Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google apps whitelist hardcoded into Chromium open source project

code.google.com

Post reply on HN
Print view View original

21–30 of 61 posts

Re: Google apps whitelist hardcoded into Chromium open source project

#21

Post by simias »

RyanZAG wrote: post #16
darren_ wrote: post #14

Earlier quoted context omitted.

> Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. Aren't they just the APIs in https://code.google.com/p/chromium/codesearch#chromium/src/p... ? By the looks of it they're just things that aren't ready for primetime, not things that are special dev-only debug tools or whatever.

Well there is https://code.google.com/p/chromium/codesearch#chromium/src/p... and https://src.chromium.org/chrome/trunk/src/ppapi/c/extensions... I haven't looked deeply, but both seem to allow for access outside the sandbox. Maybe a chromium committer could give more detail on the safety of the dev interfaces. They are blocked from public usage for a reason though.

Eh, using structs for namespacing in C. I hadn't seen that in a while.

Re: Google apps whitelist hardcoded into Chromium open source project

#22

Post by e12e »

Apparently not patched out in Debian either (according to apt-get source chromium-browser). I've got a bit of a mongrel system, so I can't rebuild from source -- but it looks like it should be easy to patch that line to read:

      bool is_whitelisted_url = false;
(If one should be so inclined).

Re: Google apps whitelist hardcoded into Chromium open source project

#23

Post by josteink »

denzil_correa wrote: post #19

An important comment in the code // Whitelisted apps must be served over https.

Security issues aside, it still reeks bad taste though.

Google is saying that everyone on the internet has to dump plugins, dump Flash and create pure HTML solutions. HTML should be good enough for everyone! Everyone except themselves, apparently.

They can just jump to native code on their websites whenever they like. So much for their credibility when it comes to web-standards, eh?

Re: Google apps whitelist hardcoded into Chromium open source project

#24

Post by true_religion »

josteink wrote: post #23
denzil_correa wrote: post #19

An important comment in the code // Whitelisted apps must be served over https.

Security issues aside, it still reeks bad taste though. Google is saying that everyone on the internet has to dump plugins, dump Flash and create pure HTML solutions. HTML should be good enough for everyone! Everyone except themselves, apparently. They can just jump to native code on their websites whenever they like. So much for their credibility when it comes to web-standards, eh?

Isn't it entirely possible they want to dog food their own new code via Chrome before they open up the API to the world?

Re: Google apps whitelist hardcoded into Chromium open source project

#25

Post by josteink »

true_religion wrote: post #24
josteink wrote: post #23

Earlier quoted context omitted.

Security issues aside, it still reeks bad taste though. Google is saying that everyone on the internet has to dump plugins, dump Flash and create pure HTML solutions. HTML should be good enough for everyone! Everyone except themselves, apparently. They can just jump to native code on their websites whenever they like. So much for their credibility when it comes to web-standards, eh?

Isn't it entirely possible they want to dog food their own new code via Chrome before they open up the API to the world?

If they were genuinely interested in dogfooding their own stuff to ensure it works properly, they should also be dogfooding the process of white-listing plugins and websites, not to mention handling graceful fallback when the user cant or wont do that.

That's a big part of getting the end-user experience to work well and can't just be "tacked on" later.

Re: Google apps whitelist hardcoded into Chromium open source project

#27

Post by leokun »

mwill wrote: post #11

Throwing some more info here, this is the NaCl whitelist, looks like it was originally added Feb last year [1]. There's a discussion on Chromium Code Reviews here [2], and an issue on the project itself here [3] The original commit includes the comment 'We should remove this code when PNaCl ships' which got removed somewhere along the way. [1] http://src.chromium.org/viewvc/chrome/trunk/src/chrome/rende... [2] https:…

From the bottom of the issue:

"Rick Waldron raised some concerns on Twitter (http://goo.gl/xk3CaX) so hopefully I can provide a bit more context:

We don't enable NaCl on the web at large because we don't want to see a particular instruction set baked into the web. We enable it for apps that are in the Chrome Web Store (even hosted apps which are in the web) because it's a place where over time we can get developers to migrate to PNaCl. For this whitelist, we have similar controls to what we have on the Chrome Web Store, and our goal is to eventually remove the need for it altogether."

Seems interesting anyway.

Re: Google apps whitelist hardcoded into Chromium open source project

#28

Post by [deleted] »

mwill wrote: post #11

Throwing some more info here, this is the NaCl whitelist, looks like it was originally added Feb last year [1]. There's a discussion on Chromium Code Reviews here [2], and an issue on the project itself here [3] The original commit includes the comment 'We should remove this code when PNaCl ships' which got removed somewhere along the way. [1] http://src.chromium.org/viewvc/chrome/trunk/src/chrome/rende... [2] https:…

[deleted]

Re: Google apps whitelist hardcoded into Chromium open source project

#29

Post by [deleted] »

mwill wrote: post #11

Throwing some more info here, this is the NaCl whitelist, looks like it was originally added Feb last year [1]. There's a discussion on Chromium Code Reviews here [2], and an issue on the project itself here [3] The original commit includes the comment 'We should remove this code when PNaCl ships' which got removed somewhere along the way. [1] http://src.chromium.org/viewvc/chrome/trunk/src/chrome/rende... [2] https:…

[deleted]

Re: Google apps whitelist hardcoded into Chromium open source project

#30

Post by [deleted] »

mwill wrote: post #11

Throwing some more info here, this is the NaCl whitelist, looks like it was originally added Feb last year [1]. There's a discussion on Chromium Code Reviews here [2], and an issue on the project itself here [3] The original commit includes the comment 'We should remove this code when PNaCl ships' which got removed somewhere along the way. [1] http://src.chromium.org/viewvc/chrome/trunk/src/chrome/rende... [2] https:…

[deleted]
Post reply on HN