thorium icon indicating copy to clipboard operation
thorium copied to clipboard

Does thorium have the hangout_services extension

Open viasux opened this issue 1 year ago • 7 comments

Add all the stuffz here https://x.com/lcasdev/status/1810696257137959018 It has and gives access to all *.google.com sites to see personally identifying information, and is default in chromium. I am curious if it's in Thorium.

viasux avatar Jul 10 '24 00:07 viasux

We did not shut down or delete this service.

gz83 avatar Jul 10 '24 01:07 gz83

Thorium should remove hangout spyware from its code.

Tarek-Hasan avatar Jul 12 '24 05:07 Tarek-Hasan

This extension is not enabled by default in non-chrome (controlled by a compile-time parameter) and has been used by Google for a long time, but Thorium has chosen to force the extension to be enabled for usability.

We will review whether it is still necessary to force-enable this extension later.

BTW, this extension is not spyware and the data it collects is not very sensitive. Please be rational and dialectical when looking at online comments.

@Tarek-Hasan @viasux

gz83 avatar Jul 12 '24 07:07 gz83

This extension is not enabled by default in non-chrome (controlled by a compile-time parameter) and has been used by Google for a long time, but Thorium has chosen to force the extension to be enabled for usability.

We will review whether it is still necessary to force-enable this extension later.

BTW, this extension is not spyware and the data it collects is not very sensitive. Please be rational and dialectical when looking at online comments.

@Tarek-Hasan @viasux

Could you not do what brave does, where there's an option to have it enabled or disabled in the settings?

viasux avatar Jul 12 '24 17:07 viasux

@Tarek-Hasan @gz83 @viasux Probably going to either make it disable-able, or remove it and instead offer it as a .crx that can be installed manually, since most people don't need it, and it does have some privacy concerns, due to it sharing more system info data than other extensions are normally allowed.

Alex313031 avatar Jul 15 '24 15:07 Alex313031

Brave's statement on this matter - https://x.com/brave/status/1811129059687997444

Tarek-Hasan avatar Jul 24 '24 21:07 Tarek-Hasan

@gz83 @Tarek-Hasan @viasux I decided to disable it for all platforms except Android (where it is still used heavily since alot of people use Hangouts and Chrome/Chromium/Thorium can use this to hook into it).

All desktop platforms in the next release will have it disabled by default, HOWEVER, I extracted the source code, made a few tweaks, and it is now present here > https://github.com/Alex313031/thorium/tree/main/infra/hangout_services

I will eventually build a .crx and place it in the repo with a link to download in the release notes. This will allow people who depend on the extension to still manually install it. Files other than the manifest.json should not be tampered with however, because then the UUID of the extension will change, and Chromium gives special permissions to this extension only by having it match the UUID that is hard coded in the source.

Alex313031 avatar Jul 30 '24 01:07 Alex313031