Chrome Exposes Scary System Functions To All Google Domains

Поделиться
HTML-код
  • Опубликовано: 11 июл 2024
  • I was terrified when I saw this. Now I realize I'm one of few people who SHOULD be upset (Ping, Zoom, other Meet competitors) and...I'm not too annoyed.
    Hope this helps clarify why Google made this "built in Chrome extension"
    SOURCES
    source.chromium.org/chromium/...
    x.com/lcasdev/status/18106962...
    x.com/dotmrjosh/status/181107...
    Check out my Twitch, Twitter, Discord more at t3.gg
    S/O Ph4se0n3 for the awesome edit 🙏
  • НаукаНаука

Комментарии • 292

  • @t3dotgg
    @t3dotgg  22 дня назад +208

    GUYS I WAS WRONG. I WAS NOT AN INVESTOR IN GOOGLE. I sold my positions long ago and forgot.
    Don’t worry, just bought some now :)

    • @JR-mk6ow
      @JR-mk6ow 22 дня назад +31

      Disclaimer: This comment is not financial advice.
      Also, it gone up like 15 cents in the last 12 minutes, good job Theo.

    • @DiegoxKa
      @DiegoxKa 22 дня назад +5

      He forgor 💀

    • @RemotHuman
      @RemotHuman 22 дня назад +11

      if you own most index funds then you are also invested in google through those

    • @swapnilchand338
      @swapnilchand338 21 день назад +1

      lol

    • @t3dotgg
      @t3dotgg  21 день назад +5

      @@RemotHuman Yep! Only my 409k is on index funds but I might put more things there so I have to disclose more often lol

  • @Jamiered18
    @Jamiered18 22 дня назад +137

    It's very simple. If they want these features in Google Meet, then they must request we install the extension like every other website has to. Baking it into the browser is unfair and untrustworthy

    • @RasmusSchultz
      @RasmusSchultz 21 день назад +4

      yeah, for me, the issue was not really about security, but more about equity - the fact that they chose to give themselves an unfair advantage this way, makes you wonder what else they're letting Google products do that other products can't.
      is this even legal in the EU under the Digital Markets Act? that's a question I'd like someone to explore. 🤔

    • @lateAutumn314
      @lateAutumn314 20 дней назад +1

      and gives a false sense of the app quality. Its not a level playing field when one party has previleged access to servies.

    • @ecosta
      @ecosta 19 дней назад +1

      @@RasmusSchultz It's probably not legal in EU but it requires someone "knowledgeable" in both EU laws AND Googles' practices to raise this concern.

    • @ramsey2155
      @ramsey2155 2 дня назад

      Why is it so serious that they get to know how much processing power your computer is using?

    • @RasmusSchultz
      @RasmusSchultz 2 дня назад

      @@ramsey2155 it's not. the issue here is equity. why should Google get exclusive access to a feature that gives their web based products an edge against competing products? if this feature is useful and necessary for certain web products, make it available equally to everyone - and if it is a security concern (which it may be, as apparently the CPU info is detailed enough to facilitate fingerprinting) then users should need to grant permission and this limitation should also apply equally to all products by Google and competitors.

  • @mollistuff
    @mollistuff 22 дня назад +51

    It's not scary because it spies on you.
    It's scary because it breaks the social contract of the open web.

    • @R4ngeR4pidz
      @R4ngeR4pidz 21 день назад +6

      This, I'm honestly disappointed by how uninformed Theo's videos are lately.
      Man reads one twitter post and goes live

    • @ecosta
      @ecosta 19 дней назад

      @@R4ngeR4pidz This is how every "RUclipsr" and "streamer" goes nowadays: they need a constant sequence of content, delivered as quick as possible to get hype and views. They start like a gourmet restaurant and ends like a fast-food.

  • @IlluminatiBG
    @IlluminatiBG 22 дня назад +155

    The problem here is that the extension is baked in and unlisted in chrome extensions. Yes, you can create your own extension to get enough CPU info for your website, but:
    1. It won't be baked in, user must install it.
    2. You don't have access to regular extension controls to disable it (this won't prevent meet to work, but it will prevent optimal CPU utilization).
    Even if the extension exists and enabled by default, it should still be visible on chrome extension page.

    • @rumplstiltztinkerstein
      @rumplstiltztinkerstein 22 дня назад +14

      Could this hidden extension be classified as spyware?

    • @Charalyn0010
      @Charalyn0010 22 дня назад +6

      Yeah, I agree. It should have been visible to the end user even if it was preinstalled, giving the user the ability to remove/disable it. Don't know why they decided to act this shady when the extension isn't even doing anything that special.

    • @krunkle5136
      @krunkle5136 22 дня назад

      Lol can't see replies.

    • @Frostbytedigital
      @Frostbytedigital 22 дня назад +1

      Lets be real. They added this as an extension to be lazy, but by your logic this would be absolutely fine if they just added another module to the code base and had these implementations directly in the browser vs. Writing it as an extensions and making it invisible. Which i agree. Its fine regardless. Lol

    • @theairaccumulator7144
      @theairaccumulator7144 21 день назад +2

      @@rumplstiltztinkerstein you're overreacting bro any native app you install on your PC can see so much more than the CPU utilization.

  • @robertdolby6272
    @robertdolby6272 22 дня назад +45

    With all that unique ID data it's a good job Google aren't an ad network or anything.

  • @nnm711
    @nnm711 22 дня назад +168

    No, it's still very bad, because it breaks the fundamental trust that all websites, including google's, play under the same rules, same API, same everything. Today they just watch some CPU usage so they can deliver a better service(than others), tomorrow they could decide to compete with MS' Replay and track user's desktop screen, or whatever. Who knows?
    The situation would be a little different, if the damned extension was at least visible in the extensions menu, even if it comes preinstalled, then people who don't use Hangouts/Meet/Google Whatever could at least find it there and disable it. But they hid it.
    This is very very clear abuse of their market position, and should be heavily punished, despite their "best intentions". Also, the sheer audacity to keep the extension in other chromium forks...

    • @tonyfield5407
      @tonyfield5407 22 дня назад +22

      100% agreed. If they want elevated access they need to ask for it just like everyone else.

    • @Frostbytedigital
      @Frostbytedigital 22 дня назад +1

      1, i havent seen any proof to say the edge and brave teams didnt choose to keep the extension. Presumably these teams forked on their own and this wasnt a google decision. 2, as a web dev since chrome became popular i would never have assumed all sites are on the same playing field and that there would be NO additional apis available to sites owned by the browsers developer. Its also not hidden. The code is exposed in the source, all they hid was the extensions visibility in the chrome extensions menu which makes sense since youre not allowed to disable it. There is no trust agreement between them and the vast general internet, chrome isnt the arbiter of the internet. Its a company. If youre that upset about them doing sensical business stuff, choose a competitor.

  • @MadafakinRio
    @MadafakinRio 22 дня назад +66

    On the topic of Firefox not handling packets that are not perfectly sequential - is that the right way to do it? I've seen someone (I think from Firefox) comment that the way Google is doing it is wrong and goes against the standard. Even though I don't use Firefox I'm way more inclined to believe them, the "global nonprofit dedicated to keeping the Internet a public resource that is open and accessible to all", that they are implementing the standards correctly, rather than Google who's been known for shitty behavior all throughout the years.

    • @xSil3nt27
      @xSil3nt27 22 дня назад +1

      Eh, it makes web video work better, if firefox is too incompetent and hung up on the "guidelines" to fix basic shit, it's on them, not google.

    • @JanVerny
      @JanVerny 22 дня назад +29

      @@xSil3nt27 I mean, if the standard isn't good, I am all for Google proposing a new better standard. But breaking the current standard would in fact not be "fixing basic shit" as you seem to imply.

    • @Leto2ndAtreides
      @Leto2ndAtreides 22 дня назад

      The problem is that the standards compliance that once made Firefox cool because IE was a trainwreck, now makes it outdated, because they're too slow about adopting new ideas.

    • @MadafakinRio
      @MadafakinRio 22 дня назад +11

      @@Leto2ndAtreides sure, but you can't just wild-wild-west style implement anything you want on your own, especially on one of the biggest websites on the planet. As Jan said above, if they have a better idea then suggest that to the standards governing body.

    • @MachineYearning
      @MachineYearning 22 дня назад

      ​​@@MadafakinRio they're not just implementing whatever they want in a vacuum. Chrome team has been the primary driver of bleeding edge web standards for years now. But if a standard just isn't working, honestly I'd rather they give me something that works than be anal about the standard. Standards can be replaced or iterated on if something isn't working, and Chrome team obviously knows this

  • @atljBoss
    @atljBoss 22 дня назад +37

    Wish google shipped this a an extension in the web store and not installed it by default. Then they could tell users to install it when they visited Meet.

    • @Leto2ndAtreides
      @Leto2ndAtreides 22 дня назад +1

      Too much hassle. And it's not like having this kind of data would help you a ton. Doubt they'd care much if they had to disable this feature.

    • @mkabilly
      @mkabilly 21 день назад +5

      @@Leto2ndAtreides If they didn't want the data, they wouldn't have spent developer time on the extension, wouldn't have made it un-uninstallable, wouldn't have kept it up to date.
      And the "too much hassle" problem is precisely the point. Theo knows he can't afford to ask users to install an extension to use his service -- and to have to prove that you're not doing anything nefarious. Google, used its position in the market to force this extension into all browsers, preventing the same "hassle" with their product while, if you want to compete with Google, you'll have to make your users go through the same "hassle".

  • @diegodoumecq5144
    @diegodoumecq5144 22 дня назад +32

    Yes, that's how security works. I can rest assured this is not a problem because you couldn't exploit it yourself in a stream (granted, with help). Come on man, you know this is fucked up.

    • @rdvansloten
      @rdvansloten 22 дня назад +9

      "A frontender copypasting shit off Twitter couldn't exploit this therefore it is safe" :')

  • @safairette
    @safairette 22 дня назад +22

    The use case is probably not as bad as it first appeared, but having it be installed and unlisted by default is gross.
    If it just was an extension that meet prompted you to install to use the service I'd have no issues with it.

    • @shapelessed
      @shapelessed 22 дня назад

      Similarly to how Spotify or Netflix prompt you for Google's WideVine plugin for DRM protection.
      But I do agree having it by default and hidden from the public is super sketchy...

  • @wlockuz4467
    @wlockuz4467 22 дня назад +95

    Its wild to me how Theo just casually uses his personal anecdotes to entirely discard serious discussions like Google throttling their services on other browsers.
    "I had a bad developer experience with Firefox, hence Google slowing down their services on other browsers must be bullsh*t" How does that even matter or make any sense. like do you even think before you speak or listen to yourself?
    Same goes for the whole video, the point is not about what that code can do, but more so about why does company specific code exist in an OS project.

    • @xSil3nt27
      @xSil3nt27 22 дня назад +2

      firefox is just chrome but bad, we all know it

    • @TangiersIntrigue
      @TangiersIntrigue 22 дня назад +13

      It becomes awfully clear that Theo is either too naive or too hopped up on neolib juice to make a fair assessment on anything where tech meets policy.

    • @Z4KIUS
      @Z4KIUS 22 дня назад +1

      abusing the speed of your engine to ship absolute garbage code that doesn't work well on other engines may seem like merely incompetence but isn't google one of the few companies that definitely can afford competent devs?

    • @nikolaygruychev2504
      @nikolaygruychev2504 22 дня назад

      ​@@TangiersIntriguehere we go with the political terms for no good reason. give ur brain a break man its a friday, you can enjoy life a little without over-analyzing everything through the same one lens

    • @nikolaygruychev2504
      @nikolaygruychev2504 22 дня назад

      tbh firefox _is_ shit for anything performance-related, so here's my own anecdote to go along theo's. i remember some time ago reading the very MDN docs on some canvas transformations and seeing the interactive examples lag on firefox but not on chrome. this was the day i stopped taking anything from firefox seriously, how can you write the best docs out there on an animation your browser can't even perform well???

  • @thomassynths
    @thomassynths 22 дня назад +61

    TLDR: Theo praises google for anticompetitive practices and also claims that updating a list of five domains every decade is too difficult for an indie company like Google

    • @ecosta
      @ecosta 19 дней назад +2

      The second part is surprisingly true in a company as large as Google. If you ever work with a large-enough software company, you can see how a simple one-line change is insanely hard to apply.
      One of my one-liner took nine months to review because of so many stupidity combined in a single place. Let alone something that impacts an external product AND an open-sourced code.
      And, of course, no one tracks/cares how a simple thing like changing domains impacts other parts of the company.
      The TL;DR: simple things are too difficult to do in large companies.

    • @thomassynths
      @thomassynths 19 дней назад +2

      @@ecostaCope

    • @tensor5113
      @tensor5113 19 дней назад +2

      It's extremely hard to update a list when everyone who knows about the list is fired

    • @Luxalpa
      @Luxalpa 13 дней назад

      @@thomassynths someone who writes bullshit like you can't be serious.

    • @thomassynths
      @thomassynths 13 дней назад +1

      @@Luxalpa Don't shoot the messenger. I didn't pick Theos words.

  • @rubenbupe
    @rubenbupe 22 дня назад +19

    A comment about the DMA: There are already multiple cases open against Apple, Google or Meta because the European Commission is not satisfied with the way these companies “comply” with the law, because they do not do it. And from what the commission has said, the regulations will continue to evolve and they will not stop sanctioning companies until they comply with the law. But it's only been a few months since the DMA came into force and these things take time...

    • @rubenbupe
      @rubenbupe 22 дня назад +7

      I am happy to finally see legislators confront these large companies that have been abusing their dominant position for years. It doesn't seem fair to judge them when there hasn't been time to see the results yet.

    • @thomassynths
      @thomassynths 21 день назад +1

      I wouldnt trust the EU with a 10 foot pole.

    • @rubenbupe
      @rubenbupe 21 день назад

      @@thomassynths You're probably not European so your opinion is irrelevant. If you have useless legislators in your country, it is not our problem that you think ours are useless too. I am European and follow the DMA and DSA regulations quite closely, and as a developer and as a consumer I have only good things to say about it. Of course there are things to improve and change, but I see that there is initiative and good intentions on the part of the EC

    • @thomassynths
      @thomassynths 21 день назад

      @@rubenbupe you act like Europeans love the EU

    • @rubenbupe
      @rubenbupe 21 день назад

      @@thomassynths I act like a person who values ​​others for what they do, not what they are. I have many problems and complaints with the EU but I appreciate when legislators do something well, and more importantly, with good intentions.

  • @cerulity32k
    @cerulity32k 22 дня назад +11

    was there not a line in a youtube script that slept for 5 seconds if you were on firefox?

  • @DaLoler1
    @DaLoler1 22 дня назад +10

    I have invested in Google.
    Google has a unfair competitive advantage over my product but I'm not too annoyed.
    Am I the only one who reads this as a conflict of interests ?

    • @Kitulous
      @Kitulous 21 день назад +2

      it definitely is. it's like LTT is invested in Framework, and if framework had to largely fuck up, Linus would have said "it's not that bad"

  • @zaxadim
    @zaxadim 22 дня назад +7

    even if you put aside the severity of the access google has, the key issue you did not address is the competitive advantage. You can't hand-wave it away by saying that the devs had a good intention at heart. How about all other devs that try to compete? do they have the same freedom to have already installed backdoor unlisted unapproved extensions?

  • @bradbradson4543
    @bradbradson4543 22 дня назад +75

    I don't entirely trust you

    • @TomNook.
      @TomNook. 22 дня назад +21

      I've noticed that when something bad happens, investors and supporters admit it's bad, do a deep dive then give the conclusion it's not really that bad. Damage limitation.

    • @Charalyn0010
      @Charalyn0010 22 дня назад +6

      @@TomNook. A lot of people also exaggerate how bad something is to stir up drama for clicks and views, or just don't bother to check if something is true before spreading it.

    • @schtormm
      @schtormm 22 дня назад +5

      that's good, you shouldn't trust any online creator blindly

    • @urmom8322
      @urmom8322 21 день назад

      You shouldn’t

    • @belstar1128
      @belstar1128 20 дней назад +2

      this guy is very corporate

  • @kennyfully88
    @kennyfully88 21 день назад +4

    Firefox, I don't care what they say about you. You're there when I need you the most. Apple did me wrong and Google does Google things.

  • @TheJoYo
    @TheJoYo 22 дня назад +4

    "If the packets aren't perfectly sequential"
    TCP?

    • @redstone0234
      @redstone0234 15 дней назад

      TCP had too much overhead, I guess?

  • @klex3905
    @klex3905 22 дня назад +6

    There's a bit too much copium here.. okay it's only scoped for meets. But that misses the problem that Google has preloaded it's own special extension, which by the way is completely exploitable. There's no reason this shouldn't be opt in only. The fact brave is even exposed says it all.
    And being open source doesn't mean anything. Because we can see their dark pattern doesn't make it less of an issue.

  • @anwiseru9064
    @anwiseru9064 22 дня назад +7

    even ignoring the possible security issues thats scary

  • @DotSquall
    @DotSquall 22 дня назад +6

    It is THAT big of a deal, can't believe you came out with this opinion.

  • @ChristopherCricketWallace
    @ChristopherCricketWallace 21 день назад +3

    The Ladybird team is probably popping champaign this week. They should be launching a membership/pledge drive drive TODAY.

  • @NithinJune
    @NithinJune 21 день назад +2

    Thumbnail looks like a low level learning video

  • @_scored
    @_scored 22 дня назад +3

    Thumbnail made me think this was Low Level Learning lol

  • @sarthikg
    @sarthikg 21 день назад +2

    Google is investing so much in Chrome so that it can move the development of Chrome as fast as possible, which means, all the other browsers (non-chromium ofc) will be left behind.
    This is forcing everyone to switch to Chromium-based browsers, which is incentifying developers to optimise their websites for chromium as much as possible. Which means, stability for other browsers is highly impacted.
    Its unfortunate that so many websites don't even work on Firefox, and as soon as you switch the user-agent to chrome, they start working in Firefox. Its just nuts.
    With Manifest V3, and such backdoors, even if 100 Theos come out to defend Chrome, I don't think anyone should hear this guy.
    The point is, Firefox doesn't have to be completely similar to Chrome. They are different browsers, and they have different ways of interpreting the browser standards. Its weird that developers have gotten so used to Chromium's interpretations that they feel like if the same thing doesn't work in Firefox, its a bug in Firefox.

  • @KidoKatsuragi
    @KidoKatsuragi 22 дня назад +2

    And you still don't understand why we need independent free browsers?

  • @guest7329
    @guest7329 21 день назад +2

    lol, google does not protect user, they protect their bottom line (because with cache anyone can track)

  • @mattilindstrom
    @mattilindstrom 22 дня назад +4

    Doesn't seem unreasonable. But let's see how Google does in European courts with this. It might take years, but if found illegal here, the monetary damages may be non-trivial.

    • @anewbimproves5622
      @anewbimproves5622 22 дня назад +6

      I was just thinking the same thing. The EU went after Microsoft IE for less.
      If this had been an opt-in extension, or if this information was available by default to every site (locked behind a permission dialog), this would be less of an issue.

    • @mattilindstrom
      @mattilindstrom 22 дня назад

      @@anewbimproves5622 Sorry about the ninja edit above the reply, had I known there already was one I'd have left it alone. My argument about the EU legalities still stands.

    • @anewbimproves5622
      @anewbimproves5622 22 дня назад

      @@mattilindstrom No worries

  • @princess_wawa
    @princess_wawa 6 дней назад +1

    They should make it a pop up, like camera and microphone acces, so that all websites can use this feature

  • @_jerieljan
    @_jerieljan 22 дня назад +2

    I have an idea where this is used: Google Meet has a Troubleshooting & help section while in a call that gives you a graph over time of your Network and CPU usage.
    The CPU graph is available only on Chrome. It shows a "Try Google Chrome to see your CPU usage" if you're using Meet on Firefox.
    From what I can tell, the network bits is what's used for their "you're on a slow connection" warning. And maybe they're doing that too if your CPU usage is consistently high.

    • @Leto2ndAtreides
      @Leto2ndAtreides 22 дня назад +3

      Would make sense to make it a browser API, and then give the user the option to enable.

  • @krunkle5136
    @krunkle5136 22 дня назад +2

    A corp can do no wrong or is always having a redemption arc when there's money invested.

  • @bgill7475
    @bgill7475 21 день назад +1

    It's not just chrome, it's all chromium browsers

  • @dj_256
    @dj_256 20 дней назад

    All this time I was thinking Theo was in a completely dark room... I feel betrayed

  • @Burgo361
    @Burgo361 22 дня назад +2

    I feel a lot better about telemetry if I get asked first, I understand the value of it but if it's collected without my consent that's a problem.

  • @tomyamado
    @tomyamado 22 дня назад +1

    I see what you did there with the thumbnail, I almost thought it was a LLL video. Great video Theo

  • @Theepicfrenchguy
    @Theepicfrenchguy 22 дня назад +1

    Is it illegal to create an unfair advantage for competitors by forcing your products to offer better performance for yourself but not others?

  • @RemotHuman
    @RemotHuman 22 дня назад +1

    2:47 maybe they have to push you to install native stuff because they can't control the browser, which leads to security vulnerabilities, which leads to you preferring google meet

  • @SidTheITGuy
    @SidTheITGuy 21 день назад

    Holy crap am I glad that I stuck around and watched your entire tear down of the topic. You have started to grow on me and now I kind of understand the level on which you deep dive into things.
    However, I'd recommend you to read what other devs are saying here. I think I agree with them too, with Google preloading the extension being a bad thing. If it needs it to work Google meet, then it should've been OPTIONAL.
    Also, that particular piece of code that you showed can be exploited in no time. Just a hunch but idk the inner details of it.
    😅 Previously I used to feel overwhelmed with your videos, with me not being able to match your level of depths.
    Phenomenal evaluation and great video as always!

  • @sorrynotsorry8224
    @sorrynotsorry8224 22 дня назад +1

    23:27 - I assume it's json5, which does allow comments. It was adopted by Chromium so it's a pretty reasonable assumption.

  • @guest7329
    @guest7329 21 день назад +1

    don't worry guys, we installed tracker in your a**us to make our app 0 5% percent better
    its fine

  • @shapelessed
    @shapelessed 22 дня назад +1

    This may not be as "big of a deal as it seems" - For now.
    But it certainly does set preciseness for Google to continue breaking standards, taking unfair advantage and slowly become what IE used to be (Except even worse)

  • @commentinglife6175
    @commentinglife6175 22 дня назад +1

    At around the 6:50 mark, when discussing intent, that's fine; that is no excuse! Think about it. Just imagine how much better your own company's services would be if you had access to ALL my computer info so you could make the product absolutely perfect. Your intent is great; who doesn't want a PERFECT experience? Does not mean I want to GIVE you that info though! Additionally, as we are constantly seeing by these big companies, intent doesn't matter. "Oh, we don't intend to use your data for our AI." Sure, but your TOS are sure written wide enough to allow that so legally, I'm not trusting your statements! Same thing here.

  • @mschelstastic
    @mschelstastic 22 дня назад

    regarding comments in plugin manifest json - are you sure it's not just JSON5? I'm not positive, a quick google search doesn't say it is, but why would they use their own format over something well defined? That's what makes me think it probably is.

  • @andrewzuo86
    @andrewzuo86 21 день назад

    Even the Chrome team is tired of Google constantly changing their messaging service 😆

  • @Octogenico
    @Octogenico 22 дня назад +150

    I am going to be honest im tired of the thumbnails, you make REALLY good content but PLEASE be normal,this is one of the better ones so it doesn't make that much sense to complain,but can you like not do that?

    • @t3dotgg
      @t3dotgg  22 дня назад +67

      Make better ones and I’ll hire you :)

    • @Aoredon
      @Aoredon 22 дня назад +8

      @@t3dotgg You always end up hooking me in with the thumbnails 😂 But it's almost always worth it

    • @MadafakinRio
      @MadafakinRio 22 дня назад +14

      The one I got seems pretty tame, idk. At least there's no gasping mount & pointing towards the code.
      Anyways if you're smart at all, you'd be using the DeArrow extension to get rid of all the shitty titles and thumbnails.

    • @schtormm
      @schtormm 22 дня назад +1

      @@MadafakinRioDeArrow is stupid too IMO, just spoils most videos

    • @MrSprinkles1F369
      @MrSprinkles1F369 22 дня назад +2

      I agree. They're obnoxious but it's part of the game. Can't be hating the player.

  • @alexaka1
    @alexaka1 20 дней назад +1

    Reads tweet.
    Sees the word DMA.
    Immediately dismisses that sentence, 'DMA sucks, ignored'.
    Looks at source code.
    Wow it is so hard to make a video chat app, meanwhile Google hacks their own browser and cheats.
    This code looks okay though.
    Absolutely clueless on what the initial claim was.

  • @smithright
    @smithright 9 дней назад

    This seems like a devastating security vulnerability. If someone sneaks a backdoor into a browser plugin or package or site hosted via a Google subdomain or GCP service, could that enable remote code execution via the browser? Help me understand. Say it ain't so.

  • @kiikoh
    @kiikoh 22 дня назад

    Loved hearing your deep knowledge in this space. Great video

  • @xtraa
    @xtraa 22 дня назад +1

    Does the slow-down stop when I change the User-Agent to Chrome?

    • @t3dotgg
      @t3dotgg  22 дня назад +1

      @@xtraa no

    • @xtraa
      @xtraa 22 дня назад +1

      @@t3dotgg thank you!

  • @Zuranthus
    @Zuranthus 21 день назад +1

    Jonathan Blow rant video incoming

  • @Leto2ndAtreides
    @Leto2ndAtreides 22 дня назад

    On further consideration, these may be better as a browser API, that the user can be prompted to enable as needed.

  • @RemotHuman
    @RemotHuman 22 дня назад

    they could have at least made the extension/API available to all websites (behind a user permission same as camera/microphone if this is bad for something like user fingerprinting). that would still give them an unfair advantage as they can work on the API features that they need first, and be the first to adopt them, but it wouldn't be as bad as only giving their own sites increased functionality that their competitors don't get

  • @isheamongus811
    @isheamongus811 2 дня назад

    3:33 Brave could send a Firefox user agent to Google Meet.

  • @SchioAlves
    @SchioAlves 18 дней назад

    If they wanted to be fair about it, they would have released it as a Chrome extensions of the WebRTC spec with a dedicated permission for sites to request it… or at least, you know, not hide the builtin addon, Chrome also comes with a builtin addon for Docs and its not hidden

  • @ecosta
    @ecosta 19 дней назад

    Unfair practices by Google? Expected. But I'm surprised how no-one seems to be concerned how this can be part of an attack vector by a hacker.

  • @pencilcheck
    @pencilcheck 22 дня назад

    At 21:13 Theo lost me on whatever he was saying. Perhaps make another video and with some evidence? I'm confused about that part.

  • @jouebien
    @jouebien 22 дня назад

    FYI switch preforms slower than if in a number of JS runtimes.

    • @t3dotgg
      @t3dotgg  22 дня назад

      @@jouebien not meaningfully shower in V8, which is the engine built by the people writing that code

    • @thomassynths
      @thomassynths 20 дней назад

      That's kinda insane if you think about how switches are efficiently lowered in languages like C. Do the people who write these js runtimes even care about decent code generation?

  • @trappedcat3615
    @trappedcat3615 22 дня назад

    There is a new API (Compute Pressure) that tells if CPU is under too much load.

  • @miallo
    @miallo 20 дней назад

    Wait - that wildcard is overly permissive, isn't it? Wouldn't a totally different domain with just the google part in the path also match? 🤔🤔
    EDIT: Ah - the docs for the extension match patterns specify that it is only for subdomains and not like a general regex (also confirmed by trying it out) 😅

  • @Sound_.-Safari
    @Sound_.-Safari 20 дней назад

    Ahh yes HLS, the 30,000 line library you need to import. Never had any issue with HLS on Firefox?

  • @Z4KIUS
    @Z4KIUS 22 дня назад +1

    and yet slack still has much better video quality

  • @peter_phamous
    @peter_phamous 21 день назад

    I wonder if Google will comply with their own manifest v3 changes on this special extension of theirs 😂😂😂

  • @tylera9822
    @tylera9822 22 дня назад +2

    Honestly sounds a bit anti-competitive.

  • @ulrich-tonmoy
    @ulrich-tonmoy 21 день назад

    twitch coughing in the back

  • @isheamongus811
    @isheamongus811 2 дня назад

    Can't use JS benchmark?

  • @TangiersIntrigue
    @TangiersIntrigue 22 дня назад

    Remember when and why Google dropped the "Don't be evil" motto?

  • @ChristopherCricketWallace
    @ChristopherCricketWallace 21 день назад

    I assumed this was the case the entire time. Everyone has been talking about 1st-party data advantage forever. Same goes for Apple blocking tracking for everyone except themselves (and then selling their own ads). It's the same reason Zuck wants his own platform---access & control.
    This is not new. (but that doesn't make it more okay). I just don't understand the shock all of the sudden.

  • @thederpykrafter
    @thederpykrafter 22 дня назад +1

    I've never had issues using Firefox lol

  • @RyderCragie
    @RyderCragie 3 дня назад

    Including Google Sites that anyone can use?

  • @vbyte.
    @vbyte. 22 дня назад +9

    comment on the firefox-youtube situation; it was brave aswell which is chromium based and was reportedly confirmed by youtube that they added a 5 second delay just to deter the usgae

    • @pooyaestakhry
      @pooyaestakhry 22 дня назад +5

      indeed, firefox-youtube situation was not because of hls decoding. There was a few seconds pause when opening a new RUclips page on Firefox not just pause for payback start

    • @aj8__8
      @aj8__8 22 дня назад +1

      he just hates firefox

    • @vbyte.
      @vbyte. 21 день назад

      @@aj8__8 if you configure it correctly it is absolutely the best browser

  • @RedStone576
    @RedStone576 22 дня назад

    finally people are talking about webext and how insane chrome is

  • @pooyaestakhry
    @pooyaestakhry 22 дня назад +8

    Mostly seems like a damage control stream.
    Starts by saying i invested in google but always call them out and then slowly turns the holy shit situation into meh, it might not be that bad.

  • @Fanaro
    @Fanaro 22 дня назад

    What about RUclips?

  • @swapnilchand338
    @swapnilchand338 21 день назад

    edge has PressureObserver damn, and still sucks ass.
    also this was available publicly right? so why now is this called out?

  • @jaralara6429
    @jaralara6429 22 дня назад +79

    Please let this convince more people to leave Chrome

    • @nnm711
      @nnm711 22 дня назад +5

      I am afraid not many. Only people like me that are one foot in Firefox, the other still in Chrome.
      The rest will not care.

    • @tylerbenton4495
      @tylerbenton4495 22 дня назад

      I've ditched using Chrome to using Firefox. The only time I use Chrome is when I'm developing browser extensions and testing apps because I know a lot of people still use it. I've even switched to use ProtonMail over Gmail and only use my Gmail account as a spam account. I'm hoping to slowly minimize the footprint Google has of me. I know everyone won't move from Google because Google does a very good job of dominating the market, this is only stuff technical people like ourselves care about and everyone always talks about leaving Google which results in nothing but a load of talk but me slowly transitioning from Google gives me a peace of mind even though I know nothing will come out of this.

    • @AndrewTSq
      @AndrewTSq 22 дня назад +1

      this is built into all chromium based browsers....

    • @SourceOfViews
      @SourceOfViews 22 дня назад +1

      I doubt it, the people that will hear this, already know enough that they made a conscious decision.

    • @pencilcheck
      @pencilcheck 22 дня назад

      You mean leaving the chromium completely? that is hard since a lot of people don't like Firefox, and Safari. I tried Firefox, with side berry and it performs absurdly slow and bad, I switched to safari now due to it's integration and cloud tabs is insane good but I can't escape chrome browsers because there are so many browsers using their code.

  • @marloelefant7500
    @marloelefant7500 14 дней назад

    Firefox is still the best browser there is. All other browsers are privacy nightmares.

  • @SkyyySi
    @SkyyySi 22 дня назад +14

    If you ever wondered why the Chrome monopoly is, in fact, a problem: This is why.

  • @Tramontano_T
    @Tramontano_T 22 дня назад +5

    Now I hope you understand the value of ladybird browser

  • @RogerClotet
    @RogerClotet 22 дня назад +1

    "Go use ladybird I guess" lol

    • @d3stinYwOw
      @d3stinYwOw 22 дня назад +2

      FF or ladybird. But definitely not chromium.

  • @bradweir3085
    @bradweir3085 22 дня назад +7

    Intent doesn't matter. Google is giving themselves an advantage for streaming video platforms in yheir browser.

  • @MarekKnapek
    @MarekKnapek 21 день назад

    You are too much concerned by what page is able to read what data from your computer. But please don't forget that you are running the pages inside a browser, a binary program written in C you don't have source code for. Chrome is not the same as Chromium. This program has access to all everything, exactly the same as any other program running on your computer (under the same OS user).

  • @dunebuggy1292
    @dunebuggy1292 21 день назад

    Why do you use the word scary in such a contrived manner?

  • @kaviisuri9997
    @kaviisuri9997 22 дня назад +18

    I love your videos, but it’s not “nice” if other sites have access.
    The fact that it’s not the case is unethical, monopolistic, and outright illegal in certain parts of the world😅.

    • @Charalyn0010
      @Charalyn0010 22 дня назад

      They can just create their own chrome extension and they'd have the same access.

    • @DaLoler1
      @DaLoler1 22 дня назад +3

      @@Charalyn0010 Isnt the extension on by default on the browser ? Isn't that the point of people getting angry

    • @Charalyn0010
      @Charalyn0010 22 дня назад

      @@DaLoler1 Yes, the google extension is installed by default and hidden from the end user, that part I get. However, it's untrue to say that only google has access to that api, since other developers can create their own extensions that would have the same kind of access. The difference is that they would have to convince users to install it. Maybe I would have agreed with the outrage if the api was restricted from other extensions, but IMO it's exaggerated to be up in arms about it like some people are.

  • @tauraamui
    @tauraamui 22 дня назад

    Is Ladybird done yet?

  • @edumorangobolcombr
    @edumorangobolcombr 22 дня назад

    What funny is that people are still waiting for big goverment to fix big tech 😂

  • @bruttosozial42
    @bruttosozial42 22 дня назад +5

    If cpu load is such a big issue for audio and video, making this information accessible to services should be a goal for browser APIs, right? Or is the tracking possibility to "scary" for that, even when the user would be queried like with other device properties like webcam access?
    I think the current state with only Google Meet having the information, and not in a transparent way for the user, is not desirable and that this code should get removed from chromium. But it feels like an opportunity to expose this information in a clean way and for other av services to use

    • @sidma6488
      @sidma6488 22 дня назад +3

      They're making a Web API for it. Did you watch the video?

    • @QoP..
      @QoP.. 22 дня назад

      @@sidma6488 Reading all the comments I don't think a lot of people watched the video before commenting...

    • @mkabilly
      @mkabilly 21 день назад

      @@sidma6488 That's still not as thorough/high resolution as the data the extension pulls.

  • @sarjannarwan6896
    @sarjannarwan6896 22 дня назад +17

    This is one of the reasons Microsoft lost their anti-trust suit. Having APIs in windows that only their browser could use.

    • @Woofer21
      @Woofer21 22 дня назад

      Anyone can make an extension and use these APIs (except the enterprise ones), did you watch to the end?

    • @sarjannarwan6896
      @sarjannarwan6896 22 дня назад +3

      ​@@Woofer21 Yes, and I didn't need to as I was aware of that already. The problem is that this is prepackaged and the user has to explicitly install an add on where as this is included by default.
      If I want to build a video call site I need to either force users to install an extension which creates a drop off or make it optional and suffer from higher bandwidth costs because I'll probably default to a less efficient codec for users who don't have it installed. It's an unfair advantage.

  • @pelic9608
    @pelic9608 22 дня назад

    Is it that time of the year again already?
    Like the one where Chrome was "spying on all of us", because it was listening for and detecting locally the "ok, Google" keywords.
    Everyone wrote a blog post, no one bothered to actually see what's going over the wire - nothing - when "google might listen to everythiglng you say".
    Great show, every time. 😄👌

  • @thephoenix215-po2it
    @thephoenix215-po2it 21 день назад

    Android > ios any day of the week.... butttt ios > android when it comes to stock operating system.

  • @dentjoener
    @dentjoener 22 дня назад +19

    Firefox might not be perfect, but Chrome and all Chromium based browsers can go suck it. If you complain about firefox that it has some flaws, maybe support it a bit more, maybe take a look at the HLS implementation and fix it yourself. You are a programmer after all aren't you?

    • @pooyaestakhry
      @pooyaestakhry 22 дня назад +1

      using chrome and chromium based browsers i feel insecure, like i know something somewhere is leaking data no matter how many flags i set to prevent them from doing so. they might introduce something new that leaks more info.

    • @sidma6488
      @sidma6488 22 дня назад +3

      Firefox is not just bad at video. They are too late on implementing Web standards. The browser is slower in many aspects.
      Chromium is open source with a BSD license. You can fork the source code and make any changes you want with it.

    • @pooyaestakhry
      @pooyaestakhry 22 дня назад

      @@sidma6488 And as you see even chromium based browsers like brave were not safe here.
      In case of being late to implement web standards i guess the award goes to safari and i personally didn't have much of a problem with Firefox not supporting a feature other than stt

    • @dentjoener
      @dentjoener 22 дня назад

      @@sidma6488 a lot of these web standards we're force by Google because of their market share. I've been using Firefox for years, and yes, it's slightly but barely slower. But I haven't really ran into bad standard implementations. If it's about video streaming with Google meet I guess we can all tell from the video who's to blame for this one

    • @ruthlessjailer6584
      @ruthlessjailer6584 22 дня назад +2

      telling people to DIY is giga cope, nobody is combing through 30 million lines of code to fix issues mozilla should have themselves YEARS ago

  • @Koroistro
    @Koroistro 22 дня назад +23

    That's an expensive debugging feature, 20% of turnover to be exact.

    • @jay.rhoden
      @jay.rhoden 22 дня назад

      It acts like it's useful for debugging, until certain three letter government agencies become interested.

  • @asrk3855
    @asrk3855 22 дня назад +17

    The fingerprinting they can do with this is massive

  • @TomNook.
    @TomNook. 22 дня назад +2

    BuT yOu'Re UsInG a GoOgLe PrOdUcT nOw

  • @fildet
    @fildet 22 дня назад +3

    Just a comment on the DMA comment: true for now, but the EU hasn’t stopped. They have 12 months to reach a non-compliance verdict so it’s still the early days for now. In the meantime Apple has the time to fix the stuff it needs to fix. If they’re found non compliant they will be given big fines

  • @cyangalaxy
    @cyangalaxy 21 день назад

    Are you Low Level Coding now? 😂

  • @dan-garden
    @dan-garden 22 дня назад +4

    L take

  • @elameend
    @elameend 22 дня назад +14

    Another day, another google bs revealed

  • @lllIIIlIlIII
    @lllIIIlIlIII 22 дня назад

    been enjoying watching your videos the last few weeks and months but this one is off and i think you and everyone else knows why. everyone has bias's and that's fine, maybe next time it happens just skip the topic and make a video about the next thing instead.

  • @dumpling_byte
    @dumpling_byte 22 дня назад

    Android > IOS