8 ms·

Limiting Private API Availability in Chromium

110 points by yunohn 6y ago

TazeTSchnitzel 6y ago
> Google features, such as […] Click to Call, that are only intended for Google’s use What is this “Click to Call”?
- Jonnax 6y ago
  https://developers.google.com/web/fundamentals/native-hardware/click-to-call https://developers.google.com/web/fundamentals/native-hardwa... Looks like you tap a phone number on a web page and it opens the dialer app
  - merb 6y ago
    I'm not sure if they meant that. Pretty sure that is standard and also works in os's where the link from the browser will be forwarded to the os, which directs to the default dialer application of the os. and it's probably a html living standard.
    - joshuaissac 6y ago
      That's right. The tel protocol is described in RFC 2806, which was written in 2000, although the proposal to make it an Internet Standard did not succeed.[1] It is certainly not a proprietary Google Chrome feature. It may be referring instead to the Chrome feature that allows users to open tel links using their phone (from their desktop).[2] 1. https://www.ietf.org/rfc/rfc2806.txt https://www.ietf.org/rfc/rfc2806.txt 2. https://www.androidpolice.com/2019/11/05/chrome-beta-78-desktop-phone-numbers/ https://www.androidpolice.com/2019/11/05/chrome-beta-78-desk...
      - merb 6y ago
        oh yeah I tried to google what It could mean but I think your second link might be it. didn't found that by googling click to call tough.
- lima 6y ago
  You can right-click on a phone number to call it from an Android phone connected to the same account.
foolinaround 6y ago
Chrome is making this play to limit the functionality in browsers such as Vivaldi, Brave, etc. maybe its good after all to have a different service that provides a private store ( in dropbox etc) for bookmarks. Dropbox (and others) can take care of the syncing.
- jfk13 6y ago
  Not sure I'd care to recommend Dropbox after just seeing https://news.ycombinator.com/item?id=25789603 https://news.ycombinator.com/item?id=25789603.
- j1elo 6y ago
  Xmarks was great for that. It just worked, and I liked that it was independent of the browser in question, so the same bookmarks could be shared and synced with Firefox and Chrome. But it disappeared... we cannot have nice things!
  - smarx007 6y ago
    xBrowserSync is not as nice (frequent full re-syncs) but still syncs bookmarks between Chrome & co. and Firefox. Had to switch to it after Xmarks was discontinued.
- SkyMarshal 6y ago
  Note to self: Don’t use an open source codebase controlled by a major corporation to build a product that competes with that corporation’s product.
- axaxs 6y ago
  Brave doesn't use sign in functionality for syncing. Unsure about Vivaldi.
  - LinAGKar 6y ago
    Vivaldi have their own accounts, and so does Opera and Edge. The biggest impact is for Linux distros which have Chromium in the repos, since they can't redistribute Chrome.
greatgib 6y ago
Personally I don't like these features, but can't this official move being seen as way to curve competitors? Especially looking at how the announcement is worded? "This meant that a small fraction of users could sign into their Google Account and store their personal Chrome sync data, such as bookmarks, not just with Google Chrome, but also with some third-party Chromium based browsers. We are limiting access to our private Chrome APIs starting on March 15, 2021." That I understand as "you can use the open source chromium version, but we did what was necessary to ensure that in all cases and derivatives it will be inferior to closed Chrome". Maybe a next move could be to disable the possibility to use the chromecast from Chromium?
- magicalist 6y ago
  > but can't this official move being seen as way to curve competitors? What competitors are using chrome sync? Other comments mention Brave and Vivaldi, but they both have their own sync systems. Edge has Microsoft accounts, ungoogled-chromium has sync disabled completely...
  - Macha 6y ago
    Arch's Chromium build seems to be one affected: https://lists.archlinux.org/pipermail/arch-dev-public/2021-January/030260.html https://lists.archlinux.org/pipermail/arch-dev-public/2021-J...
- bzb6 6y ago
  Why should third party browsers be able to use google servers to store data? Why should google provide this service for free?
  - dgrove 6y ago
    3rd Party browsers are not, they have their own sync infrastructure. This is mostly affecting builds of Chromium that are not directly built by Google https://groups.google.com/a/chromium.org/g/embedder-dev/c/NXm7GIKTNTE/m/Qxcew5lfCAAJ?pli=1 https://groups.google.com/a/chromium.org/g/embedder-dev/c/NX...
CSDude 6y ago
It's good that Chromium is degoogle'd more, however did they really notice it thanks to an audit? Probably anyone in the organization could have pinpointed this situation existing for years. Or are they just fed up with the (somewhat) popular forks gaining traction? I understand Google's point of view but the phrasing it as a result of an external audit seems funny.
- lima 6y ago
  They didn't say it was an external audit.
abrowne 6y ago
Anyone know if by "third-party Chromium based browsers" they mean sonething like Ubuntu's Chromium package or something like Brave or Vivaldi?
- anaisbetts 6y ago
  All of the above. The only entity that is now allowed to use / call these APIs is Google-built software
  - abrowne 6y ago
    Too bad (I use Ubuntu's Chromium): I don't use sync, but I'll miss the Google Translate feature in Chromium.
bilal4hmed 6y ago
Private APIs are just that private aka not for everyone else to use. I dont see the issue here
- tyingq 6y ago
  Maybe I've got the wrong document, but why would a private api have a public doc on how to use it? https://chromium.googlesource.com/chromium/src/+/HEAD/docs/sync/model_api.md https://chromium.googlesource.com/chromium/src/+/HEAD/docs/s... Edit: Unrelated to what's above, but searching around I came across chrome://sync-internals/ I wasn't aware that existed in Chrome. It's a pretty complete admin type view.
  - est31 6y ago
    chromium is an open source browser. Its development is closed enough already.
chaz6 6y ago
Hopefully this will spur on some competition. I could be tempted to use a Chromium-based browser if I could easily store my data in Nextcloud.
- suhail 6y ago
  It won’t. For users, it will simply make it harder to move to anything not owned by Google. If you can’t move bookmarks, passwords, extensions, history, it requires more effort for the user to switch. Not too mention, interop to sync on mobile.
  - franga2000 6y ago
    You should be able to move them, just not directly sync them with Google. GDPR etc. took care of that. It's on the third party developers to make importing data as easy as possible.
suhail 6y ago
Worked for years. Even showed up in the GCP dashboard as having access. Had no idea it “private”. We just plugged in credentials from Google as per chromium build instructions. They knew we and others were using it because there are stats. Now we are given 2 months to develop a completely new solution.
- lima 6y ago
  The Chromium build instructions are very clear on this: https://www.chromium.org/developers/how-tos/api-keys https://www.chromium.org/developers/how-tos/api-keys > Note that the keys you have now acquired are not for distribution purposes and must not be shared with other users. > Many of the Google APIs used by Chromium code are specific to Google Chrome and not intended for use in derived products. In the API Console (http://developers.google.com/console http://developers.google.com/console) you may be able to purchase additional quota for some of the APIs listed above. For APIs that do not have a "Pricing" link, additional quota is not available for purchase. The notice has been there since 2013, when the page was first archived: https://web.archive.org/web/20131211101458/https://www.chromium.org/developers/how-tos/api-keys https://web.archive.org/web/20131211101458/https://www.chrom...
  - deleted 6y ago
    [deleted]
  - suhail 6y ago
    Buried in depths of their documentation? It’s also worked for years too. Google has docs that are completely outdated and neglected. Chrome Extension docs didn’t get updated for 5+ years until recently. Why put it in the console then? Why have tool tips that say “Access to this API is enabled.” There’s no improvement to security. This will be a cake walk to reverse engineer. I don’t see how my point is invalid.
    - lima 6y ago
      > Buried in depths of their documentation? You mean right in the instructions on how to acquire them? > It’s also worked for years too. It was tolerated for years, but it was always on very shaky ground. Now Google pulled the rug. I'm annoyed because that means my Chromium AUR package stops working, and I'll have to pry the tokens from a release build, but this isn't unexpected. > Why put it in the console then? Why have tool tips that say “Access to this API is enabled.” For outside developers who want to work on Chromium. This is also CLEARLY stated in their docs. > There’s no improvement to security. This will be a cake walk to reverse engineer. They didn't say it was about security.
CyberRabbi 6y ago
How are they technically going to prevent non-chrome builds from using these features?
- Ayesh 6y ago
  Google Chrome isn't open source, so they can modify chromium as much as they want to add their now-private APIs.
  - catern 6y ago
    Yikes, if that's actually how they end up doing it, that's a big reduction in the amount of Chrome that is open source... Chrome has always been closed source but if they do that it's going to be quite far from Chromium...
lrossi 6y ago
Sad. I have often switched to Chromium whenever a Chrome update was breaking various websites I used. Chromium is lagging a bit behind in repositories; some delay is enough to let the website owners update. Then I can switch back to Chrome for that site once again. This has been happening more often lately, in my experience. Sure, you could say that the website is broken and not the browser. But from a user’s perspective, it used to work and now it doesn’t. Users don’t care whose fault it is. But big corps don’t care if less than 0.1% of users are impacted. Even if that means 100,000 people. So it’s ok to break a few eggs. As a website owner myself, I’ve had to make changes about once a year to keep things running properly in Chrome due to deprecated APIs. This is for a website that has not changed at all otherwise in 5 years, and I built without using any external dependencies so that I can avoid updating things. Compare this with other environments: Windows apps usually can run for 20 years without issues; Linux apps even more. Not to mention document formats, like PDF, which are pretty much guaranteed to be accessible forever. Adobe got at least one thing right. The only good thing I can say about this disregard for backwards compatibility is that it gives web developers good job security.
- slrz 6y ago
  > As a website owner myself, I’ve had to make changes about once a year to keep things running properly in Chrome due to deprecated APIs Does this refer to standard Web APIs or Chrome-specific and more or less experimental interfaces?
- Ayesh 6y ago
  I don't think any web developer needs to be concerned. It's about chromium based browser developers, who will find their browser cannot use these private Google APIs anymore. Browsers that don't use Google services (such as ungoogoed chrome, Vivaldi, and Brave for example) will be fine. A rebranded Google chrome fork will not.
  - lrossi 6y ago
    Other comments say that Chromium is affected as well. Is it? I reread the article, but it doesn’t seem to state it explicitly.
deleted 6y ago
[deleted]
lumost 6y ago
Having recently tested the waters of Firefox after using chrome for the last 10 years. Firefox was just a faster, and better experience. Chrome is handicapped by the need to support Google's ad business. Open-source, and potentially freemium browsers do not have this limitation. Non-google browsers can block most trackers, auto-fill privacy settings to be the best for the customer and hell, maybe even auto-deny cookies for websites that function fine without them. This makes the internet noticeably faster, but the con is that there is more browser lock-in than before due to features like stored passwords, credit cards, search suggestions and other tedious to enter information.
- oellegaard 6y ago
  Couldn’t agree more. I use Safari and Firefox and couldn’t be more happy after finally deleting Chrome after using it since forever.
- cat199 6y ago
  my only need for chrome is compatibility testing & node devtools.. please FF grow some node devtools !!
nemoid 6y ago
The main reason for me to use Chromium was hardware accelerated video on Linux. Can they finally sort that out or force users into a degraded experience?

110 points by yunohn 6y ago

TazeTSchnitzel 6y ago

> Google features, such as […] Click to Call, that are only intended for Google’s use What is this “Click to Call”?

Jonnax 6y ago
https://developers.google.com/web/fundamentals/native-hardware/click-to-call https://developers.google.com/web/fundamentals/native-hardwa... Looks like you tap a phone number on a web page and it opens the dialer app
- merb 6y ago
  I'm not sure if they meant that. Pretty sure that is standard and also works in os's where the link from the browser will be forwarded to the os, which directs to the default dialer application of the os. and it's probably a html living standard.
  - joshuaissac 6y ago
    That's right. The tel protocol is described in RFC 2806, which was written in 2000, although the proposal to make it an Internet Standard did not succeed.[1] It is certainly not a proprietary Google Chrome feature. It may be referring instead to the Chrome feature that allows users to open tel links using their phone (from their desktop).[2] 1. https://www.ietf.org/rfc/rfc2806.txt https://www.ietf.org/rfc/rfc2806.txt 2. https://www.androidpolice.com/2019/11/05/chrome-beta-78-desktop-phone-numbers/ https://www.androidpolice.com/2019/11/05/chrome-beta-78-desk...
    - merb 6y ago
      oh yeah I tried to google what It could mean but I think your second link might be it. didn't found that by googling click to call tough.
lima 6y ago
You can right-click on a phone number to call it from an Android phone connected to the same account.

foolinaround 6y ago

Chrome is making this play to limit the functionality in browsers such as Vivaldi, Brave, etc. maybe its good after all to have a different service that provides a private store ( in dropbox etc) for bookmarks. Dropbox (and others) can take care of the syncing.

jfk13 6y ago
Not sure I'd care to recommend Dropbox after just seeing https://news.ycombinator.com/item?id=25789603 https://news.ycombinator.com/item?id=25789603.
j1elo 6y ago
Xmarks was great for that. It just worked, and I liked that it was independent of the browser in question, so the same bookmarks could be shared and synced with Firefox and Chrome. But it disappeared... we cannot have nice things!
- smarx007 6y ago
  xBrowserSync is not as nice (frequent full re-syncs) but still syncs bookmarks between Chrome & co. and Firefox. Had to switch to it after Xmarks was discontinued.
SkyMarshal 6y ago
Note to self: Don’t use an open source codebase controlled by a major corporation to build a product that competes with that corporation’s product.
axaxs 6y ago
Brave doesn't use sign in functionality for syncing. Unsure about Vivaldi.
- LinAGKar 6y ago
  Vivaldi have their own accounts, and so does Opera and Edge. The biggest impact is for Linux distros which have Chromium in the repos, since they can't redistribute Chrome.

greatgib 6y ago

Personally I don't like these features, but can't this official move being seen as way to curve competitors? Especially looking at how the announcement is worded? "This meant that a small fraction of users could sign into their Google Account and store their personal Chrome sync data, such as bookmarks, not just with Google Chrome, but also with some third-party Chromium based browsers. We are limiting access to our private Chrome APIs starting on March 15, 2021." That I understand as "you can use the open source chromium version, but we did what was necessary to ensure that in all cases and derivatives it will be inferior to closed Chrome". Maybe a next move could be to disable the possibility to use the chromecast from Chromium?

magicalist 6y ago
> but can't this official move being seen as way to curve competitors? What competitors are using chrome sync? Other comments mention Brave and Vivaldi, but they both have their own sync systems. Edge has Microsoft accounts, ungoogled-chromium has sync disabled completely...
- Macha 6y ago
  Arch's Chromium build seems to be one affected: https://lists.archlinux.org/pipermail/arch-dev-public/2021-January/030260.html https://lists.archlinux.org/pipermail/arch-dev-public/2021-J...
bzb6 6y ago
Why should third party browsers be able to use google servers to store data? Why should google provide this service for free?
- dgrove 6y ago
  3rd Party browsers are not, they have their own sync infrastructure. This is mostly affecting builds of Chromium that are not directly built by Google https://groups.google.com/a/chromium.org/g/embedder-dev/c/NXm7GIKTNTE/m/Qxcew5lfCAAJ?pli=1 https://groups.google.com/a/chromium.org/g/embedder-dev/c/NX...

CSDude 6y ago

It's good that Chromium is degoogle'd more, however did they really notice it thanks to an audit? Probably anyone in the organization could have pinpointed this situation existing for years. Or are they just fed up with the (somewhat) popular forks gaining traction? I understand Google's point of view but the phrasing it as a result of an external audit seems funny.

lima 6y ago
They didn't say it was an external audit.

abrowne 6y ago

Anyone know if by "third-party Chromium based browsers" they mean sonething like Ubuntu's Chromium package or something like Brave or Vivaldi?

anaisbetts 6y ago
All of the above. The only entity that is now allowed to use / call these APIs is Google-built software
- abrowne 6y ago
  Too bad (I use Ubuntu's Chromium): I don't use sync, but I'll miss the Google Translate feature in Chromium.

bilal4hmed 6y ago

Private APIs are just that private aka not for everyone else to use. I dont see the issue here

tyingq 6y ago
Maybe I've got the wrong document, but why would a private api have a public doc on how to use it? https://chromium.googlesource.com/chromium/src/+/HEAD/docs/sync/model_api.md https://chromium.googlesource.com/chromium/src/+/HEAD/docs/s... Edit: Unrelated to what's above, but searching around I came across chrome://sync-internals/ I wasn't aware that existed in Chrome. It's a pretty complete admin type view.
- est31 6y ago
  chromium is an open source browser. Its development is closed enough already.

chaz6 6y ago

Hopefully this will spur on some competition. I could be tempted to use a Chromium-based browser if I could easily store my data in Nextcloud.

suhail 6y ago
It won’t. For users, it will simply make it harder to move to anything not owned by Google. If you can’t move bookmarks, passwords, extensions, history, it requires more effort for the user to switch. Not too mention, interop to sync on mobile.
- franga2000 6y ago
  You should be able to move them, just not directly sync them with Google. GDPR etc. took care of that. It's on the third party developers to make importing data as easy as possible.

suhail 6y ago

Worked for years. Even showed up in the GCP dashboard as having access. Had no idea it “private”. We just plugged in credentials from Google as per chromium build instructions. They knew we and others were using it because there are stats. Now we are given 2 months to develop a completely new solution.

lima 6y ago
The Chromium build instructions are very clear on this: https://www.chromium.org/developers/how-tos/api-keys https://www.chromium.org/developers/how-tos/api-keys > Note that the keys you have now acquired are not for distribution purposes and must not be shared with other users. > Many of the Google APIs used by Chromium code are specific to Google Chrome and not intended for use in derived products. In the API Console (http://developers.google.com/console http://developers.google.com/console) you may be able to purchase additional quota for some of the APIs listed above. For APIs that do not have a "Pricing" link, additional quota is not available for purchase. The notice has been there since 2013, when the page was first archived: https://web.archive.org/web/20131211101458/https://www.chromium.org/developers/how-tos/api-keys https://web.archive.org/web/20131211101458/https://www.chrom...
- deleted 6y ago
  [deleted]
- suhail 6y ago
  Buried in depths of their documentation? It’s also worked for years too. Google has docs that are completely outdated and neglected. Chrome Extension docs didn’t get updated for 5+ years until recently. Why put it in the console then? Why have tool tips that say “Access to this API is enabled.” There’s no improvement to security. This will be a cake walk to reverse engineer. I don’t see how my point is invalid.
  - lima 6y ago
    > Buried in depths of their documentation? You mean right in the instructions on how to acquire them? > It’s also worked for years too. It was tolerated for years, but it was always on very shaky ground. Now Google pulled the rug. I'm annoyed because that means my Chromium AUR package stops working, and I'll have to pry the tokens from a release build, but this isn't unexpected. > Why put it in the console then? Why have tool tips that say “Access to this API is enabled.” For outside developers who want to work on Chromium. This is also CLEARLY stated in their docs. > There’s no improvement to security. This will be a cake walk to reverse engineer. They didn't say it was about security.

CyberRabbi 6y ago

How are they technically going to prevent non-chrome builds from using these features?

Ayesh 6y ago
Google Chrome isn't open source, so they can modify chromium as much as they want to add their now-private APIs.
- catern 6y ago
  Yikes, if that's actually how they end up doing it, that's a big reduction in the amount of Chrome that is open source... Chrome has always been closed source but if they do that it's going to be quite far from Chromium...

lrossi 6y ago

Sad. I have often switched to Chromium whenever a Chrome update was breaking various websites I used. Chromium is lagging a bit behind in repositories; some delay is enough to let the website owners update. Then I can switch back to Chrome for that site once again. This has been happening more often lately, in my experience. Sure, you could say that the website is broken and not the browser. But from a user’s perspective, it used to work and now it doesn’t. Users don’t care whose fault it is. But big corps don’t care if less than 0.1% of users are impacted. Even if that means 100,000 people. So it’s ok to break a few eggs. As a website owner myself, I’ve had to make changes about once a year to keep things running properly in Chrome due to deprecated APIs. This is for a website that has not changed at all otherwise in 5 years, and I built without using any external dependencies so that I can avoid updating things. Compare this with other environments: Windows apps usually can run for 20 years without issues; Linux apps even more. Not to mention document formats, like PDF, which are pretty much guaranteed to be accessible forever. Adobe got at least one thing right. The only good thing I can say about this disregard for backwards compatibility is that it gives web developers good job security.

slrz 6y ago
> As a website owner myself, I’ve had to make changes about once a year to keep things running properly in Chrome due to deprecated APIs Does this refer to standard Web APIs or Chrome-specific and more or less experimental interfaces?
Ayesh 6y ago
I don't think any web developer needs to be concerned. It's about chromium based browser developers, who will find their browser cannot use these private Google APIs anymore. Browsers that don't use Google services (such as ungoogoed chrome, Vivaldi, and Brave for example) will be fine. A rebranded Google chrome fork will not.
- lrossi 6y ago
  Other comments say that Chromium is affected as well. Is it? I reread the article, but it doesn’t seem to state it explicitly.

deleted 6y ago

[deleted]

lumost 6y ago

Having recently tested the waters of Firefox after using chrome for the last 10 years. Firefox was just a faster, and better experience. Chrome is handicapped by the need to support Google's ad business. Open-source, and potentially freemium browsers do not have this limitation. Non-google browsers can block most trackers, auto-fill privacy settings to be the best for the customer and hell, maybe even auto-deny cookies for websites that function fine without them. This makes the internet noticeably faster, but the con is that there is more browser lock-in than before due to features like stored passwords, credit cards, search suggestions and other tedious to enter information.

oellegaard 6y ago
Couldn’t agree more. I use Safari and Firefox and couldn’t be more happy after finally deleting Chrome after using it since forever.
cat199 6y ago
my only need for chrome is compatibility testing & node devtools.. please FF grow some node devtools !!

nemoid 6y ago

The main reason for me to use Chromium was hardware accelerated video on Linux. Can they finally sort that out or force users into a degraded experience?