News for hackers. Stuff that matters.
Re:Google Chrome Keystone is modifying /var symlink on non S... by Scapeghost on Tuesday September 24, 2019 @07:04PM (#21065614)
I've always hated that "service" (more like malware given this news) like everything else that installs itself into the autolaunch sequence without permission, and remove* it whenever I notice/remember it, but it keeps coming back whenever I touch Google Chrome, which I prefer not to use in favor of Safari/FireFox because of reasons like this.

Things like these (including secretly signing you into Search when you sign into YouTube† or refusing to support PiP on iPadOS/macOS) just solidify Google's image in my mind as a forever scummy, intrusive company that I wish I could leave behind like I did Microsoft, but sadly Google Search and YouTube still don't have good enough alternatives yet.

* (startup items usually reside in the LaunchAgents/ and LaunchDaemons/ folders in your user ~/Library/, the root /Library/ and /System/Library/)

† (you can fix this by deleting all Google cookies after signing into YouTube, on any OS)

Re:Google Chrome Keystone is modifying /var symlink on non S... by apostacy on Wednesday September 25, 2019 @12:35AM (#21067642)
The trends that Google has spearheaded have had a real effect on me over the years.

I feel alienated from my computer. Subtle things will just change. If I really dig I might be able to find out why, but I don't have the time, so I just accept it.

Usually very small things that are barely noticeable. My Chromecast extension disappeared and was integrated into the browser. My brain could not help but notice this benign change, which caused a hard to place sense of unease.

Or when Google decided to remove rotation from the home screen on Android 2.3 -- it wasn't a huge problem, but I could have sworn that something changed. Users were conflicted, many convincing themselves that the homescreen never rotated at all.

It has made me not trust my computer. I second guess myself much more. If some option no longer exists, I wonder if it was just my imagination or if it was quietly deprecated while I wasn't looking. Does it even matter?

I think that we are being trained to see devices as ephemeral, and not to get too attached to them.

Re:Google Chrome Keystone is modifying /var symlink on non S... by cortesoft on Wednesday September 25, 2019 @01:26AM (#21067878)
You feel alienated from your computer because there has been a conscious decision to take away options and user control in modern software. And I get why that decision has been made, even if I hate it as much as you and every other computer enthusiast.

For 90% of people, they have always "felt alienated" from their computers. They didn't understand what was happening or why things changed either, and it was easy to get yourself into trouble if you didn't know what you were doing and were trying to figure out how to fix something.

So companies decided to make their software have fewer options, and do more things automatically, without asking the user to have to make a choice. They don't give the users an option to customize, so they don't have to worry about those customizations causing breakage.

For advanced users this is crippling, but there are a lot more of them than there are of us, so they are going to be catered to.

Re:Google Chrome Keystone is modifying /var symlink on non S... by apostacy on Wednesday September 25, 2019 @09:24AM (#21070515)
> For 90% of people, they have always "felt alienated" from their computers. They didn't understand what was happening or why things changed either, and it was easy to get yourself into trouble if you didn't know what you were doing and were trying to figure out how to fix something.

I have stubbornly resisted it, but I think I will go the way of all of my friends and just accept it soon.

I now spend more time doing personal system administration than at any time in my life as a computer user. If you want to have control of your computing devices, you need to spend more time than in the age of five in floppy disks.

Most updates are a one way trip now, and they aren't keep on publishing exactly what features they have removed, so a lot of time is spent disabling updates, firewalling, researching, jailbreaking, imaging, and backing up.

My biggest liability now is not malware, but updates! I have to put all of my development toolchains in virtual machines, because they will break and I can not rely on being able to re-create them. Re-creating my modest workflow is a bi-annual affair, when it really shouldn't be.

And there has been a cultural change in software development as well. Software like Firefox will clobber your data during an update, and when you file a bug report, it will be WONTFIX, and they will say that it is your fault for not using Time Machine and rolling back their changes. They did this awhile back with bookmarks, and they certainly do it with extensions. I had to spend an entire afternoon recovering annotations and citations that were destroyed by a Firefox update, and I was told it was essentially my fault for trusting Firefox and not having hourly backups.

I hate to sound like a broken record, but there was a time when you could reasonably assume that if an update was making major changes, that it would give you the option to go back, or at least export your data if it didn't support it. I really wish the open source community would step up and be different, instead of embracing this.

Re:Google Chrome Keystone is modifying /var symlink on non S... by forgottenpass on Wednesday September 25, 2019 @10:46AM (#21071266)
I think these "lower the ceiling rather than raise the floor" rationales are cop-outs.

Yes, I get it, this reasoning does technically provide a justification for the design decisions made that will shut some people up. But that doesn't make the product or design decisions anything to be proud of.

And, to take it a step further, I don't think UX is putting in honest effort to improve things for unskilled users. All the low barrier to entry stuff is superficially pleasant, but the number of common UI paradigms end users have to learn how to intuit their way around has exploded, while affordances and discoverability have plummeted. People who've spent their dayjobs in front of computers for years - if not decades - are assumed to categorically have bad, less-than-worthless, ideas about what might make interacting with those devices easier. All because "shut up, nerds. Nobody would ever like the things you like" was easier than listening and figuring out the how to separate the wheat from the chaff.

Re:Google Chrome Keystone is modifying /var symlink on non S... by yesco on Wednesday September 25, 2019 @02:46AM (#21068346)
Ironically despite there being less choices in an effort to make it easier for that "90%", the amount of tech support friends and family request from me has only increased in the past years.

Personally I don't buy the whole "removing choices to stop users from hurting themselves" excuse. To me it seems like over zealous designers trimming far more than necessary to make things look nicer at the cost of usability. But what do I know?

Re:Google Chrome Keystone is modifying /var symlink on non S... by stetrain on Wednesday September 25, 2019 @03:47PM (#21074556)
People are using tech to do a lot more. 20 years ago tech was a thing you sat down at, turned on, and used to check your email, update a spreadsheet, or type up a document.

Now we're using computers and software every waking hour and using software with millions of distributed users that we expect to always show us the latest updates.

We're using phones for banking and payments, to turn our lights on and off, to keep a lifetime of family photos backed up and synced across multiple devices.

It has made things more complex, but I don't think a world of 1997 style configure-it-yourself software would necessarily help with that.

Re:Google Chrome Keystone is modifying /var symlink on non S... by grenoire on Wednesday September 25, 2019 @03:25AM (#21068555)
Regarding the increase, I would argue that is less about increased device complexity but more about the increase in the amount of people who are using these devices on a daily basis. More they use, the more problems they encounter; I think the intersection between complexity and usage is determined moreso by the latter.
Re:Google Chrome Keystone is modifying /var symlink on non S... by nvrspyx on Wednesday September 25, 2019 @03:40AM (#21068639)
I doubt the number of people using smartphones and computers has increased significantly in developed/first-world countries, especially when it comes to one’s family and friends.

As anecdotal as it may be, my friends and family have used computers and smartphones for years, but I’ve experienced the same increase in requests for tech support as the parent comment.

Further, no one said there’s increased complexity. The argument is that the oversimplification, the removal of features, and overzealous design assumptions have made UX go in the wrong direction. It’s also an argument I agree with.

A lot of UX design today fails to recognize the spectrum of “tech literacy” and it should, ideally, accommodate all within that spectrum, rather than pander to the least “tech literate” end. It’s not always possible, but it should be strived towards. Instead, we have UX trending towards attempting to be so “intuitive” that it becomes counterproductive.

Re:Google Chrome Keystone is modifying /var symlink on non S... by apostacy on Wednesday September 25, 2019 @09:11AM (#21070405)
I had an interesting incident recently, where I was with some relatives and we were trying to plan the next leg of our trip; what restaurants to go to and what directions to take, etc.

Anyway, we had to start using a paper notepad and pens to keep track of the information! Even for people who just want to paste an address from a text message to look up in maps, and especially if you want to do anything with the calendar.

I just remember 15 years ago on my Treo 650 never needing to do that, and having no problem copying text between different apps seamlessly, between calendar, email, text, maps, and other apps. Same with Blackberry. Using modern Android is as awkward as driving a car with a mouse.

But I think there was an intentional push to minimize options for users, to make fewer pathways for things to go wrong. Forcing people to use pen and paper when they have a smartphone next to them is a UX success for them, because they don't have to improve handling text.

Re:Google Chrome Keystone is modifying /var symlink on non S... by eecc on Wednesday September 25, 2019 @03:21PM (#21074303)
I'm afraid that's Agile development for you; teams contemplating the emptiness of their backlog and rushing to invent an endless stream of small t-shirts to fill it and keep the velocity within the desired KPIs.

/s

Re:Google Chrome Keystone is modifying /var symlink on non S... by madeofpalk on Wednesday September 25, 2019 @09:24AM (#21070510)
> You feel alienated from your computer because there has been a conscious decision to take away options and user control in modern software. And I get why that decision has been made, even if I hate it as much as you and every other computer enthusiast.

This is a weird claim here because this issue only appears if you made a conscious decision to disable a critical security of the operating system, something only possible because you have "options and user control in modern software".

Re:Google Chrome Keystone is modifying /var symlink on non S... by Wowfunhappy on Wednesday September 25, 2019 @10:15AM (#21070972)
That this conversation arose within this context is somewhat ironic, but not particularly weird.

It’s great that Apple lets you disable SIP in macOS. It’s not great that Google frequently takes away user control. Different companies making different decisions in different situations is not contradictory, and outliers do not discount an overall trend.

Re:Google Chrome Keystone is modifying /var symlink on non S... by fishnchips on Wednesday September 25, 2019 @03:53AM (#21068704)
My wife stopped using Android for that very reason. She’s not much into tech and complained that every time Android updates to a new major version, she needs to learn it from scratch, while iOS changes are noticeable but rarely touch user interaction fundamentals.
Re:Google Chrome Keystone is modifying /var symlink on non S... by inapis on Wednesday September 25, 2019 @04:50AM (#21068943)
My mother had that exact same experience with her Nexus 5x. Things kept on shuffling every 6 months. Ever since I’ve got her on iOS, she’s been happy and I’ve been happy. I don’t even have to ask her to update to the latest iOS. She does it automatically and generally is able to find her way through. Never so on Android.

Apple wins in that regard - stability, consistency and reliability in daily use. It’s boring in a way for tech enthusiasts but wins in the eyes of people for whom their phone is just another tool which needs to work when they need it. They’ve no inclination to fiddle around with things nor a desire for a changing UI.

Re:Google Chrome Keystone is modifying /var symlink on non S... by StreamBright on Wednesday September 25, 2019 @04:20AM (#21068834)
I am into tech and I stopped using Android for the same reason. UX is what keeps or alienates users.
Re:Google Chrome Keystone is modifying /var symlink on non S... by pishpash on Wednesday September 25, 2019 @05:20AM (#21069084)
History observers will know that Google started the forced auto-update and permanent beta culture. "We know better than users".

When all is said and done, Google can die off or fail as a business, but this and persistent data collection as a norm will remain its most lasting "contributions".

Re:Google Chrome Keystone is modifying /var symlink on non S... by Crinus on Wednesday September 25, 2019 @08:15AM (#21069975)
I absolutely hate auto-updates on anything. Of course this is always met with "but security issues..." YOU BROUGHT SECURITY ISSUES BY MAKING EVERYTHING NETWORKED AND IN A PERPETUALLY UNFINISHED STATE!!!

And of course since everything is in a constantly broken state, it is also in a need of constant auto-updates that both break and unnecessarily change stuff without my knowledge or permission.

Re:Google Chrome Keystone is modifying /var symlink on non S... by jraph on Wednesday September 25, 2019 @07:17AM (#21069601)
> Or when Google decided to remove rotation from the home screen on Android 2.3 -- it wasn't a huge problem, but I could have sworn that something changed. Users were conflicted, many convincing themselves that the homescreen never rotated at all.

For this specific feature, on LineageOS, you can restore home screen rotation. I don't really understand why it's off by default though, it's confusing to have apps rotate but not the home screen.

I've always assumed they know what they are doing (Android UX seems quite good, despite what my three years younger self would think), but I don't get this. Is it because you can mess up your home screen by adding or moving icons when rotated?

Re:Google Chrome Keystone is modifying /var symlink on non S... by apostacy on Wednesday September 25, 2019 @08:25AM (#21070062)
> For this specific feature, on LineageOS, you can restore home screen rotation. I don't really understand why it's off by default though, it's confusing to have apps rotate but not the home screen.

I think it is either because iOS doesn't rotate the home screen on phones, or because they introduced this simplified car interface that did rotate, and they wanted to differentiate. But like so many design choices, it was not due to technical reasons, but marketing or political reasons.

It's funny, when I used Windows 10 for the first time recently, Ubuntu's unintuitive lock screen finally made sense, since they copied it. Whenever open source software starts doing something strange with their interface, I only have to look at proprietary software to see what interface they cargo-culted, going back to Pidgin copying iChat. I would love to see the discussions where they make these decisions. I imagine someone bursting into a meeting "You guys, Microsoft did a thing with their interface, we have to put everything else on hold to copy them!"

Re:Google Chrome Keystone is modifying /var symlink on non S... by disjhshava on Wednesday September 25, 2019 @05:41PM (#21075848)
When I used versions of android with home screen roatation, I remember it would completely jack up most of my widgets. They were designed to be displayed at some aspect ratio and that aspect ratio would change after rotation. Maybe they got rid of the feature because it wasn't worth it to herd developers of widgets into fixing this issue.
Re:Google Chrome Keystone is modifying /var symlink on non S... by dantondwa on Wednesday September 25, 2019 @02:50AM (#21068359)
I feel the same. That's why I appreciate a lot Free Software and I try to never have essential parts of my workflow depend on proprietary software; because it doesn't change condtantly, it doesn't run away from me, it is always available. It really takes a lot of stress away. If only I could replace every tool with a free alternative...
Re:Google Chrome Keystone is modifying /var symlink on non S... by ratww on Wednesday September 25, 2019 @02:35AM (#21068284)
I share your pain.

Some time last week Youtube removed the publication date from videos. Apparently they restored it today.

For a while it was super strange and I had to rely on comments to guess when the video was posted.

Re:Google Chrome Keystone is modifying /var symlink on non S... by hans1729 on Wednesday September 25, 2019 @03:44AM (#21068664)
This was way more than a week ago, I remember installing an extension for exactly this months ago. Then it came back, then it disappeared again [...] - this might be betatesting though.
Re:Google Chrome Keystone is modifying /var symlink on non S... by AJ007 on Wednesday September 25, 2019 @08:31AM (#21070104)
I can’t speak authoritatively about this specific instance, but I use multiple unlinked google products across multiple devices and they absolutely split test UI changes. It can be fairly nefarious on the advertiser/publisher side of things if you actually understand what their attempting to do.

It’s really too bad, because Google traded their pristine reputation for possibly a slight boost in their near term earnings.

Re:Google Chrome Keystone is modifying /var symlink on non S... by pishpash on Wednesday September 25, 2019 @05:18AM (#21069080)
You have to make the window larger (than "mobile-sized") to see it.
Re:Google Chrome Keystone is modifying /var symlink on non S... by Crontab on Wednesday September 25, 2019 @03:32PM (#21074412)
> I feel alienated from my computer. Subtle things will just change.

I sometimes feel like companies have used the guise of "protecting novice users" as a means to take away our freedoms and increase their power (e.g. Google forcing updates on Chrome; Microsoft forcing updates and telemetry on Windows; Apple prohibiting non-app store applications and iOS downgrades). Of course, Linux and BSD exist, but many people don't want to deal with them.

The whole situation is just depressing to me.

Re:Google Chrome Keystone is modifying /var symlink on non S... by climb_stealth on Wednesday September 25, 2019 @01:15AM (#21067824)
That is one thing I really appreciate about running lineageOS on Android. You can see every single code change that makes it into a given update [0].

[0] for example https://download.lineageos.org/beryllium/changes/

Re:Google Chrome Keystone is modifying /var symlink on non S... by 0xdeadb00f on Wednesday September 25, 2019 @03:09AM (#21068464)
> It has made me not trust my computer. I second guess myself much more. If some option no longer exists, I wonder if it was just my imagination or if it was quietly deprecated while I wasn't looking. Does it even matter?

Reminds me of 1984.

Re:Google Chrome Keystone is modifying /var symlink on non S... by apostacy on Wednesday September 25, 2019 @08:33AM (#21070119)
It's fascinating, because whatever thing was silently deprecated, there will be hoards of defenders in comments insisting that the thing never existed, and it was just your imagination. Even on sites like Stackoverflow!

Part of this is because release notes no longer most things removed (they are just covered under "other interface enhancements").

I did track down the home screen rotation change but it was very obscure. In one thread a user had to post actual video of two different Nexus One devices and prove that the update removed landscape homescreen mode. This is the world we live in, where this is a massive cloud of uncertainty over what our devices are even capable of doing!

Re:Google Chrome Keystone is modifying /var symlink on non S... by IfOnlyYouKnew on Wednesday September 25, 2019 @09:07AM (#21070374)
A software changing some minor feature reminds you of a world-wide plunge into fascist dystopia?
Re:Google Chrome Keystone is modifying /var symlink on non S... by donalhunt on Thursday September 26, 2019 @12:51PM (#21082833)
Re: chromecast extension: https://support.google.com/chromecast/answer/7249696

This actually bugged me a lot (I cast into meetings quite a bit) and your comment made me go find a solution... Turns out it's super easy!

Re:Google Chrome Keystone is modifying /var symlink on non S... by toyg on Tuesday September 24, 2019 @07:22PM (#21065781)
Yeah, I removed Chrome precisely because it kept re-adding its crap to the login sequence. It really drove home the notion that Google will not respect any boundary or privacy - your machine is their machine, your data is their data, and screw you if you don't agree.

Now I live in Firefox and it's just as good as Chrome, at least for my needs. I've dropped pretty much all Google stuff except for GMail, mostly out of laziness (I would have to update hundreds of accounts).

Re:Google Chrome Keystone is modifying /var symlink on non S... by w0utert on Tuesday September 24, 2019 @08:08PM (#21066145)
>> I've dropped pretty much all Google stuff except for GMail, mostly out of laziness (I would have to update hundreds of accounts).

I held off for two years moving away from GMail for this reason. A year ago I decided to pull the plug anyway, and it turned out to be much less annoying than expected. My strategy was as follows: first enable a forward from GMail to your new mail address, then directly migrate the ~10 vital/daily accounts, then just leave the rest pointing to the GMail account. After that, change each remaining account immediately (no exceptions) the moment I either log in to it, or receive an e-mail from it that refers to the GMail address.

It took me about two months migrating away from GMail, and as a bonus I was able to identify quite a few old login I didn't really have a use for anymore, so I closed them.

For regular mail I put an auto-reply in GMail that says I don't use it anymore and the address will be closed at some point in the future. But honestly, I don't think anyone ever saw it as nobody sends regular email anymore these days. All in all the process was pretty painless, and I feel very happy about ditching the last Google service I was still using (except the rare Google query of DDG fails to return useful results)

Re:Google Chrome Keystone is modifying /var symlink on non S... by justinclift on Tuesday September 24, 2019 @10:52PM (#21067134)
> ... nobody sends regular email anymore these days.

That seems strange to me, as email is my main form of communication.

What are the people you know using instead?

Re:Google Chrome Keystone is modifying /var symlink on non S... by ImprovedSilence on Tuesday September 24, 2019 @11:47PM (#21067423)
Not OP, but for personal email I've noticed the utility of email has gone down and down for me the past few years. I've got more spam/junk, 90% of my other traffic is automated bills and newsletters I get, etc, and an ever dwindling amount of friends keeping in touch via email. There seemed to be a progression from email->fb->whatsapp,snap,IG,etc-> .....?/i'm too old to keep up with the lastest communication these days. Most of my social convos have regressed 15 yrs and are again mostly just texting, even for photo sharing....

Now email in professional life is a different story, and is 100% mandatory, but that's all in the enterprisy outlook world...

Re:Google Chrome Keystone is modifying /var symlink on non S... by nicoburns on Wednesday September 25, 2019 @04:26AM (#21068861)
WhatsApp or Facebook Messenger. The only personal emails I receive nowadays are from my parents, and people travelling abroad without reliable internet connections.
Re:Google Chrome Keystone is modifying /var symlink on non S... by cortesoft on Wednesday September 25, 2019 @01:10AM (#21067799)
Work is mostly slack, personal life is mostly text messages
Re:Google Chrome Keystone is modifying /var symlink on non S... by jeremija on Tuesday September 24, 2019 @08:29PM (#21066295)
I've been thinking about migrating away from GMail for a while now. Are you self hosting your email now, or are you using a provider like ProtonMail? Just curious
Re:Google Chrome Keystone is modifying /var symlink on non S... by osamagirl69 on Wednesday September 25, 2019 @09:20AM (#21070472)
not GP either, but I did the same and migrated to Fastmail. The transition was extremely smooth, and at least for now gmail allows you to set up integration (either forwarding rule or remote retrieval through IMAP) to forward you old e-mail to fastmail. I have it set up to auto tag all incoming gmail mail and move it into a folder that I check occasionally to see if anything interesting came through.

One amazing advantage to using fastmail (or really any real e-mail provider) is that it is trivial to set it up to use your own domain for e-mail, and to do catchall addresses for your domain. I use this feature heavily, using the general strategy of giving every service a different e-mail address. In this way I can sort by incoming to field, and block out anyone who sends spam using rules acting on the to field. This does an amazing job of sorting out things like mailing lists that keep re-adding you or that are worth monitoring but aren't worthy of showing up in my inbox.

Re:Google Chrome Keystone is modifying /var symlink on non S... by dewey on Tuesday September 24, 2019 @09:02PM (#21066511)
Not GP but I did my migration with the same steps from Google Apps to Fastmail. They even have a nice importer that works well.
Re:Google Chrome Keystone is modifying /var symlink on non S... by w0utert on Friday September 27, 2019 @02:40AM (#21089097)
>> Are you self hosting your email now, or are you using a provider like ProtonMail?

I switched to FastMail, and and added an MX record for the domain I already had to alias the mail adres to that domain. So now I could easily switch to some other e-mail provider at any time in the future. But I’ve been totally happy with FastMail so far.

I did consider self-hosting but decided it’s just too much of a hassle to get decent spam filtering and security set up.

Re:Google Chrome Keystone is modifying /var symlink on non S... by leokennis on Thursday September 26, 2019 @04:35PM (#21085240)
My 2 cents. Use your own domain. It’s really cheap and now you own your email address and can move it to another provider whenever you like.

Setting it up in Fastmail is super easy if your halfway computer literate. It literally says what DNS records you need to creat.

Importing your Gmail emails is even easier: log into Gmail from within the Fastmail options. Grant access. Now it’ll import all your mail in the background.

Re:Google Chrome Keystone is modifying /var symlink on non S... by Marsymars on Tuesday September 24, 2019 @10:39PM (#21067065)
> Yeah, I removed Chrome precisely because it kept re-adding its crap to the login sequence.

This, and forced auto-updates were exactly what finally led me to entirely removing Chrome from all my systems.

> (I would have to update hundreds of accounts).

I actually have been doing this for the past couple months. It wasn't too bad, just time consuming. I took the opportunity to request account closures for every account that I don't expect to use in the future.

Re:Google Chrome Keystone is modifying /var symlink on non S... by masklinn on Wednesday September 25, 2019 @02:48AM (#21068353)
> Yeah, I removed Chrome precisely because it kept re-adding its crap to the login sequence. It really drove home the notion that Google will not respect any boundary or privacy - your machine is their machine, your data is their data, and screw you if you don't agree.

Exactly this. Chrome was never my main browser, but though it's useful for testing web dev I just nuked it from the system once I realised it kept trying to find new ways around my deactivation and / or removal of keystone. That was several years back.

Re:Google Chrome Keystone is modifying /var symlink on non S... by mtsr on Wednesday September 25, 2019 @04:07AM (#21068769)
First step for moving email from any provider is getting your own domain name. All decent providers allow it and it’s not hard to set up.

You will never have to update any accounts with new email addresses ever again.

Re:Google Chrome Keystone is modifying /var symlink on non S... by Scapeghost on Tuesday September 24, 2019 @08:42PM (#21066391)
iCloud mail + the default Apple Mail app has worked fine enough for me for a decade.

What does Gmail offer that you can't get on other services? (honest question)

Gmail's mandatory phone number requirement upon registration and inability to get unique aliases (iCloud allows 3, so you can have 4 addresses per account at a time, and without the "baseaddress+" prefix which self-defeats the point of an alias) turns me off right at the start.

Re:Google Chrome Keystone is modifying /var symlink on non S... by Marsymars on Tuesday September 24, 2019 @10:41PM (#21067077)
> Gmail's mandatory phone number requirement upon registration

It's not always mandatory. I don't know what the heuristics are, but I've managed to create a couple new Google accounts (non-gmail, for dev purposes) during the past couple weeks without them being tied to a phone number.

Re:Google Chrome Keystone is modifying /var symlink on non S... by nine_k on Wednesday September 25, 2019 @12:46AM (#21067684)
What I can't seem to get elsewhere: tags.

Folders don't cut it.

Re:Google Chrome Keystone is modifying /var symlink on non S... by prepend on Wednesday September 25, 2019 @02:24AM (#21068219)
Gmail doesn’t give me tags.
Re:Google Chrome Keystone is modifying /var symlink on non S... by nine_k on Wednesday September 25, 2019 @10:49AM (#21071307)
They are named "labels".
Re:Google Chrome Keystone is modifying /var symlink on non S... by prepend on Wednesday September 25, 2019 @02:13PM (#21073509)
Thanks. Sorry, I was wrong. I got gmail and gdrive mixed up.
Re:Google Chrome Keystone is modifying /var symlink on non S... by techslave on Tuesday September 24, 2019 @10:02PM (#21066842)
> What does Gmail offer that you can't get on other services?

whitespace. precious, precious whitespace

Re:Google Chrome Keystone is modifying /var symlink on non S... by Shank on Tuesday September 24, 2019 @08:46PM (#21066418)
This is the one thing I wish Apple would solve in a new version of macOS. There are so many ways to automatically start software, and I would love a more built-in way to manage what can start with the system. They have login items, but that's an incomplete list. I recently _gave up_ trying to remove Dropbox because its auto-updater kept coming back after removing seemingly all possible places where it was stored.

Apple is willing to inundate users with permission prompts for microphone, location, and disk access. Why not the ability to start with the system?

Re:Google Chrome Keystone is modifying /var symlink on non S... by Scapeghost on Tuesday September 24, 2019 @08:55PM (#21066466)
Yes, it's one of the first things that befuddled/frustrated me on macOS after coming from Windows (not that that was much better).

Dropbox apparently also used to show you a fake system password dialog which saved your administrator password, and more:

https://hn.algolia.com/?q=dropbox

Re:Google Chrome Keystone is modifying /var symlink on non S... by ryandrake on Wednesday September 25, 2019 @02:26AM (#21068231)
It looks like Dropbox still tries [1] to abuse [2] Accessibility services in order to gain increased access to things on your computer that applications typically shouldn't need access to. Accessibility services are for helping blind people use your software, not for your software to run roughshod all over my system. Jeez!

1: https://help.dropbox.com/installs-integrations/desktop/mac-p...

2: https://applehelpwriter.com/2016/07/28/revealing-dropboxs-di...

Re:Google Chrome Keystone is modifying /var symlink on non S... by colatkinson on Wednesday September 25, 2019 @03:14AM (#21068487)
This isn't entirely accurate. The hack that they used (writing creds directly into the TCC db instead of using the official dialog) was closed by Apple in High Sierra I believe (might've been Mojave? I can't remember atm). Regardless, now they use the official prompt. Of course, while Apple went to the trouble of SIP protecting the TCC db, they didn't actually fix the API for getting Ax permissions, and it's still a massive pain to get it even remotely right.

As for what they're using accessibility for, I believe the official primary use case is tighter integration with the Office suite (e.g. showing users if anyone else has the doc open). So nothing exactly malicious.

This isn't anything new. Keep in mind that Dropbox was offering sync status icons for years before Apple finally created an official API for doing so. IIRC that was using an even dirtier hack, involving monkey patching Finder at runtime. I'd definitely count that as a useful feature as well, and one that Apple had no interest in supporting until it became a user expectation.

I've got no affiliation with Dropbox, and I can definitely see the concern over the TCC hack. But once you try to do any meaningful integration with macOS, you do begin to sympathize. The official APIs are limited, flaky, and prone to deprecation at a moment's notice (see Quicklook plugins in Catalina for a fresh example). And Apple, despite making it impossible for third parties to innovate in their ecosystem, gets to paint themselves as saints.

Security is paramount, of course, but needlessly restricting how users and developers can use the OS will either lead to even dirtier hacks, or only Apple apps being allowed to do new, interesting things. And I don't particularly like either option.

Re:Google Chrome Keystone is modifying /var symlink on non S... by ymolodtsov on Thursday September 26, 2019 @04:09AM (#21079122)
A number of respectable apps uses Accessibilty features, for instance Alfred.
Re:Google Chrome Keystone is modifying /var symlink on non S... by Shank on Tuesday September 24, 2019 @09:05PM (#21066541)
> not that that was much better

At least on Windows, I could with confidence say that Sysinternals Autoruns + Process Hacker would get you 99.9% of the way. I too went from Windows to macOS, and I tried countless tools (Lingon X, CleanMyMac, App Cleaner, App Cleaner & Uninstaller Pro, etc.) to no avail in my quest to kill Dropbox.

Re:Google Chrome Keystone is modifying /var symlink on non S... by fortran77 on Wednesday September 25, 2019 @08:41AM (#21070175)
Agreed! The Macs are still a crazy mess. Not that much different from the old days with chains of Inits.
Re:Google Chrome Keystone is modifying /var symlink on non S... by apostacy on Wednesday September 25, 2019 @12:02AM (#21067486)
At least with Dropbox, they needed that access to modify menus and make changes to benefit the user. And they also made it clear that this is what they needed it for.

When Google does it, they are just elbowing their way into your computer.

I really wish there was a way I could revoke an App's ability to request access.

Re:Google Chrome Keystone is modifying /var symlink on non S... by jbverschoor on Wednesday September 25, 2019 @01:11AM (#21067802)
Which I don’t want or need. They gave no respect for your system.
Re:Google Chrome Keystone is modifying /var symlink on non S... by pilif on Tuesday September 24, 2019 @11:17PM (#21067273)
Back then it turned out the password dialog wasn't fake but was the standard OS dialog apps can request sudo access with. The text in the dialog is app-customizable.
Re:Google Chrome Keystone is modifying /var symlink on non S... by api on Tuesday September 24, 2019 @10:49PM (#21067116)
A lot of these things are hacks to streamline user experience.
Re:Google Chrome Keystone is modifying /var symlink on non S... by ratww on Tuesday September 24, 2019 @09:46PM (#21066764)
I remember a few months ago when Google Cloud was offline and people made a room on Zoom to discuss it. Just clicking on a link opened the Zoom app, because it had installed a daemon behind my back. Considering it's an app with microphone access, I was VERY concerned when it happened.

I might be saying that to the wrong audience, but I think Apple is being overly cautious not to bother developers and power users at the expense of security on the desktop. Not as if other OSs are better – just this week my flash drive came back with a Windows virus after I sent it to a print shop –, but still.

In this specific case it shouldn't be possible to run without SIP outside of safe mode IMO, but it's still possible because some people need to run unsigned kexts and other hacks.

It's the same thing with the sandbox. I've seen a lot of developers making excuses not to publish on the App Store because they need things like unlimited access to home directory for whatever reason and the sandbox restricts them. Last excuse I saw was "we need to scan for subtitles". Yeah, right.

Re:Google Chrome Keystone is modifying /var symlink on non S... by Scapeghost on Tuesday September 24, 2019 @10:28PM (#21066997)
> Last excuse I saw was "we need to scan for subtitles". Yeah, right.

Yeah, that's not even a valid excuse! Once a user manually selects a file, the macOS sandbox also gives an app access to any "associated" files like subtitles, automatically:

https://developer.apple.com/library/archive/documentation/Se...

(search for "subtitle" on that page)

Re:Google Chrome Keystone is modifying /var symlink on non S... by saagarjha on Tuesday September 24, 2019 @11:13PM (#21067244)
Note that the file name has to match exactly for this to kick in.
Re:Google Chrome Keystone is modifying /var symlink on non S... by whatusername on Tuesday September 24, 2019 @11:22PM (#21067302)
Re:Google Chrome Keystone is modifying /var symlink on non S... by ratww on Tuesday September 24, 2019 @11:36PM (#21067365)
That was discovered a short time after I noticed the rogue daemon myself!

Let me try to explain better: There was a thread here in HN about a Google Cloud outage and someone posted a link to a Zoom conference. I noticed that their app was still installed after clicking the given link. This happened to other people too:

https://news.ycombinator.com/item?id=20077805

I wonder if it's a coincidence!

Re:Google Chrome Keystone is modifying /var symlink on non S... by sterlind on Wednesday September 25, 2019 @12:30AM (#21067609)
In a limited way, Windows is better about this sort of thing. System integrity checks (checksums of critical files) can't be disabled, only defeated. All drivers must be signed or you have to enable test signing mode, which requires a reboot and puts annoying text permanently in the corner of the screen.

...but you can still delete whatever you want out of System32 (though it may grow back), and you can add your own things, and dll hijacking is an issue etc. Just when it comes to kernel code are the protections better.

Re:Google Chrome Keystone is modifying /var symlink on non S... by ratww on Wednesday September 25, 2019 @12:43AM (#21067671)
I vaguely remember Microsoft pissing off a lot of device makers and users with Vista because it started requiring signed drivers.

I might be remembering it wrong, but I thought it was definitely a good thing and definitely a step forward.

I wish that would happen more often. With so many things moving to the web there's not that many excuses left to sacrifice security and stability for backwards compatibility.

Re:Google Chrome Keystone is modifying /var symlink on non S... by LgWoodenBadger on Wednesday September 25, 2019 @10:43AM (#21071233)
Are you referring to the same Apple that pushed a silent update to REMOVE the hidden Zoom server?

https://news.ycombinator.com/item?id=20407233

Re:Google Chrome Keystone is modifying /var symlink on non S... by ratww on Wednesday September 25, 2019 @02:51PM (#21073931)
Well, I'd expect the "Malware Removal Tool" to remove malware/backdoors in the first place.

But my point is that Zoom shouldn't even have been able to install that server on my system in the first place. It's my computer, so I should have been asked before. Same for Google Keystone Updater.

Re:Google Chrome Keystone is modifying /var symlink on non S... by dreamcompiler on Wednesday September 25, 2019 @12:49AM (#21067694)
Dropbox is my next war on this front. The difference with Dropbox is it pretty much has to be running all the time to be useful, which means it has much more power than Chrome to be an unkillable auto-updater.
Re:Google Chrome Keystone is modifying /var symlink on non S... by zadokshi on Wednesday September 25, 2019 @04:06AM (#21068764)
Considering that Dropbox appears to be a CIA tool to enable snooping on people’s computers masquerading as a file sharing service, I would be surprised if there is anyway to completely safely remove it at all.
Re:Google Chrome Keystone is modifying /var symlink on non S... by chrisweekly on Wednesday September 25, 2019 @07:39AM (#21069722)
Citation? Please/thanks
Re:Google Chrome Keystone is modifying /var symlink on non S... by boardwaalk on Tuesday September 24, 2019 @09:55PM (#21066814)
I'm not even quite sure why Google does it. Can't they just check and fetch updates while Chrome is open? What's it matter if Chrome is out of date if it isn't running? Are they trying to push off updates to the middle of the night or something? That doesn't really make sense, since people probably mostly leave their browser open anyways.

I had Chrome installed "just in case" (mainly for the dev tools for the rare occasion I do web dev) and I just uninstalled it and the updater. It's not worth the surface area...

Now to get around to nuke all this junk that Citrix Receiver installs. Ugh.

Re:Google Chrome Keystone is modifying /var symlink on non S... by cbsmith on Tuesday September 24, 2019 @10:09PM (#21066878)
It's a better way to mitigate against zero days in the browser, where you might get exploited even before you find out the browser is out of date.
Re:Google Chrome Keystone is modifying /var symlink on non S... by apostacy on Wednesday September 25, 2019 @12:07AM (#21067507)
While that is true, I do not believe that is why they are doing it that way. There's nothing stopping them from giving some minimal feedback that an update happened. It would actually be better that they did.

It is also suspicious how set they are so against users using an older version of their browser. Security is not a good enough justification. It is actually easier to use an older Operating System than an older version of Chrome.

This is clearly just to protect the integrity of their platform.

Re:Google Chrome Keystone is modifying /var symlink on non S... by kevingadd on Wednesday September 25, 2019 @04:50AM (#21068942)
What kind of zero-day does this protect against that wouldn't be blocked by an at-launch-time update check like most regular software uses? If anything, at-launch-time is better because Keystone's last update check might have been 2 hours before the 0day patch came out, but at-launch-time would check immediately and notice.
Re:Google Chrome Keystone is modifying /var symlink on non S... by Already__Taken on Wednesday September 25, 2019 @07:17AM (#21069604)
at-launch check would obviously delay launch. Users do not want chrome to start slower I thought this would be obvious.
Re:Google Chrome Keystone is modifying /var symlink on non S... by nothis on Wednesday September 25, 2019 @08:34AM (#21070127)
>but sadly Google Search and YouTube still don't have good enough alternatives yet.

I thought that, too, but then I held my breath and just switched to DuckDuckGo as my main search engine and... there's no difference, really. Maybe some niche cases where google spits out more specific results and handles exact quotes better. But for 99% of "type a word, get results" kind of uses, it works great. I did not expect that, maybe still burnt from when Google was so far ahead of the competition in search it wasn't even a question.

Youtube is a different story but I don't really miss anything not logging in, so there's that.

Re:Google Chrome Keystone is modifying /var symlink on non S... by narrator on Wednesday September 25, 2019 @08:40AM (#21070164)
If duckduckgo doesn't do a good search you can always type "g! <search>" and it will search using google. I usually search duckduckgo first and then fall back to Google. The thing that made me quit google was the "controversial twiddler"[1] and their delisting of non corporate health sites[2].

[1]https://news.ycombinator.com/item?id=20723327

[2] https://news.ycombinator.com/item?id=20676755

Re:Google Chrome Keystone is modifying /var symlink on non S... by jvzr on Thursday September 26, 2019 @02:39AM (#21078784)
I've been using DDG for literal years now, and whenever (rarely) I use Google for a search, I'm completely befuddled by Google Search's user experience. There's stuff everywhere: vertical lists, horizontal lists, thumbnails, chevrons, cards, blocks, drop shadows. DDG is just no-nonsense: a list of web results, like Google was then. For that alone, it wins my heart. Though, privacy is the main reason I use DDG.
Re:Google Chrome Keystone is modifying /var symlink on non S... by sneak on Tuesday September 24, 2019 @07:20PM (#21065753)
Yeah, the Google autoupdater’s insistence on reinstalling itself to maintain RCE on my machine even after being explicitly removed is really irksome.
Re:Google Chrome Keystone is modifying /var symlink on non S... by techslave on Tuesday September 24, 2019 @10:00PM (#21066831)
interesting that apple brought the hammer out for zoom but doesn’t do that for chrome
Re:Google Chrome Keystone is modifying /var symlink on non S... by universenz on Wednesday September 25, 2019 @02:38PM (#21073794)
You should check out BlockBlock[1] by the cool dudes at Objective-See..

"Malware installs itself persistently, to ensure it's automatically re-executed at reboot. BlockBlock continually monitors common persistence locations and displays an alert whenever a persistent component is added to the OS."

[1] https://www.objective-see.com/products/blockblock.html

Re:Google Chrome Keystone is modifying /var symlink on non S... by bluedino on Tuesday September 24, 2019 @08:17PM (#21066210)
Google's update service was the cause of my Mac not waking up from sleep. :(
Re:Google Chrome Keystone is modifying /var symlink on non S... by fpgaminer on Wednesday September 25, 2019 @02:27AM (#21068236)
Any details? My Mac sometimes won't wake (eventually k-panics). Curious if I'm falling prey to the same thing...
Re:Google Chrome Keystone is modifying /var symlink on non S... by bluedino on Wednesday September 25, 2019 @08:25AM (#21070064)
Do your logs mention it (open the Mac console app)?
Re:Google Chrome Keystone is modifying /var symlink on non S... by _bxg1 on Wednesday September 25, 2019 @10:07AM (#21070895)
In fairness, having a less-than-up-to-date web browser or OS is quite dangerous from a security perspective. I'm extremely glad that today's browsers patch themselves in the background.
Re:Google Chrome Keystone is modifying /var symlink on non S... by jasonvorhe on Wednesday September 25, 2019 @06:24AM (#21069351)
You hate software with a big more than malware?
Re:Google Chrome Keystone is modifying /var symlink on non S... by crushingcrash on Tuesday September 24, 2019 @07:46PM (#21065976)
Agreed with you 100% - I also hate the nonstandard window GUI interface elements (tabs in the title bar, fuck outta here!) and the really horrific preferences pane. Chrome is a dumpster fire.
Re:Google Chrome Keystone is modifying /var symlink on non S... by human20190310 on Tuesday September 24, 2019 @08:18PM (#21066219)
I like Chrome for Javascript development/debugging, but I don't use it for anything else.
Re:Google Chrome Keystone is modifying /var symlink on non S... by fmajid on Tuesday September 24, 2019 @08:44PM (#21066406)
Use Vivaldi instead.
Re:Google Chrome Keystone is modifying /var symlink on non S... by dewey on Tuesday September 24, 2019 @09:02PM (#21066516)
Why not Firefox?
Re:Google Chrome Keystone is modifying /var symlink on non S... by PikachuEXE on Wednesday September 25, 2019 @05:36AM (#21069151)
or Brave (for debugging only)
Re:Google Chrome Keystone is modifying /var symlink on non S... by minusf on Thursday September 26, 2019 @07:10AM (#21079857)
I use iridium.
Re:Google Chrome Keystone is modifying /var symlink on non S... by techslave on Tuesday September 24, 2019 @09:59PM (#21066827)
my #1 UI hate is single click in omnibar selects all. WTF
Re:Google Chrome Keystone is modifying /var symlink on non S... by crushingcrash on Wednesday September 25, 2019 @06:57PM (#21076507)
I hate how they have this "Hold Command-Q to quit.' FUCK that.