Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Chrome Apes IE8, Adds Clickjacking, XSS Defenses

timothy posted more than 4 years ago | from the damn-dirty-apes dept.

Google 90

CWmike writes "Google has announced that it added several new security features to Chrome 4, including two security measures first popularized (some later shot down as having 'zero impact') by rival Microsoft's IE8 last year. The newest 'stable' build of Chrome includes five security additions that target Web developers who want to build more secure sites, said Adam Barth, a software engineer on the Chrome team. The two aped from IE include 'X-Frame-Options'" a security feature that helps sites defend against 'clickjacking' attacks, and cross-site scripting protection.'"In Google Chrome 4, we've added an experimental feature to help mitigate one form of XSS [cross-site scripting], reflective XSS,' Barth said. 'The XSS filter checks whether a script that's about to run on a Web page is also present in the request that fetched that Web page. If the script is present in the request, that's a strong indication that the Web server might have been tricked into reflecting the script.'"

cancel ×

90 comments

Thanks (0)

iamapizza (1312801) | more than 4 years ago | (#30946946)

Thanks for adding the security features to Chrome, developers at Google. That is all.

Re:Thanks (1)

iamapizza (1312801) | more than 4 years ago | (#30946952)

Would I have been so forgiving if it were IE that were late with their security additions?

Re:Thanks (1)

RobertM1968 (951074) | more than 4 years ago | (#30947196)

Would I have been so forgiving if it were IE that were late with their security additions?

I dunno... though I also dont know if this security addition works in IE8 either... ;-)

late? (0)

Anonymous Coward | more than 4 years ago | (#30949162)

What's "late" about it? This isn't a fix for a security hole, it's a heuristic that helps cut down on some attacks. There is no strict need to implement it, it's just a "would be nice" feature.

Re:Thanks (0)

Anonymous Coward | more than 4 years ago | (#30947468)

Thanks for adding the security features to Chrome, developers at Google. That is all.

that's just plain ridiculous

Re:Thanks (2, Funny)

Jurily (900488) | more than 4 years ago | (#30947534)

I read it as "Chrome Apes, IE8 Adds Clickjacking"...

Re:Thanks (1)

sakdoctor (1087155) | more than 4 years ago | (#30947884)

I hope this new Chrome security works on the clickjacking on google's own SERPs.

Re:Thanks (1)

GameboyRMH (1153867) | more than 4 years ago | (#30948098)

Hahahaha! (the clickjacking happens when running searches while logged into a Google account).

Re:Thanks (0)

Anonymous Coward | more than 4 years ago | (#30949676)

Agreed. The only people I want stealing my personal data are the good folks at Google.

Chrome Apes? Moronic Monkies? (2, Funny)

syousef (465911) | more than 4 years ago | (#30946958)

Anyone else getting flashbacks from Planet of the Apes?

Is that the new code name for the next version of Chrome? Ubuntu Panhandling Panda, now featuring Chrome Apes! Download now! Steve Balmer your Monkey Boy days are numbered, so dance while you can, it's the year of the Google Desktop.

Re:Chrome Apes? Moronic Monkies? (0)

Anonymous Coward | more than 4 years ago | (#30947030)

FYI, "to ape" also means "to imitate", although this does not seem to be frequently used.

Re:Chrome Apes? Moronic Monkies? (1, Insightful)

Velska1 (1435341) | more than 4 years ago | (#30947172)

Believe me, it's used frequently enough for any fluent speaker in conversations, let alone native speakers. It's an old one, besides, I found it in a dictionary from the 1950s.

Re:Chrome Apes? Moronic Monkies? (3, Insightful)

jez9999 (618189) | more than 4 years ago | (#30947548)

I'm a native English speaker and it seems like a bizarre, stupid usage of the word to me. But then, Slashdot headline have always had trouble making sense.

Re:Chrome Apes? Moronic Monkies? (0, Offtopic)

Anonymous Coward | more than 4 years ago | (#30948136)

I'm a native american, you insensitive clod!

Re:Chrome Apes? Moronic Monkies? (1)

cheesewire (876598) | more than 4 years ago | (#30948688)

The kids aped the apes, the apes aped the kids. The kids went ape.

Re:Chrome Apes? Moronic Monkies? (1)

thetoadwarrior (1268702) | more than 4 years ago | (#30953874)

This is purely a guess and probably full of shit but I would assume it comes from the fact that monkeys and apes will often mimic humans and their movements so it makes perfect sense.

Re:Chrome Apes? Moronic Monkies? (1)

VON-MAN (621853) | more than 4 years ago | (#30949142)

I'm no native English speaker but I know it's an normal English word. However, I've never heard someone use it when revering to software. And it sounds really derogatory. So yes, it's a weird use of the word.

Re:Chrome Apes? Moronic Monkies? (0)

Anonymous Coward | more than 4 years ago | (#30952050)

This is a perfectly common use of the word ape. When satan is referred to as 'the ape of god', it doesn't mean he's some kind of evil gibbon.

Re:Chrome Apes? Moronic Monkies? (1)

DMUTPeregrine (612791) | more than 4 years ago | (#30954066)

Some monkeys & apes are known to imitate others. Thus, to "ape" someone/thing is to imitate it. It's not derogatory or a particularly odd use, just less common now than it used to be.

Re:Chrome Apes? Moronic Monkies? (1)

VON-MAN (621853) | more than 4 years ago | (#30955174)

"Some monkeys & apes are known to imitate others."
"to "ape" someone/thing is to imitate it"

Thanks yes. I always thought that to be common knowledge.
However, "ape" & "imitate" in google gives me a link to "www.thefreedictionary.com" where "to ape" is defined as "To mimic slavishly but often with an absurd result."

And that's exactly what I was trying to say earlier: it's a pretty negative way of describing behavior. But then to use it in the context of software? Ridiculous! Software doesn't ape, or imitate. It emulates or re-implements. I really think it's a silly little article.

Re:Chrome Apes? Moronic Monkies? (1)

thetoadwarrior (1268702) | more than 4 years ago | (#30953812)

It's mainly because English is being dumbed down and internet is a breeding ground for dumb English so you aren't very likely to hear decent English. Hell, even I could afford to read everything before I press submit.

Re:Chrome Apes? Moronic Monkies? (1)

thetoadwarrior (1268702) | more than 4 years ago | (#30953778)

http://www.google.co.uk/search?q=define%3A+ape [google.co.uk]

# any of various primates with short tails or no tail at all
# imitate uncritically and in every aspect; "Her little brother apes her behavior"
# copycat: someone who copies the words or behavior of another
# caricature: represent in or produce a caricature of; "The drawing caricatured the President"
# anthropoid: person who resembles a nonhuman primate

You can thank me for the free English lesson later.

Re:Chrome Apes? Moronic Monkies? (1)

syousef (465911) | more than 4 years ago | (#30959924)

What is wrong with people? I made a joke, and they assume I don't understand the context? WTF?

Gayfield Penishands - The Movie! Soon at IMDB.com (-1, Offtopic)

Anonymous Coward | more than 4 years ago | (#30947024)

G4yfield P3nishands is a touching film about a 29 year old g4y emo man, with long p3nises for fingers. In the tradition of Edward scissorhands, we bring you:

G4yfield P3nishands

Watch as G4yfield stumbles around in his world where his p3nis fingers get him in all sorts of michief. With every simple sneeze, volcanic mayonnayse storms erupt.

Will G4yfield P3nishands live a fruitful life? Is he to find love?

Re:Gayfield Penishands - The Movie! Soon at IMDB.c (-1, Offtopic)

Anonymous Coward | more than 4 years ago | (#30947044)

g4y emo man

No Wynona Ryder.
FAIL.

security by obscurity (0)

Anonymous Coward | more than 4 years ago | (#30947060)

security by obscurity... just imagine how many developers will be baffled by this behavior, spending hours trying to find out what is wrong with their code...

Re:security by obscurity (1)

Lillebo (1561251) | more than 4 years ago | (#30947978)

Probably because most "developers" are clueless script kiddies to begin with.

Re:security by obscurity (1)

Runaway1956 (1322357) | more than 4 years ago | (#30950762)

I've had that thought a time or two, but never voiced it. Why don't we run a poll, and find out how many developers actually develop anything, and how many just tie scripts together, like the guy at the circus who makes dogs and horses out of balloons. It could get interesting!

Re:security by obscurity (1)

Goaway (82658) | more than 4 years ago | (#30948388)

just imagine how many developers will be baffled by this behavior

Imagining...

Done. Zero developers were baffled.

Imagining complete.

but what about jQuery? (0)

Anonymous Coward | more than 4 years ago | (#30947090)

I'm interested into how this ties in with commonly used external scripts, such as the jQuery and Yui frameworks which are commonly fetched from their respective servers, rather than hosted locally on the server of the website, so they're cached etc.

Re:but what about jQuery? (1)

MemoryDragon (544441) | more than 4 years ago | (#30947124)

Hehe I am pretty sure this feature is disabled if you fetch the Google build of those scripts from the cloud...
(

Re:but what about jQuery? (1)

Goaway (82658) | more than 4 years ago | (#30948398)

It does not affect that in any way whatosever.

Re:but what about jQuery? (1)

WiFiBro (784621) | more than 4 years ago | (#30949532)

I assume (danger!) that they are only looking for XSS in the GET, POST and COOKIE input.

Cross-site scripting (4, Interesting)

commlinx (1068272) | more than 4 years ago | (#30947138)

Recently I starting doing a bit of web development after being out of the loop for a while. I was working on a project and it was convenient to have the XHTML / JS running on my development machine while doing a few AJAX calls to my development server. After it failed at first I found I could add Access-Control-Allow-Origin: * to the HTTP header to allow cross-site access.

It made we wonder if you wanted to exploit cross-site vulnerabilities couldn't you setup a proxy in the middle that returned information from the original site but added that to the header? Anyway just got me wondering and maybe someone more knowledgeable could comment on it.

Re:Cross-site scripting (4, Insightful)

NNKK (218503) | more than 4 years ago | (#30947154)

At that point you're already a man in the middle and can send whatever you want to the browser, why on earth would you need to exploit XSS vulnerabilities?

Re:Cross-site scripting (1)

icepick72 (834363) | more than 4 years ago | (#30947520)

Maybe men in the middle have a particular fetish for that kind of attack.

Re:Cross-site scripting (1)

MrCoke (445461) | more than 4 years ago | (#30948550)

Because you want to do something "useful" instead of just snooping?

Re:Cross-site scripting (1)

Quantumstate (1295210) | more than 4 years ago | (#30948714)

No you are missing the point. The man in the middle can modify stuff going through so they just change the page itself rather than trying to use fancy XSS attacks.

Re:Cross-site scripting (4, Informative)

TorKlingberg (599697) | more than 4 years ago | (#30947920)

If you are going to use Access-Control-Allow-Origin you should probably be aware that it is very new, and many browsers out there do not support it. Firefox added it in version 3.5.

Stay classy /. (-1, Flamebait)

WiiVault (1039946) | more than 4 years ago | (#30947156)

A few potentially good ideas somehow changes a decade of standards abuse and generally shitty security? I hope the submitter realized that the only reason MS even bothered with any of this is thanks to them getting an ass pounding over the last few years for not giving a shit about security. Your welcome MS drones.

Moderation abuse 101 (1, Offtopic)

WiiVault (1039946) | more than 4 years ago | (#30947200)

Off topic? The summary is pure troll.

Re:Moderation abuse 101 (0)

Anonymous Coward | more than 4 years ago | (#30947676)

Hi

I am an Anonymous Coward / troll and I would like to apply for the position of new Slashdot meme creator.
I have many valuable ideas that regular members will find amusing and informative. My first idea is the 'I just farted' meme in which a user adds a semi-useful comment onto a discussion and then concludes with "BTW, I just farted." Hilarious!

I hope this meets with your approval.

BTW, I just farted.

Regards

AC/t

Re:Stay classy /. (3, Insightful)

1s44c (552956) | more than 4 years ago | (#30947642)

I hope the submitter realized that the only reason MS even bothered with any of this is thanks to them getting an ass pounding over the last few years for not giving a shit about security. Your welcome MS drones.

MS have never got the 'ass pounding' their security record has earned. If the security problems they cause cost them just 1% of what they cost their customers they would be bankrupt fairly quickly.

Software is weird, where else would you not be responsible for the faults in the products you sell?

Re:Stay classy /. (1, Insightful)

Anonymous Coward | more than 4 years ago | (#30948162)

Because if you were, you probably wouldn't be able to purchase the software as it'd be seriously more expansive than it is today.

Re:Stay classy /. (0)

Anonymous Coward | more than 4 years ago | (#30948704)

expensive != expansive

Re:Stay classy /. (2, Insightful)

Kevin Stevens (227724) | more than 4 years ago | (#30949158)

Your house is seriously insecure, even if you have a steel door and have window panes are made of bullet-proof glass, you probably live in a stick frame building where a drill and a sawz-all can gain me access to the interior in an hour or two. Yet no one seems to get excited about the insecurity of our houses.

When our houses get robbed, we recognize that the wrongdoing is being done by the criminal. Yet when our computers are hacked, we place the wrongdoing on the provider of the software.

I have never really understood why software is held to such lofty standards, particularly on consumer desktops. It would be one thing if file sharing of your entire filesystem was enabled by default in typical software, but lets be real- hacks these days require really clever methods to exploit systems, and if it wasn't for very intelligent, very dedicated people constantly pounding and poking our software, we wouldn't have to worry at all. Yet an uneducated teenager can break into a house in a few minutes with little more than a stick to break a window, and we seem to all go about our day without any outrage at all.

I just don't understand this.

Re:Stay classy /. (1)

mister_playboy (1474163) | more than 4 years ago | (#30949346)

Breaking into a house requires the criminal to be at the house physically and people understand that. Breaking into a computer can take place from virtually anywhere and that seems much more abstract. Since most people don't understand exactly what happened to allow the criminal access, they place the blame with someone who they assume does understand, the software manufacturer.

If a little kid gets hurt and you try to comfort them, they often get angry at you, at least briefly. Same basic idea.

Re:Stay classy /. (1)

hairyfeet (841228) | more than 4 years ago | (#30953128)

While I agree the users blame the OS the problem with that is as a PC repairman I'd say a good 9 out of 10 infected PCs I have come across my desk can be traced back to PEBKAC. It doesn't matter how many times you warn them, if you wave a cookie in their face they WILL ignore any and all warnings and go around all your nice defenses.

So I would say it isn't the OS it is the user. Just to see if it would help I put one of my PEBKAC customers on Linux. He was one of those "hot pron" guys that would click on anything that had the word porn in it. Did Linux help? Nope, he completely borked the machine in less than a week, to the point the thing wouldn't even boot. How did he manage? He decided he didn't like the package manager and instead Googled "Cool Linux Programs" and then went and installed a bunch of crap he found on Freshmeat and ended up in dependency hell. As they said in Forrest Gump "Stupid is as stupid does". No matter how much you try to idiot proof a box as long as you are not allowed to lock them into a thin client situation the idiot WILL find a way to fuck things up.

Re:Stay classy /. (2, Interesting)

10101001 10101001 (732688) | more than 4 years ago | (#30949580)

Your house is seriously insecure, even if you have a steel door and have window panes are made of bullet-proof glass, you probably live in a stick frame building where a drill and a sawz-all can gain me access to the interior in an hour or two. Yet no one seems to get excited about the insecurity of our houses.

In large part because, as you point out, it's impossible to make a house physically secure (although security guards can hypothetically do a good job). Similarly, it's impossible to make a computer physically secure (after all, it's in a house or building and those security guards still aren't perfect). Meanwhile, software, being a virtual good, can actually provide absolute security within the confines of the computer that runs it being physically secure. Hence, there's a higher standard held on software.

When our houses get robbed, we recognize that the wrongdoing is being done by the criminal. Yet when our computers are hacked, we place the wrongdoing on the provider of the software.

No. In both situations, the wrongdoers are the criminals. The issue comes to the point, really, of whether any blame can be put upon the constructor of your house (or its parts) and the constructor of your computer (or its parts). For homes, if someone sold a lock that, as sold, should be reasonably able to stop being hacksawed through was in fact hacksawed through, you'd still have reason to blame the lock maker. Similarly, software that is clearly defective against what it reasonably should block would leave blame upon the software maker. The issue, then, is merely that Microsoft (and most software makers) regularly admit their software is faulty (the need for Windows Update). The only real thing left, then, is to point out that Microsoft has such a poor reputation, no person should reasonably expect their software to be secure; if that's your position, I agree that blame is being badly cast on Microsoft.

I have never really understood why software is held to such lofty standards, particularly on consumer desktops. It would be one thing if file sharing of your entire filesystem was enabled by default in typical software, but lets be real- hacks these days require really clever methods to exploit systems, and if it wasn't for very intelligent, very dedicated people constantly pounding and poking our software, we wouldn't have to worry at all. Yet an uneducated teenager can break into a house in a few minutes with little more than a stick to break a window, and we seem to all go about our day without any outrage at all.

Again, software can be actually made secure. Most the "easy" exploits have been fixed because they are actually fixable. There's nothing you can do to prevent a teenager from being able to break into a house (well, not legally, anyways); you can in many states/areas shoot the teenager after they enter. The comparison is rather apple and oranges.

Re:Stay classy /. (1)

forgottenusername (1495209) | more than 4 years ago | (#30952808)

Locking your front door and window is merely a deterrent to your fairly normal, average civilized person. It's illusionary security, a social construct that says "hey, this is private, keep out". Same thing with passwords on accounts and firewalls.

Software is held to lofty standards because people don't understand it and blindly have faith in OS vendors, AV vendors etc to magically keep them safe. So when those software companies fail to protect them from threats they don't even really understand they get angry as only ignorant people who got duped can get ;)

Powerful M2TS Converter (-1, Troll)

johnismile (1732642) | more than 4 years ago | (#30947208)

Hi, do you want to convert your M2TS files created by your Sony Camcorder and enjoy them on your Mobile Phone? With this powerful M2TS Converter [m2tsconverterreviews.com] to convert m2ts to mp4 [m2tsconverterreviews.com] Really nice software, just have a try now.

Chrome Apes IE8, Adds Clickjacking, XSS (0, Offtopic)

SharpFang (651121) | more than 4 years ago | (#30947380)

Defenses

I like how Slashdot renders that headline.

Dumb article (5, Insightful)

Undead Waffle (1447615) | more than 4 years ago | (#30947388)

Oh my god Chrome is copying IE by supporting for the http header X-Frame-Options that Microsoft wants web developers to start using. Don't they know you're supposed to invent your own browser-specific variation of what your opponent implements?

I also like how they mention Chrome added 5 security features but they only cover the 2 that are already in IE.

It's nice that all of the browsers are adding security features but can we cover one of them without focusing on who did what first?

Re:Dumb article (0, Troll)

Anonymous Coward | more than 4 years ago | (#30947644)

It's nice that all of the browsers are adding security features but can we cover one of them without focusing on who did what first?

No. The lineage of any technology is always mentioned.

Why is it a problem for you?

It's actually kind of funny that Google releases something that MS initially did: Google copies Microsoft. Google is showing no imagination. First their own OS, Browser and now security features that MS originally put in their browser. What's this with Google?

Did I mention that Microsoft were the first to put these needed security features? Of course when they did it, it wasn't needed, but apparently, their Goodness Google thought differently.

Just what are the Microsoft haters going to do?

Re:Dumb article (4, Insightful)

Robert Zenz (1680268) | more than 4 years ago | (#30947930)

Google copies Microsoft. Google is showing no imagination. First their own OS, Browser and now security features that MS originally put in their browser.

I didn't knew that MS invented operating systems and browsers, and when you write your own that you're copying from MS.

Re:Dumb article (0)

Anonymous Coward | more than 4 years ago | (#30952578)

I know , patent law is pretty tricky that way.

Re:Dumb article (1)

psetzer (714543) | more than 4 years ago | (#30950052)

I'm going to savor the day when there's an article about this awesome new feature in the Linux kernel that uses hardware encryption to verify the integrity of loaded kernel modules and prevent rootkits.

Re:Dumb article (1)

the_B0fh (208483) | more than 4 years ago | (#30966228)

doesn't tivo already do this?

Protection on other browsers (4, Informative)

pmontra (738736) | more than 4 years ago | (#30947514)

This post [hackademix.net] of NoScript's author Giorgio Maone dates back to one year ago and goes into the details of X-Frame-Options. His point seems to be that if you have JavaScript enabled, there are well-known ways [wikipedia.org] to achieve the same result, unless you use IE (they can be circumvented). If you don't have JS enabled, NoScript on Firefox is already giving you the same degree of protection. Anyway (this is me) adding that level of protection by default on all browsers looks a nice thing to have.

Ads (2, Funny)

1s44c (552956) | more than 4 years ago | (#30947622)

If Chrome can't block ads it's not ready for the internet. It doesn't matter what else it does and doesn't do, blocking stupid flashing graphics is the main function of web browsers these days.

Re:Ads (0)

Anonymous Coward | more than 4 years ago | (#30947790)

Don't expect this to be added to Chrome anytime soon. Why would Google help you block their main source of income?

Re:Ads (1)

StripedCow (776465) | more than 4 years ago | (#30947852)

Chrome is open-source, right? Anybody else could add this to Chrome.

Adblock works fine in Chrome (2, Informative)

brunes69 (86786) | more than 4 years ago | (#30947872)

I have Adblock and a ton of other extensions working just fine in Chrome. Just use the testing / developer streams which have plugin support.

Re:Adblock works fine in Chrome (0)

Anonymous Coward | more than 4 years ago | (#30948986)

Or, even better, just use the latest stable release. Chrome 4 went live a few days ago.

Re:Ads (2, Informative)

Ranzear (1082021) | more than 4 years ago | (#30947898)

You're easily a month behind on this. https://chrome.google.com/extensions [slashdot.org]

Re:Ads (5, Informative)

mister_playboy (1474163) | more than 4 years ago | (#30948006)

For users familiar with the ad-blocking in Firefox or Opera, Chrome's ad-blocking extensions are terrible in comparison. They don't render the ad, but they still waste bandwidth downloading it, negating half of their value.

Chromium doesn't include a provision for real element blocking, so this issue would have to be dealt with in the browser itself, not just in the extensions.

Re:Ads (2, Insightful)

W3bbo (727049) | more than 4 years ago | (#30948406)

Some 'adblocker detection' services may flag your client if they see you've downloaded the page, but not the associated ad content, so they know your browser isn't displaying the ad, but if the client does download it they have no way of knowing if it's being rendered or not, short of using a DOM-inspection script. With the exception of Flash video adverts, I've never had any bandwidth problems with banners, except for those off-site advert scripts that delay the page loading.

Re:Ads (1)

badkarmadayaccount (1346167) | more than 4 years ago | (#30964110)

Do they follow the transfer through? Or can you stop it at the first byte?

Re:Ads (1)

Goaway (82658) | more than 4 years ago | (#30948414)

Well, then, I guess that means Chrome is ready for the internet, huh.

Re:Ads (1)

JThundley (631154) | more than 4 years ago | (#30967690)

Here's how I block flash: Never install it in the first place.

It's foolproof and works on all sites!

What's the need for all this security stuff... (2, Insightful)

Hurricane78 (562437) | more than 4 years ago | (#30947716)

...when Google goes ahead, tracks your every move, and sells it to the same crooks anyway?

(Not trolling here. As far as I heard, Google does track everything. And as far as I know, Google does sell that information to advertisers as its main business. Finally, as far as I know, those advertisers include all those spamming crooks and their friends.)

Re:What's the need for all this security stuff... (2, Insightful)

StripedCow (776465) | more than 4 years ago | (#30947862)

And as far as I know, Google does sell that information to advertisers as its main business

Not so sure about that... in their privacy statement, they say that they inform advertisers only about the number of times their ads were clicked (that is, in total, thus no information about individual clicks is released).

Re:What's the need for all this security stuff... (4, Informative)

Anonymous Coward | more than 4 years ago | (#30948726)

Add .google-analytics. to your AdblockPlus rules. Then install the Better Privacy extension. Finally, remove all existing cookies from Google and make sure that in future the permissions are set to 'Block'. Done, Google is not tracking you anymore.

(I work at Google, hence posting as AC.)

Mod parent up please, very informative! (1)

e2d2 (115622) | more than 4 years ago | (#30949184)

Mod parent up please, very informative!

Re:Mod parent up please, very informative! (1)

badkarmadayaccount (1346167) | more than 4 years ago | (#30964214)

Better - EasyList+EasyElement (USA), EasyPrivacy+Cederics Liste, Malware Domains subscriptions. Though Some sites - not only porn sites - mange to get passed that. I'm stumped why.

Re:What's the need for all this security stuff... (1)

thetoadwarrior (1268702) | more than 4 years ago | (#30954092)

I'm glad no one else is tracking me and that Bing doesn't use the same tactics. If you don't like being tracked then you should attack everyone rather than just the guy on top who will just end up being replaced by someone doing the same exact thing.

Chromium blog post on the new security features (0)

Anonymous Coward | more than 4 years ago | (#30947996)

Chromium blog post on the new security features [chromium.org] , some of which are rather interesting

bit34 (-1, Offtopic)

Anonymous Coward | more than 4 years ago | (#30948110)

formed his own company a 2 I know i7 sux0rs, survey which [idge.net] things 1n YOU CAN. WHEN THE

Off topic: In regards to the facebook icon... (0, Offtopic)

Antiocheian (859870) | more than 4 years ago | (#30948140)

... and the twitter icon as well, appearing on every story and even on my own journal:

fuck off Slashdot.

Re:Off topic: In regards to the facebook icon... (1)

rgo (986711) | more than 4 years ago | (#30948748)

Take it easy gramps... they're making it easier for us to share interesting things in other networks. If you don't wanna share, then don't click the icons.

It's not like they are showing tweets with the comments...

Re:Off topic: In regards to the facebook icon... (2, Funny)

mister_playboy (1474163) | more than 4 years ago | (#30949410)

It's not like they are showing tweets with the comments...

Please don't give them any ideas!

Re:Off topic: In regards to the facebook icon... (1)

Antiocheian (859870) | more than 4 years ago | (#30949898)

You think that my problem is clicking the icons ? These are adblocked. You think if you wanted to share interesting things in other networks you couldn't greasemonkey them yourself ? Of course not.

It's that they facilitate people who wish to share "interesting things" on gossip networks that bugs me.

Does it install in 'program files', on Windows? (1)

Midnight Thunder (17205) | more than 4 years ago | (#30949892)

Can anyone tell me whether it finally installs in 'program files', on Windows XP? I haven't been able to find a way with the previous versions, and this is my only hurdle to installing it on my work PC due to the anti-virus rules.

No thanks, no more Chrome for me. (1)

cheros (223479) | more than 4 years ago | (#30950588)

I stopped using Chrome. It comes from a supplier that sees privacy as a problem, and I don't feel I have enough control over what it does with the information it gains from my surfing - that's also why I don't use Google DNS. I also have no idea how to switch the "referrer" information off (in FF that's quite easy).

So, personally I don't give a damn what Chrome (or any other Google app) does. I prefer FF, even when I switch to OSX later this year (yes, I'm switching control freaks :-))..

That's good, but work on usability too please (1)

Daetrin (576516) | more than 4 years ago | (#30952870)

Improving security is great, but they really need to keep working on usability as well! I just installed Chrome for the first time yesterday and have been playing around with it. It seems pretty speedy but the UI is a bit weird.

The lack of a title bar seems kind of weird. I don't know what they were going for with that, but it's the only window on my entire machine and it stands out, and not in a good way. At one point i tried adding a new tab while waiting for visual studio to start a debug session, and the UI hung up for a little bit, and for a few brief seconds Chrome acquired a title bar. I actually thought it looked better that way. A couple minor aesthetic gripes. I may eventually get used to having the tab bar above the toolbar, though currently it seems pretty funky to me.

I haven't done a side-by-side comparison with Firefox yet, but my initial rough estimates seem to be that Chrome uses at least 75% as much memory as Firefox, possibly more, and at least as much virtual memory. I find the fact that Chrome has about 40 process running right now to be rather awkward, but hopefully it at least means that when i start closing large numbers of tabs that the memory will actually be released (unlike Firefox.)

The biggest problem however is the tab bar. Personally i don't like having new tabs open in the middle of the bar, screwing up the ordering, but it was easy to find an extension to fix that behavior. However if you open up a lot of tabs they just get smaller and smaller until you can't see what each of them is anymore. And to my further frustration there's no way to access a list of the tabs. There are a couple extensions that offer some kind of tab index, but nothing that presents a simple list like in Firefox.

After a little searching i found out the reason for these problems in a Chromium blog post. [chromium.org] The designers are approaching the UI design from a heavily aesthetic angle. Which is good in theory, but they're also being fanatical about it. If they don't think a feature is aesthetically correct but can't think of a more aesthetically pleasing way to implement it they just won't implement the feature at all, even though they admit that the lack of that feature causes usability problems!

And to wrap it all up, they say "In all of these areas we've resisted adding options to control behavior. Keeping our set of options minimal is a good forcing function for us as user interface designers to come up with the right approach, since we never rely on the crutch of making the user decide what we were unable to."

Well i hate to tell you guys, but it doesn't seem to be working really well as a "forcing function" given that you've crippled an important part of the UI while dithering about what the "best" way to implement it is. The blog post was made a year ago and they apparently still haven't found a solution! And i find it very aggravating that they feel once they've come up with the "right" approach they don't want to provide options to do it any other way. Clearly if the user has a different aesthetic sense than the designer then the user is wrong! I've dealt with designers like this on projects before, and trying to convince them that the users can legitimately have a different opinion is a very frustrating task.

I remember the painful process of Firefox developers trying to get their tab bar into a useful state under similar circumstances. Perhaps their solution isn't 100% aesthetically appealing to the Chrome designers, but it undeniably _works_, and leaving the users hanging while they try to figure out something more "aesthetically" and "spatially" pleasing seems like pure egotism to me.

Re:That's good, but work on usability too please (0)

Anonymous Coward | more than 4 years ago | (#30959318)

I like this post, it's critical but constructive and well thought out.

It's also wrong. I don't like to nit pick at each point separately but your complain with chrome is basically you don't like how it looks. That's fine an all but we all know you won't please everyone.

I like that there is no title bar, I like the way tabs open. The memory that chrome uses is excellent, simply because you can get it back. I could go into length about how you might have measured the memory wrong or why it doesn't matter or how clever it uses it but.

I feel the important thing to remember is now that there is so much choice, pick what you like. Trying to get aesthetics changed is impossible because someone else is going to complain, you need to think about the reasons for the changes, e.g.

No title(full) bar? - If your using a widescreen view, and extra 20-30px that bar takes up pretty much needlessly is great, and no status bar at the bottom.

That's the example I'm going with anyway.

Want to know the killer feature for me? Closing tabs. closing multiple tabs means leaving your mous over the X, clicking the correct amount of times. Firefox I've got to click twice the amount because it ignores the second click for some reason if it's over the X already, and if the tabs resize i've gotta move my mouse and onto the X again. Yes I find this annoying.

Re:That's good, but work on usability too please (1)

Daetrin (576516) | more than 4 years ago | (#30959562)

I should have put the "A couple minor aesthetic gripes. I may eventually get used to [them]" part at the top of the paragraph talking about aesthetic stuff, that was bad editing on my part and confused things, sorry.

I agree with you that they can't fix the aesthetics to please everyone. I'm hoping that changes like that will be something that's easy to implement in extensions later.

The part i'm more concerned about is the usability issues i talked about further down, particularly in regard to tabs. Like you said, they've improved some part of the tab interface in regards to Firefox. The fact that they then turned around and rejected usability features that Firefox perfected a long time ago in the hopes of _eventually_ implementing something better and more aesthetically pleasing is not okay in my book. If they had a way to handle large numbers of tabs other than a sliding tab bar and a drop down index that might be a little frustrating to those of us who preferred the old way, but it would be bearable. Getting rid of the old way but not replacing it with anything is just maddening, as is insisting that they're not going to add options because giving us a choice would indicate they had failed to find the "one true way." It is unrealistic, and somewhat hubristic, to believe that there is actually a "one true way" that is perfect for _everyone_ and that they will be the ones to find it.

Chrome 4? (1)

anexkahn (935249) | more than 4 years ago | (#30952962)

By this time next year we will be on Chrome Version 17!
Check for New Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...