be evil
Google apps whitelist hardcoded into Chromium open source project
41–50 of 61 posts
Re: Google apps whitelist hardcoded into Chromium open source project
#42From the source: Allow Chrome Web Store extensions, built-in extensions and extensions under development (for calls from whitelisted apps amongst others)
That, and give Google special treatment.
Re: Google apps whitelist hardcoded into Chromium open source project
#43Code never lies, comments sometimes do.
— Ron JeffriesRe: Google apps whitelist hardcoded into Chromium open source project
#44A lot of things are hodecoded into chrome/chromeium. For example the font types and sizes of the tab area. Their browser is practically unusable on a 4k monitor at full resolution.
Re: Google apps whitelist hardcoded into Chromium open source project
#45I'm more horrified by how ugly that code is
Re: Google apps whitelist hardcoded into Chromium open source project
#46Re: Google apps whitelist hardcoded into Chromium open source project
#47Earlier quoted context omitted.
Did a bit of digging - it lets NACL apps downloaded from those whitelisted Google apis have access to "dev interfaces". Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. In effect, this gives Google remote code execution rights from their domains on anybody running Chromium.
I only use Chrome to access Google apps/docs/gmail, since it seems to work better than other browsers for this. Looking like it might be worth setting up a VM appliance for this now.
Firefox is more performant on my Ubuntu box than Chromium, even for things like Gmail and Google Docs.
Re: Google apps whitelist hardcoded into Chromium open source project
#48Very uncool. Google's association with Chromium is why I still recommend FireFox over Chromium, even though they are both open source. Now that I see this, I'm glad I do.
Re: Google apps whitelist hardcoded into Chromium open source project
#49I mean. Google is so large it will always be making mistakes like this. A lot of people look at Google as a whole like it is the greatest set of technical minds in any room on the planet. Sure they have lots of smart people etc.etc but with >10,000 engineers it's impossible.
Also, with >10,000 engineers (even assuming they are the best 10k in the world), mistakes will be made which is why vulnerabilities exist in the real world.
I guess what I'm trying to say is. Don't act surprised. We've seen it before and we will see it again.
Re: Google apps whitelist hardcoded into Chromium open source project
#50Throwing some more info here, this is the NaCl whitelist, looks like it was originally added Feb last year [1]. There's a discussion on Chromium Code Reviews here [2], and an issue on the project itself here [3] The original commit includes the comment 'We should remove this code when PNaCl ships' which got removed somewhere along the way. [1] http://src.chromium.org/viewvc/chrome/trunk/src/chrome/rende... [2] https:…
I would be curious to find out who removed that comment 'We should remove this code when PNaCl ships'