81–90 of 99 posts
Earlier quoted context omitted.
Microsoft has to have wrestled some power away with Edge. They have a seat at the table.
Edge is just Chromium now https://finance.yahoo.com/news/microsoft-edge-chrome-chromiu...
The IndexedDB API in Safari has been buggy and unstable for a very long time.
Given that there’s really no way around Safari on the iPhone, developers should perhaps just not use IndexedDB if the browser is Safari, given how buggy the implementation is. It pretty clear that Apple isn’t giving Safari/WebKit the focus it needs, but it’s also clear that developers just continue to push for more and more features in the browser. I’d much prefer that browsers started to cut back. While Google is ex…
It's very interesting seeing exploits like this from this organization. On one hand their service fingerprints users and offers extended metadata like whether the user is in incognito via sketchy web apis. On the other hand they report (and help close) some gnarly exploits like this via sketchy web apis. What do you all make of this? It's hard to not see it as some weird "were not doing a bad thing" gaslighting (perh…
I had the same thoughts; it seems to present a friendly picture but there are a lot of unanswered problems with this technology, even if only used for fraud protection. What if clients use it for tracking and other shady purposes, would they do something about it? Btw I tried with Tor Browser and it did not accurately fingerprint it between sessions which makes me wonder how effective it really is. Especially for fra…
Is it usual to disclose (what appears to me to be) a vulnerability with massive potential for exploitation towards disastrous ends, before the developers of the software have shipped a fix? I guess I'm curious as to what the norms are around disclosure of such discovered vulnerabilities are in general.
Is it usual to disclose (what appears to me to be) a vulnerability with massive potential for exploitation towards disastrous ends, before the developers of the software have shipped a fix? I guess I'm curious as to what the norms are around disclosure of such discovered vulnerabilities are in general.
It allows a site to see which other sites you have visited. It’s not that disastrous.
Still though:
> Moreover, we observed that in some cases, websites use unique user-specific identifiers in database names. This means that authenticated users can be uniquely and precisely identified. Some popular examples would be YouTube, Google Calendar, or Google Keep. All of these websites create databases that include the authenticated Google User ID and in case the user is logged into multiple accounts, databases are created for all these accounts.
Earlier quoted context omitted.
>I rarely (never?) see Apple engineers posting in these threads. You mean on HN? Oh they do, From JSC to Webkit Engineers. Mostly on technical discussions.
Maybe I’m just not reading the right threads then. It’s all a perception.
Earlier quoted context omitted.
Well, don’t get caught up in unimportant distinctions. Security vs. privacy depends on the relationships between the subject of data, the holder of data and those seeking to use the data. Consider the relationships between browser end users, Google, and the parties who provide Google’s revenue. If we want to distinguish privacy from security here, we have to argue about how to characterize these relationships and has…
I would trust Chrome to flash GrapheneOS to my Pixel — that's security. I do not trust it not to report back that I use GrapheneOS, or which internet communities I visit, back to Google for use in who knows what data correlation research — that's privacy.
I think a security issue is one that allows another party to take information or property you have without your consent, and use it for their gain without regard for the harm it may do to you or others.
It's arguable, but I believe that's at the core of Google's business model with regard to Chrome users.
Earlier quoted context omitted.
Microsoft has to have wrestled some power away with Edge. They have a seat at the table.
It’s an improvement over the situation as it was, but Google still has a great deal more muscle than anybody else in steering the development of Blink and the web in general. Really, at this point I think Chrome/Blink should be spun out as a separate entity. It could be set up as a model similar to that of ARM, or perhaps a non-profit of some kind. Either way, Blink needs to be separated from overwhelming corporate i…
Dear god, no, please.
The Chrome team is a treasure of immense value to the world. They are the only major software team in the world where my bug reports have been triaged and fixed. Again and again and again, and usually very quickly too. Ocassionally I would find some hellish obscure corner case of a bug, ignore it, and it would still get fixed even without my reporting it: the team is just unbelievably effective! I wished Google were not selling advertising, but the downsides for Chrome have been fairly limited. The fact that they have given the source code to Chromium away for free is just plain astonishing. I am blown away by how good Google has been as a custodian of something that is used by so many in the world: it has been a fair gift to us all with surprisingly few caveats.
If you don’t like Google’s guardianship then use a derivative browser, even Microsoft Edge!
Split off Chromium and it would likely turn to shit. How many times have I seen browser vendors go down the path of evil? How many times have I seen important software get sold, and the product focus shift to something execrable?
On browsers: the Safari team is a black hole for bug reports, with a browser full of broken or non-compliant functionality… IndexedDB is just one of many similar symptoms. Firefox has the right social goals, but it hasn’t been delivering guru level engineering, but instead Firefox is continually chasing useless queer features (similar to many other now dead products in the world). The Microsoft Edge team did fix one bug report for me once, but I just happened to report it while they were developing the feature, and I had test cases showing the feature working in Firefox and Chrome. I still have trauma from Microsoft IE6+ (although it was a competitive edge for my business that I could usually make it work, albeit at the cost of years of my life devoted to creating IE workarounds).
Earlier quoted context omitted.
I would trust Chrome to flash GrapheneOS to my Pixel — that's security. I do not trust it not to report back that I use GrapheneOS, or which internet communities I visit, back to Google for use in who knows what data correlation research — that's privacy.
But I wonder what your definitional difference is. I think a security issue is one that allows another party to take information or property you have without your consent, and use it for their gain without regard for the harm it may do to you or others. It's arguable, but I believe that's at the core of Google's business model with regard to Chrome users.
have security without privacy,
but no privacy without first having security!