Hacker News Reader

I reported a very serious one to Edge recently and the team told me they would "backlog it and might be on a future release".

Chrome had already patched it and Firefox never had it. (It was related to incorrect DOM spec implementation of document inheritance allowing cookie access from anywhere).

I'll do a full write up and blog it when I'm back from vacation but to summarize I was really unimpressed by the team at Edge and Microsoft Security.

Yeah that Chrome experience doesn't sound great. Fwiw I tend to put my test cases on jsbin or Glitch, but yeah, a Chrome engineer should know to put the page on a basic web server.

If anyone runs into problems like this, feel free to bug one of the Chrome dev rel folks, such as me.

Like I said, my impression is that often the people replying are not engineers. Here's one with that problem: https://bugs.chromium.org/p/chromium/issues/detail?id=674096...

Yeah, that's not great, but the commenter in #12 is a senior engineer on devtools, so at least the right person saw it in the end.

<soapbox> looking at that ticket, the response from google is catastrophic. the guy or gal handling the ticket has no idea about web browsers. the reporter shows up with a complete reproducer and the best google manages is throw clueless screenshots (for a brief fully textual error message no less!) at them? they've already done a bunch of your work for free. get your ass off the heap of money, ffs! </soapbox>

edit: oh, and i lower my hat to you for coming here and taking the heat. appreciated, having a real person to vent at is so special in the case of google...

To be fair, the screenshot does provide additional info, like the fact that they are using file://.. It's often better to include more in a screenshot than less.

I would imagine that the chromium teams probably gets a lot of tickets. That means they need a lot of bodies to triage them. It's not like any Sr. Dev ist going to be jumping at that job.

Yeah, it seems they need to take this issue seriously. Could be a way for hackers as well.

https://bugs.chromium.org/p/chromium/issues/detail?id=674096... was an assignment 6 months ago. It's still open after 2.5 years. I would not call this a good outcome.

Sure, but priorities are a thing. I don't think it's fair to compare this to an origin model exploit.

Yeah, this is a UI bug in devtools for a feature not a lot of people use. Plus web worker bugs always get pushed to the bottom of the queue for every browser. So I don't have any problem with how long my weird issues take to get fixed.

It's more about comparing to Firefox where you usually get a quick response which at least conveys that the person on the other end understands what is being reported. I'm fine with the eventual outcome here. A comment acknowledging that it's a real bug (or not) would have been better, but being assigned to someone sort of acknowledges that, I guess.

> Plus web worker bugs always get pushed to the bottom of the queue for every browser.

Why is that?

It's pretty rare to use in user-code. It might be well used in libraries, but I guess the standard developer experience is using libraries not writing them.

Of course it’s rare because it’s unreliable and buggy as shit across browsers atm (tho a lot better than it was).

So... somewhat self-fulfilling

They should take this kind of bugs seriously.

What would you rather happen? Browser vendors hire more people such that they can fix every valid bug ever filed?

Maybe.

A first good step would be if the billion dollar company would try to come up to the standard of the non profit.

*trillion dollar company.

I have an S3 bucket for mine.

E.g. a js closure memory leak:

https://bugs.chromium.org/p/chromium/issues/detail?id=315190

https://s3.amazonaws.com/chromebugs/memory.html

Whoa, that page crashed my (long running) Nightly (presumably exhausted RAM completely) and in freshly started got 4 GB for the tab process (and survived). Nice.

> If anyone runs into problems like this, feel free to bug one of the Chrome dev rel folks, such as me.

Hi, and thanks for being part of creating Chrome && reaching out here.

Now that I have a Chrome guy here maybe you can help with another annoying issues:

-QC internally at Google seems to be blissfully unaware of the fact that other browsers exists.

Examples:

- one glaring issue I'm running into in core Angular on a daily basis.

- Google Calendar performance is sometimes unreasonably slow in Firefox

- For weeks or months Google search results would drive once CPU core to 100% twice a minute.

none of those are something a chrome dev rel person can help you with.

People like you are the reason we have to deal with three layers of low-level tech support before we can actually talk to somebody who knows what they're doing - please don't just spray your random complaints at anybody who happens to be related to google in any way.

And it's not like the Chrome dev rel team doesn't fight for these things, but ultimately the Chrome team doesn't have any control of prioritisation of bugs in other products (like Calendar).

The only way we're going to see a significant change is when those high up in the Google org chart start caring about products working well in other browsers; as long as it's up to each individual product we'll continue to see products prioritising time-to-market and targeting only the browser with the majority of the market.

That's the second reason to post it here: because if you see one googler there are hundreds nearby, and some of them might be at the relevant team.

(And if I point out often enough what happened last time a mega corp abused their position to market their browser then maybe some of them starts talking about it internally?)

> none of those are something a chrome dev rel person can help you with.

Chrome dev rel persons are Google employees. I've been surprised by how much can be fixed once somebody on the inside are aware of it.

Also it seems a lit of googlers hang around here so it might get picked up based on that too.

> People like you are the reason we have to deal with three layers of low-level tech support before we can actually talk to somebody who knows what they're doing -

Blame Google, not me. Where there is a bug tracker I often use it.

Unfortunately there isn't a public one for Search, Calendar etc.

When they choose to only engage on HN, and only with one guy from dev rel, that's where I'll post.

well thanks for doing your best to ensure they stop engaging on HN, i guess...

Tell me a better way to get Google to fix things, I'm all ears.

Complaining in social media, bugging people you know inside the walls and calling them out here works

You have the wrong attitude here. Twice, actually.

The fact that you haven't found a good way to get Google to fix things for you isn't an excuse to just charge forward with the best way that you have found.

Suppose you're stuck in traffic. The most effective way to move forward might really be to just lay on your horn. The people in front of you will probably eventually yield (most just eager to put distance between themselves & you, others generously assuming that you have some kind of emergency). That doesn't make it okay for you to do that.

The second time you had the wrong attitude is when you demanded that people teach you a better way. Maybe somebody on HN will generously extend that favor to you, but if they do then realize that they've done you a favor -- they didn't owe it to you.

Stop using Google products then. Get a new career.

And this is why you don't get immediate access to a dev folks!

I have direct access to Mozilla devs. Look how much I bother them.

Did you report the Safari bug to Apple or to WebKit.org? I've had good luck getting responses and fixes from the webkit guys

They seem to get the things done professionally and effectively.

Personally over many bug reports and many years:

A+ experience with the Chrome team

E with Edge

F with Safari

The Chrome devs have been astonishingly good. My experience has repeatably been that if they are given a good bug report, they get it fixed and often fix it really fast. Or they reply with excellent technical reasons why not. Also multiple times I have seen extreme corner-case regressions get magically fixed without me reporting anything!

Edge - always waffle and misdirection in reply to bug reports. I only bother to give them very well documented, repeatable bugs, plus attached repro file, for things I really need fixed. However: I did have one good experience recently because I reported the bug for the Edge beta, on a feature they were actively working on catching up to the other browsers (however they still had poor interaction).

Safari: hopeless. Report a critical bug with excellent repro file, and get no response, and no fix.

No rating for Firefox because I haven't bothered reported any bugs to them in the last few years.

Edit: this is for non-security related bugs.

Apple hears ya, Apple don't care.

Yeah apparently from people familiar with the deep black hole that is Radar you're supposed to keep submitting bugs, dupes count as a vote or something.

It sounds absolutely horrendous.

I once reported a chrome issue. Got no attention until I found a different issue I thought was related and commented there, which got the attention of someone competent who realized it was a hardware bug they'd fixed before but had a regression.

Not a security bug, just that a very large number of websites didn't load.

In other words, the experience gets progressively worse the bigger the company. I'm not surprised, having worked in companies of that scale the amount of bureaucracy and general red-tape to do the smallest of things is absolutely irritating.

Did you include a 90 day public disclosure window?

and Samsung's browser?