News for hackers. Stuff that matters.

A comment on Chrome Is Bad. Parent comment

Re:Chrome Is Bad by masswerk on Saturday December 12, 2020 @03:08PM (#25401200)
I remember quite well the Google update process being notorious for evading Little Snitch firewall rules. It popped up every intervall as if it were a new (unseen) process. There's definitely something going on with the app signature. (Haven't used Chrome for some time by now.)
[ Parent | on HN ]
Re:Chrome Is Bad by comex on Saturday December 12, 2020 @03:44PM (#25401536)
I am curious why that happens. From some Googling it seems like the updater copies itself to a random directory each time it runs [1], and I guess Little Snitch classifies programs by their full path, so it sees it as a new program each time.

Copying itself is odd and probably suboptimal behavior, but it is explainable without assuming malice: my guess is that it’s related to some kind of “before we update let’s update the updater” bootstrapping logic. I could be wrong, but IIRC the updater code is open source, so it should be easy to find out.

[Edit: Oops, it's actually not open source. Their Windows updater (Omaha) is open source, but their Mac one (Keystone) is not. Of course, one can still open the binaries in a decompiler.]

Regardless, moving a program around on disk, or even deleting the program while it’s running (which is possible on macOS), would not prevent it from showing up in Activity Monitor.

[1] http://www.reecefowell.com/2012/11/16/ksfetch-annoyance-on-m...

[ Parent | on HN ]
Re:Chrome Is Bad by masswerk on Saturday December 12, 2020 @04:15PM (#25401777)
> my guess is that it’s related to some kind of “before we update let’s update the updater” bootstrapping logic.

However, it happens (happened) specifically, if network access has been denied and there couldn't have been an upadate possibly received.

[ Parent | on HN ]
Re:Chrome Is Bad by _qulr on Saturday December 12, 2020 @04:24PM (#25401852)
I think the observation is just out of date now. "Haven't used Chrome for some time by now." At present, Little Snitch does just fine at blocking GoogleSoftwareUpdate.
[ Parent | on HN ]