Slashdot Mirror
Google Chrome Developers On Browser Security
CowboyRobot writes "Developers of Google's Chrome browser have spoken up in an article describing their approach to keeping the browser secure, focusing on minimizing the frequency, duration, and severity of exposure. One tool Chrome uses is a recently open-sourced update distribution application called 'Omaha.' 'Omaha automatically checks for software updates every five hours. When a new update is available, a fraction of clients are told about it, based on a probability set by the team. This probability lets the team verify the quality of the release before informing all clients.'"
So basically, they're getting a random sample of their user base to beta test updates in the wild for them. I hope there's some kind of warning about this while using it.
Canada: The US's more awesome sibling.
I thought Google's motto was 'Be Not Evil'?
Now if they could stop running googleupdate crap ALL THE TIME (maybe use the OSs built in scheduling system to run every so often) and give me more control over when/how things get updated it will be much better.
Wake me when there is a Qt4 fork of Chromium, or a version of Rekonq that implements Chrome's separate process model.
http://blindscribblings.com - Tasty pop-culture in conceptual fashion.
Any time you release a new version of software, there's an increased likelihood that there will be unforeseen bugs not specifically tested for. You can test tell you're blue in the face, but no matter how you look at it, real-life is the real test.
And it's not just bugs. Even when things are working exactly to plan, you don't necessarily want to roll it out everywhere all at once.A good example is our password-change policy - we now require periodic changes in passwords. When we did this, requiring everybody to change their password, we did it "gracefully" over a month's time so that the help desk wouldn't be overwhelmed by idiots who don't understand the idea of changing their password.
It's pretty sad that something so simple would cause people to freak out, but it does, and that's just humanity. Get over it, already. People are people, and it's easier to spread the work out over a period of time rather than just beat yourself up all at once.
Gradual roll-out is a *good thing* unless it's a terrible security issue that must be addressed immediately.
I have no problem with your religion until you decide it's reason to deprive others of the truth.
One tool Chrome uses is a recently open-sourced update distribution application called 'Omaha.' 'Omaha automatically checks for software updates every five hours. When a new update is available, a fraction of clients are told about it, based on a probability set by the team. This probability lets the team verify the quality of the release before informing all clients.'"
TO:
One tool Chrome uses is a recently open-sourced update distribution application called 'Obama.' 'Obama automatically checks for software updates every five hours. When a new update is available, a fraction of clients are told about it, based on a probability set by the team. This probability lets the team verify the quality of the release before informing all clients.'"
Every 5 hours?
Fraction?
Probability?
Set by the developer?
Verify the quality?
Yeah, no thanks.
I want updater services to DIE.
Check for an update when I launch your program, and give me the option to turn it off.
Don't run in the background all the time.
Give me the option to manually check for updates.
If there are updates, list them and let me choose whether not to install them. Also supply details about the update, preferably without making me launch your web page.
Tell me which updates will require restarting the program. Tell me how large they are. Give me the option to download now, and install later.
Quality test the fucking updates yourself.
All users should be able to get the update at the same time, with a probability of 1.
Microsoft say that Internet Explorer 8 is the secure browser!?! Plus much more: http://www.microsoft.com/windows/internet-explorer/get-the-facts/browser-comparison.aspx
...is that verifying the veracity of frequent update requests will grow tiresome and people will just click "Ok" without thinking. It'll be easy for an attacker to spoof their popup or whatever they use for notification and attach a malicious download. Even better the attacker can have the update "require your password" before proceeding and look ligit.
NEVER ok a software update unless you've initiated the "check for updates" yourself.
One of the things the Chrome developers forget to mention all the time is that Chrome only works on x86 and arm CPUs (due to the proprietary V8 JS engine and the sandboxing system). I will continue using Firefox, thanks.
And get into HTML5 for video etc:
"Google Chrome must support plug-ins such as Flash Player and Silverlight so users can visit popular Web sites such as YouTube. These plug-ins are not designed to run in a sandbox, however, and they expect direct access to the underlying operating system. This allows them to implement features such as full-screen video chat with access to the entire screen, the userâ(TM)s webcam, and microphone. Google Chrome does not currently run these plug-ins in a sandbox, instead relying on their respective vendors to maintain their own security."
Version2 of Chrome is STILL terrible from the first release i used back when it appeared on the dev channel.
Doing something as simple as opening up the Bebo homepage (lol) rockets my D-C (1.7Ghz) up to 90% across both, sometimes 100%, interrupting all other tabs and even other applications!
In fact, it happens pretty much with any site, besides the more simpler sites with just HTML.
I think the only explanation is that new Full Page Zoom crap, the most useless feature ever. I don't give a damn about consistent zooming, if i did, i would ENABLE it, but i don't.
It only seems to happen when a page is loading, yes, read that again, when a page is loading, so even if some server on the other end is taking a year to reply to me, the CPU is using 90-100% until it is finished!
This simply will not do. They have lost me now. Fuck V2.
I will stick with V1 (in a sandbox, "yo dawg" blah blah etc) until they decide to get their damn act together, Version 2 is still unacceptable for a release. I know you guys said you were going to start going away from the whole Permanent Beta thing, but JESUS, calm the beans a little, you're acting as if you're on steroids or something. (literally, not being able to think and releasing sloppy inefficient code)
And a bigger kick in the teeth is the fact that Multi-Profiles missed this launch. ALSO, scrolling is still quite bad, including some strange offset that is generated on middle clicking. (which was the same with flash on right clicks, but the Flash offset was several hundred pixels.)
A similar thing happened with Mozilla and Firefox releases, adding useless features at the sacrifice of SPEED and MEMORY.
Don't become the next Mozilla, please don't become the next Mozilla, they ruined Firefox, they horribly done it wrong every release that requires developers to update their code almost all the time because they keep screwing around with stuff that should be 100% static.
"opening up the Bebo homepage (lol) rockets my D-C (1.7Ghz) up to 90% across both, sometimes 100%, interrupting all other tabs and even other applications!"
..
Hadn't noticed here on this 768MB ~2992 Mhz machine
"Internet Explorer 8 takes the cake with better phishing and malware protection, as well as protection from emerging threats"
"Firefox and Chrome have more support for emerging standards like HTML5 and CSS3, but Internet Explorer 8 invested heavily in having world-class, consistent support for the entire CSS2.1 specification"
"Internet Explorer 8 is more compatible with more sites on the Internet than any other browser"
At least those other browsers give you a choice of whether to update. Chrome defaults to applying updates and doesn't even inform the user that they have been applied. There is a mechanism for changing this behavior, but it's convoluted and outside of Chrome itself and I think it's Windows-only.
Can you imagine the /. thread if Microsoft decided to force all users to silently install updates to IE?