Chrome 14 released | Hacker News Reader

Chrome 14 released

googlechromereleases.blogspot.com

69 pointsAshleysBrain46 comments

This release includes another significant change that, for some reason, neither the submitted article nor the higher-level announcement [1] mentions: if an HTTPS page loads a script over HTTP, the script is now blocked from executing. There's a popup which warns you that "This page has insecure content", and you can opt to ignore the warning and unblock.

[1] http://chrome.blogspot.com/2011/09/new-stable-release-of-chr...

This was covered a little while back. [1][2]

Still worthy of mention though. I personally love this change. I am on the dev channel (15.0.874.5) and I think insecure content is just blocked by default, without a dialog.

[1] http://news.ycombinator.com/item?id=2662694 [2] http://news.ycombinator.com/item?id=2698378

It was covered as a future change, but as it breaks apps, it's important to note that this release brings it into the mainstream.

Agreed, although you could argue that apps were already broken. Chrome just isn't as kind to broken apps anymore.

BTW, has anyone actually seen an extension using the experimental sidebar API in the wild?

http://code.google.com/chrome/extensions/experimental.sideba...

I've been waiting for a bookmarks sidebar (which I habitually use as a reading queue in other browsers).

You're not allowed to submit extensions/apps that use the experimental APIs.

Right, but what's to stop you from publishing one on your personal blog? I googled for people playing around with it and came up more or less empty-handed. Or is extension install non-trivial if you're not going through the web catalog? How do extension authors test their work?

I've written only apps for Chrome, not extensions, but the process is nearly identical. If you go to Wrench > Tools > Extensions you can load the directory you're working in. I suppose you can self-publish extensions with the experimental APIs but I doubt many people play around with chrome.experimental. I played around with chrome.experimental.tts a bit, but not knowing if the feature will be killed or promoted is reason enough not to waste too much of your time.

I wrote my own extension to place a reading list of URLs in the sidebar.

I was sick of having 50+ tabs open, so now I can click on a link or press a button on a window to add it to the stack.

I would say that I am going to release it soon, but I have said that about a dozen other mini-apps that I use myself and have yet to release :)

follow me on github if you want notification of when I do release it: http://github.com/nikcub

(and btw, I have yet to add any of my chrome extensions to the web directory. they are all self-hosted, including the updater, and they have thousands of users. chrome users are pretty good about going out on the web to find extensions)

There's this guy, who I think is doing tree tabs:

http://code.google.com/p/sidewise/

Is this really the Chrome implementation of a sidebar?

Looks to me more like a floating secondary window which continually tries to dock to the main Chrome frame.

I started a few months ago but at the time there was no way to change the width so it didn't end up being useful. I've been meaning to check if this has changed since then or not.

How come they didn't mention it includes Native Client and the Web Audio API? That is very newsworthy.

http://www.readwriteweb.com/archives/new_chrome_blurs_the_li...

Does anybody have more details about this bug or the fix. The Google code link 403s for me:

[$2337] [93906] High CVE-2011-2862: Unintended access to v8 built-in objects. Credit to Sergey Glazunov.

[93906] http://code.google.com/p/chromium/issues/detail?id=93906

I think the release managers usually unlock security bugs for a release once most of the population has been updated. So check back in a few days to a week.

The blog posts mention that the bugs are only kept private until most people are up to date, but some never seem to be made public. For example:

http://googlechromereleases.blogspot.com/2011/01/chrome-stab...

Some of the bugs (e.g. 66560) still give me a 403 (although some are accessible).

Of the 15 bugs there, 9 are open now. I'll poke someone more knowledgable and ask them to explain why the others have not been opened.

I could imagine that it's that the process for unlocking them is manual and easy to forget, or it could be that other instances of those bugs were uncovered so it still isn't safe to open them.

aayra (who replied to great-grandparent) works on Chrome security team. It looks like all the bugs that are still closed are WebKit bugs (css, svg, etc), and we don't open them until the other WebKit clients are updated.

66560 is a webkit issue. Webkit is an open source project. Webkit vulnerabilities are not disclosed until all the other consumers like Safari are updated.

Just to expand on @aboodman and @aarya's responses, for any third-party dependencies we don't disclose the details of the vulnerability until we're reasonably certain all affected parties have had time to deploy a fix.

It seems like Sergey Glazunov practically makes a full time living off of Chrome bug bounties. Someone should do an interview with him - I bet it would be pretty interesting.

Sergey's a university student in Russia, and he's actually quite private. As interesting as it would be to here his perspective and approach (almost all manual source auditing) I'm not sure he'd be entirely comfortable with that level of attention.

Which only means all the bugs get a "MovedFrom-14" tag.

looks like full-screen is back in lion, and actually works!

Big fan of Firefox nightly here. It's only 5% slower than Chrome dev channel on Kracken, has a better garbage collector (fewer pauses, less overhead), is more configurable (UI, better extensions), about the same compositing, scales to any number of open tabs.

I can't wait until the new download manager lands, the current download window feels archaic.

Try download status bar, been using it for years.

I don't understand why security-minded people seem to use Chrome more than Chromium. Does anyone understand this?

What do you mean "security-minded"? Chrome doesn't include HTTPS or XSS vulnerabilities that Chromium does not. Both browsers are as 'secure' as each other.

I assume you really mean "people who don't like sharing personal data". They're different things.

Correct, I meant privacy-minded.

I've never heard of the phenomenon myself, but Chrome is self-updating—AFAIK Chromium isn't.

I prefer Chrome because its updater also includes the flash plugin, and it has its own pdf-reader plugin.

Chromium also doesn't do releases, just lots of bleeding edge snapshots, and one or two of those have been badly broken.

I switched from Chromium for the PDF reader. It's nice.

For a while, just copying the PDF reader plugin from a Chrome installation to a Chromium installation worked for me. I've switched to FF Nightly, but you could give it a try to see if it works.

Outside of conspiracy theories and some limited statistics, all tracking features can be disabled.

http://en.wikipedia.org/wiki/Google_Chrome#Usage_tracking

Chromium doesn't have an auto-update mechanism and it can be hard to find a version that corresponds to the current stable release.

I'm concerned about Privacy to the extent that I might actually be negatively affected by it. The worst-case scenario that I can think of from the usage tracking in Chrome (that you can opt out of) is that I get served more relevant advertising that I might actually care about clicking. That doesn't seem evil at all.

I prefer Chrome due to its ability to sync bookmarks, which I use often.

Chromium does this too.

Well, I'm happily running 16.0.878.0 now :) (newer builds break, but only a matter of days till it will be fixed, most likely)

And people complain about the new Firefox release cycles. At least they ship improvements to the browser every release, instead of just shipping fast.

What?

Firstly, there are several improvements:

http://chrome.blogspot.com/2011/09/new-stable-release-of-chr...

Secondly, Firefox's new release is the same as Chrome's. Every six weeks, like clockwork. More releases, less big features in each release.

Like I said, same release cycle, but barely shipping anything. Please try to read comments before you reply to them. Thanks!

Please try to know your history before posting. Thanks!

The Chrome release cycle is meant to make sure not only features, but critical updates make it out to users on a timely basis. Every release isn't guaranteed to be feature-packed because that isn't the goal.

Ultimately it's about keeping the project on a steady rhythm of development which sees features and fixes out the door as soon as they're ready.

I'm not complaining about Chrome's release cycle. I'm pointing out the double standard.

Don't assume things!

Chrome updates itself and things like Flash, you never have to do anything. Indeed most users won't even realize they have been updated, it's quite invisible. It has also always worked this way, so knowing what version of Chrome you're using isn't even a concept.

This release did include some major features, such as the Web Audio API and support for NaCl in extensions. There are a number of other features and improvements as well, but just those two are pretty big.

As for the double standard you're claiming, people made a lot of noise when Chrome started the six week release process over a year ago. However, it's died down now that people are used to the release pacing. Firefox just started their rapid releases, so I'd expect any negative commentary to trail off in the same way.

Reply on news.ycombinator.com