justinschuh

12 ms·

61.
by justinschuh 12y ago
Sorry, but what the FUD is this? Chromium has never done anything of the sort. It's developed completely in the open and has a huge number of non-Google contributors committing code every day.
62.
by justinschuh 12y ago
"Ignorance more frequently begets confidence than does knowledge."
63.
by justinschuh 12y ago
While you are correct that the PDF rendering code originally came from Foxit, Google purchased it and open-sourced it a while ago. So, it's included in Chromium and the project is hosted here: https://code.google.com/p&
64.
by justinschuh 12y ago
An NSL can be used only to compel release of connection or transaction metadata, and cannot be used to compel disclosure of message contents. It's basically a fast-track for getting things like call records, and it most emphatically
65.
by justinschuh 12y ago
Will the settings be changed for existing users, or only for new installs?
66.
by justinschuh 12y ago
I'm now curious. Explain to me how an NSL fits into the scenario you're implying.
67.
by justinschuh 12y ago
You might want to read up on what an NSL actually is, since you and the GP are clearly very confused.
68.
by justinschuh 12y ago
And XP was 5.1.
69.
by justinschuh 12y ago
Layout and compositing need to be cross-origin; the Web implicitly allows cross-origin resource loads; and (as was raised above by pcwalton) browsing contexts like windows and frames need to function as if they're running on the same t
70.
by justinschuh 12y ago
There were numerous factors, but that wasn't one of them. The biggest delays were things like the build toolchain and logistics. For example, Microsoft's toolchain couldn't even build a working, optimized, 64-bit Chrome binar
71.
by justinschuh 12y ago
Users generally don't know or care if the issue is a bug in Chrome or not. To them the problem is just that Chrome is not working. So, we try to fix it where we can. We have code in Chrome to block third-party hook DLLs that we've
72.
by justinschuh 12y ago
I think you're misunderstanding the context. A percentage of users opt in to crash reporting, and from that we see all manner of crashes on user systems. The biggest causes in Chrome tend to be: third-party software (i.e. plugins and i
73.
by justinschuh 12y ago
Actually, segmentation isn't available on 64-bit Windows kernels (rather than just in x64 mode). So, NaCl already used a different type of sandbox model, where the validator enforces read/write masking.
74.
by justinschuh 12y ago
Did you even read what you're responding to here? Because your comments throughout this thread imply that you have not. The only use of the term "open web" was specifically in reference to cross-browser technologies. You are
75.
by justinschuh 12y ago
It's a myth that NPAPI is browser portable (at least in the sense that portability is not a massive undertaking). NPAPI doesn't work on mobile platforms and it requires a huge effort to add or even maintain support for a multi-pro
76.
by justinschuh 12y ago
I'm sorry, but I just don't understand where this argument is coming from. There's no mention of EME, DRM, or anything along those lines in that post, because those are the furthest possible things from a motivation to deprec
77.
by justinschuh 12y ago
I think it's fairly clear that NaCl is suggested only as an alternative for applications with needs not yet supported by open web technologies: Most use cases that previously required NPAPI are now supported by JavaScript-based o
78.
by justinschuh 12y ago
Could you provide a link to the source for the sandbox implementation?
79.
by justinschuh 12y ago
What is the popup you're encountering? Because it sounds like a bug, and I'd like to make sure someone is working on fixing it (or has already done so).
80.
by justinschuh 12y ago
> What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 The team may choose to do something like that in the end. That's really the point of experimenting with di
81.
by justinschuh 12y ago
I agree that this experiment isn't demonstrating a perfect mitigation, but it's important to appreciate that it's currently vastly easier for a phisher to permute paths and subdomain components than it is to create a convinci
82.
by justinschuh 12y ago
> Is it? What are the numbers? Providing more detailed background and better numbers on phishing sounds like a good idea. However, this is an experiment that is not on track to ship in any version of Chrome, so I wouldn't consider i
83.
by justinschuh 12y ago
Chrome has been highlighting the origin component and de-emphasizing the path since its initial release, but the fact is that the vast majority of users are still very unclear about the security relevance of origin and easily fall victim to
84.
by justinschuh 12y ago
This is an in-development experiment, so its current state is a work in progress. Anything that would ship to users (assuming it even does) would do so in a way that does not damage the general utility of URLs.
85.
by justinschuh 12y ago
As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the
86.
by justinschuh 13y ago
I'm not sure I understand your question. Nations conduct foreign intelligence primarily to inform policy makers in ways that help them further their own national interests. The majority of the time, doing so doesn't involve milita
87.
by justinschuh 13y ago
Here's NSA's own statement on their SIGINT mission: "The National Security Agency is responsible for providing foreign Signals Intelligence (SIGINT) to our nation's policy-makers and military forces. SIGINT plays a vital
88.
by justinschuh 13y ago
I'm not surprised that I'm getting smeared by a sock puppet on HN, but I'll try to use it as a chance to clarify myself in more than 140 characters: https://plus.google.com/u/0/+JustinSchuh/post
89.
by justinschuh 13y ago
Is my sarcasm filter off here? The ghost towns in the US are dramatically smaller, were pretty much all the result of organic growth, and were actually populated at some point. They're ghost towns now because the populations moved away
90.
by justinschuh 13y ago
Attempting to recover from OOM is almost always a bad idea, which is why Chrome terminates processes by default on OOM. To underscore this point, I should note that I've found a number of serious vulnerabilities resulting from applicat

More ›