Re: [qubes-users] Re: Announcement: New community forum for Qubes OS users!

… Google earns almost all their money
by selling user data / presenting advertisements. …

Even if the engineers working on their products have good motivations,
as a publicly traded corporation Google’s goals are ultimately
maximizing “shareholder value”… which you can see by them making
compromises for suppressive states (China et al). The same is true for
any corporation including Apple.

I’m not so clued-in about the mechanics behind publicly traded corporations, but I would have thought that maximising profits (which perhaps is what you are implying) is the only goal. Some businesses can sacrifice profits for a certain set of ethics…

Chrome OS is cheap and sufficient enough for this particular set of
low-stake needs I have.

That’s perfectly fine. …

What I want to provide is an explanation why people in this forum – who
care a lot about both security and privacy – have a particular dislike
for surveillance capitalistic superstars like Google, Microsoft and
Facebook. The basic (lack of) trust argument can be made about all
non-open technology.

Whilst there is a relationship between privacy and security, increasing security doesn’t necessarily mean that you increase privacy. Your arguments against Google seem to be significantly in relation to privacy, but sometimes security can be increased at the cost of losing privacy.

The cloud-based aspect of Chromebooks means that in those situations where you don’t consider you have much local on-site security, you can gain extra security by keeping things in the cloud, and using cloud software. I cover some of the reasons why this is the case, in the “Sandboxing and cloud computing” section I wrote in the End-user Computer Security book hosted on Wikibooks (which can be accessed here).

Otherwise, Chromebooks can have security advantages because they use an open-source secure custom BIOS/UEFI known as Coreboot. Vendor-supplied OEM pre-installed closed-source BIOS/UEFI firmware can pose a security vulnerability–they can also be hard to replace with a custom firmware (which I’m particularly finding at the moment). Some info on the security aspects of custom BIOS/UEFI firmware can be found here.

That said, I definitely have security concerns over using the cloud. Keeping things on-site would probably be ideal in the case that you have strong on-site security.

Kind regards,

Mark Fernandes

Hi Mark,

I’ve read your wiki entries and enjoyed them–thanks for taking the time to share the information. I just want to clarify that Chromebooks do have local storage and that this can be completely isolated from the cloud (and usually is). This means I can choose not to be at the mercy of the cloud and the condition of my internet connection.

Also, I’ve been looking for evidence that Chromebooks generally have Coreboot installed several years ago before using Chromebooks and now after reading your article. I’ve failed to find any so far, aside from sites like MrChromebox that mentions older devices. I know that there are ARM Chromebooks, but from a business point of view I don’t really see why Google would feel the need to replace ME with Coreboot for the wide variety of CPUs in their devices (though I wish it were true).