Chrome ‘Bug’ Exempts Google Cookies from Data Privacy Settings | Hacker News Reader

Chrome ‘Bug’ Exempts Google Cookies from Data Privacy Settings

hfet.org

174 pointsbetaman029 comments

Dupe. Previous discussion:

https://news.ycombinator.com/item?id=24817304

https://news.ycombinator.com/item?id=24837404

https://news.ycombinator.com/item?id=24856402

What's missing from those links is that this was clearly a bug and was already fixed. This just surfaces in cycles from bloggers who can't be bothered to check their articles for outdated info.

bloggers who can't be bothered to check their articles for outdated info.

Accurate, timely information doesn't generate clicks. Outrage pays.

These days it seems like 70% of the links on HN are rando bloggers trying to make tech nerds angry for fun and profit.

From deep in one of those previous threads, the fix was https://chromium.googlesource.com/chromium/src.git/+/f800edb...

It appears to be only partly fixed: https://news.ycombinator.com/item?id=25144791

Isn't this just partially fixed? I believe google.com cookies are still exempt in the current latest release.

So shocked. Funny how bugs, errors, omissions, and “mistakes” so often benefit the entity making them lately.

And often the damage is already done. Cf. AARD code which was only in Windows 3.1 beta

Wow. Compared to what Apple and Google today that's so tame, but it was handled seriously by the government.

Any followup to this, since the original story is from back in October? Namely, has Google fixed their 'bug'?

It appears to be partly fixed, partly unfixed.

Specifically, youtube.com seems to have been fixed in Chrome 86.0.4240.111 on October 20, soon after this went "viral", but google.com remains unfixed in the latest Chrome 87.0.4280.66

Everytime a chrome thread comes up I love putting this quote up from a chrome dev here on HN "We put a lot of thought in the APIs we implement you can trust us to do the right thing."

FTA- "We are aware of a bug in Chrome that is impacting how cookies are cleared on some first-party Google websites. We are investigating the issue, and plan to roll out a fix in the coming days."

Chrome is open source, right? So can we see the bug and judge if it really does seem like an innocent bug?

> Chrome is open source, right? So can we see the bug and judge if it really does seem like an innocent bug?

Not sure what the sibling comments are talking about. The bug fix[1] links the original change that introduced the bug[2].

[1] https://chromium.googlesource.com/chromium/src.git/+/f800edb...

[2] https://chromium-review.googlesource.com/c/chromium/src/+/21...

Thanks for digging this up! It only addresses the YouTube half, but if memory serves the Google half is due to a mandatory deep integration between browser profiles and Google cookies. I'm unclear if they classified that one as a "bug" (not that it really matters since they use custom HTTP headers to implement tracking for google properties).

Chrome is not open source, it's a derived proprietary superset of the open source Chromium. They are not the same thing in very material ways

Only a few things are different in Chrome. Notably, it has the ability to send crash reports and metrics, play proprietary audio codecs, some Google API keys are added (eg. safe browsing, speech, web store), and the Widevine component to enable DRM. Nothing is different in the core code of the browser.

https://chromium.googlesource.com/chromium/src/+/master/docs...

> in very material ways

No pun intended?

Each user's version of Chrome is not necessarily the same. As a result of field trials/variations, some Chrome users are running code that is not yet (and may never be) available to the public.

https://textslashplain.com/2017/10/18/chrome-field-trials/

https://www.ghacks.net/2013/04/05/field-trials-in-chrome-how...

https://stackoverflow.com/questions/12183575/what-is-followi...

It's crazy that even though this came out a while ago, it STILL has not been fixed. Nasty practice by Google. And I do not for a second believe that a bug caused this LOL. Come on...

It's fixed for YouTube.

And the way the big was introduced is now well-understood.

What other browsers can you guys recommend that support Linux and have cloud sync capabilities? I'm currently eyeing Opera and brave but wanted to see if I have more options. Thanks.

Additional vote for Firefox. Lately it's been less buggy for me than Chrome even.

Firefox?

Funny I would have recommended firefox about a year ago, its hot garbage now. They destroyed the UI and user flow, destroyed bookmarks and downloading from browser recently. Hot. Mess.

Also mighty fishy 3 new accts created to say the exact same thing at the same time, especially as it's no longer truly viable IMO.

Just the other day I posted an ask hn about how to export saved login data/bookmarks from firefox which used to be easy as could be- they have now completely removed the capability.

Firefox is now run by MBAs and is the new IBM.

As for an alternative fennec seems to be a close fork and is available on f droid.

And another vote for Firefox. It is way better than Chrome atm.

Firefox is far from perfect but it seems to be the best thing out there for now.

Another vote for Firefox. Seems to be the best option out there IMO.

Reply on news.ycombinator.com