Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google apps whitelist hardcoded into Chromium open source project

code.google.com

Post reply on HN
Print view View original

51–60 of 61 posts

Re: Google apps whitelist hardcoded into Chromium open source project

#51

Post by yzshen »

RyanZAG wrote: post #16
darren_ wrote: post #14

Earlier quoted context omitted.

> Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. Aren't they just the APIs in https://code.google.com/p/chromium/codesearch#chromium/src/p... ? By the looks of it they're just things that aren't ready for primetime, not things that are special dev-only debug tools or whatever.

Well there is https://code.google.com/p/chromium/codesearch#chromium/src/p... and https://src.chromium.org/chrome/trunk/src/ppapi/c/extensions... I haven't looked deeply, but both seem to allow for access outside the sandbox. Maybe a chromium committer could give more detail on the safety of the dev interfaces. They are blocked from public usage for a reason though.

They don't enable access outside the sandbox and should be pretty safe.

PPB_Testing_Dev is a set of helpers for writing tests: querying status of the plugin; running nested message loop to wait for results of async operations; simulate input events which are received only by the plugin itself.

PPB_Ext_Events_Dev is for registering/unregistering events provided by Chrome apps apis (http://developer.chrome.com/apps/api_index.html). It will only be accessible when the NaCl module is included in a Chrome app. This interface hasn't been implemented yet.

Re: Google apps whitelist hardcoded into Chromium open source project

#53

Post by smussman »

Zoomla wrote: post #50
mwill wrote: post #11

Throwing some more info here, this is the NaCl whitelist, looks like it was originally added Feb last year [1]. There's a discussion on Chromium Code Reviews here [2], and an issue on the project itself here [3] The original commit includes the comment 'We should remove this code when PNaCl ships' which got removed somewhere along the way. [1] http://src.chromium.org/viewvc/chrome/trunk/src/chrome/rende... [2] https:…

I would be curious to find out who removed that comment 'We should remove this code when PNaCl ships'

Looks like it was done in this commit: http://src.chromium.org/viewvc/chrome/trunk/src/chrome/rende...

Re: Google apps whitelist hardcoded into Chromium open source project

#54

Post by wmf »

josteink wrote: post #23
denzil_correa wrote: post #19

An important comment in the code // Whitelisted apps must be served over https.

Security issues aside, it still reeks bad taste though. Google is saying that everyone on the internet has to dump plugins, dump Flash and create pure HTML solutions. HTML should be good enough for everyone! Everyone except themselves, apparently. They can just jump to native code on their websites whenever they like. So much for their credibility when it comes to web-standards, eh?

As of yesterday(?), everyone is allowed to use PNaCl.

Re: Google apps whitelist hardcoded into Chromium open source project

#55

Post by hidamon »

Why would they check if Adblock is installed or not?

https://code.google.com/p/chromium/codesearch#chromium/src/c...

  bool ChromeContentRendererClient::IsAdblockInstalled() {
    return g_current_client->extension_dispatcher_->extensions()->Contains(
        "gighmmpiobklfepjocnamgkkbiglidom");
  }

  bool ChromeContentRendererClient::IsAdblockPlusInstalled() {
    return g_current_client->extension_dispatcher_->extensions()->Contains(
        "cfhdojbkjhnklbpkdaibdccddilifddb");
  }

Re: Google apps whitelist hardcoded into Chromium open source project

#56

Post by elq »

hidamon wrote: post #55

Why would they check if Adblock is installed or not? https://code.google.com/p/chromium/codesearch#chromium/src/c... bool ChromeContentRendererClient::IsAdblockInstalled() { return g_current_client->extension_dispatcher_->extensions()->Contains( "gighmmpiobklfepjocnamgkkbiglidom"); } bool ChromeContentRendererClient::IsAdblockPlusInstalled() { return g_current_client->extension_dispatcher_->extensions()->Contains( "c…

They were apparently trying to understand performance issues with adblock, so they can fix them...

  // TODO(mpcomplete): remove the extension-related histograms after we collect
  // enough data. http://crbug.com/100411
  
  const bool use_adblock_histogram =
      ChromeContentRendererClient::IsAdblockInstalled();
https://code.google.com/p/chromium/issues/detail?id=100411

Re: Google apps whitelist hardcoded into Chromium open source project

#57

Post by ryanhuff »

theboss wrote: post #49

I mean. Google is so large it will always be making mistakes like this. A lot of people look at Google as a whole like it is the greatest set of technical minds in any room on the planet. Sure they have lots of smart people etc.etc but with >10,000 engineers it's impossible. Also, with >10,000 engineers (even assuming they are the best 10k in the world), mistakes will be made which is why vulnerabilities exist in the…

I agree, but lets also be sure they don't get a pass just because they are large. In Google's case, being a behemoth corporation is in itself a business risk that they need to manage, and one way to motivate them self-police is by holding them accountable for bad decisions.

Re: Google apps whitelist hardcoded into Chromium open source project

#59

Post by acdha »

RyanZAG wrote: post #12
rurounijones wrote: post #2

What whitelist? JS Execution? No popup blocking? Something else?

Did a bit of digging - it lets NACL apps downloaded from those whitelisted Google apis have access to "dev interfaces". Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. In effect, this gives Google remote code execution rights from their domains on anybody running Chromium.

> In effect, this gives Google remote code execution rights from their domains on anybody running Chromium.

If you're running Chrome, you've already given them code execution rights – the only thing this does is make it slightly harder to detect.

Re: Google apps whitelist hardcoded into Chromium open source project

#60

Post by true_religion »

josteink wrote: post #25
true_religion wrote: post #24

Earlier quoted context omitted.

Isn't it entirely possible they want to dog food their own new code via Chrome before they open up the API to the world?

If they were genuinely interested in dogfooding their own stuff to ensure it works properly, they should also be dogfooding the process of white-listing plugins and websites, not to mention handling graceful fallback when the user cant or wont do that. That's a big part of getting the end-user experience to work well and can't just be "tacked on" later.

You're just adding things that probably aren't within the scope of the project.

For instance graceful fallback is a 'nice to have' but not necessary. If you deny flash or javascript, essentially most sites simply break. I imagine a native client plugin would have the same results if you don't enable it.

As for white listing, why can't it simply be handled with the same dialogs used for whitelisting all the other existing extensions per site?

Post reply on HN