there is no cost ("load") imposed on anyone else. It makes zero difference to the copyright holder's material wellbeing whether you obtain an unauthorized copy or just ignore the work altogether. It's understandable that people would like to be paid for nothing more than giving permission for something that doesn't actually affect them at all, but there's no just basis for it.

Obviously people should get paid for the labor involved in creating new works, to the extent that there is a demand for them. That does not in any sense imply that they should be able to control the distribution of works which have already been created and published. There are plenty of other models (including patronage, crowdsourcing, bounties, and work for hire) which would permit creators of works to get paid fairly without control over distribution. Copyright in general and DRM in particular are among the worst choices, not only because they are unjust but also because they impose massive negative externalities on the rest of society for relatively little gain.

The owner owns their device, yes but they don't always own the data on the device. DRM, for all its faults, is an attempt to reconcile to reconcile the two conflicting requirements.

Owning a resource means that you get to decide how the resource is consumed, i.e. used up. This is exclusive only to the extent that scarce resources cannot be put to two conflicting uses simultaneously, so active use by anyone else would prevent the owner from consuming the resource as they choose. Data, however, is not scarce; it can never be used up. There is no possible conflict between the "owner" and any other user, which makes the claim of ownership meaningless. No matter what anyone else might do with the data, the "owner" still has it and can use it however they wish.

That may be semantically different than “ownership”, but is otherwise functionally irrelevant in the context of this conversation.

The idea that creators shouldn't have the right to control their works is wildly radical -- even more than the FSF's view. Even the concept of copyleft relies on the right of the creator to impose licensing on their creative works. If copyrights didn't exist, licenses that require source to be shared, like GPL, couldn't exist.

You're well entitled to your opinion, but I'm glad the world doesn't work that way, because things like the restrictive clauses in GPL have been very good for the world.

That's the labor which is scarce. Not copies of the copyrighted work. I already said people who create things should be paid for that labor—or more to the point, have to be paid if you want them to continue to create things. That does not imply that they deserve to control what others do with the work after it's been produced and published. That was just an expedient method chosen to encourage "the sciences" (though in practice it's been applied more to entertainment). There are better ways.

> If copyrights didn't exist, licenses that require source to be shared, like GPL, couldn't exist.

The GPL was created as a counterbalance to copyright. In a world without copyright there never would have been any need for it. Moreover, permissive licenses like MIT and BSD have had their share of success even without a requirement to share source code for modifications.

> The idea that creators shouldn't have the right to control their works is wildly radical -- even more than the FSF's view.

It's not really all that radical. Copyright itself is a relatively recent invention and was originally designed as a means of censorship and protectionism for publishers. Before that there was no practical means for an author to control distribution of their work, or any expectation that they should be able to do so. The manual duplication of notable works was routine, and you wouldn't find those scribes begging the author's permission.

In more modern terms, the popularity of file sharing certainly suggests that a very large fraction of the population doesn't act like they believe authors should be able to control the distribution of their works once they're published. Copyright is mainly popular among those who directly benefit from it, much like any other subsidy.

> There are better ways.

Like what, paying for labor instead of the work itself? That may work well (and already does) for more commoditized/custom-purpose/one-time-use creative works, but how do we apply something like that to something like recorded-media entertainment? Prepay for Taylor Swift's next album on Kickstarter?

Yes, exactly. There is no reason why a Kickstarter or Patreon model wouldn't work for recorded-media entertainment. Those approaches have already been used for things which are much more labor-intensive than music albums.

Artists with an established brand and fan following have some additional options, such as limited-edition merchandise or signed prints. Scarce physical goods that can't just be duplicated because their value is derived from their providence.

PS: I think most DRM works against the businesses that attempt to implement it. But it isn't malware. It is a data protection layer.

I think you may be referring to businesses making an anti-user decision to withhold content, and mistaking exceptions to that to be things useful to a user.

DRM schemes are anti-user decisions in the sense that users are presented with a choice of either allowing companies to hijack their machines to enforce a subpar experience, or walking away.

Of course, I'd argue most DRM pushes normal people to piracy because the restrictions usually suck. Had they just distributed the content in a more unrestricted way, they'd do more business. But that is a business problem, not a technical one.

Another way is to not do it. The law does not require you to implement crazy DRM schemes, it requires me to not distribute copyrighted work to which I don't own the copyright.

The law doesn't force companies to implement DRM. It's a choice, and as a choice, it can be considered malicious action by customers.

Grocery stores doesn't hire large amount of security people so that every customer would have a security person assigned to them that follows them around and ensures they don't steal anything. They could do it, I don't think any law anywhere prevents them from doing that. But the first one to try it would quickly lose all its customers. If such a practice happened to get ultimately established (e.g. normalized by stores in non-commodity position), I suspect the meatspace equivalent of FSF would be ranting about it too.

How about:

- Using the fast forward function in media playback software to skip over advertisements.

- Ripping DVD and Blu-Ray movies for use with a media server.

- Playing movies and games from other countries (region locking.)

- Recording or streaming console gameplay (e.g. HDCP on PS3, disabling the share function in certain PS4 games.)

- Running certain software, even some single-player games, if you are not connected to the internet ("always-on DRM.")

DRM sucks, but you don't have to use it.

For example, in the "Sabotage" section, it describes how by turning off a server, Google turned a device "into a $300 out-of-warranty brick."

Now, it is a fact that the device did cost $300 and it was out-of-warranty, but pointing out that the device is out of warranty without also pointing out that Google offered full refunds for all of the devices is deceptive wording.

This is a poor standard. For example:

> Kim Jong-un is an elected leader

It's technically correct, but it does not provide any useful information, and could be classified as heavily misleading. But hey, technically it's true!

https://www.gnu.org/philosophy/right-to-read.en.html

I've been reading a lot recently, and so buying a lot of books. Some digital, some not. As far as I can tell I own a single copy of the physical ones. I can transfer them to someone by handing them my copy. I can do the same with digital ones. It's legal for other people to read my paperback, or for me to hand them my Kindle. I can even, get this, do stuff to the mobi file I get when I download the ebook.

What am I missing?

Amazon can — and have — reach into your Kindle and delete books you have there (notably, they did this to 1984, proving that real life can be ironic).

You cannot lend one Kindle book to someone else, without lending the entire Kindle.

Your phone, computer and TV run binary code which can do literally anything (say, logging your passwords and transmitting them in unused protocol headers), which you are not permitted to remove or modify, in the name of DRM and similar user-restricting technologies.

The FSF/RMS insistence on calling things by different words seems so irrational and dishonest. Likewise with taking common words with many meanings (like "free") and claiming that word as their own, then claiming that what "free" really means in the context of software can only be expressed once you tack on several KB of legalese that tells you what you can't do with it and how you're a bad person if you do. It's like the naming of the PATRIOT Act- it had nothing to do with patriotism, but it surely changed people's perceptions of it in subtle ways. What congressman would vote against patriotism? How could anyone be opposed to freedom? It's the same BS rhetorical trick, and it makes whoever uses that trick seem less honest and more irrational (to me at least). It's still an effective propaganda technique, which is exactly why they should avoid these sorts of rhetorical tricks. I don't want to hear their propaganda, I want to hear their philosophy. Because if their philosophy is truly built on a foundation of propaganda and rhetorical tricks, then their philosophy is meaningless. I agree with much of what the FSF advocates but they've always done such a terrible job advocating for it.

It literally is a backdoor into your phone. Whether it's ethical or not depends if they've ever used it with law enforcement or for their own personal gain.

> They describe a bug where Google Assistant incorrectly identified the "Okay Google" hotword as "Google Assistant recording users' conversations"

This isn't necessarily great but I've run into situations where it activated on completely unrelated phrases. Is it Google's best interest as an ad company to sell data to fix this? No.

The issues you see as someone else pointed out are because you implicitly trust Google. I personally don't trust Google. The fact they manipulate their products for "algorithmic fairness" is proof they have ulterior motives one way or another. Is it that far of a stretch to think they could be abusing other components of their platform either intentionally or not?

To be fair to GNU, GNU Hurd cannot be infected with malware because no one is quite sure how to install it and keep it running for any meaningful amount of time.

The worst, of course, is the tragedy of the commons dynamics. A lot of harm that comes from surveillance capitalism does not affect someone in particular, but it amounts to great damage to society as a whole. For example, by degrading public discourse, addicting people to screen time while robbing them of living their actual lives, and assisting authoritarian regimes in oppressing their own people (project dragonfly).

I think the point he was making, in part, was that if the average user worried about those things, they would WANT most of those features and decisions.

It is a backdoor... They can install or remove any apps on my device without my authorization and I cannot disable "that feature" even if I know about it. So it's almost like a rootkit.