Slashdot Mirror
Google Quashes 13 Chrome Bugs, Adds PDF Viewer
CWmike writes "Google on Thursday patched 13 vulnerabilities in Chrome 8 (stable), and debuted Google's built-in PDF viewer, an alternative to the bug-plagued Adobe Reader plug-in, and included support for the still-not-launched Chrome Web Store. The 13 flaws fixed in Chrome 8.0.552.215 are in a variety of components, including the browser's history, its video indexing and the display of SVG (scalable vector graphics) animations. Next up: Adobe and Google have collaborated to put the Flash Player plug-in inside a sandbox within the dev build of Chrome, an effort by the two companies to better protect users from attacks."
So Adobe didn't mind helping Google, even while Google was developing a replacement for Acrobat Reader?
Seems a little odd to me.
There's no -1 for "I don't get it."
Just tested it with chrome 9.x... the pdf rendering is ridiculously fast.
"The viewer renders PDF documents as HTML-based pages"
I hope it does a better job than the PDF viewer built into Google search...
Most people would die sooner than think; in fact, they do.
It's been in the dev or beta channel for a while. Works fine and hasn't choked on any PDFs I've viewed with it yet.
Pain is merely failure leaving the body
The problems with pdf security are either due to the latter standards that allow excusable to be imbedded or due to poor security in the adobe and apple readers. You never hear about evince or ocular being a security risk.
So the bugs subpoenaed Google, and Google asked the judge that the motion of discovery be nullified?
Or did they mean squashed?
The PDF Viewer will be nice. Have had issues on both Windows and Linux.
Henry Tafolla Online Marketing, Made Simple
I'm guessing not.
The correlation between ignorance of statistics and using "correlation is not causation" as an argument is close to 1.
One of the biggest problems with Adobe Acrobat Reader is that attackers can run exploits via embedded flash ... since Chrome supports flash, does that mean it will support flash in the PDFs it converts to HTML? I hope not, or at least not by default.
I'd like to see Chrome come with a dummy app that pretends to be a PDF reader which merely runs a specialized window holding the document content in a manner akin to your typical PDF viewer. This would help people stop wean themselves off of Acrobat Reader. Maybe it will be better than FoxIt and Evince et al. (though I suspect not; the whole point of PDF is in a perfectly consistent rendering so as to always print the same, while HTML is almost impossible to do that. Google likely has no interest in molding Chrome into something that ideal for paged media, but I can hope...)
(Disclaimer: I word processes in HTML using vim; I know a good amount of page-media CSS, including all those CSS1 and CSS2 bits that still lack implementation in FF and Chrome...)
Use my userscript to add story images to Slashdot. There's no going back.
All this enhancement sounds great, but I wish they would concentrate on compatibility with web sites first. There are too many sites that don't work well with Chrome and I am tired of getting warnings from popular sites that warn me about running an unsupported browser.
Talk about undoing your own work, huh?
I have left slashdot and am now on Soylent News. FUCK YOU DICE.
Does it fix the "I can't paste into a textarea" bug?
I was using it instead of Firefox, but that one's a dealkiller for me.
Peter predicted that you would "deliberately forget" creation 2000 years ago...
Just download the unstable branch. It's as close to WebKit Nightly as you get for Chrome.
You start with something small and fast.
Soon you're all about embedding this and that and everything else. Now you're all about bloat.
See, I use foxit. I like foxit. I don't install the embedded reader because I don't like it to be embedded. That's my choice. You may not agree, but that's cool because that's what choice means.
Now, Chrome embeds its own viewer. There goes my choice. There goes the lightweight browser. Hello monoculture software. Hello exploits.
bah.
The problem with quotes on the internet, is that nobody bothers to check their veracity. -- Abraham Lincoln
At first I thought you were joking when you said you were testing it with Chrome 9.x I didn't even know Chrome 8.x was out.
Am I just getting old or are these releases abnormally fast?
Any website that warns about unsupported browsers is by definition designed by someone who doesn't know how to design websites. Properly designed websites follow standards, and web browsers comply with those standards. When a web developer speaks in terms of which browsers they do and don't support that is a direct indication that they don't understand even the most basic and fundamental concepts of website design.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
about:plugins -> Chrome PDF Viewer -> Disable.
or
Options -> Under the Hood -> Content settings -> Plug-ins -> Block all.
Also it's weird to say a plugin is causing bloat, when the plugin resides in a shared library, it only registers one embed handler, and is entered only when a PDF is viewed. It has zero runtime overhead and its .text section is shared between processes (iirc... loadlibrary on win32 does copy-on-write).
This has been annoying me for awhile now. Where's a bug we can all vote for and Slashdot?
Don't thank God, thank a doctor!
...and here's why:
The fact that after all these releases, Google still does not see it prudent to had 'print preview' added to Chrome as one of its features.
Folks, this feature is a killer for me...and I am not alone. Trust me on this.
Ok, good information. Not sure you'll know I said that, because its an AC post, but what the hell. Thanks.
The problem with quotes on the internet, is that nobody bothers to check their veracity. -- Abraham Lincoln
I'm not a fan of PDF at all - but if you want to use a browser for work, decent PDF handling is a necessary evil. The old "solution" - pulling the PDF into Google Apps - couldn't handle PDF files accessed through https. That made it a non-starter in my work environment.
All you young'uns are free to bitch and moan about PDF itself; but in the real world you usually have to be pragmatic.
#DeleteChrome
So they are working with Adobe to get Flash Player in, but against Adobe to get Adobe Reader out?
3 years after the request was made they still can't offer a universal zoom level. I'll not read a single PDF on Chrome so long as I have to zoom in to every single bloody one of them separately. I hate IE, but I still have to use it on a daily basis as it's the only browser that offers a default zoom level for websites.
Hello monoculture software. Hello exploits.
We embedded a viewer so that we could sandbox it. This makes exploits much harder to pull off. If you do manage to get a user to open a PDF that exploits a bug, the sandbox ensures that the process you now control is unable to access the filesystem or open network connections, and will be killed if it tries.
99% of users don't know what a plugin is, and won't keep them up to date unless the process is totally automatic. Chrome got this right: Updates are silently downloaded and applied unless you go out of your way to disabling them. Making the PDF plugin a part of Chrome allows chrome updates to update the plugin. Chrome's track record fixing security bugs fast is far better than the record of the PDF plugin that virtually all Windows users most user have.
If you don't want to use the fast, small, sandboxed PDF viewer that gets security updates, go to about:plugins and click disable. Nothing stops you from using other plugin if you want to.
Actually it probably does affect Chrome. For some stupid reason the Windows version of Chrome shares it's network settings with Internet Explorer, which makes it lose a great many points.
If you ignore ACs because they are anonymous - you're an idiot.
web browsers comply with those standards.
Unless, of course, the maker of the web browser is using the lack of compliance with standards in older versions of the browser as a tool to sell another product that the web browser requires. I routinely get banner ads for IE 9 when browsing with Chrome under Ubuntu 10.10 or Firefox under Windows XP; I click them and they end up being ads for Windows 7.
It's a massive pain in the ass to have to reconfigure proxy and PKI on a per application basis. I personally love that Chrome uses the OS settings that Firefox ignores.
For months, the basic ability to copy and paste text in chrome has been broken. Its not just me, others have noted it, even bloggers noting it.
To read and comment on slashdot I *have to * use firefox. to do the basic task of quoting someone. ctrl-c gets it to the clipboard and I can paste to notepad, but cant to the reply form field.
To quote from the film 300: This is madness.
In post Patriot Act America, the library books scan you.
FYI, Google's using Foxit for the built-in PDF viewer. So, you know, this is kind of like you using Foxit, but with less bloat, since you don't need a completely separate application and UI to get the Foxit PDF rendering engine.
Oh finally those annoying page breaks in pdf are gone. I mean, time after time i switch to "continuous" mode, but, always, they were coming back. You click the scrolling arrows, but pdf shows the page it wants to show, not the one I want, so annoying it was.
But it is gone now!
As per subject. It threats that like an URL to be opened.
To be honest, it's not mentioned in the help either.
Mastering the English language is fucking easy: all you have to do is to put an f* word in every fucking sentence.
Looking at the speed of new developments by Google and Apple, i can not help but wonder how far we would have come since the Alto/Lisa had it not been for the stifling influence of first IBM and then Microsoft. OK, maybe the newbies stand on the shoulders of giants, but damn aren't they a couple of feisty dwarfs.
It isn't an OS setting, it's the Internet Explorer setting.
If you ignore ACs because they are anonymous - you're an idiot.
> See, I use foxit. I like foxit.
you may be interested to know that Chrome seems to be using Foxit for their plugin:
http://googlesystem.blogspot.com/2010/08/google-chromes-pdf-plugin-uses-foxit.html
plus additional sandboxing, for extra security.
But inline PDF doesn't seem to be available for Linux, and there's very little information about why. I have heard rumours that the PDF code isn't open source. It would be really nice if there was some communication on this...
I've seen Chrome choke on a few sites that work fine in Firefox and Opera. It's generally an issue with JavaScript and/or the way forms are handled. Just because you haven't run into the problem doesn't mean it doesn't exist.
Chrome does not, so far as I know, use the "security zones" concept being exploited in that example. Therefore, it should still run at low integrity level. Sharing proy settings has nothing to do with that attack.
There's no place I could be, since I've found Serenity...
Security patches for poppler, the library that evince is built upon, are issued fairly regularly.
They're close to the same thing. It's a system setting that IE happens to be the main consumer of, but it's not specific to IE or even to MSHTML. It's not an "OS setting" in the sense that it doesn't force all apps to use the proxy, but generally speaking proxy-aware apps will respect it. Chrome is hardly the only third-party program to do so.
There's no place I could be, since I've found Serenity...
So is this closed-source then? If so, then presumably it won't make it into Chromium.
I think Foxit is proprietary, but it's really, really fast; display speed between Foxit PDF Reader and Adobe Reader isn't even a contest. Last I checked it leaves Ghostscript in the dust too. I haven't used anything but Foxit for Windows PDF reading for a while now. Now, Poppler (which uses Cairo) is a different story: those libraries are pretty fast. Chromium might be able to do something interesting with a Poppler-based reader instead of Foxit.
Plenty of third party software uses the setting, and to me it makes perfect sense to only have to set up proxies and trust one time. Zones? Not so much.
Okay so that's a (very) nice addition for Windows users, but what about Mac OS X, which handles basic PDF files just fine? Is the built-in PDF viewer only in the Windows version of Chrome? If not, can we disable it?
You know IE8 passes acid2
Which is why I still test on IE >= 8.
IE9 gets a 95 on the acid3 test.
Which is comparable to Firefox. But there are more copies of Windows on which IE 9 doesn't run than on which IE 9 does run. The first result from Google windows market share states that as of November 2010, Windows Vista and Windows 7 combined make about 32 percent to Windows XP's 58 percent.
It's an IE setting, that some apps choose to honour. I'm really only aware of MSN messenger that does though. Seriously, it's not an OS setting in any sense. Can you give a list of some popular programs that make use of those settings?
If you ignore ACs because they are anonymous - you're an idiot.
Like what third party software? Cause, all the programs I use you have to set it manually, which is normal.
If you ignore ACs because they are anonymous - you're an idiot.