Google Chrome Developers On Browser Security

CowboyRobot writes "Developers of Google's Chrome browser have spoken up in an article describing their approach to keeping the browser secure, focusing on minimizing the frequency, duration, and severity of exposure. One tool Chrome uses is a recently open-sourced update distribution application called 'Omaha.' 'Omaha automatically checks for software updates every five hours. When a new update is available, a fraction of clients are told about it, based on a probability set by the team. This probability lets the team verify the quality of the release before informing all clients.'"

Comments

Beta testers

[twidarkling]

So basically, they're getting a random sample of their user base to beta test updates in the wild for them. I hope there's some kind of warning about this while using it.

Re:Beta testers

[jayme0227]

It's certainly better than having the entire user base beta test the patch for them which is where we're at now in most cases.

Re:Beta testers

[RoFLKOPTr]

No, they're getting a random sample of their user base to test a ready-for-release patch so that in case there are a couple cases not within their testing scenarios where the patch is unstable or a security hole is present, they will be able to address that (if it's serious enough) before releasing it to the whole world. This is so much better than the current way of doing things, because patches are still tested in the shop to the same degree as they would be without Omaha, except this way there's even more to be sure that the patch works correctly.

Re:Beta testers

[ForAllTheFish]

I wish more companies would do this with patches. Historically, some non-trivial percentage of all patches (to some OS or software) also caused a new bug under some small percentage (like 10%) of the possible software configurations out there. It's better to patch, cause issues, and roll back on a few thousand users than a few hundred thousand. A week later, the quality for all users is the same.

Re:Beta testers

[siloko]

A bit passe to reply to your own posts but the mod is right. I started out writing a side splitter but the beer decided that it should turn into a troll post. Pints and posting do not mix! Buenas noches ;)

Re:Beta testers

[Brian Gordon]

I wish Google would fix its gaping security holes at all; I don't care how they do it. On my Gentoo Firefox 2 I'm invulnerable. On my XP Chrome, accidentally clicking an on.nimp.org link necessitates a hard power down. I'm paranoid about every click on Chrome.

Re:Beta testers

[Ash Vince]

So basically, they're getting a random sample of their user base to beta test updates in the wild for them. I hope there's some kind of warning about this while using it.

Since none of us actually read the licence agreement there probably is :)

Re:Beta testers

[bennomatic]

The methodology--i.e. random users--is not necessarily ideal, though. Wouldn't it be nice if there was a "labs" option in the browser so you could volunteer to be a guinnea pig? Then maybe after the early adopters, feed out the updates at a rate of 10% a day to hoi polloi.

Re:Beta testers

[hairyfeet]

But let us be fair here: How many fricking machines are running Windows? How many hundreds of thousands or even millions of different hardware and software configurations? Just in my home I have a 733Mhz, a 1.7Ghz laptop, my boys 2.6Ghz and 3.06Ghz, and finally the 3.6GHz I'm about to give the oldest, all running XP32, while I am running XP x64 on my new AMD dual. They all have hugely different hardware and software installed, yet somehow it just seems to work.

According to Wikipedia you are looking at a 400 million + install base for JUST XP, and then when you figure in that they are currently supporting Win2K Pro, WinXP 32/64, WinServer 2K3 32/64, and WinVista the idea that they could put out patches that wouldn't break something is just plain crazy. The fact that the "oops" patches only happen once or twice a year is frankly a miracle when you consider how many different possible combinations of software/hardware there can be on a Windows machine.

How many times have you see on the forums after the latest Ubuntu release "the update for foo completely hosed my (insert hardware here)"? I'm sure the Linux guys doing hardware driver support can tell you what a massive PITA it is trying to make sure an update doesn't totally hose something else, and still there are always problems. So considering the fact that unlike certain companies named after fruit I can put a machine together with so many different mish mashes of hardware together and actually have the thing work and run stable I think we can cut the guys at MSFT a little break when it comes to the occasional "oops" patch.

Re:Beta testers

[BikeHelmet]

Someone sure must hate me. Every post I made in the last day is modded troll.

According to Wikipedia [wikipedia.org] you are looking at a 400 million + install base for JUST XP, and then when you figure in that they are currently supporting Win2K Pro, WinXP 32/64, WinServer 2K3 32/64, and WinVista the idea that they could put out patches that wouldn't break something is just plain crazy. The fact that the "oops" patches only happen once or twice a year is frankly a miracle when you consider how many different possible combinations of software/hardware there can be on a Windows machine.

Usually a random person from MSFN submits fixes for whatever Microsoft breaks. I remember when they did a half-assed update pack for Win2k when ending support - but it broke more than it fixed. Someone on MSFN figured out how to fix it breaking hibernation and power management. Someone else repacked everything in service pack format.

Just think, rather than breaking 2 million Win2k computers, they could've broken only ~20,000 before detecting the problems, if they followed this train of thought.

Re:Beta testers

[BikeHelmet]

(Number inflation intentional; with something like an XP or Vista update, it'd hit many people than the Win2k update did.)

Re:Beta testers

[Lord Bitman]

Microsoft takes down those patches? I thought they just released advisories on unrelated pages.

Re:Beta testers

[hairyfeet]

Yes Linux works IF, and here is the really fucking big IF, you do research on every single fricking purchase from now until the end of the PCs life. That just cut out a good 95% of the population, including all of my customers. I said customers because yes, I build, repair and sell Windows PCs for a living, so yes I have installed more XP copies than you have had hot meals.

As for installing drivers? It takes about 20 minutes. How? by either using the Windows driver from Universal 2K/XP Driver DVD or Driverpacks. I personally prefer the driver pack from driverpacks.net because it is updates a little more often, but the first one has some of the more obscure drivers included, so it is nice to have both. And in case you haven't tried it lately Windows update actually includes most of the drivers for even slightly popular hardware, so often I don't even need the disc. Hoe much easier do you want?

Have you ever tried selling Linux boxes to REAL folks? I mean average Joes, not geeks with IT experience. I have, and I was looking at 600% return rates. I shouldn't have been surprised as MSI was looking at 400%. That kind of return rate will bankrupt me and therefor I won't be selling anymore Linux machines for at least 2 years. And before the Linux fanboys start modding me to hell or saying "get out of 1998 with your FUD" the last time was right after Ubuntu 9.04 came out.

Now lets have some REAL "get the facts" FACT-Support in Linux for consumer level hardware sucks. I'm sorry but it does and there is a REASON for that, and it ain't a MSFT conspiracy. It is because Linux is currently divided into two factions, and has been since Linux and RMS started snarking at each other. On the one hand you have Linus and the useability camp, and on the other RMS and "everything must be free!" hardcore believers that treat Linux as a religion and not just an OS. BTW, if you want to look it up(too fucking tired ATM) RMS uses a Loongson ARM Netbook because he refused to use a PC without even the BIOS being "free"! And unfortunately there are enough "true believers" to make sure you NEVER get even 1/3rd the driver support for Windows.

You see, if I am a hardware manufacturer I can write just 4 Windows drivers and have every consumer OS covered from 1998-2014, with ZERO out of pocket after the drivers have been written: I just have my guys write a Win98/ME, a Win2K/XP32, a WinXP64/Vista 64, and a WinVista32/Win732. Because Win7 can use WinVista drivers I have just covered every Windows users for 14 years with no more out of pocket. I simply can't do that on Linux? Why? Because the RMS believers will NEVER allow you to have a stable ABI in Linux, that's why. Because if there was a stable ABI Linux could actually have working binary drivers from all those companies that now refuse to support Linux, and frankly will continue to refuse to support Linux as long as you demand full hardware specs and code. Sorry, if the choice is opening our hardware and code and risking a patent troll lawsuit or not supporting Linux? Well then Linux don't get supported, just as it isn't now.

Finally for proof why Linux can't be sold to home consumers, I offer the "hairyfeet challenge" where I will prove to you beyond a shadow of a doubt that despite its flaws Windows beats Linux for home consumers and non IT types. Ready? From this moment on you are my consumer, who has just bought a Kubuntu box from me. You must NOT do research before you go shopping, because home users don't research anything than is less expensive than a car. Ready? Open three browser tabs. You are now three consumers who just bought Kubuntu. Now go to Walmart.com, Bestbuy.com, and Staples.com. Those are the big three for PC gadgets. Now buy these three items by putting them into your cart, which are the items that are most requested

Re:Beta testers

[The Archon V2.0]

Just think, rather than breaking 2 million Win2k computers, they could've broken only ~20,000 before detecting the problems, if they followed this train of thought.

I'm not arguing for or against your post, I just came here to say that 'tis a sad state of affairs when breaking 20,000 systems is presented as the better option.

Re:Beta testers

[BikeHelmet]

Well, there's clearly a problem. Why else would companies have IT people run extensive tests before upgrading the whole network? :P

If only 20k computers could be affected, worldwide, that'd be a huge improvement.

Re:Beta testers

[rantingkitten]

I dunno, dude. My sister lives in Israel and her laptop recently broke, so I offered to send her a new one as they are insanely expensive there and I had an old HP nx7400 lying around. What I did not have was a Windows disc of any kind, so I put Ubuntu on it for her. It installed in forty minutes with all the drivers working properly, including video, ethernet, wireless, and sound -- four things I've never seen work properly out of the box on any Windows install.

In Windows I always have to fuck around for an hour hunting down drivers, with a secondary computer, and looking up the specs on the computer to find out what hardware it has cause Windows sure ain't gonna tell me ("Unknown Device" isn't helpful, guys).

To be nice I loaded her computer up with some mp3s. I did this by using a free USB drive I got as a promotional item from the Camel girls that come round to clubs and bars hawking cigarettes. It's a cheap little half-gig piece of junk, and worked fine.

She's using this machine on a daily basis now, and having no problems. Her random-ass Brother printer worked when she plugged it in. I don't have to get calls from her every week about how her computer is "running slow" because of all the crapware she's downloaded. I don't have to deal with making sure her virus scanner is updated, and whether or not it even works (cause we all know they really don't). And once I showed her where Synaptic was she was fine with using that to get new programs -- and *I* don't have to worry about her downloading random, untrusted executables from god-knows-where on the web.

I don't know about TV tuners so I can't comment. What I do know is that my sister knows absolutely nothing about computers and is having zero problems using Ubuntu as her day-to-day OS, on a completely random computer I had lying around, with whatever completely random hardware she has lying around (her printers and USB sticks).

Now for a better scheduler

[Anonymous Coward]

Now if they could stop running googleupdate crap ALL THE TIME (maybe use the OSs built in scheduling system to run every so often) and give me more control over when/how things get updated it will be much better.

Re:Now for a better scheduler

[Anonymous Coward]

It _is_ killable - ironically, part of what you have to do is delete the job from the scheduler which restarts the damn thing every so often.

It could do with a more user friendly ticky box to turn it off, but it's not completely evil.

One thing I've never understood is why MS didn't expose the Windows Update facilities to other vendors (with user approval, of course.) A one-stop shop for updates a la Ubuntu's Update Manager would be a hell of a lot less messy, and it would actually work for people who do the Right Thing and don't run with Admin / Power User privileges.

Re:Now for a better scheduler

[EdZ]

If you have to open administrative tools and disable it's scheduled task just to turn it off, it's pretty damn evil. As is bundling it with every application, with no clean version available (or at least, no clean version that aren't buried in a forum link somewhere).

An anecdote: last time I installed Google Earth, I immediately ran the uninstaller for Google update (incidentally, the Google Earth installer makes no mention that it is installing the Google Updater for you). Not a few minutes later, Comodo is warning me that Google Updater is trying to access the internet. 3 killed process later, and no problems. Until about half an hour passes, and those processes are back again. Removing the scheduled tasks this time stopped the processes from returning.

Re:Now for a better scheduler

[eliphas_levy]

Here goes... If *I* know how to add a scheduled task to windows scheduler at install time (when I have the god-admin-rights) - how google does not? Oh yes, it knows... but it does not want it to be simple. Do no evil. I always put a (unchecked) .CMD file backup task to the whathever-install that I make. Could not google do the same? Yes.

Re:Russian Roulette Anyone?

[InsertWittyNameHere]

The "Don't Be Evil" policy currently only applies to a fraction of Google's userbase. Once they verify the quality of this policy they will release it to all users.

Don't Be Evil [BETA]

Wake me...

[Enderandrew]

Wake me when there is a Qt4 fork of Chromium, or a version of Rekonq that implements Chrome's separate process model.

Glass ($halfEmpty != $halfFull)

[mcrbids]

Any time you release a new version of software, there's an increased likelihood that there will be unforeseen bugs not specifically tested for. You can test tell you're blue in the face, but no matter how you look at it, real-life is the real test.

And it's not just bugs. Even when things are working exactly to plan, you don't necessarily want to roll it out everywhere all at once.A good example is our password-change policy - we now require periodic changes in passwords. When we did this, requiring everybody to change their password, we did it "gracefully" over a month's time so that the help desk wouldn't be overwhelmed by idiots who don't understand the idea of changing their password.

It's pretty sad that something so simple would cause people to freak out, but it does, and that's just humanity. Get over it, already. People are people, and it's easier to spread the work out over a period of time rather than just beat yourself up all at once.

Gradual roll-out is a *good thing* unless it's a terrible security issue that must be addressed immediately.

No Thanks

[sexconker]

Every 5 hours?
Fraction?
Probability?
Set by the developer?
Verify the quality?

Yeah, no thanks.

I want updater services to DIE.

Check for an update when I launch your program, and give me the option to turn it off.
Don't run in the background all the time.

Give me the option to manually check for updates.
If there are updates, list them and let me choose whether not to install them. Also supply details about the update, preferably without making me launch your web page.

Tell me which updates will require restarting the program. Tell me how large they are. Give me the option to download now, and install later.

Quality test the fucking updates yourself.
All users should be able to get the update at the same time, with a probability of 1.

Re:No Thanks

[Anonymous Coward]

The problem is if they do that, then 90% of the non-power user internet users won't EVER update. Which means security flaws are never patched. Which means they get a bad name for not fixing a problem that was patched 5 months ago.

I admit that patchers and automatic updaters are a real headache and I wish most of them would just die already... But the simple fact is I'm a power user. Most people (of which my brother is one) don't care. He would rather it handle his business for him cause it's one less thing he has to think about. (no I don't particularly understand this point of view but putting that aside)

Also, as another poster pointed out... They do test the updates, however, they cannot simulate EVERY situation or EVERY computer in existence. It's just impossible. A statistically small roll out makes sense and means that at any one given time, the chance you have to bear the burden of beta tester is minimized. To me, this is an acceptable situation however I would very much like it if they did what you suggested. I would love to have all the details about all the patches and updates immediately shown to me so I can choose what to do with them. However, in the long run, it's just not user friendly for the other 90% of the consumers.

Re:No Thanks

[Capt.DrumkenBum]

Sounds like someone needs to buy them self a Mac.

No webpage.
Can be told to bugger off when I am busy.
Tells me if an update requires restart.
Can for shutoff, and run manually if you insist.

Re:No Thanks

[sexconker]

Oh, Windows updates work just fine with regards to what I want.

It's the application updates I hate.

Adobe, Apple, Google, Java, etc. are all varying degrees of in your face, shitty options, shitty deployment routines, and outright ignoring my preferences.

Re:Russian Roulette Anyone?

[geobeck]

I thought Google's motto was 'Be Not Evil'?

Actually it's "Do no evil." So you can be as evil as you want, as long as you don't act on it. Even Dick Cheney could work for Google if he stopped... um, well... breathing.

Get the facts

[chainz]

Microsoft say that Internet Explorer 8 is the secure browser!?! Plus much more: http://www.microsoft.com/windows/internet-explorer/get-the-facts/browser-comparison.aspx

Re:Get the facts

[Thermionix]

this is quite seriously one of the most amazing pages I've ever read.

Microsoft believes that IE8 is the greatest browser that has ever existed, and that will ever EXIST, sure chrome, firefox and opera are mean to children, drown puppies and are generally horrible, but do they really deserve this??

I found the page may have at least had some truth, if everywhere Internet Explorer was said, you replaced it with opera.

Re:Geez, I complete misread this . . .

[sexconker]

How much do they pay Obama for this?

Re:Russian Roulette Anyone?

[Paaskonijn]

*Sigh* Here we go again...

No it's not. It's "Don't be evil."

Is it really that hard to remember? Especially taking into account this gets brought up every single time Google gets a mention in an article's summary.

Re:Russian Roulette Anyone?

[geobeck]

Yes, but that would ruin the joke! :P

Re:Russian Roulette Anyone?

[buchner.johannes]

Google - Probably not evil.

Re:Russian Roulette Anyone?

[somersault]

Google - nicer than most of those other bastards.

Re:Russian Roulette Anyone?

[Bill Dog]

Google - evil you can trust!

Another reason to turf Flash ASAP

[tonywong]

And get into HTML5 for video etc:

"Google Chrome must support plug-ins such as Flash Player and Silverlight so users can visit popular Web sites such as YouTube. These plug-ins are not designed to run in a sandbox, however, and they expect direct access to the underlying operating system. This allows them to implement features such as full-screen video chat with access to the entire screen, the userâ(TM)s webcam, and microphone. Google Chrome does not currently run these plug-ins in a sandbox, instead relying on their respective vendors to maintain their own security."

Chrome and Bebo homepage

[viralMeme]

"opening up the Bebo homepage (lol) rockets my D-C (1.7Ghz) up to 90% across both, sometimes 100%, interrupting all other tabs and even other applications!"

Hadn't noticed here on this 768MB ~2992 Mhz machine ..

Re:Get the FUD

[viralMeme]

"Internet Explorer 8 takes the cake with better phishing and malware protection, as well as protection from emerging threats"

"Firefox and Chrome have more support for emerging standards like HTML5 and CSS3, but Internet Explorer 8 invested heavily in having world-class, consistent support for the entire CSS2.1 specification"

"Internet Explorer 8 is more compatible with more sites on the Internet than any other browser"

Re:Russian Roulette Anyone?

[slim-t]

Actually it's "Do no evil." So you can be as evil as you want, as long as you don't act on it. Even Dick Cheney could work for Google if he stopped... um, well... breathing.

My theory is that Dick Cheney died of a heart attack in 2002. He stopped breathing, but his replacement robot kept right on being evil.