10 ms·

New in Chrome 113

180 points by feross 4y ago

ripley12 4y ago
I'm not sure I understand the "Override network response headers" feature. Haven't the responses already been handled? Assuming no time travel, it's not clear what actually happens after you edit a response header.
- judge2020 4y ago
  It's an override, so I imagine future requests will follow the header changes you institute. Now all we need is response editing to really integrate burp/mitmproxy-esque response hacking.
  - petemill 4y ago
    We already have response editing. You can save a file in devtools and set up workspace folders to override responses at any url.
    - jbroman 4y ago
      This is an improvement to that feature which allows you to modify the response headers in addition to the response body.
    - jckahn 4y ago
      That’s only for GET requests, isn’t it?
- adrr 4y ago
  Javascript and the browser use the response headers. The example they gave is overriding CORS. Let say you're running code locally and using remote APIs. Now you can override CORS to allow your local code to still call the APIs.
  - echelon 4y ago
    That's incredibly useful! Dev and staging environment setup involves proxies, SSL, CORS, etc., and can be a total nightmare. If they integrate request header modification, we can get rid of cookie tools and plugins such as ModHeaders. This is a really great dev experience improvement.
slowhadoken 4y ago
[flagged]
- KeplerBoy 4y ago
  Because she's a developer relationship engineer and that's her job. English is not my first language and i have no problem understanding her. get over it.
  - slowhadoken 3y ago
    So emotional.
  - high_priest 4y ago
    [flagged]
    - renewiltord 4y ago
      Strange. I found it quite easy to understand. With no offence intended, do you have a listening difficulty or bad hardware or something else that can explain it? Perhaps the CC will help?
    - the_doctah 4y ago
      [flagged]
  - joecool1029 4y ago
    > English is not my first language and i have no problem understanding her. Arguably you have more flexibility in understanding different accents if you acquired that language later on and are used to focusing on it. I remember this one time I visited Montreal that I watched as an Argentine guy tried to explain the same thing over and over again to confused locals. They could not make heads or tails of what he was saying. I come from NJ and grew up with lots of people of different Latin American backgrounds and for me comprehension was automatic, but if you haven't had the exposure it just might not be. There's a reason news anchors speak 'General English' but I agree that it's a weird flex to bitch about not being able to understand her when the blog post is a direct transcript.
Dalewyn 4y ago
>First-Party Sets (FPS) is starting to roll out to stable. First Party Sets is part of the Privacy Sandbox. It is a way for organizations to declare relationships among sites, so that browsers allow limited third-party cookie access for specific purposes. Am I correct in my understanding that this basically undermines a user's choice to block third party cookies? Because a third party cookie is a third party cookie no matter how much icing you dump on it. I hope this is an option that can be disabled or is separate from the current blocking of all third party cookies.
- shadowgovt 4y ago
  First party sets are a centralized list of sites that act as one logical site. The list is gated by the browser vendor. Details here (https://github.com/GoogleChrome/first-party-sets/blob/main/FPS-Submission_Guidelines.md https://github.com/GoogleChrome/first-party-sets/blob/main/F...). This is intended to deal with several technical challenges (https://github.com/WICG/first-party-sets#use-cases https://github.com/WICG/first-party-sets#use-cases), such as the technical challenge that when company A buys company B, the process of fusing the auth rules so that being logged into A implies a login to B is a colossal nightmare project under first-party-only rules. So, for example, this lets Facebook declare that instagram.com is in the same FPS as facebook.com to simplify the auth story. What it should not allow is for joe-random-domain.com to declare that the DoubleClick ad endpoints are first-party to them.
  - GauntletWizard 4y ago
    There are already reasonable ways to proactively or unproactively copy session-cookies from one domain to another one that shares a backend. What does this solve except saving a roundtrip when you visit google.co.kr?
  - maccard 4y ago
    > What it should not allow is for joe-random-domain.com to declare that the DoubleClick ad endpoints are first-party to them. But it lets Google declare that doubleclick is part of them.
VWWHFSfQ 4y ago
So with first party sets is this suggesting that Google can declare doubleclick.com as a "trusted first party" and undermine any ability to allow Google.com and YouTube.com cookies but block their 3rd party ad tracker? It seems like they're just trying to remove any distinction between 1st and 3rd party cookies at all.
- nr2x 4y ago
  Yup.
- zagrebian 4y ago
  I mean, if you block cookies, you’re using a browser extension, and that extension blocks whatever you tell it to; it’s not affected by First Party Sets. Google’s changes only affect people who use vanilla Chrome. And the people who use vanilla Chrome without any privacy extensions don’t have much privacy to begin with, so First Party Sets does not make things much worse than they already are.
  - capableweb 4y ago
    > I mean, if you block cookies, you’re using a browser extension If all you want to do is blocking cookies, why would you use a browser extension for that? Most browsers ship with a configuration option to disable them. For Chrome/Chromium it's over at chrome://settings/cookies
    - akira2501 4y ago
      > why would you use a browser extension for that? To avoid breaking sites that cease to function without cookies. EFF's Privacy Badger is pretty good at this and it allows you to select individual domains in the popup to add or remove the ability to receive cookies.
    - Night_Thastus 4y ago
      I use Privacy Badger to selectively restrict cookies. It lowers the tracking at least a bit, while it's almost never broken a site. Completely disabling cookies can break a lot.
bhouston 4y ago
WebGPU! Wohoo. I'm tracking the increase in availability of WebGPU across the web here: https://twitter.com/benhouston3d/status/1653865357080248321 https://twitter.com/benhouston3d/status/1653865357080248321
- runlevel1 4y ago
  That sounds like a fun new fingerprinting attack surface. --- EDIT: That might have been too cynical. Let me take another stab: That opens up some cool new possibilities, but also a seemingly large new attack surface. Does anyone know what's been done to mitigate it?
  - sebazzz 4y ago
    Also another GPU driver attack vector.
    - cubefox 4y ago
      I'm also excited about WebGPU!
  - runlevel1 4y ago
    To partially answer my own question, some of the risks are identified here: https://www.w3.org/TR/webgpu/#malicious-use https://www.w3.org/TR/webgpu/#malicious-use The mitigations, however, feel rather light given the exposure.
    - cubefox 4y ago
      The alternative would be to ask for explicit permission per website, similar to notifications or webcam access. Sounds like overkill to me.
  - lxgr 4y ago
    Malicious/non-informed cryptocurrency mining in a background tab also comes to mind. Would it make sense for GPU access to be a permission that users have to explicitly grant?
krono 4y ago
Google pretend-playing "building a more private web" again. Blocking third party cookies is great, but with these "Third-Party Sets", self-appointed gatekeeper Judge Google (Judge Dread) takes requests from website owners for lists of domains they control to be partially exempted from these third party cookie restrictions. Instead of making third-party cookies obsolete as is one of the exclaimed goals of the broader initiative, they turned it into an insidious and opaque tool that lets them increase their insight, influence, and control over the web and all its users even further. This is bad for both advertisers and their prey alike. Addendum: Getting rid of third-party cookies whilst not breaking Single Sign-On and similar such features could also have been achieved with a user-controlled local browser setting and a new type of permission request popup. The need for Google to be in control of this is non-existent and the people working there are more than smart enough to understand this. They are playing us all here.
- ozaark 4y ago
  Doesn't part of this update also make fingerprinting users even more robust with webGPU? Aka you don't need cookies because we can see who you are without them based on your machines unique specs
- Xeoncross 4y ago
  > they turned it into an insidious and opaque tool that lets them increase their insight, influence, and control Sounds like most of the laws passed in my lifetime
- renewiltord 4y ago
  The FPS spec as described looks entirely duplicable by others and openly reimplementable by just cloning the FPS repo and following the same spec (which is open). Someone could choose in their browser to use a different set or a different repo or some hierarchical structure. Because domain owners use /.well-known/first-party-sets.json, others can also scan for that themselves and perhaps build an independent repo from spidering.
- paulddraper 4y ago
  > self-appointed gatekeeper Judge Google (Judge Dread) takes requests from website owners for lists of domains they control More specifically, website owners populate /.well-known/first-party-sets.json for their site and Chrome will always allow those cookies.
cj 4y ago
I honestly think this move toward "less tracking" (3rd party cookie restrictions) is having the opposite intended effect. It used to be you could just "clear your cookies" and you'd have a virtually clean identity on the internet. Now basically every ad platform, including Google Ads, is heavily encouraging the use of "first party data" - aka name, email addresses, phone numbers, mailing addresses - as a way to target customers. Google Ads help docs specifically cite the phasing out of cookies as the reason advertisers should send Google as much "first party data" as possible. In effect, that means "clearing your cookies" will do nothing if you're the average Google users who's still logged into chrome/google after clearing your cookies. And instead of Google + ad networks just having your data in cookies, now they have your name, email, mailing address, zip code, etc provided to them on the backend with no way for the consumer to easily opt out or delete their data. Edit: adding another supporting example: for advertisers tracking conversions, it’s no longer good enough to just fire a conversion pixel on a checkout page. Now it’s heavily encouraged to send the user’s personal data (email, name, phone, etc) along with the conversion pixel/tag so Google (or whatever ad platform) can match the conversion to clicks without cookies at all. This type of conversion tracking was not pushed or encouraged until browsers started phasing out 3rd party cookies. Edit 2: Google has even gone as far as adding a setting to their AdWords tracking tag that automatically scrapes the HTML of a page in search of anything that resembles a user’s email address or phone number to make it easier to collect first party data automatically.
- RowanH 4y ago
  I guess I shouldn’t have been shocked but this week looking at some display ads, in Googles audience builder there’s literally an “upload email of who you want to target” feature. Made my skin crawl. Can’t tell me that’s not abused to the ends of the earth and back - some marketing interns will just go nuts, GDPR be damned
  - svachalek 4y ago
    There's got to be some more regulation around advertising in general. I just don't see how it adds anything to the world that even begins to compensate for the damage. It should be like cigarettes, something we used to see as a legitimate business but decided we're really just better off taxing the heck out of and boxing into very limited places.
VHRanger 4y ago
What's going on with Chrome and their seeming push for advertising this week? They've restarted actively advertising their browser on Youtube, and now random releases are getting to #1 slot on HN. I'm guessing this is having to do with Edge gaining popularity?
- bonestamp2 4y ago
  I think you're probably right. For example, we're no longer recommending that Windows users to download chrome since Window's default browser (Edge) is fine now... so I'm sure edge popularity is taking away a lot of marketshare from Chrome. Not to mention the news this week of Safari surpassing Edge in popularity. Either way it's clear there is competition and Google is a little afraid.
- echelon 4y ago
  Google makes 50% of their revenue from Google Search. Google can only funnel people to Google Search with Chrome and first party Android. If Chrome falls, they're in a precarious position. Google is being IBMified right now.
- kccqzy 4y ago
  If you look at historical submissions from chrome.com you'll find that Chrome 112 and Chrome 111 release posts are submitted to HN as well. The fact that this submission was near the top probably reflected people's excitement over WebGPU.
NoMoreNicksLeft 4y ago
I keep hoping something will show up that'd make it possible to do a proper DHT in js.
nikeee 4y ago
So, if I'm using Chrome and I can't log out of my Google account any more, does that mean that site-owners are incentivized to use Google-based tracking? Because if they add Google-based tracking to their first party, it could use the data of my logged-in session of my Google account. What am I missing? This doesn't seem as if this should be possible.
MichaelZuo 4y ago
The 'Chrome 113 deprecations and removals' link in the 'Further reading' section leads to an error page: https://developer.chrome.com/blog/deps-rems-113/ https://developer.chrome.com/blog/deps-rems-113/ Does that mean there are no changes here?
qwerty456127 4y ago
What about the masonry layout?
taf2 4y ago
I appreciate all the concern everyone has with third party cookies with respect to privacy but this really kills the use case of third party embedded web apps. Saleforce ecosystem is going to take a real hit as a result of this change. Hopefully everyone will figure out away to implement First Party Sets quickly and Saleforce will be able to offer a solution.
jdougan 4y ago
At least in iOS chrome, 113 brings with it a "fix" to the bookmark sync problem [1] they themselves recently created with the the cap on mobile bookmark sync raised to that of desktop chrome (100,000 bookmarks up from 20,000!) [1] https://bugs.chromium.org/p/chromium/issues/detail?id=1347466#c43 https://bugs.chromium.org/p/chromium/issues/detail?id=134746... edit: correct URL
- MartyMacGyver 4y ago
  I was one of first the "insane number of bookmarks" users on the thread after they quietly pushed this change out: https://bugs.chromium.org/p/chromium/issues/detail?id=1347466#c18 https://bugs.chromium.org/p/chromium/issues/detail?id=134746... What still galls me is that instead of doing the right and reasonable thing and making a feature flag (and adding some indication that you're over their arbitrary limit) they did the bare minimum possible short of nothing at all, replacing one arbitrary mobile limit with the arbitrary desktop limit. And their communications on this? tumbleweeds pass by... This still hasn't dropped for Android so there's no way to test it out fully yet, and if you're a user with over 100K bookmarks? Too bad, so sad, apparently.
  - jdougan 4y ago
    It's a reason to look for alternatives. If no one there has 100,000+ bookmarks, they can't understand their users and problem domain that well. Once Android chrome is out with the update, I'll start looking at other browsers and bookmark options.
lofaszvanitt 4y ago
Still no sign of any initiative to declare that you do not give consent to use your page's contents as a training set for ML models. Yet the overcomplication of web standards is ongoing with light speed. Whats next, another color space coordination system after rgb, hls, lab, oklab, oklch?? Ridiculous.
jaimex2 4y ago
So can you now just mine crypto in a pool by going to a site?
kotaKat 4y ago
Can Chrome 113 give me a user-toggle to turn off the new annoying-ass daily New Tab Promo bullshit? I don't want to have to bury into the enterprise policies to turn that off. (New Tab Promos are the stupid one-line blurbs that come up under your website list on the new tab page that "you won't see THIS SPECIFIC message again" when you dismiss. Please respect my decisions, I should be able to say "I don't want to see these at all".)
sBqQu3U0wH 4y ago
>WebGPU is here. >Can not create WebGPU Device and/or context. Oh well.

180 points by feross 4y ago

I'm not sure I understand the "Override network response headers" feature. Haven't the responses already been handled? Assuming no time travel, it's not clear what actually happens after you edit a response header.

judge2020 4y ago
It's an override, so I imagine future requests will follow the header changes you institute. Now all we need is response editing to really integrate burp/mitmproxy-esque response hacking.
- petemill 4y ago
  We already have response editing. You can save a file in devtools and set up workspace folders to override responses at any url.
  - jbroman 4y ago
    This is an improvement to that feature which allows you to modify the response headers in addition to the response body.
  - jckahn 4y ago
    That’s only for GET requests, isn’t it?
adrr 4y ago
Javascript and the browser use the response headers. The example they gave is overriding CORS. Let say you're running code locally and using remote APIs. Now you can override CORS to allow your local code to still call the APIs.
- echelon 4y ago
  That's incredibly useful! Dev and staging environment setup involves proxies, SSL, CORS, etc., and can be a total nightmare. If they integrate request header modification, we can get rid of cookie tools and plugins such as ModHeaders. This is a really great dev experience improvement.

slowhadoken 4y ago

[flagged]

KeplerBoy 4y ago
Because she's a developer relationship engineer and that's her job. English is not my first language and i have no problem understanding her. get over it.
- slowhadoken 3y ago
  So emotional.
- high_priest 4y ago
  [flagged]
  - renewiltord 4y ago
    Strange. I found it quite easy to understand. With no offence intended, do you have a listening difficulty or bad hardware or something else that can explain it? Perhaps the CC will help?
  - the_doctah 4y ago
    [flagged]
- joecool1029 4y ago
  > English is not my first language and i have no problem understanding her. Arguably you have more flexibility in understanding different accents if you acquired that language later on and are used to focusing on it. I remember this one time I visited Montreal that I watched as an Argentine guy tried to explain the same thing over and over again to confused locals. They could not make heads or tails of what he was saying. I come from NJ and grew up with lots of people of different Latin American backgrounds and for me comprehension was automatic, but if you haven't had the exposure it just might not be. There's a reason news anchors speak 'General English' but I agree that it's a weird flex to bitch about not being able to understand her when the blog post is a direct transcript.

Dalewyn 4y ago

>First-Party Sets (FPS) is starting to roll out to stable. First Party Sets is part of the Privacy Sandbox. It is a way for organizations to declare relationships among sites, so that browsers allow limited third-party cookie access for specific purposes. Am I correct in my understanding that this basically undermines a user's choice to block third party cookies? Because a third party cookie is a third party cookie no matter how much icing you dump on it. I hope this is an option that can be disabled or is separate from the current blocking of all third party cookies.

shadowgovt 4y ago
First party sets are a centralized list of sites that act as one logical site. The list is gated by the browser vendor. Details here (https://github.com/GoogleChrome/first-party-sets/blob/main/FPS-Submission_Guidelines.md https://github.com/GoogleChrome/first-party-sets/blob/main/F...). This is intended to deal with several technical challenges (https://github.com/WICG/first-party-sets#use-cases https://github.com/WICG/first-party-sets#use-cases), such as the technical challenge that when company A buys company B, the process of fusing the auth rules so that being logged into A implies a login to B is a colossal nightmare project under first-party-only rules. So, for example, this lets Facebook declare that instagram.com is in the same FPS as facebook.com to simplify the auth story. What it should not allow is for joe-random-domain.com to declare that the DoubleClick ad endpoints are first-party to them.
- GauntletWizard 4y ago
  There are already reasonable ways to proactively or unproactively copy session-cookies from one domain to another one that shares a backend. What does this solve except saving a roundtrip when you visit google.co.kr?
- maccard 4y ago
  > What it should not allow is for joe-random-domain.com to declare that the DoubleClick ad endpoints are first-party to them. But it lets Google declare that doubleclick is part of them.

VWWHFSfQ 4y ago

So with first party sets is this suggesting that Google can declare doubleclick.com as a "trusted first party" and undermine any ability to allow Google.com and YouTube.com cookies but block their 3rd party ad tracker? It seems like they're just trying to remove any distinction between 1st and 3rd party cookies at all.

nr2x 4y ago
Yup.
zagrebian 4y ago
I mean, if you block cookies, you’re using a browser extension, and that extension blocks whatever you tell it to; it’s not affected by First Party Sets. Google’s changes only affect people who use vanilla Chrome. And the people who use vanilla Chrome without any privacy extensions don’t have much privacy to begin with, so First Party Sets does not make things much worse than they already are.
- capableweb 4y ago
  > I mean, if you block cookies, you’re using a browser extension If all you want to do is blocking cookies, why would you use a browser extension for that? Most browsers ship with a configuration option to disable them. For Chrome/Chromium it's over at chrome://settings/cookies
  - akira2501 4y ago
    > why would you use a browser extension for that? To avoid breaking sites that cease to function without cookies. EFF's Privacy Badger is pretty good at this and it allows you to select individual domains in the popup to add or remove the ability to receive cookies.
  - Night_Thastus 4y ago
    I use Privacy Badger to selectively restrict cookies. It lowers the tracking at least a bit, while it's almost never broken a site. Completely disabling cookies can break a lot.

bhouston 4y ago

WebGPU! Wohoo. I'm tracking the increase in availability of WebGPU across the web here: https://twitter.com/benhouston3d/status/1653865357080248321 https://twitter.com/benhouston3d/status/1653865357080248321

runlevel1 4y ago
That sounds like a fun new fingerprinting attack surface. --- EDIT: That might have been too cynical. Let me take another stab: That opens up some cool new possibilities, but also a seemingly large new attack surface. Does anyone know what's been done to mitigate it?
- sebazzz 4y ago
  Also another GPU driver attack vector.
  - cubefox 4y ago
    I'm also excited about WebGPU!
- runlevel1 4y ago
  To partially answer my own question, some of the risks are identified here: https://www.w3.org/TR/webgpu/#malicious-use https://www.w3.org/TR/webgpu/#malicious-use The mitigations, however, feel rather light given the exposure.
  - cubefox 4y ago
    The alternative would be to ask for explicit permission per website, similar to notifications or webcam access. Sounds like overkill to me.
- lxgr 4y ago
  Malicious/non-informed cryptocurrency mining in a background tab also comes to mind. Would it make sense for GPU access to be a permission that users have to explicitly grant?

krono 4y ago

Google pretend-playing "building a more private web" again. Blocking third party cookies is great, but with these "Third-Party Sets", self-appointed gatekeeper Judge Google (Judge Dread) takes requests from website owners for lists of domains they control to be partially exempted from these third party cookie restrictions. Instead of making third-party cookies obsolete as is one of the exclaimed goals of the broader initiative, they turned it into an insidious and opaque tool that lets them increase their insight, influence, and control over the web and all its users even further. This is bad for both advertisers and their prey alike. Addendum: Getting rid of third-party cookies whilst not breaking Single Sign-On and similar such features could also have been achieved with a user-controlled local browser setting and a new type of permission request popup. The need for Google to be in control of this is non-existent and the people working there are more than smart enough to understand this. They are playing us all here.

ozaark 4y ago
Doesn't part of this update also make fingerprinting users even more robust with webGPU? Aka you don't need cookies because we can see who you are without them based on your machines unique specs
Xeoncross 4y ago
> they turned it into an insidious and opaque tool that lets them increase their insight, influence, and control Sounds like most of the laws passed in my lifetime
renewiltord 4y ago
The FPS spec as described looks entirely duplicable by others and openly reimplementable by just cloning the FPS repo and following the same spec (which is open). Someone could choose in their browser to use a different set or a different repo or some hierarchical structure. Because domain owners use /.well-known/first-party-sets.json, others can also scan for that themselves and perhaps build an independent repo from spidering.
paulddraper 4y ago
> self-appointed gatekeeper Judge Google (Judge Dread) takes requests from website owners for lists of domains they control More specifically, website owners populate /.well-known/first-party-sets.json for their site and Chrome will always allow those cookies.

cj 4y ago

I honestly think this move toward "less tracking" (3rd party cookie restrictions) is having the opposite intended effect. It used to be you could just "clear your cookies" and you'd have a virtually clean identity on the internet. Now basically every ad platform, including Google Ads, is heavily encouraging the use of "first party data" - aka name, email addresses, phone numbers, mailing addresses - as a way to target customers. Google Ads help docs specifically cite the phasing out of cookies as the reason advertisers should send Google as much "first party data" as possible. In effect, that means "clearing your cookies" will do nothing if you're the average Google users who's still logged into chrome/google after clearing your cookies. And instead of Google + ad networks just having your data in cookies, now they have your name, email, mailing address, zip code, etc provided to them on the backend with no way for the consumer to easily opt out or delete their data. Edit: adding another supporting example: for advertisers tracking conversions, it’s no longer good enough to just fire a conversion pixel on a checkout page. Now it’s heavily encouraged to send the user’s personal data (email, name, phone, etc) along with the conversion pixel/tag so Google (or whatever ad platform) can match the conversion to clicks without cookies at all. This type of conversion tracking was not pushed or encouraged until browsers started phasing out 3rd party cookies. Edit 2: Google has even gone as far as adding a setting to their AdWords tracking tag that automatically scrapes the HTML of a page in search of anything that resembles a user’s email address or phone number to make it easier to collect first party data automatically.

RowanH 4y ago
I guess I shouldn’t have been shocked but this week looking at some display ads, in Googles audience builder there’s literally an “upload email of who you want to target” feature. Made my skin crawl. Can’t tell me that’s not abused to the ends of the earth and back - some marketing interns will just go nuts, GDPR be damned
- svachalek 4y ago
  There's got to be some more regulation around advertising in general. I just don't see how it adds anything to the world that even begins to compensate for the damage. It should be like cigarettes, something we used to see as a legitimate business but decided we're really just better off taxing the heck out of and boxing into very limited places.

VHRanger 4y ago

What's going on with Chrome and their seeming push for advertising this week? They've restarted actively advertising their browser on Youtube, and now random releases are getting to #1 slot on HN. I'm guessing this is having to do with Edge gaining popularity?

bonestamp2 4y ago
I think you're probably right. For example, we're no longer recommending that Windows users to download chrome since Window's default browser (Edge) is fine now... so I'm sure edge popularity is taking away a lot of marketshare from Chrome. Not to mention the news this week of Safari surpassing Edge in popularity. Either way it's clear there is competition and Google is a little afraid.
echelon 4y ago
Google makes 50% of their revenue from Google Search. Google can only funnel people to Google Search with Chrome and first party Android. If Chrome falls, they're in a precarious position. Google is being IBMified right now.
kccqzy 4y ago
If you look at historical submissions from chrome.com you'll find that Chrome 112 and Chrome 111 release posts are submitted to HN as well. The fact that this submission was near the top probably reflected people's excitement over WebGPU.

NoMoreNicksLeft 4y ago

I keep hoping something will show up that'd make it possible to do a proper DHT in js.

nikeee 4y ago

So, if I'm using Chrome and I can't log out of my Google account any more, does that mean that site-owners are incentivized to use Google-based tracking? Because if they add Google-based tracking to their first party, it could use the data of my logged-in session of my Google account. What am I missing? This doesn't seem as if this should be possible.

MichaelZuo 4y ago

The 'Chrome 113 deprecations and removals' link in the 'Further reading' section leads to an error page: https://developer.chrome.com/blog/deps-rems-113/ https://developer.chrome.com/blog/deps-rems-113/ Does that mean there are no changes here?

qwerty456127 4y ago

What about the masonry layout?

taf2 4y ago

I appreciate all the concern everyone has with third party cookies with respect to privacy but this really kills the use case of third party embedded web apps. Saleforce ecosystem is going to take a real hit as a result of this change. Hopefully everyone will figure out away to implement First Party Sets quickly and Saleforce will be able to offer a solution.

jdougan 4y ago

At least in iOS chrome, 113 brings with it a "fix" to the bookmark sync problem [1] they themselves recently created with the the cap on mobile bookmark sync raised to that of desktop chrome (100,000 bookmarks up from 20,000!) [1] https://bugs.chromium.org/p/chromium/issues/detail?id=1347466#c43 https://bugs.chromium.org/p/chromium/issues/detail?id=134746... edit: correct URL

MartyMacGyver 4y ago
I was one of first the "insane number of bookmarks" users on the thread after they quietly pushed this change out: https://bugs.chromium.org/p/chromium/issues/detail?id=1347466#c18 https://bugs.chromium.org/p/chromium/issues/detail?id=134746... What still galls me is that instead of doing the right and reasonable thing and making a feature flag (and adding some indication that you're over their arbitrary limit) they did the bare minimum possible short of nothing at all, replacing one arbitrary mobile limit with the arbitrary desktop limit. And their communications on this? tumbleweeds pass by... This still hasn't dropped for Android so there's no way to test it out fully yet, and if you're a user with over 100K bookmarks? Too bad, so sad, apparently.
- jdougan 4y ago
  It's a reason to look for alternatives. If no one there has 100,000+ bookmarks, they can't understand their users and problem domain that well. Once Android chrome is out with the update, I'll start looking at other browsers and bookmark options.

lofaszvanitt 4y ago

Still no sign of any initiative to declare that you do not give consent to use your page's contents as a training set for ML models. Yet the overcomplication of web standards is ongoing with light speed. Whats next, another color space coordination system after rgb, hls, lab, oklab, oklch?? Ridiculous.

jaimex2 4y ago

So can you now just mine crypto in a pool by going to a site?

kotaKat 4y ago

Can Chrome 113 give me a user-toggle to turn off the new annoying-ass daily New Tab Promo bullshit? I don't want to have to bury into the enterprise policies to turn that off. (New Tab Promos are the stupid one-line blurbs that come up under your website list on the new tab page that "you won't see THIS SPECIFIC message again" when you dismiss. Please respect my decisions, I should be able to say "I don't want to see these at all".)

sBqQu3U0wH 4y ago

>WebGPU is here. >Can not create WebGPU Device and/or context. Oh well.