6 ms·

>Many didn't know that Chrome engineers could run experiments on their tightly-controlled Chrome installations, let alone that Google engineers could just ship

>Many didn't know that Chrome engineers could run experiments on their tightly-controlled Chrome installations, let alone that Google engineers could just ship changes to everyone's browsers without any prior approval. Uhm, isn't that the entire auto-update feature, that google ships changes without you even being aware?

esquire_900 7y ago
Strange indeed that "tightly controlled enterprise environments" are so blissfully unaware of the functionality of chrome.
- tomc1985 7y ago
  There aren't a lot of alternatives to the current trend of shipping shit fast and furious.
  - esquire_900 7y ago
    Firefox does: https://support.mozilla.org/en-US/kb/firefox-esr-release-cycle https://support.mozilla.org/en-US/kb/firefox-esr-release-cyc...
    - mrspuratic 7y ago
      ESR user for many years, plus useragent-switcher for sites that pretend to care about my "security" (but mostly care about CSS eye candy and the latest whizzbang). Free beta tester for other people isn't in my job description ;-)
      - progval 7y ago
        > plus useragent-switcher for sites that pretend to care about my "security" What kind of site does that? I'm on ESR too (from Debian's repos) and never seen anything like it
        krageon 7y ago
        Specifically this example I don't know, but there are pretty big differences between look and feel on websites when sending a Chrome UA vs a Firefox UA. The most obvious example is Google.
        mrspuratic 7y ago
        I just lie about the version: an ESR can lag current by 8 major versions, ~12 months (with full security patching of course)
        mrspuratic 7y ago
        Citrix support kb is one. I've heard Twitter & Spotify too.
    - Freak_NL 7y ago
      I always recommend Firefox ESR to corporate clients that use our web-based product. Long-term stability, automatic security updates, and a yearly, well-documented release cycle that allows their IT department to test the upcoming ESR release and upgrade with confidence, while we get the benefit of a modern web browser to target.
    - sciurus 7y ago
      Also relevant is that there are additional management features targeted at Enterprise needs like group policy. https://www.mozilla.org/en-US/firefox/enterprise/ https://www.mozilla.org/en-US/firefox/enterprise/
  - dragonwriter 7y ago
    > There aren't a lot of alternatives to the current trend of shipping shit fast and furious. Sure there are, especially in enterprise, where IE is still a thing. There aren't good alternatives, but...
tozeur 7y ago
The experiments released to the general public should be stable. Unstable experiments are released in their canary builds.
- voiper1 7y ago
  Article said they already ran it in beta and even experimented in stable! >"The experiment/flag has been on in beta for ~5 months," said David Bienvenu, a Google Chrome engineer. "It was turned on for stable (e.g., M77, M78) via an experiment that was pushed to released Chrome Tuesday morning." >"Prior to that, it had been on for about 1% of M77 and M78 users for a month with no reports of issues, unfortunately," he added.
  - omh 7y ago
    This indicates a flaw in their testing strategy. The bug affected Citrix-style environments, where perhaps 10-20 users are running Chrome on the same machine. If 1% of users are running the experiment the chance of two of those 10 users running the experiment is tiny, and when they experience the bug it's unlikely to get reported back to Google.
kaared 7y ago
My interpretation of the below quote from the article is that Google enabled the feature through pushing a configuration change to active clients. So if I'm a sysadmin and have done my due diligence and successfully tested the new build (with my configuration) before deploying it, I would be very unhappy if/when Google decides to turn this on without my consent or knowledge. Ref. quote from article: "Chrome engineers operate a system called Finch that lets them push updated Chrome settings to active installs, such as enabling or disabling experimental flags."
- voiper1 7y ago
  Thanks, I didn't grok that was something different than the auto-update that I'm used to seeing.
omh 7y ago
This change didn't come from a binary update. We were affected and our version hadn't changed (in fact we weren't quite on the latest version - we were still testing it). We have updates disabled and are very much aware of how to manage this. Google changed a feature flag that was automatically picked up by existing copies of Chrome and changed their behaviour.
- voiper1 7y ago
  Whoa, that wasn't clear in the article. Thanks for enlightening me!
  - dudus 7y ago
    That was crystal clear on the article. Be honest you just read the title.
    - voiper1 7y ago
      Right, I put a quote from the end of the article but I just read the title. /s
  - vanadium 7y ago
    In the bug thread, multiple orgs stated they tried to downgrade to the last version and encountered the exact same problem. This alone is going to leave orgs circumspect about their security and Chrome’s reliability, at the very least.
- ehsankia 7y ago
  If Chrome is critical to your company, shouldn't you be testing on Beta before it goes stable? In this case, the feature was enabled on Beta for 5 months, yet not a single impacted company caught it. Even with 1% enabled, no one caught and reported it.
- ikiris 7y ago
  This is explicit. Binary changes and flag flips are very strongly split. This is almost always a good thing, as it means you don't need to roll back binaries to revert problems.

esquire_900 7y ago

Strange indeed that "tightly controlled enterprise environments" are so blissfully unaware of the functionality of chrome.

tomc1985 7y ago
There aren't a lot of alternatives to the current trend of shipping shit fast and furious.
- esquire_900 7y ago
  Firefox does: https://support.mozilla.org/en-US/kb/firefox-esr-release-cycle https://support.mozilla.org/en-US/kb/firefox-esr-release-cyc...
  - mrspuratic 7y ago
    ESR user for many years, plus useragent-switcher for sites that pretend to care about my "security" (but mostly care about CSS eye candy and the latest whizzbang). Free beta tester for other people isn't in my job description ;-)
    - progval 7y ago
      > plus useragent-switcher for sites that pretend to care about my "security" What kind of site does that? I'm on ESR too (from Debian's repos) and never seen anything like it
      - krageon 7y ago
        Specifically this example I don't know, but there are pretty big differences between look and feel on websites when sending a Chrome UA vs a Firefox UA. The most obvious example is Google.
        mrspuratic 7y ago
        I just lie about the version: an ESR can lag current by 8 major versions, ~12 months (with full security patching of course)
      - mrspuratic 7y ago
        Citrix support kb is one. I've heard Twitter & Spotify too.
  - Freak_NL 7y ago
    I always recommend Firefox ESR to corporate clients that use our web-based product. Long-term stability, automatic security updates, and a yearly, well-documented release cycle that allows their IT department to test the upcoming ESR release and upgrade with confidence, while we get the benefit of a modern web browser to target.
  - sciurus 7y ago
    Also relevant is that there are additional management features targeted at Enterprise needs like group policy. https://www.mozilla.org/en-US/firefox/enterprise/ https://www.mozilla.org/en-US/firefox/enterprise/
- dragonwriter 7y ago
  > There aren't a lot of alternatives to the current trend of shipping shit fast and furious. Sure there are, especially in enterprise, where IE is still a thing. There aren't good alternatives, but...

tozeur 7y ago

The experiments released to the general public should be stable. Unstable experiments are released in their canary builds.

voiper1 7y ago
Article said they already ran it in beta and even experimented in stable! >"The experiment/flag has been on in beta for ~5 months," said David Bienvenu, a Google Chrome engineer. "It was turned on for stable (e.g., M77, M78) via an experiment that was pushed to released Chrome Tuesday morning." >"Prior to that, it had been on for about 1% of M77 and M78 users for a month with no reports of issues, unfortunately," he added.
- omh 7y ago
  This indicates a flaw in their testing strategy. The bug affected Citrix-style environments, where perhaps 10-20 users are running Chrome on the same machine. If 1% of users are running the experiment the chance of two of those 10 users running the experiment is tiny, and when they experience the bug it's unlikely to get reported back to Google.

kaared 7y ago

My interpretation of the below quote from the article is that Google enabled the feature through pushing a configuration change to active clients. So if I'm a sysadmin and have done my due diligence and successfully tested the new build (with my configuration) before deploying it, I would be very unhappy if/when Google decides to turn this on without my consent or knowledge. Ref. quote from article: "Chrome engineers operate a system called Finch that lets them push updated Chrome settings to active installs, such as enabling or disabling experimental flags."

voiper1 7y ago
Thanks, I didn't grok that was something different than the auto-update that I'm used to seeing.

omh 7y ago

This change didn't come from a binary update. We were affected and our version hadn't changed (in fact we weren't quite on the latest version - we were still testing it). We have updates disabled and are very much aware of how to manage this. Google changed a feature flag that was automatically picked up by existing copies of Chrome and changed their behaviour.

voiper1 7y ago
Whoa, that wasn't clear in the article. Thanks for enlightening me!
- dudus 7y ago
  That was crystal clear on the article. Be honest you just read the title.
  - voiper1 7y ago
    Right, I put a quote from the end of the article but I just read the title. /s
- vanadium 7y ago
  In the bug thread, multiple orgs stated they tried to downgrade to the last version and encountered the exact same problem. This alone is going to leave orgs circumspect about their security and Chrome’s reliability, at the very least.
ehsankia 7y ago
If Chrome is critical to your company, shouldn't you be testing on Beta before it goes stable? In this case, the feature was enabled on Beta for 5 months, yet not a single impacted company caught it. Even with 1% enabled, no one caught and reported it.
ikiris 7y ago
This is explicit. Binary changes and flag flips are very strongly split. This is almost always a good thing, as it means you don't need to roll back binaries to revert problems.