3 ms·

I had a long comment about security of old browser versions that I just deleted because I misread the article. By "Chrome will instead rely on its automatic up

by sgentle 15y ago

I had a long comment about security of old browser versions that I just deleted because I misread the article. By "Chrome will instead rely on its automatic update mechanism" it means there will be a separate update stream using the same system, not that revocation list updates will be packaged with new Chrome versions. The latter would mean that not upgrading Chrome would stop you from getting cert revocation updates, which would be a Bad Thing. To quote the original blog post[1]: "Our current method of revoking certificates in response to major incidents is to push a software update. Microsoft, Opera and Firefox also push software updates for serious incidents rather than rely on online revocation checks. But our software updates require that users restart their browser before they take effect, so we would like a lighter weight method of revoking certificates. "So Chrome will start to reuse its existing update mechanism to maintain a list of revoked certificates, as first proposed to the CA/Browser Forum by Chris Bailey and Kirk Hall of AffirmTrust last April. This list can take effect without having to restart the browser." [1] http://www.imperialviolet.org/2012/02/05/crlsets.html http://www.imperialviolet.org/2012/02/05/crlsets.html

redthrowaway 15y ago
>it means there will be a separate update stream using the same system, not that revocation list updates will be packaged with new Chrome versions. The latter would mean that not upgrading Chrome would stop you from getting cert revocation updates, which would be a Bad Thing. Well sure, you'd get the cert revocation updates, but you wouldn't get security fixes, which seems equally Bad. Why wouldn't you just let Chrome do what Chrome does? What would you gain by actively borking its update process?
- sgentle 15y ago
  Not equally bad at all. Holding back Chrome versions means you need to keep track of Chrome vulnerabilities to stay safe. Holding back Chrome updates and cert revocation updates means your security surface area includes every SSL website you use. There are plenty of good reasons to "bork its update process", for example if you work in enterprise and have a change management process for browser updates. Or if Chrome introduced a feature you don't like (like Lion fullscreen). Or if you prefer to use your OS's package management system for browser updates. It's not so much a matter of Chrome's update process as your update process. If that's "I want the newest version as soon as it comes out, all the time", then great, but there's no guarantee that's true. That's the exact reason Firefox is doing its whole ESR thing.
  - mukyu 15y ago
    Just because enterprises have silly rules about updating software does not make it a 'good reason'. Just think of how much effort has been wasted over the years by most of the internet propping up IE6 to appease corporations that have these policies.
- acdha 15y ago
  I think it's more that they want the ability to ship a revocation as cheaply and easily possible rather than tying it to a binary release.
- obtu 15y ago
  They can push updates fast enough[0] that they don't want this to wait after a restart. And since you're bringing software updates into this, even though an optimal strategy will target both problems independently: one can't force users to restart without a lot of pain, as long as there isn't true session checkpointing. [0] Thialfi: http://research.google.com/pubs/archive/37474.pdf http://research.google.com/pubs/archive/37474.pdf

by sgentle 15y ago

redthrowaway 15y ago

>it means there will be a separate update stream using the same system, not that revocation list updates will be packaged with new Chrome versions. The latter would mean that not upgrading Chrome would stop you from getting cert revocation updates, which would be a Bad Thing. Well sure, you'd get the cert revocation updates, but you wouldn't get security fixes, which seems equally Bad. Why wouldn't you just let Chrome do what Chrome does? What would you gain by actively borking its update process?

sgentle 15y ago
Not equally bad at all. Holding back Chrome versions means you need to keep track of Chrome vulnerabilities to stay safe. Holding back Chrome updates and cert revocation updates means your security surface area includes every SSL website you use. There are plenty of good reasons to "bork its update process", for example if you work in enterprise and have a change management process for browser updates. Or if Chrome introduced a feature you don't like (like Lion fullscreen). Or if you prefer to use your OS's package management system for browser updates. It's not so much a matter of Chrome's update process as your update process. If that's "I want the newest version as soon as it comes out, all the time", then great, but there's no guarantee that's true. That's the exact reason Firefox is doing its whole ESR thing.
- mukyu 15y ago
  Just because enterprises have silly rules about updating software does not make it a 'good reason'. Just think of how much effort has been wasted over the years by most of the internet propping up IE6 to appease corporations that have these policies.
acdha 15y ago
I think it's more that they want the ability to ship a revocation as cheaply and easily possible rather than tying it to a binary release.
obtu 15y ago
They can push updates fast enough[0] that they don't want this to wait after a restart. And since you're bringing software updates into this, even though an optimal strategy will target both problems independently: one can't force users to restart without a lot of pain, as long as there isn't true session checkpointing. [0] Thialfi: http://research.google.com/pubs/archive/37474.pdf http://research.google.com/pubs/archive/37474.pdf