5 ms·

The "severe security issue" in libxml2 they mention is actually a non-issue and the code in question isn't even used by Chrome. I'm all for switching to memory-

The "severe security issue" in libxml2 they mention is actually a non-issue and the code in question isn't even used by Chrome. I'm all for switching to memory-safe languages but badmouthing OSS projects is poor style.

cxr 1y ago
Where's the best collection or entry point to what you've written about Chrome's use of Gnome's XML libraries, the maintenance burden, and the dearth of offers by browser makers foot the bill?
chuckadams 1y ago
The issue in question is just one of the several long-unfixed vulnerabilities we know about, from a library that doesn't have that many hands or eyes on it to begin with.
- sroussey 1y ago
  And why doesn’t Google contribute to fixing and maintaining code they use?
  - deleted 1y ago
    [deleted]
  - SoftTalker 1y ago
    Because in this case it doesn't contribute to their ability to deliver ads.
  - kccqzy 1y ago
    Because they don't want to use the code. They begrudgingly use it to support XSLT and now they don't use it.
    - lunar_mycroft 1y ago
      Maintaining web standards without breaking backwards compatibility is literally what they signed up for when they decided to make a browser. If they didn't want to do that job, they shouldn't have made one.
      - will4274 1y ago
        According to whom? Chromium is open source and free (both as in beer and speech). The license says they've made no future commitments and made no warrants. Google signed up to give something away for free to people who want to use it. From the very first version, it wasn't perfectly compatible with other web browsers (which mostly did IE quirks things). If you don't want to use it, because it doesn't maintain enough backwards compatibility... Then don't.
        lunar_mycroft 1y ago
        The license would be relevant if I'd claimed that removing XSLT was illegal or opened them up to lawsuits, but I didn't. The obligation they took on is social/ethical, not legal. By your logic, chrome could choose to stop supporting literally anything (including HTML) in their "browser" and not have done anything that we can object to. iIRC, lack of IE compatibility is fundamentally different, because the IE specific stuff they didn't implement was never part of the open web standards, but rather stuff Microsoft unilaterally chose to add.
        will4274 1y ago
        > By your logic, chrome could choose to stop supporting literally anything (including HTML) in their "browser" and not have done anything that we can object to. Literally this. Microsoft used to ship a free web browser. Then they stopped. That's not something anybody can object to. > because the IE specific stuff they didn't implement was never part of the open web standards, but rather stuff Microsoft unilaterally chose to add. Standards aren't holy books. It's actually more important to support real customer use cases than to follow standards. But you know this. If standards are more important that real use cases, then the fact that XSLT has been removed from the html5 standard is enough justification to remove it from Chrome.
- timeon 1y ago
  If that was case they would switch to (rust XPath/XSLT) Xee.
delfinom 1y ago
Nobody is badmouthing open source. It's the core truth, open source libraries can become unmaintained for a variety of reasons, including the code base becoming a burden to maintain by anyone new. And you know what? That's completely fine. Open source doesn't mean something lives forever
flomo 1y ago
Sounded like the maintainers of libxml2 have stepped-back, so there needs to be a supported replacement, because it is widely used. (Or if you are worried the reputation of "OSS", you can volunteer!)
jeroenhd 1y ago
Google is too cheap to fund or maintain the library they've built their browser with after its hobbyist maintainers got burnt out, for more than a decade so they're ripping out the feature. Their whole browser is made up of unsafe languages and their attempt to sort of make c++ safer has yet to produce a usable proof of concept compiler. This is a fat middle finger in the face of all the people's free work they grabbed to collect billions for their investors.
Genbox 1y ago
It is also kinda a self-burn. Chromium an aging code base [1]. It is written in a memory unsafe language (C++), calls hundreds of outdated & vulnerable libraries [2] and has hundreds of high severity vulnerabilities [3]. People in glass houses shouldn't throw stones. [1] https://github.com/chromium/chromium/commits/main/?after=c5a4b284fbc0e35d64239a0f66061f3a92941daa+1662000 https://github.com/chromium/chromium/commits/main/?after=c5a... [2] https://github.com/chromium/chromium/blob/main/DEPS https://github.com/chromium/chromium/blob/main/DEPS [3] https://www.cvedetails.com/product/15031/Google-Chrome.html?vendor_id=1224 https://www.cvedetails.com/product/15031/Google-Chrome.html?...
- mycall 11mo ago
  Given Google's resources, I'm a little surprised they having created an LLM that would rewrite Chromium into Go/Rust and replace all the stale libraries.

cxr 1y ago

Where's the best collection or entry point to what you've written about Chrome's use of Gnome's XML libraries, the maintenance burden, and the dearth of offers by browser makers foot the bill?

chuckadams 1y ago

The issue in question is just one of the several long-unfixed vulnerabilities we know about, from a library that doesn't have that many hands or eyes on it to begin with.

sroussey 1y ago
And why doesn’t Google contribute to fixing and maintaining code they use?
- deleted 1y ago
  [deleted]
- SoftTalker 1y ago
  Because in this case it doesn't contribute to their ability to deliver ads.
- kccqzy 1y ago
  Because they don't want to use the code. They begrudgingly use it to support XSLT and now they don't use it.
  - lunar_mycroft 1y ago
    Maintaining web standards without breaking backwards compatibility is literally what they signed up for when they decided to make a browser. If they didn't want to do that job, they shouldn't have made one.
    - will4274 1y ago
      According to whom? Chromium is open source and free (both as in beer and speech). The license says they've made no future commitments and made no warrants. Google signed up to give something away for free to people who want to use it. From the very first version, it wasn't perfectly compatible with other web browsers (which mostly did IE quirks things). If you don't want to use it, because it doesn't maintain enough backwards compatibility... Then don't.
      - lunar_mycroft 1y ago
        The license would be relevant if I'd claimed that removing XSLT was illegal or opened them up to lawsuits, but I didn't. The obligation they took on is social/ethical, not legal. By your logic, chrome could choose to stop supporting literally anything (including HTML) in their "browser" and not have done anything that we can object to. iIRC, lack of IE compatibility is fundamentally different, because the IE specific stuff they didn't implement was never part of the open web standards, but rather stuff Microsoft unilaterally chose to add.
        will4274 1y ago
        > By your logic, chrome could choose to stop supporting literally anything (including HTML) in their "browser" and not have done anything that we can object to. Literally this. Microsoft used to ship a free web browser. Then they stopped. That's not something anybody can object to. > because the IE specific stuff they didn't implement was never part of the open web standards, but rather stuff Microsoft unilaterally chose to add. Standards aren't holy books. It's actually more important to support real customer use cases than to follow standards. But you know this. If standards are more important that real use cases, then the fact that XSLT has been removed from the html5 standard is enough justification to remove it from Chrome.
timeon 1y ago
If that was case they would switch to (rust XPath/XSLT) Xee.

delfinom 1y ago

Nobody is badmouthing open source. It's the core truth, open source libraries can become unmaintained for a variety of reasons, including the code base becoming a burden to maintain by anyone new. And you know what? That's completely fine. Open source doesn't mean something lives forever

flomo 1y ago

Sounded like the maintainers of libxml2 have stepped-back, so there needs to be a supported replacement, because it is widely used. (Or if you are worried the reputation of "OSS", you can volunteer!)

jeroenhd 1y ago

Google is too cheap to fund or maintain the library they've built their browser with after its hobbyist maintainers got burnt out, for more than a decade so they're ripping out the feature. Their whole browser is made up of unsafe languages and their attempt to sort of make c++ safer has yet to produce a usable proof of concept compiler. This is a fat middle finger in the face of all the people's free work they grabbed to collect billions for their investors.

Genbox 1y ago

It is also kinda a self-burn. Chromium an aging code base [1]. It is written in a memory unsafe language (C++), calls hundreds of outdated & vulnerable libraries [2] and has hundreds of high severity vulnerabilities [3]. People in glass houses shouldn't throw stones. [1] https://github.com/chromium/chromium/commits/main/?after=c5a4b284fbc0e35d64239a0f66061f3a92941daa+1662000 https://github.com/chromium/chromium/commits/main/?after=c5a... [2] https://github.com/chromium/chromium/blob/main/DEPS https://github.com/chromium/chromium/blob/main/DEPS [3] https://www.cvedetails.com/product/15031/Google-Chrome.html?vendor_id=1224 https://www.cvedetails.com/product/15031/Google-Chrome.html?...

mycall 11mo ago
Given Google's resources, I'm a little surprised they having created an LLM that would rewrite Chromium into Go/Rust and replace all the stale libraries.