Existing users, log in.  New users, create a free account.  Lost password?

Mac OS X  |  Home / Education  |  Math / Science  |  Google Earth  |  People hinting how to remove the injected updater misses the point

Google Earth

Google Earth

View satellite imagery, maps, terrain, 3D buildings, geographical content.

Version:  5.1.3533.1731

   [ Views: 161 ]

People hinting how to remove the injected updater misses the point

Feedback Type:  Commentary

Contributed by: Ilgaz Friday, May 08 2009 @ 03:53 PM PDT

Product Platform: MacOSX

Used Product For: Over One Year

Guys, if someone is knowledgeable enough to figure a admin owned launchd process running every 2 hours, he sure knows how to remove it and thanks to Unix/launchd logic, it is relatively easy even for Google megalomaniacs.

The issue here is the attitude... "We will install an updater which will run as root owned process every 2 hours. If it is not good with you? Go away, you can't use our free software you beggar".

The reason of updater being coded instead of using de-facto standard Sparkle framework which everyone uses? Is it because Google has too much money in hand looking to waste it re-inventing the wheel? It is not just that! Mr. Google has some nice plans for us and they want some update framework which can also update... kernel drivers! For example, Apple is such a moron to run "software update check" as normal (non super) user, they don't know a thing! Sparkle original coder and contributors didn't have this neat idea of running SUID binaries on a Unix system just to check updates.

It took 20 years to really take off and 5-6 years for Microsoft to gain everyone's (including their customers) hate but for Google, it could be very fast... Just like they took off very fast. Landing could be same speed too and it won't be comfortable for them.

For people wondering where "keyhole" like terminology comes? Well, Google Earth was originally "Keyhole" application funded by CIA. Choosing _this_ application to force a updater installed should be used in PR classes as a lesson about how to make your users super paranoid. It is not spyware though. It is just a huge, stupid security risk. Nr. 1 rule on security is, never run anything as super user unless it is definitely needed _and_ enabled by user. Look to "Sharing" prefs of OS X, you will see Apple has disabled them by default. It is not like Apache will be hacked just by showing a homepage, it is just running it without need and opening a socket to internet as superuser is a stupid, needless security risk.   

6 of 7 users found this helpful.

Rate this Commentary

Was this Commentary helpful? Yes | No

Comments

0 comments |

No user comments.