5 ms·

What the heck bugs are you running into that surface as a result of chrome being chrome? I’m no google fan but I find chrome to be far and away the most stable

What the heck bugs are you running into that surface as a result of chrome being chrome? I’m no google fan but I find chrome to be far and away the most stable and enjoyable browser to debug with.

chinhodado 7y ago
One that's particularly annoying to me a while ago was you cannot drag and drop elements from an iframe to another iframe from another domain. IIRC it was only an issue in Chrome.
- dthedev 7y ago
  To be fair, you can't blame them for disallowing things like that. Protection against cross-site scripting, I'm sure.
  - chinhodado 7y ago
    I just don't see a realistic attack vector with cross-origin drag-n-drop.
    - jonny_eh 7y ago
      Anything cross-origin is a potential XSS attack.
    - eganist 7y ago
      This one's actually pretty easy: clickjacking. Imagine permitting cross-origin drag-n-drop and a page is clickjacked: the user may end up dragging a sensitive item in the clickjacked page into an invisible iframe with a drop point layered on top of whatever target the user thinks they're dropping data into, and the end result would be that data intended for one endpoint, in this case the endpoint that was clickjacked, is sent to another. It'd be a nontrivial attack to mount, but as you posed the challenge, I can see it done as part of e.g. a phish where a site like dropbox is iframed in a clickjacking attack (assuming they haven't mitigated it). I can sketch (literally) what the dom might physically look like if it helps convey the attack I have in mind more effectively.
    - pdjstone 7y ago
      Here's some stuff you used to be able to do by combining UI-redressing (clickjacking) with cross-origin drag and drop. https://www.contextis.com/media/downloads/Context-Clickjacking_white_paper_2010.pdf https://www.contextis.com/media/downloads/Context-Clickjacki... There have also been plenty of UXSS bugs in various browsers caused by cross-origin drag-and-drop.
sdegutis 7y ago
I think GP means that Chrome deviates from some HTML/CSS/JS/etc official standards, and that they don't intend to fix a lot of these discrepancies. So when you write code how it's supposed to work according to the standards, and it works well in Firefox, it might not work right in Chrome. (And GP suggests this is common.)
simion314 7y ago
An example, a third party lib I used crashed because after an update Chrome changed an optional function parameter into a required one, I am referring to this function https://developer.mozilla.org/en-US/docs/Web/API/Element/requestFullScreen https://developer.mozilla.org/en-US/docs/Web/API/Element/req... So in my case I go to work and get reports that X is no longer working, lucky for me in JS is easy to patch third party code and fix this issue but I could not find a ticket that explains why Chrome did this.
mceachen 7y ago
https://bugs.chromium.org/p/chromium/issues/detail?id=158753 https://bugs.chromium.org/p/chromium/issues/detail?id=158753 meant PhotoStructure had to do user agent sniffing. If it's Firefox, I can stream the original image directly, and the correct thing happens. With Chrome, I have to do the rotation server-side before I send it to the browser (or I'd have to send metadata about the image to rotate it client-side with CSS, either is irritating). There are several more #ifdefs I've had to add due to weird chrome glitches (like around the html5 video player, which just works seamlessly with Firefox).
soulofmischief 7y ago
Don't get me wrong-- on the Firefox side of things, it's been the user experience of the browser itself which has been suffering. Every single update since Quantum has made things worse. Three days ago I opened up Firefox to find out all of my settings had been nuked, 200+ tabs, themes and extensions lost, about:config reset, search settings reset (hello again Google) etc. I'm still fuming mad about this. I don't feel like drudging up old history but my most recent bug was that Chrome doesn't properly bubble mouse click events when some UI elements fire. WONTFIX of course, apparently I should just use event.preventDefault() even though every other browser handled this particular mouse event correctly. Chrome was the only outlier. So now I am writing code specifically for Chrome. Two years ago I had an SVG rendering bug that turned out to be so deep that I had to spend two weeks debugging and come up with an incredibly convoluted scheme for loading dynamic SVG icons because `<use/>` is broken hot garbage on Chrome. Bug report dead in the water. More code just for Chrome. You get the picture. I now have to develop on Chrome as much as I hate it, even though FF has better debug messages and stability, just because it saves time testing every little thing out.
- badamp 7y ago
  Can’t you restore all the settings from a TimeMachine backup or similar? They’re just stored in files in the profile directory.
  - javagram 7y ago
    I upvoted you (because your suggestion is a good solution) but let’s be real, most people don’t have backups, even developers. In my experience as a developer companies don’t even issue me a USB backup drive to run time machine on my work issued MacBook Pro unless I specifically request it.
    - jyrkesh 7y ago
      Really replying to @tlb here (reply depth is maxed), but what's the Time Machine equivalent for ? Most of the pre-rolled backup solutions I've used either have you point to a specific set of content folders (like Photos, Music, Videos, etc.), and do a terrible job at handling profile data, system files, and everything that's "in use" when using my box is handling some kind of state.

What the heck bugs are you running into that surface as a result of chrome being chrome? I’m no google fan but I find chrome to be far and away the most stable and enjoyable browser to debug with.

chinhodado 7y ago

One that's particularly annoying to me a while ago was you cannot drag and drop elements from an iframe to another iframe from another domain. IIRC it was only an issue in Chrome.

dthedev 7y ago
To be fair, you can't blame them for disallowing things like that. Protection against cross-site scripting, I'm sure.
- chinhodado 7y ago
  I just don't see a realistic attack vector with cross-origin drag-n-drop.
  - jonny_eh 7y ago
    Anything cross-origin is a potential XSS attack.
  - eganist 7y ago
    This one's actually pretty easy: clickjacking. Imagine permitting cross-origin drag-n-drop and a page is clickjacked: the user may end up dragging a sensitive item in the clickjacked page into an invisible iframe with a drop point layered on top of whatever target the user thinks they're dropping data into, and the end result would be that data intended for one endpoint, in this case the endpoint that was clickjacked, is sent to another. It'd be a nontrivial attack to mount, but as you posed the challenge, I can see it done as part of e.g. a phish where a site like dropbox is iframed in a clickjacking attack (assuming they haven't mitigated it). I can sketch (literally) what the dom might physically look like if it helps convey the attack I have in mind more effectively.
  - pdjstone 7y ago
    Here's some stuff you used to be able to do by combining UI-redressing (clickjacking) with cross-origin drag and drop. https://www.contextis.com/media/downloads/Context-Clickjacking_white_paper_2010.pdf https://www.contextis.com/media/downloads/Context-Clickjacki... There have also been plenty of UXSS bugs in various browsers caused by cross-origin drag-and-drop.

sdegutis 7y ago

I think GP means that Chrome deviates from some HTML/CSS/JS/etc official standards, and that they don't intend to fix a lot of these discrepancies. So when you write code how it's supposed to work according to the standards, and it works well in Firefox, it might not work right in Chrome. (And GP suggests this is common.)

simion314 7y ago

An example, a third party lib I used crashed because after an update Chrome changed an optional function parameter into a required one, I am referring to this function https://developer.mozilla.org/en-US/docs/Web/API/Element/requestFullScreen https://developer.mozilla.org/en-US/docs/Web/API/Element/req... So in my case I go to work and get reports that X is no longer working, lucky for me in JS is easy to patch third party code and fix this issue but I could not find a ticket that explains why Chrome did this.

mceachen 7y ago

https://bugs.chromium.org/p/chromium/issues/detail?id=158753 https://bugs.chromium.org/p/chromium/issues/detail?id=158753 meant PhotoStructure had to do user agent sniffing. If it's Firefox, I can stream the original image directly, and the correct thing happens. With Chrome, I have to do the rotation server-side before I send it to the browser (or I'd have to send metadata about the image to rotate it client-side with CSS, either is irritating). There are several more #ifdefs I've had to add due to weird chrome glitches (like around the html5 video player, which just works seamlessly with Firefox).

soulofmischief 7y ago

Don't get me wrong-- on the Firefox side of things, it's been the user experience of the browser itself which has been suffering. Every single update since Quantum has made things worse. Three days ago I opened up Firefox to find out all of my settings had been nuked, 200+ tabs, themes and extensions lost, about:config reset, search settings reset (hello again Google) etc. I'm still fuming mad about this. I don't feel like drudging up old history but my most recent bug was that Chrome doesn't properly bubble mouse click events when some UI elements fire. WONTFIX of course, apparently I should just use event.preventDefault() even though every other browser handled this particular mouse event correctly. Chrome was the only outlier. So now I am writing code specifically for Chrome. Two years ago I had an SVG rendering bug that turned out to be so deep that I had to spend two weeks debugging and come up with an incredibly convoluted scheme for loading dynamic SVG icons because `<use/>` is broken hot garbage on Chrome. Bug report dead in the water. More code just for Chrome. You get the picture. I now have to develop on Chrome as much as I hate it, even though FF has better debug messages and stability, just because it saves time testing every little thing out.

badamp 7y ago
Can’t you restore all the settings from a TimeMachine backup or similar? They’re just stored in files in the profile directory.
- javagram 7y ago
  I upvoted you (because your suggestion is a good solution) but let’s be real, most people don’t have backups, even developers. In my experience as a developer companies don’t even issue me a USB backup drive to run time machine on my work issued MacBook Pro unless I specifically request it.
  - jyrkesh 7y ago
    Really replying to @tlb here (reply depth is maxed), but what's the Time Machine equivalent for ? Most of the pre-rolled backup solutions I've used either have you point to a specific set of content folders (like Photos, Music, Videos, etc.), and do a terrible job at handling profile data, system files, and everything that's "in use" when using my box is handling some kind of state.