New in Chrome 73
developers.google.com
developers.google.com
Break point like console logging is a neat idea.
And safari's own devtools inherited it years ago.
edit: looked it up, was introduced in Safari 8 (2014): https://news.ycombinator.com/item?id=8585122
This may be useful for improving security, especially of CDNs. Binary Transparency seems to be one of the use cases mentioned in the spec[1] - perhaps someday this would be used for an unified scheme for signing application packages/updates, without reinventing the wheel every time.
[0]: https://developers.google.com/web/updates/2019/03/nic73#sgx
[1]: https://wicg.github.io/webpackage/draft-yasskin-http-origin-...
Currently only one CA provides paid certificates with a special extension so that the cert can be used to sign SXG files [0].
[0]: https://www.digicert.com/account/ietf/http-signed-exchange.p...
As for binary transparency it's not enough to stamp the certificate (that's what CT logs do). The artifact would have to be stamped and published in a widely accessible source. Actually Binary Transparency doc published by Mozilla [1] creates a new regular certificate for new published binary thus utilizing CT infrastructure as it is today.
[1]: https://wiki.mozilla.org/Security/Binary_Transparency
If we're at Mozilla, it's also interesting to see what's their position on SXG [2]. There is only one spec there with that status there.
It seems the real issue at the moment is that it just isn't a high priority for them.
Displays the origin of the content?
This is one of our longer term visions for the API, not there just yet.
You cannot sandbox and have native access, full stop.
What's the point of buying into the whole Chrome Sync thing if it randomly dies for no apparent reason?
https://wicg.github.io/construct-stylesheets/
They added two new methods to solve the FOUC (flash of unstyled content) problem.
It can easily become part of the standard if the feedback is positive.
"When the browser loads this Signed Exchange, it can safely show your URL in the address bar because the signature in the exchange indicates the content originally came from your origin."
- the original website will not see these requests in its logs. Can visitors even tell that their browser is not accessing the server that shows up in the address bar? Their privacy is being violated.
- when the original website deletes or modifies a resource, the old outdated version may still be distributed by a 3rd party
Alternately, depending on your perspective, it could improve privacy, by making it easier to create web apps that don't phone home and disclose your IP address. Perhaps distributed on a DVD? (I don't know if it supports full offline access.)
Yes, reading stale content is possible. But this model of distribution is not new, it's how ordinary software distribution works. It's like downloading software from a mirror site, but the signature is automatically checked.
Or consider what Cloudflare does and that you need to give them use of your private key to make it work. It's a trade-off.
It also seems to sometimes not want to display the text for the New Tab icons in white and picks a nearly-imperceptible slightly-darker grey.
With `prefers-color-scheme` soon websites will be able to react to system theme too.
intel sgx: software guard extensions
chrome sgx: Signed HTTP(????) Exchanges
* Dark mode is now supported on Mac, and Windows support is on the way.
What's missing in Firefox?
Opera also has a battery saving feature.
Tried running Edge for a while, which is gentle on battery, however Edge is just lacking.
However when I develop I always develop for Firefox first, but the Firefox developer tools are starting to age as well.
Has the web standards become so complex that it is inevitable that we will have a Chromium monoculture?
I want to believe, but I heard that multiple times and still can't even open simplest html websites without hearing the pain of my machine.
It's nice to have choiches.
Web monoculture make the web worse for everybody.
It was also not respecting the standards but only after a while (at release it was at the forefront of it), and that is also not a problem that Chrome can relate to.
I say that as someone who uses Chrome, enjoy it, but would also prefer if we didn't go back to a single engine being supported on the web (and I switched back to firefox on mobile, because of chrome lacks of support for ad blocking there).
By confusing what the fight is about and trying to make it about what it's not, I fear you make some people like me ignore it.
When ad blockers won't work, when you get DRM everywhere and trackers will be embedded in the browser, the tech will have progressed. Yet it will not be the progress you want to live.
It's like if suddenly you had only one car maker and say "it will be easier to design infrastructure for it". Yes, it will be. But it also mean you won't get innovation for you, only for the car maker.
For google that would mean pushing techs serving the ad and data collection business of course. But also in general, that would mean building for big companies. Adopting standards that are mostly beneficial to people that have the money to buy patents, setup many CDN, have high end engineers, invest in specialized hardware, etc.
"Chrome being a monopoly is bad because X" and I say there are lots of issue with only Chrome remaining but not X, it doesn't apply to Chrome. You answer by saying "but there is Y, and W, and Z, and ..." which is basically my point: no need to focus on what is not the issue.
Mozilla (then at 0.9.x) and Internet Explorer 5 for Mac were both significantly better.
You seem to be missing the link between monopoly and stagnation though. IE wasn't always stagnant. It brought us XMLHTTPRequest for instance.
I think the debate has to be about whether or not Chromium being open source changes the equation.
My biggest worry with a Chrome quasi monopoly would be the erosion of browser making competence and financial resources outside of Google.
So whenever Google's vested interests clash with what users want, there would be no one left to step up. Chromium would be open source, but only Google employees would know the source well enough to do anything with it.
It's a worry. I'm not saying it's the same as with a closed source IE back then.
I was there when IE 6 was a thing, and no, nobody was complaining that IE was too static. That wasn't the main reason at all. One of the main problems is that it was too dynamic, but in a proprietary and unsafe way (ActiveX).
Read, for example, this article from 2002, when "Phoenix" (aka Firefox) was launched: https://www.geek.com/news/mozilla-launches-new-faster-browse...
IE was pushed down the throat of everybody, and the main consumer complaints was "it's bloated".
For developers instead, the craze of the day was to pass the Acid test: we are talking about CSS implementation. We are talking about open standards.
Open standards where the main concerns for developers: http://davidnaylor.org/blog/2005/04/web-standards-acid2-test...
Acid 2 and Acid 3 where a the main thing during the browsers wars (https://en.wikipedia.org/wiki/Browser_wars). And they were ALL about standards.
I see this as a much bigger issue than IE ever had. It's not technical so a simple patch in your web app won't fix it.
Tabs: with the old edgy style you saw "more" and was easier to click. This might be a personal choice though.
Account: Previously (on Windows) your Google account was displayed next to the minimize/maximize/close button. Now it's next to the icons for addons. Wasting space.
Difference between Linux and Windows: On Linux (Fedora, Ubuntu) you can use the scrollwheel to cycle through tabs when hovering over them. Doesn't work in Windows.
There are plenty of tricks to work around ad blockers.
I feel like way too many companies are making native apps just for the sake of users being able to install them and have that icon on the home screen. Most of the time the app doesn't require any native-only functionalities, it could function as web app just fine, so it's a bunch of unnecessary overhead. And mobile platform owners love this as the growing ecosystem means more lock-in.
PWAs seem to be a nice middle ground solution to this problem IMHO.
In fact, PWAs are UWP apps on Windows, having access to all native UWP apis without additional FFI, or having to deal with the likes of Ionic, React Native and friends.
However, if PWAs allow us to ditch electron for good, I'm all for them. Each electron app shipping its own browser copy and having full access to everything on my computer is a security nightmare.