Slashdot Mirror
Chrome 61 Arrives With JavaScript Modules, WebUSB Support (venturebeat.com)
The latest version of Google Chrome has launched, bringing a host of new developer features like JavaScript modules and WebUSB support. An anonymous Slashdot reader shares a report from VentureBeat: Google has launched Chrome 61 for Windows, Mac, and Linux. Additions in this release include JavaScript modules and WebUSB support, among other developer features. You can update to the latest version now using the browser's built-in silent updater or download it directly from google.com/chrome. Google also released Chrome 61 for Android today. In addition to performance and stability fixes, you can expect two new features: Translate pages with a more compact toolbar and pick images with an improved image picker.
Chrome now supports JavaScript modules natively via the new element, letting developers declare a script's dependencies. Modules are already popular in third-party build tools, which use them to bundle only the required scripts. Native support means the browser can fetch granular dependencies in parallel, taking advantage of caching, avoiding duplications across the page, and ensuring the script executes in the correct order, all without a build step. Google recommends these two blog posts for more information: ECMAScript modules in browsers and ES6 Modules in Depth. Speaking of JavaScript, Chrome 61 also upgrades the browser's V8 JavaScript engine to version 6.1. Developers can expect performance improvements and a binary size reduction. The WebUSB API meanwhile allows web apps to access user-permitted USB devices. This enables all the functionality provided by hardware peripherals such as keyboards, mice, printers, and gamepads, while still preserving the security guarantees of the web.
Chrome now supports JavaScript modules natively via the new element, letting developers declare a script's dependencies. Modules are already popular in third-party build tools, which use them to bundle only the required scripts. Native support means the browser can fetch granular dependencies in parallel, taking advantage of caching, avoiding duplications across the page, and ensuring the script executes in the correct order, all without a build step. Google recommends these two blog posts for more information: ECMAScript modules in browsers and ES6 Modules in Depth. Speaking of JavaScript, Chrome 61 also upgrades the browser's V8 JavaScript engine to version 6.1. Developers can expect performance improvements and a binary size reduction. The WebUSB API meanwhile allows web apps to access user-permitted USB devices. This enables all the functionality provided by hardware peripherals such as keyboards, mice, printers, and gamepads, while still preserving the security guarantees of the web.
while still preserving the security guarantees of the web.
I would've stopped reading right there.
you mean a zero day to follow ?!!
you mean unintentional (wink) programming flaws that leak user info?
i guess me and the other 5 people on the planet still worried about security will not be installing it. good luck the world.
This JavaScript bullshit has gone too far. It's features are already abused too much, this will just make things worse.
Anons need not reply. Questions end with a question mark.
This is nothing more than another subtle move to try to push people towards web-apps (like palm-pre, mozilla phone (lol!), and other devices that failed miserably)
Nobody wants webapps. Nobody wants webapps on mobile. Stop trying to give us them because they'll always be shit.
Native apps work, and don't need a google connection.
Also coming web serial port, web Firewire and web smoke signals.
HOLY FUCK! I've read one of the articles, and it mentions some stuff that I find really, really, really fucking creepy.
HOLY FUCK! I don't want my browser to be able to give web sites access to that info!
HOLY FUCK! I don't want my browser to be able to give web sites access to that info!
HOLY FUCK! I don't want my browser to be able to give web sites access to that info!
HOLY FUCK! I don't want my browser to be able to give web sites access to do that!
HOLY FUCK! I don't want this stuff!
I'm hoping that the next version of Chrome will allow web pages to automatically update my BIOS. It would be really useful for sysadmins and OEMs!
HOLY FUCK! I don't want my browser to be able to give web sites access to that info!
Then click No when the browser asks you if a particular origin should be able to use a particular API. Depending on localization decisions made before launch, the No button may be labeled Deny or Block or Don't Allow.
I think they are just being honest. "We have as much security as the wide open internet." Hopefully systemd has a method for blocking USB device access to a specific application, in this case chrome.
Had to block chrome from using dbus because it kept the computer from sleeping even with a blank page open. Chrome is bad at cleaning up it's dbus power manager locks.
and you are even using the internet how? did you personally audit the code running on your machine line for line.
Some people use a Firefox ESR extension* called LibreJS. It's similar to NoScript, except it automatically whitelists any script that it can verify as having complete corresponding source code available under a free software license. This preserves the user's ability to audit code that runs in the browser's ESVM.
* I refer to this as a "Firefox ESR extension" because it uses Jetpack, not WebExtensions.
Scouts honour, we won't access your usb webcam - we leave that for the shady ad server companies?
I think the idea is that it follows the same permission pattern as WebRTC:
"shadyadnetwork.com wants to access your webcam" - "Deny"
Javascript being interpreted
Major ECMAScript virtual machines (ESVMs) haven't been primarily interpretive for several years. All have JIT compilers nowadays.
If the browser didnt have Javascript, you would end up with Flash again
That or web applications would have instead been written as native applications that run outside the browser in the first place. This means an application would ship as a Windows installer, a macOS disk image, and if you're lucky a CentOS package and a Debian package. Or they'd be like the NES emulator Mesen: an executable for the CLR that runs on .NET Framework under Windows or on Mono under macOS and GNU/Linux.
Which stupid idiotic moron thought it was a good idea to allow USB access from a web browser ?
Somebody who was interested in a particular native application that interacted with a USB peripheral but felt disappointed after he discovered that it was exclusive to an operating system other than the one that his PC runs.
Counting down to the first malware strain that sends advertisements to a 3D printer via WebUSB without users intervention...
Inheritance is the sincerest form of nepotism.
Native apps work
Only on one operating system. Good luck (legally) running a native app distributed as a .dmg on anything but a Mac.
issue 1) this was already available as of Chrome 60 (behind a flag)
issue 2) as of Chrome 62 (Canary), the modules were not (as yet) loading in the correct order.
The module loader still gets confused if the nesting is too deep (I have to manually order part of the loading).
issue 3) it's not a "new element". It is new attributes on the same old element.
Seriously, don't go with what VentureBeat says about anything technical. As if they would even have a clue.
It's pretty straightforward, it means that it'll have the same security as the mass of malware, trojans, droppers, bots, and worms that have made the web what it is today.
Native apps work
Only on one operating system. Good luck (legally) running a native app distributed as a .dmg on anything but a Mac.
Nope. Windows runs Linux binaries. FreeBSD runs Linux binaries. Linux, BSD, and macOS run Windows binaries. Windows 10 on ARM runs x86 Win32 binaries.
Then what else runs macOS binaries? I thought this was clear from "distributed as a .dmg", as .dmg is the archive format commonly used to distribute macOS applications outside the Mac App Store.
So until a particular developer can scrape together the budget to produce multi-platform releases, is the solution to test in Windows and in Wine on either FreeBSD or GNU/Linux, distribute Windows binaries, and expect users of GNU/Linux, FreeBSD, and macOS to use Wine? If so, this strategy still misses mobile.
And that's not even mentioning of cross platform native applications. I use the same web browser and email client on all three operating systems I regularly use.
That's because the Chrome and Firefox web browsers and the Thunderbird mail client have enough of a budget for multi-platform development and testing. A hobbyist or startup may not have enough financial resources to launch simultaneously on all native platforms. "Just use Qt" isn't enough; a developer still has to buy the appropriate hardware (namely a Mac with enough RAM to run the other operating systems in VMs) and spend labor on testing on all supported operating systems.
Indeed. But now it can hack your USB devices without hacking your computer or browser first. The sheer stupidity and arrogance expressed in this is staggering.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
These are people with a "can do" attitude and the skills to back that up. Unfortunately, these are also young and inexperienced people that vastly overestimate their own skills and that think it could never happen to them. To make matters worse, they are living inside the Google filter-bubble.
This is a catastrophe in the making.
Incidentally, read a few "scientific" publications by Google people to find out how utterly clueless they are about reality, all while thinking they are the greatest engineers ans scientists ever. Most really good people have left Google (I know a few) and what is left has failed to realize they are the dross. And they then make demented decisions like this one.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
You think systemd will save you? If I were religious, my prayers would be with you....
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
All JS which executes in your browser has complete source available.
Just because it has the same syntax as source code doesn't mean it's source code. A transpiled or minified ES program is not "the preferred form of the work for making modifications to it." That'd be like saying the assembly language output of a C++ compiler is source code because some people write programs in x86 or x86-64 assembly language.
by default JavaScript is delivered as source code.
Most major sites do not use this default scenario. Instead they send the program in minified form, which strips out meaningful variable names, meaningful function names, and comments, because the Gzip encoding of a minified script is smaller than the Gzip encoding of its source code.
you say "disagree" and maps closes.
If Google Maps requires surveillance of users' locations at all times as a condition of use, and you disagree with this surveillance, try this: Close Google Maps, use a competitor, recommend a competitor to your friends, and explain on your blog why you use a competitor.
Permission requests are presented through a UI element presented by the web browser, which floats over the HTML document and (at least in Firefox) partially extends into the location bar. A script in an advertisement being able to activate this is considered a serious security defect in the browser, which browser makers promise to fix as soon as discovered.
the Chrome and Firefox web browsers and the Thunderbird mail client have enough of a budget for multi-platform development and testing. A hobbyist or startup may not have enough financial resources to launch simultaneously on all native platforms.
I use the same image editor [gimp.org] on all three platforms. I use the same network analyzer [wireshark.org] on all three platforms. I use the same video tools [ffmpeg.org] on all three platforms. I use the same office suite [libreoffice.org] on all three platforms.
GIMP, WireShark, FFmpeg, and LibreOffice are well-known free software projects with enough of a labor budget for multi-platform development and testing. The 1- or 2-person team behind another native application you come across may not. What should the developer of an application that isn't quite as popular as GIMP, WireShark, FFmpeg, or LibreOffice do to lower the cost of multi-platform building and testing?
Uh, yeah, thanks, Google...
But can you please build into Chrome a feature that allows users to block HTML5 video that autoplays?
Please?