[HN Gopher] Google Chrome has an API accesible only from *.googl...
___________________________________________________________________
Google Chrome has an API accesible only from *.google.com
Author : develatio
Score : 638 points
Date : 2024-07-09 16:35 UTC (6 hours ago)
(HTM) web link (twitter.com)
(TXT) w3m dump (twitter.com)
| bonestamp2 wrote:
| Is it fair to assume this is used for fingerprinting/tracking
| users?
| sophiebits wrote:
| No.
| daniel_levine wrote:
| this is a great comment, thank you for your service!
| diggan wrote:
| The tweet says:
|
| > So, Google Chrome gives all *.google.com sites full access to
| system / tab CPU usage, GPU usage, and memory usage. It also
| gives access to detailed processor information, and provides a
| logging backchannel.
|
| Those things can absolutely be used to "improve"
| fingerprinting. I don't think it's fair to assume it's being
| used for that though, without any further evidence. But it
| certainly could be used for it.
|
| Anyone have any further context? As it stands right now, it's
| just a random claim without any proof what so ever? There is
| link in another comment, but how is that related to the tweet?
| CoastalCoder wrote:
| > I don't think it's fair to assume it's being used for that
| though, without any further evidence.
|
| Maybe in this situation we should distinguish "fair" vs.
| "probable".
|
| I'd guess it's _improbable_ that Google is trying to use this
| for fingerprinting.
|
| But if we've previously found them with their hand in the
| cookie jar, then maybe it's _fair_ to treat them as guilty
| until proven innocent?
| rolph wrote:
| perhaps a measure to determine if the owners devices can
| tolerate one more web app or ad stream before it runs out of
| resources
| plorkyeran wrote:
| Google doesn't need any extra help to track users who are
| browsing Google sites in the Google browser. It is probably
| instead anticompetitive functionality that lets Google sites
| work better in Chrome in ways that other sites can't replicate.
| MisterDizzy wrote:
| Hardly surprising. This is very Google-like behavior. The
| question is do other Chromium browsers have this? Edge? Brave?
| Chromium? Ungoogled Chromium?
| bakugo wrote:
| Don't know about the rest, but ungoogled chromium scrambles
| every occurrence of the string "google" in the code
| specifically to avoid things like this, so probably not.
| idunnoman1222 wrote:
| Scrambles to a static unpurchased domain?
| doctorpangloss wrote:
| You'd hope so right?
|
| If you don't want to use Google's browser, don't use
| Google's browser.
| scrollaway wrote:
| I don't think you understand the security implication of
| what you just said.
|
| Edit, if it's not obvious: an unclaimed domain with
| special permissions is a massive security hole.
| 8organicbits wrote:
| Perhaps you could explain.
| doctorpangloss wrote:
| I understood what the commenter was saying and the
| "security implication." I am mocking the thing that
| people want: to use Google Chrome but with the "googly"
| bits removed. It isn't super practicable. Just use
| Firefox.
| Dwedit wrote:
| If you end up with characters outside of the valid range
| after scrambling, then probably not.
| rany_ wrote:
| No network traffic is allowed on that random TLD. It is
| blocked.
| xigoi wrote:
| What if it's checking a hash of the domain name?
| yreg wrote:
| Unless Chromium does something like atob("Z29vZ2xlLmNvbQ==")
| 0cf8612b2e1e wrote:
| Malware obfuscation techniques to fuel the ad machine.
| burkaman wrote:
| It is disabled: https://github.com/ungoogled-
| software/ungoogled-chromium/blo...
|
| If this flag is true then the extension is added: https://sou
| rce.chromium.org/chromium/chromium/src/+/main:chr... and http
| s://source.chromium.org/chromium/chromium/src/+/main:chr...
| burkaman wrote:
| Yes, Edge has it enabled. If you open Google Meet
| troubleshooting in Edge you can see your system CPU. If you try
| it in Firefox it says "Try Google Chrome to see your CPU
| usage".
| pcwalton wrote:
| Google has done this sort of thing before. My memory is fuzzy as
| to the details, but I think it was Native Client being
| allowlisted at the domain level to only work on Hangouts, or
| something like that.
| beardyw wrote:
| What has an hidden API where? I have no idea what this is trying
| to say. Can anyone make sense of it?
| emilsedgh wrote:
| Google allows web pages from *.google.com to read a user's cpu
| usage, gpu usage, etc.
|
| Other web pages don't have such access.
| sophiebits wrote:
| Websites hosted on the google.com domain can access more data
| about the device than websites hosted on any other domain.
| josephcsible wrote:
| https://source.chromium.org/chromium/chromium/src/+/main:chr...
|
| That API is baked into Google Chrome. It's hardcoded to only
| let google.com use it.
| jeffbee wrote:
| I don't think that is an accurate description. The APIs are
| available in Chrome to anyone: https://developer.chrome.com/d
| ocs/extensions/reference/api/s...
|
| The allowlisting going on here is that normally when you
| install an extension in Chrome it asks you to confirm the
| access to those APIs on the sites where the extension wants
| to run, but this one comes pre-confirmed from the factory. A
| quick GitHub search finds ~1000 manifest files that list
| system.cpu, possibly because that API is also in the
| boilerplate example chrome extension manifest.
| josephcsible wrote:
| That's still just as unfair, though. Google always has
| access to that information because their extension is
| preinstalled and you can't disable it, but other websites
| have no access to that information unless you go out of
| your way to install a third-party extension to do so.
| jeffbee wrote:
| OK. That's a point of view. I just thought it should be
| accurately described.
|
| I think the idea that you will download a web browser
| from Google and then it won't be able to figure out what
| model of CPU it is running on is a bit weird, when you
| think it through. There are lots of features of Chrome
| that are only "available to Google" for example it will
| only download updates from Google, unless you've modified
| its source code.
| IshKebab wrote:
| I mean... You downloaded the browser from Google. Did you
| think Google wouldn't have some kind of privileged access
| to it?
| autoexec wrote:
| Google would naturally have privileged access to the
| browser, but that doesn't need to mean they have secret
| privileged access to my computer's hardware
| IshKebab wrote:
| Uhm... you do know Chrome runs on your hardware and has
| full permission to do pretty much whatever it likes?
| ranger_danger wrote:
| That is the source code of Chromium, not Chrome.
| Loic wrote:
| If correct, once you access a `.google.com` website, the
| browser makes available through javascript an API allowing the
| querying of a lot of information about _all_ the open tabs (if
| open, for example, your banking website) and _can_ send the
| collected information to the "mother ship".
|
| If true, as usually, a lot of people have a Google tab open,
| you can easily deduct what it means.
|
| This is definitely something to be investigated, for the
| moment, we only have a tweet.
| happyopossum wrote:
| > an API allowing the querying of a lot of information about
| all the open tabs (if open, for example, your banking
| website)
|
| No. It uses the chrome.system.cpu API, that any extension can
| access, which gives CPU and RAM utilization info about your
| tabs. It doesn't give anyone "a lot of information about all
| the open tabs", and does nothing to expose your banking
| website...
|
| https://developer.chrome.com/docs/extensions/reference/api/s.
| ..
| jeffbee wrote:
| You can build Chrome without this by setting
| `enable_hangout_services_extension` to false. Of course, then
| none of the WebRTC stuff on google.com will work.
| ramesh31 wrote:
| One does not simply "build chrome".
| tgv wrote:
| Chromium has ungoogled builds: https://chromium.woolyss.com/
| ranger_danger wrote:
| yes but that's Chromium, not Chrome (which is proprietary).
| I think that's what OP was saying
| mananaysiempre wrote:
| Not necessarily. Building even Chromium can be...
| unpleasant[1].
|
| [1] https://liberda.nl/weblog/heres-your-copium/
| lifesaverluke wrote:
| The process is well documented :-)
| dudus wrote:
| FWIW I once tried and failed to compile Chrome. My machine
| didn't have enough RAM to compile chrome at the time. Even
| though it was able to fully compile any other software I
| threw at it.
| lifesaverluke wrote:
| Yeah, you need a big machine. I provide Chromium builds
| for AWS Lambda, compiling on a large EC2 instance.
| sebazzz wrote:
| Is that special to the Chrome codebase, or inherent to
| the fact that a web browser is now basically an operating
| system by itself?
| poincaredisk wrote:
| I think parent's point was that Chrome is not open-
| source, chromium is.
| ramesh31 wrote:
| But also this. Compiling Chromium from source is a
| nontrivial task, even for a senior dev, and requires an
| extremely powerful system.
| recursive wrote:
| Just like the US tax code is well documented?
| daft_pink wrote:
| i just want to know if this is built into arc to be honest.
| autoexec wrote:
| No WebRTC would be a win, but people can just use firefox and
| disable WebRTC globally.
| htrp wrote:
| > So, Google Chrome gives all *.google.com sites full access to
| system / tab CPU usage, GPU usage, and memory usage. It also
| gives access to detailed processor information, and provides a
| logging backchannel.
|
| So I guess the question becomes how quickly you can spoof this ?
| justo-rivera wrote:
| You just need to "register" a subdomain. So basically any
| google employee has potentially full access to your system?
| sophiebits wrote:
| You're likely severely underestimating the amount of internal
| paperwork and review that is required to launch a new
| google.com subdomain.
| isodev wrote:
| Maybe they don't need a new subdomain, something unused
| could do the trick.
| drpossum wrote:
| I did one on my local network and didn't fill out anything
| block_dagger wrote:
| But only you have access to your local network.
| therein wrote:
| That's not necessarily true.
| drpossum wrote:
| Good thing all networks everyone connects to are always
| known by that user to be secure
| bqmjjx0kac wrote:
| Do these APIs not require https?
| drpossum wrote:
| The case here was just injecting a domain. There's
| another thread for this post pointing out you would also
| need to inject a malicious root cert for https traffic,
| which is correct, but not impossible (and given some
| bad/lazy practices I've seen places do when they sign
| their own certs for internal infrastructure, not a far
| stretch)
| jonas21 wrote:
| If they can do that, they can spoof or proxy any website
| and collect your passwords, auth cookies, and anything
| else sent over the network. At that point, who cares if
| they can also see how much CPU you're using?
| drpossum wrote:
| I've unlearned over my years that trying to come up with
| what malicious actors can do under what scenarios and
| conditions isn't worth the effort, because they are many,
| know more than me, have different goals than me, and I am
| one. There's endless permutations of environments and
| additional weakness or scenarios or a particular
| sensitivity of information that you don't or can't
| consider that make some attack really painful. For this
| case, maybe CPU usage or aggregate changes in CPU usage
| tips off an attacker on what someone is ramping up
| internally that can be used for espionage or even timing
| attacks.
|
| What I have learned in place of that is plug holes to
| minimize attack vectors.
| pharrington wrote:
| is your local network google.com ?
| shreddit wrote:
| I can tell my pc what ca to trust, so yes i can make it
| to...
| mimon wrote:
| So if you can just trick someone into trusting a bogus
| root CA, take control of their DNS resolution, and get
| them to open an attacker controlled domain in Chrome then
| you can... Use this API to get information about their
| current CPU utilisation.
|
| Wow some attack you got there.
| riccardomc wrote:
| Probably a 'something.google.com'...
|
| But you could have teams with DNS zone delegation who
| can.create.anything.like.this.google.com
| drpossum wrote:
| Or anyone who controls your DNS resolution which has a number
| of paths (for example a local hosts file, possibly a router,
| changing your config or how you get your config to a
| malicious DNS server, etc)
| ruined wrote:
| or public wifi access point
| q3k wrote:
| Not that easy with HSTS.
| wbl wrote:
| Also need a cert which is tricky
| eknkc wrote:
| Won't work with https.
|
| If that malicious actor can install a custom ca too, they
| can already install whatever spyware they want.
| abirch wrote:
| You'd probably need DNS and Root Certificates, something to
| which most employers have access
| mywittyname wrote:
| Is it really that easy? I just kind of assumed that devs
| could create subdomains under a dev TLD like googdev123.com,
| but not google.com until it was a fully-fledged product
| release.
| hn_go_brrrrr wrote:
| Nothing at Google is that easy. It is a large and slow-
| moving bureaucracy.
| rpnx wrote:
| Agree. I work at Google. I promise nothing happens
| quickly. It can take over a week to set up a new SQL
| database & client. Half coding (don't get me started on
| boq...) and half data integrity and criticality
| annotations for the data...
|
| I don't know what setting up a new domain is like but I
| can't imagine it's something you "just do".
| Tiberium wrote:
| In what world does "system / tab CPU usage, GPU usage, and
| memory usage" mean "full access to the system"? Any Chrome
| extension can access this info easily, the point that the
| tweet makes is that there's a built-in Chrome extension that
| shares this info with Google's own websites without any
| confirmation.
| nashashmi wrote:
| Drive.google.com links also work
| mysterydip wrote:
| What about anything on sites.google.com?
| sophiebits wrote:
| If you mean can another domain trick Chrome into letting it
| access those APIs... probably not; it seems it's based on the
| browser extension architecture which is already somewhat
| hardened and I believe doesn't even load the code for the
| extension if you're not on a matching domain (though the
| typical protection goes the other way around -- preventing
| extensions from accessing website data without permission).
| darby_nine wrote:
| It seems bad enough that Google has access to it to justify
| ripping it out.
| lyu07282 wrote:
| Pretty much impossible, would need to defeat https/ct. You
| would have to spoof *.google.com within chrome.
| jandrese wrote:
| So if you install your own certificate authority and then
| spoof the DNS it might be possible? Not so useful as an
| attack vector, but potentially useful for people who want to
| do fun things with the browsers they own.
| explaininjs wrote:
| You can just expose the data to all sites with your own
| extension if you have access to the device.
| etc-hosts wrote:
| certificate pinning would prevent this for google related
| domains.
| AnimalMuppet wrote:
| Don't have to spoof it - just put something on Google Docs and
| send people a link.
| sophiebits wrote:
| Google Docs is designed to not let you run arbitrary JS in a
| trusted (i.e. google.com origin) context, or else the author
| of any doc you visit could act as you on Google properties.
| fjni wrote:
| Wouldn't you be able to deploy an app script website, which is
| hosted on "script.google.com" and make use of this?
| jhdifdhsak wrote:
| your code do not run from that domain at all.
| rc_mob wrote:
| it does if I hack your dns server :)
| agartner wrote:
| It seems most if not all google domains are HSTS
| preloaded so no you can't:
| https://hstspreload.org/?domain=script.google.com
| pixl97 wrote:
| Does Chrome do certificate pinning checking in this case?
| jeffbee wrote:
| If you could spoof google.com you have much bigger fish to fry.
| bastien2 wrote:
| This just in: Google Spyware has features accessible only to
| Google.
| blackeyeblitzar wrote:
| So this is a lot like Microsoft using specialized formats or APIs
| in Windows that competitors cannot access, which was a problem
| throughout the 90s. The problem never went away - it has just
| changed appearance.
| Brian_K_White wrote:
| This is a little different than Office being able to use some
| useful OS integration feature that LibreOffice can't use.
|
| This is allowing Google to do something TO you that no one else
| can do to you, and that you assumed no one could do to you.
| baggy_trough wrote:
| Wonder if Edge renames this to *.microsoft.com or bing.com.
| mcpar-land wrote:
| Google spent billions muscling their way into their majority
| market share of web browsers, now they're going to keep on
| cashing out with unfair practices like these.
| ethanppl wrote:
| I wonder how Chromium, Brave or Edge handle this?
| newzisforsukas wrote:
| Its in the chromium repo:
|
| https://source.chromium.org/chromium/chromium/src/+/main:chr...
|
| https://source.chromium.org/chromium/chromium/src/+/main:chr...
| newzisforsukas wrote:
| You also could probably block this with a policy file.
|
| The extension ID is: nkeimhogjdpnpccoofpliimaahmaaome
|
| https://chromeenterprise.google/policies/?policy=ExtensionIn.
| ..
| jgalt212 wrote:
| It's like Google relishes in giving the FTC all the help it could
| ever want.
| ranger_danger wrote:
| login-walled
| madeofpalk wrote:
| I'm not sure what these APIs are exactly and why they're there,
| but Firefox also does something similar. It has special APIs
| available only to Mozilla and/or Firefox domains, for things like
| installing extensions, or helping with first-run experience.
|
| A blog post about it was shared here on Hacker news <12 months
| ago, but I'm having trouble finding it...
| jhdifdhsak wrote:
| Hardly the same.
|
| apis are public, documented and the domain allowlist is both
| included in the UI and about:config (save from android
| playstore version where they hide everything to make the
| browser pure garbage for whatever reason)
|
| and I'm pretty sure devs would at least think about adding your
| domain by default if you ask nicely with a great use case on
| bugzilla.
| nightpool wrote:
| What? You think that Mozilla devs would think about adding
| your domain to the whitelist of domains allowed to _install
| extensions_ if you just asked nicely? That would be insane
| from a security perspective.
| Osmose wrote:
| I wrote a post about the UITour parts a long time ago:
| https://www.mkelly.me/blog/content-uitourjs/
|
| It's pretty standard among browsers. The risk should be about
| equal to someone spoofing the domains that the browser
| downloads software updates from, and you can turn it off via
| prefs if you really don't want it.
| xxmarkuski wrote:
| A commit to Webkits Quirks.cpp was shared last month [0].
| Probably not what you are referring to but has a similar vibe.
|
| [0] https://news.ycombinator.com/item?id=40631439
| thayne wrote:
| But that is for websites directly related to operating the
| browser, whereas chrome is exposing APIs used by unrelated
| google products such as google meet.
|
| This could possibly also be a violation of anti-trust laws
| since it is using a monopoly in one market (browsers) to get an
| advantage in another (video conferencing).
| Tiberium wrote:
| I think the submission is a bit wrong in editing the title from
| the original. I understood it like this:
|
| Chrome has a built-in extension that uses public Chrome APIs that
| are easily available to other Chrome extensions. The issue
| described is that this extension shares this information to
| Google's own domains when they're communicating with the
| extension, while other websites can't do this.
|
| There's no "special hidden API".
| Cyphus wrote:
| "special" in the sense that unlike other extensions which are
| user-installed, this one is built into Chrome.
|
| "hidden" in the sense that when I go to chrome://extensions it
| is not listed.
|
| And as you already mentioned, it's a Chrome API.
| danans wrote:
| There is potentially an innocuous and straightforward
| explanation for this. Imagine the browser comes with some
| functionality implemented as a google.com-signed web app (as
| opposed to compiled/linked C++ as a lot of the older Chrome
| UI).
|
| It would be silly if that PWA-implemented browser code would
| need permission to access the system information, since it is
| part of the browser's functionality itself.
|
| Another use case for a private API (that has long existed) is
| integration of the Chrome browser with Google-specific websites
| that provide core functionality, like the Chrome Web store, to
| allow for installation/removal of extensions from a web page.
| ranger_danger wrote:
| Any time things like this are needed, I think it should ask
| the user for permission first.
| danans wrote:
| My examples are of core browser functionality, just
| implemented with a different tool chain (a web app instead
| of C++). Should the user be asked for permission for C++ to
| send an IPC to another C++ component? Should the Chrome Web
| store ask for permission to install extensions in Chrome?
|
| Down-thread I see that this is being used for Google Meet
| functionality, for which I agree it should ask for the
| user's permission.
| runarberg wrote:
| I think it is a mistake to give a company like Google the
| benefit of the doubt. Consumer protection is a lot like
| security, we should theorize the worst case scenario, and
| assume the company is willing to work against consumer
| interest if it serves their own interests.
|
| If there exists a mundane and reasonable explanation for
| this, that doesn't matter if there also exists a potential to
| exploit it in a way that harms consumers' interests.
| parhamn wrote:
| Same thing with more steps?
| silverwind wrote:
| A "built-in extension" is still part of the browser unless it
| can be disabled.
| lwansbrough wrote:
| This is functionally equivalent.
| simonw wrote:
| Paste this into a Chrome DevTools console on a Google site -
| sure looks like a special API to me:
| chrome.runtime.sendMessage(
| 'nkeimhogjdpnpccoofpliimaahmaaome', { method:
| 'cpu.getInfo' }, response => {
| console.log('CPU Info:\n', JSON.stringify(response, null, 2));
| } );
| Jcampuzano2 wrote:
| For what its worth, I'm on Brave (chromium based) and this
| also works there, so it appears to not necessarily be only
| Chrome but potentially any chromium browser where they
| haven't specifically blocked/disabled this
| rundev wrote:
| > Paste this into a Chrome DevTools console
|
| I just learned that Chrome's sandbox has a huge hole in it
| for Google sites, and you want me to paste code into DevTools
| for said sites? Any bash scripts you want me to run as root
| as well? :)
| simonw wrote:
| You're welcome to read the five lines of code I shared
| yourself before you run it!
| ikiris wrote:
| You're literally running their program already. They're
| already running arbitrary code on your machine.
| lnxg33k1 wrote:
| People are running it because they think Google is
| trustworthy, so telling about abuses might be useful in
| order to erode that trust and let people know they
| shouldn't run anything from that company
| replete wrote:
| This does not work (as expected) on `ungoogled-chromium`.
| chrsig wrote:
| Is there more of an explanation? I see a baseless claim without
| any specificity.
|
| I'm not saying it's right/wrong, just that no evidence was
| presented.
| develatio wrote:
| There is a link pointing out the exact place in Chrome's code.
| mmsc wrote:
| And? Google uses Chrome to retrieve data about the user.
|
| Every Chromium-based browser has 'hidden' APIs only accessible on
| certain domains. That's how the custom (read: closed source)
| extensions work. "Component extensions" are used to interact with
| them normally:
| https://chromium.googlesource.com/chromium/src/+/main/extens...
|
| See https://blogs.opera.com/security/2021/09/8000-bug-bounty-
| hig... and https://blogs.opera.com/security/2021/09/bug-bounty-
| guest-po... for examples of when there are vulnerabilities in
| those extensions, and how they can be abused for remote code
| execution.
|
| Any whitelisted domains for these APIs cannot be written to using
| user-installed extensions, in order for a malicious extension to
| not be able to inject a script and execute the special API.
|
| At Opera, we previously tried attacking the underlying
| implementation about how these 'hidden' APIs are accessible.
| Although we found a lot of Opera-specific issues, the Chromium
| logic seems sound and a "bypass" for other websites accessing the
| API is unlikely. It also seems that the developer here was just a
| bit overzealous in allowing this API to be accessed from all
| google.com subdomains.
| jhdifdhsak wrote:
| technically correct. google chrome should forever be called
| "Tainted Chromium" to use the same nomenclature as the Linux
| Kernel when you load blobs.
| CMYKninja wrote:
| I can hear the regulators in Strasbourg typing up complaints and
| fines now.
| lashkari wrote:
| If it's really accessible from *.google.com, wouldn't this be
| simple to verify/exploit by using Google Sites (they publish your
| site to sites.google.com/view/<sitename>)?
| DownrightNifty wrote:
| JS on Google Sites, Apps Script, etc. runs on
| *.googleusercontent.com, otherwise cookie-stealing XSS happens.
| simonw wrote:
| Looks like they added this in October 2013:
| https://github.com/chromium/chromium/commit/422c736b82e7ee76...
| Bundle Hangouts Services extension with Chrome
| BUG=291271 Review URL:
| https://codereview.chromium.org/35873003
|
| Here's that review URL: https://codereview.chromium.org/35873003
| PNWChris wrote:
| Disclaimer: I work at Google, but not on Chrome or on these APIs.
|
| I think the explanation is quite mundane. An example usage: open
| google meet, start an empty meeting (an "instant meeting"), click
| the "..." menu, click "troubleshooting and help".
|
| There'll be plots of various stats, including CPU utilization. I
| think meet will also helpfully suggest closing tabs if your
| machine is overloaded during a meet call, too.
|
| It's very helpful, I check it from time to time.
|
| Edit: now that I think about it, I'm not sure about the
| suggestion to close tabs is actually a thing. I've only actually
| used the stats view.
| john-n wrote:
| I believe this is the point, rather than being mundane. Other
| video conference tools are not able to offer this debugging
| option - which you have pointed out is useful.
| tantalor wrote:
| The user could easily install an extension that provides the
| same debugging capability. Most users don't care, so they
| won't need it.
| elicksaur wrote:
| Defaults are powerful.
| lucacasonato wrote:
| like 90% of the DMA is just this haha
| yjftsjthsd-h wrote:
| Then why did Google build it into the browser?
| 3D30497420 wrote:
| Are features like this available to other websites outside of
| Google? Say, could Zoom also add a feature like this?
| RIMR wrote:
| A level playing field for competition? This is Google we're
| talking about.
| SirMaster wrote:
| If Zoom makes a chrome extension, then yes.
| lwansbrough wrote:
| Will the Zoom extension also be installed by default?
| ikiris wrote:
| Do you want every person in the world to run a line to
| your house, or do you want to have 1, and use that
| service to talk to them?
| lucacasonato wrote:
| Except that is not what Google is doing. They have
| exclusive access to the one line that is preinstalled for
| all houses. Only they can use it. And if you want a
| different provider, you can't use that same line. You
| have to pay for the installation of a line from that
| provider with your own cash.
| SirMaster wrote:
| Huh, Chrome doesn't come preinstalled unless you are
| talking about ChromeOS.
|
| I guess I just don't see the problem in a feature like
| this in a third party browser software that is completely
| optional to install and use and has lots of alternatives.
| crowcroft wrote:
| Yes, and then I want them to be heavily regulated.
| octopoc wrote:
| That is incorrect. Zoom would have to modify the browser
| source code to enable the API on their domain.
| hot_gril wrote:
| Beside the point, but I don't think Chrome extensions have
| access to those hardware details.
| YmiYugy wrote:
| They do: https://developer.chrome.com/docs/extensions/ref
| erence/api/p...
|
| But yeah, having that build into your browser is a huge
| advantage over having to nag your users to install an
| extension or worse convincing the IT department that it's
| worth installing.
| hot_gril wrote:
| The special built-in API reveals system-wide CPU usage,
| not just for browser processes. Still surprised
| extensions can see browser processes though.
|
| Edit: https://developer.chrome.com/docs/extensions/refere
| nce/api/s... seems to provide that, though
| jhdifdhsak wrote:
| if we are guessing I would drawn my guess from the hyper
| controlled access to android play services, which do much more
| than what you are guessing.
|
| my guess would also include some nifty debug info from FLoC ;)
| danielmarkbruce wrote:
| It's hilarious how people jump to the most sensational
| explanation for things like this, when in almost every case the
| reason is mundane. In the VR team at google back in 2016, we
| spent soooo much time making sure we deleted any data that
| could in any way be imagined to be related to tracking, not
| because we tracked anything personal, but because it could be
| perceived the wrong way by people with sensational viewpoints.
| "yes, but if you have those random 27 pieces of information,
| and correlate it using x advanced method, you can track what
| some random dude is doing!"
| ascorbic wrote:
| This isn't a mundane explanation though: this is exactly the
| example Luca gives in the original thread. It's anti-
| competitive, because it's functionality only available to
| Google Meet. Google is using its browser monopoly to
| advantage its other products.
| danielmarkbruce wrote:
| They are just trying to make their products better. Anti
| competitive behavior is generally perceived to be about
| doing things that put the company in question in a better
| position without improving the product.
|
| Ask yourself the question - are customers better or worse
| off because of this?
| sbergot wrote:
| Other companies are also trying to make their product
| better. If other products are not able to compete this
| can become a problem for the users.
| danielmarkbruce wrote:
| Companies don't compete with Google Meet? You cannot be
| serious.
| ascorbic wrote:
| That's not what anti-competitive means at all. Having
| APIs that Google Meet can use but competing products
| can't reduces competition, which makes customers worse
| off.
| danielmarkbruce wrote:
| No prospective competitor to Meet ever said "they can do
| app performance monitoring a bit easier than us, we can't
| compete". It's a ridiculous claim.
| danShumway wrote:
| "All they're doing is making their product better."
|
| "Making your product better by privileging your own
| domains in the browser is the anti-competitive part."
|
| "Come on, it's not like it's making their product
| _better_. "
|
| ----
|
| This really isn't complicated. Is this making Google Meet
| better? I would quote:
|
| > danielmarkbruce: "They are just trying to make their
| products better."
|
| Okay. So then Google Meet would be a worse product if
| they didn't have privileged API access over other apps.
| So... this does make it harder for those other apps to
| compete, unless you think that the quality of a product
| is somehow irrelevant for competition.
|
| Sure, Google Meet still isn't winning, but who knows
| where they'd be in the market if they didn't privilege
| themselves.
|
| You're saying that their product would be worse if they
| didn't do this, but also that it somehow doesn't matter
| because they're not the _best_ product. Which has a
| similar energy to me cutting a loop out of a marathon and
| saying, "Come on guys, I only came in third. It's not
| _cheating_ unless I come in first, everybody knows that.
| As long as I don 't come in first I'm allowed to take
| shortcuts. Give me my third place medal that I definitely
| earned fairly, why is everybody mad about this?"
| danielmarkbruce wrote:
| That's a misleading analogy. The point of products is to
| provide value to customers. The point of competition law
| is to benefit customers. Competition is a by product of
| several companies out there with products. That is very
| different from a marathon where the competition is the
| point itself.
|
| Misleading analogies don't illuminate.
| hot_gril wrote:
| You're saying it's not a big deal while also saying it
| improves the product. The debug panel is apparent, but we
| don't know what else the API's data is used for. Maybe
| Meet uses it to improve performance too.
| danielmarkbruce wrote:
| The goal is to improve the product, not hobble
| competitors.
|
| The result is, they still haven't won.
|
| Motivation = good. Result = immaterial. No contradiction.
| hot_gril wrote:
| Then make the API available to competitors too. They
| still haven't won because Meet is frankly not very good,
| for unrelated reasons.
| rurp wrote:
| Yeah, crazy to think that Google of all companies would track
| people in unexpected ways :eyeroll:.
|
| Your post is evidence that the scrutiny Google gets is
| actually helping matters. Companies, especially powerful
| ones, should default to not tracking personal data any more
| than necessary. I'm glad to hear that at least one department
| took that seriously.
| danielmarkbruce wrote:
| I worked in a few different parts of google - not only did
| they take it seriously, it was insane how hard people
| worked to not even make it possibly interpreted to be
| tracking.
|
| For the vast majority of products, tracking people isn't
| useful. People's imaginations run far ahead of reality.
| ayewo wrote:
| > People's imaginations run far ahead of reality.
|
| Can you really blame people for that when the company in
| question has been enmeshed in a case like this [1]
| involving Chrome.
|
| 1: https://www.reuters.com/legal/google-
| settles-5-billion-consu...
| danielmarkbruce wrote:
| Have you read the details of what they were actually
| doing? Like, the actual details. What you are going to
| find is the left hand not knowing what the right hand is
| doing, and the combination of hands making it possible to
| track in a way neither hand thought about.
|
| Google is 200k employees or something now. They aren't
| all in sync. They suffer from the same problems every
| large company does. With very few exceptions, every time
| they are found to be doing something "bad", it boils down
| to incompetence of some sort (the type that is almost
| completely unavoidable), not nefarious goals.
| gavindean90 wrote:
| Tracking is very rarely useful to the application but can
| be useful to the company when the application isn't
| profitable on its own. Google has demonstrated this
| before.
| danielmarkbruce wrote:
| If you think google is using meet performance data for
| advertising, i have a bridge to sell you.
| joshuamorton wrote:
| This is almost precisely backwards. Developers want so
| much telemetry for their applications, almost all of
| which is totally useless outside of the need to debug or
| improve that application.
| lucianbr wrote:
| Don't you find it hilarious how people who work or worked at
| Google happen to think that things Google does are "mundane",
| even when other people think they're outrageous? Hilarious
| coincidence, really. Can't stop laughing.
| danielmarkbruce wrote:
| It's sort of the definition of "sensational"...
| RIMR wrote:
| Very cool that Google built an anticompetitive browser that
| offers such useful features only to themselves.
|
| Very cool of you as a Google employee to say the quiet part out
| loud for us.
| danielmarkbruce wrote:
| Are customers better off or worse off?
| trickstra wrote:
| Worse, by having less alternatives to choose from. This is
| why anti-monopoly laws exist.
| danielmarkbruce wrote:
| No, Google should not make their products worse so people
| have more choice. More choice isn't good all by itself.
| Having 700 crappy extra choices is net bad. The explicit
| goal of anti-trust legislation and regulation has always
| been grounded in what is good for the customer (although
| Lina Khan has some different ideas that don't seem to be
| going far in court).
|
| Did this thing even achieve the non-goal of reducing
| alternatives?
| AlexandrB wrote:
| Worse off. I have to use Meet for work, and I'm forced to
| run Chrome for Google's shitty software to run acceptably.
|
| Edit: And for some reason I have a Chrome profile even
| though I never created one and never "logged into" Chrome.
| Another thing that's been forced on me by Google's product
| team.
| karaterobot wrote:
| Trying to be generous, the only reason I can think for why
| customers would be worse off is that Google is literally
| the only one who can be trusted with this kind of power.
| Not Zoom, not Microsoft, not the user whose data is being
| transmitted, etc.
|
| But even that does not explain why the existence of the API
| was not disclosed. Do you agree that that looks bad for
| them?
|
| Then there is the fact that Google is far from being a
| company people trust. They should be rushing to be
| transparent about their decision, if there is a good,
| persuasive reason for it. They could use the good press.
| Instead, they made a secret API that can read privileged
| system information, locked it so that nobody else could use
| it, and then never told anybody about it--all while
| claiming to be secure, and privacy-focused, and definitely
| _not_ abusing their browser monopoly.
| danielmarkbruce wrote:
| Of course it looks bad.
|
| Google is by and large run by a bunch of engineers who
| are trying to do the right thing and often don't think
| about how things might be perceived. On top of that, they
| do put enormous effort into privacy and security and to
| many folks there, that is enough. There are costs and
| benefits to that situation and attitude.
| YmiYugy wrote:
| Microsoft Edge's source code isn't available. We don't
| know really know what kind of stuff they patch in. It's
| just that Google keeps most stuff in Chrome open.
| miki123211 wrote:
| > I think the explanation is quite mundane
|
| > There'll be plots of various stats, including CPU
| utilization. I think meet will also helpfully suggest closing
| tabs if your machine is overloaded
|
| This is not mundane at all, it's a perfect example of giving
| your product an unfair competitive advantage.
|
| If Meet users are told why their meeting isn't working
| correctly but Zoom, Teams and Slack, Meet users are going to
| have a better experience that Zoom, Teams or Slack has no way
| of replicating.
|
| No wonder every other meeting provider pushes you aggressively
| into using their desktop app, Google Meet's desktop app is just
| Chrome!
| trealira wrote:
| > If Meet users are told why their meeting isn't working
| correctly but Zoom, Teams and Slack, Meet users are going to
| have a better experience that Zoom, Teams or Slack has no way
| of replicating.
|
| I had to re-read this a few times; did you accidentally omit
| a word?
|
| > If Meet users are told why their meeting isn't working
| correctly but Zoom, Teams and Slack _aren 't_, Meet users are
| going to have a better experience that Zoom, Teams or Slack
| has no way of replicating.
|
| I fully agree with you, though; it's anticompetitive for them
| to use Chrome to give their other products an advantage.
| lupire wrote:
| Insert "aren't" after the first "Slack".
| trealira wrote:
| That makes sense; that's how I interpreted it.
| hot_gril wrote:
| At least other video conferencing tools don't lag like Meet,
| so users don't need to debug ;) I think this has to do with
| all of them using H.264 while Meet uses VP8/9.
| fayalalebrun wrote:
| As a result of a flaw in the protocol itself or in its
| implementation?
| hot_gril wrote:
| The implementation is what I was thinking of. I've also
| heard claims that VP9 is inherently slower to encode than
| H.264, but no idea if that's accurate. AVC/H.264 has very
| broad hardware support. For example, the 2019 MBP I'm
| using right now can't do hardware-accelerated VP9
| encoding, but even 2011-ish MBPs can do H.264
| acceleration in both directions. Intel's support matrix:
| https://en.wikipedia.org/wiki/Intel_Quick_Sync_Video
|
| For PCs with dedicated GPUs, Nvidia's matrix doesn't even
| mention VP8/9 encoding, and for decode there are a lot of
| VP8/9 "no"s for GPUs that have "yes" for H.264:
| https://developer.nvidia.com/video-encode-and-decode-gpu-
| sup...
|
| AV1 looks like it's getting broader support, but it's
| still new. Zoom's release notes mention they'll use AV1
| if the participants support it, and I don't see a similar
| note about VP8/9.
| vundercind wrote:
| Oh wow.
|
| This explanation was the first I read of what this actually
| does (yeah, yeah, I didn't read the linked article first) and
| that's a _lot_ worse than I expected.
| tamimio wrote:
| And they do the same thing with YouTube by slowing down the
| initial load in other browsers. Google is evil, and this is the
| least of it.
| justanotheratom wrote:
| "don't be evil"
| lucacasonato wrote:
| I agree it is very useful! This is also how I discovered this
| in the first place.
|
| But that is not at all my point. The point is that google.com
| web properties have access to an API and a browser capability
| that is not available to it's competitors. Google only allows
| reading CPU info for itself.
|
| The reason the data is not available for everyone, is because
| it would be a huge tracking vector. Same reason we don't allow
| webpages to read the device hostname, or username, or Chrome
| profile name. Google exposes this to google.com because it
| trusts itself. That poses this antitrust issue though.
| oldkinglog wrote:
| Monopoly leveraging is illegal, not mundane.
| not2b wrote:
| You have a competitor, Zoom. They have an in-browser version.
| Can they use this API for troubleshooting performance issues?
| No? The European regulators might be interested in that.
|
| Perhaps this is one reason why Meet performs well in the
| browser and Zoom doesn't, meaning Zoom users use the native app
| if they want reasonable performance (particularly with many
| people in the meeting).
| trickstra wrote:
| So helpful that no other website and no other browser can use
| it?
| heavyset_go wrote:
| Looking forward to seeing this comment in discovery
| creatonez wrote:
| The monopolists' first step towards unfairly dominating a
| market always seems pretty mundane.
| toenail wrote:
| Hm, I guess it's good I have a firewall?
| aflag wrote:
| How does that help?
| simonw wrote:
| If you want to see what this does, navigate to
| https://www.google.com/ in Chrome and paste this into your
| DevTools console: chrome.runtime.sendMessage(
| 'nkeimhogjdpnpccoofpliimaahmaaome', { method:
| 'cpu.getInfo' }, response => {
| console.log('CPU Info:\n', JSON.stringify(response, null, 2));
| } );
|
| I got this: { "value": {
| "archName": "arm64", "features": [],
| "modelName": "Apple M2 Max", "numOfProcessors": 12,
| "processors": [ { "usage": {
| "idle": 26879793, "kernel": 5270058,
| "total": 42511068, "user": 10361217
| } }, { "usage": {
| "idle": 27925505, "kernel": 5045974,
| "total": 42900999, "user": 9929520
| } }, { "usage": {
| "idle": 29153545, "kernel": 4688719,
| "total": 43152989, "user": 9310725
| } }, { "usage": {
| "idle": 30140852, "kernel": 4360719,
| "total": 43319960, "user": 8818389
| } }, { "usage": {
| "idle": 34426211, "kernel": 2169516,
| "total": 43433582, "user": 6837855
| } }, { "usage": {
| "idle": 38586206, "kernel": 1338183,
| "total": 43658789, "user": 3734400
| } }, { "usage": {
| "idle": 41067872, "kernel": 598226,
| "total": 43874597, "user": 2208499
| } }, { "usage": {
| "idle": 41795321, "kernel": 412479,
| "total": 43965499, "user": 1757699
| } }, { "usage": {
| "idle": 34484688, "kernel": 2180147,
| "total": 43500079, "user": 6835244
| } }, { "usage": {
| "idle": 38604714, "kernel": 1340358,
| "total": 43680869, "user": 3735797
| } }, { "usage": {
| "idle": 41086212, "kernel": 599273,
| "total": 43883401, "user": 2197916
| } }, { "usage": {
| "idle": 41802500, "kernel": 411499,
| "total": 43970596, "user": 1756597
| } } ], "temperatures": []
| } }
|
| This won't work on non-Google URLs.
| CoastalCoder wrote:
| I'm glad that, at least, CPU ID isn't part of that.
|
| Actually, do modern Macs even allow normal software to discover
| the CPU ID?
| leros wrote:
| I briefly worked on Internet Explorer in ages past. They would
| develop APIs with the Windows team for use in IE to give IE
| special features that other browsers couldn't implement.
| tantalor wrote:
| Looks like this is accessing "chrome.system.cpu" API, which any
| extension can access (given the "system.cpu" permissions).
|
| https://developer.chrome.com/docs/extensions/reference/api/s...
|
| You can see all the permissions requested by this extension here:
|
| https://source.chromium.org/chromium/chromium/src/+/main:chr...
| Palmik wrote:
| People arguing that this is "just extension" are ignoring the
| fact that extensions have special priviledges compared to
| websites, and you would not want all websites to have the full
| power of arbitrary extension.
|
| If it's "just extension", make it available to all domains.
| lwansbrough wrote:
| For anyone having trouble with the logic here, which seems like a
| lot of people in this thread for some reason:
|
| [Google's browser] comes with [code] that [does things] in a
| default installation of [Google's browser] that [Google's
| competitors] can't do in a default installation of [Google's
| browser].
| SahAssar wrote:
| Didn't you leave out that [Google's browser] allows [Google's
| websites] to do things [other websites] cannot?
|
| Ostensibly [Google's websites] are websites like any other, but
| [Google's browser] treats them differently. IIRC Mozilla does
| similar things for addons.mozilla.org, but googles seem more
| broad since they are not as clearly linked to browser
| functionality.
| lwansbrough wrote:
| We're saying the same thing. There are some who believe this
| is okay. But it is clearly monopolistic behaviour that should
| be regulated.
| SahAssar wrote:
| My reading of your comment was defensive of google,
| basically "google ships a software package so of course
| they should be able to do stuff others can't" where I tried
| to highlight "google ships a _browser_ which should of
| course treat websites equally ". Seems like I misunderstood
| the intent behind your comment.
| kristjansson wrote:
| [does _relatively innocuous, relatively boring_ things]
| ffhhj wrote:
| Like [slowing Youtube down] on [Firefox] [0].
|
| [0]: https://www.zdnet.com/article/youtube-is-slowing-video-
| loads...
| rvnx wrote:
| A "bug", like breaking Google Docs on Vivaldi -\\_(tsu)_/-
| some_random wrote:
| That only Google can do, which makes competing with them
| harder. This isn't difficult to understand.
| kristjansson wrote:
| yes the resource monitoring and alerting on meet was
| instrumental to my decision to cancel all other software
| subscriptions and give all my money to google
| some_random wrote:
| What the fuck are you talking about?
| realce wrote:
| It's generally anti-competitive behavior, your personal
| experience with it has no bearing?
| kristjansson wrote:
| I'm joking a bit, but I do think it's important to
| articulate the purported harms of claims of anti-
| competitive behavior. What did they do with this
| capability? How did that harm their competitors? Is the
| actual conduct worth getting up in arms about?
| paulddraper wrote:
| Can you elaborate?
|
| Is it just Google's competitors, or it is everyone?
| Suppafly wrote:
| I don't have a problem with the logic, I'm just not sure why I
| should care. I imagine Edge probably can do magic stuff on
| microsoft sites that it can't on the rest of the web too. It
| makes sense for the browser to have a higher level of trust for
| the company that makes it than it does for the wider web.
| lupire wrote:
| There was massive antitrust lawsuit about behavior like this,
| when browses where new.
| Suppafly wrote:
| >There was massive antitrust lawsuit about behavior like
| this, when browses where new.
|
| I'm still no sure why I should care.
| curtisblaine wrote:
| > I'm still no sure why I should care.
|
| Because the Web is supposed to be based on open standards
| and browsers are supposed to be neutral platforms that
| implement the standards.
|
| If you don't care about that, fair: nobody really cares
| that you don't care. What everybody cares about is what
| happens if some of the various antitrust agencies of the
| world start caring.
| shadowgovt wrote:
| Some people remember when the government went after Microsoft
| for having secret APIs that only IE could use.
|
| ... but other people remember that in the time since, that
| entire Microsoft monopoly fiasco is held up as an example of
| bad prosecution, and we don't go after companies like that
| anymore.
| Suppafly wrote:
| >... but other people remember that in the time since, that
| entire Microsoft monopoly fiasco is held up as an example
| of bad prosecution, and we don't go after companies like
| that anymore.
|
| This, but also, I still don't see anyone posting a
| compelling reason why I should care about this issue. The
| government and I don't necessarily have the same interests.
| Personally I don't care that google gives their own browser
| more access to my computer when I use google services, and
| if it improves my experience, I actually want that to be
| the case.
|
| The bulk of the complaints about this just seem to be
| tattletale behavior you see from children, not any thought
| out complaints based upon an actual harm.
| curtisblaine wrote:
| The actual harm is that other companies can't use that
| additional access. If they could they might be offering
| better products than Google to me and you. You might not
| care about better products, but I (and probably many
| people on this post) do.
| mike_hearn wrote:
| The name hangout_services suggests this is some old tech debty
| hack intended to make developing Google Hangouts easier by giving
| that team a direct stream of telemetry. For those who have
| forgotten, Hangouts was the first app that did video calling in
| the browser using what became WebRTC. If you look at what this
| module is doing it's exposing stuff like CPU/GPU/RAM
| usage/hardware details back to the app that it wouldn't normally
| have.
|
| My guess is that Google will react to this Twitter thread by
| simply deleting it. Hangouts has been a dead product for a while;
| if their server side code still uses it they can surely remove it
| as presumably the Chrome team monitor WebRTC performance
| themselves in a multi-site way now, given the much wider usage.
| lucacasonato wrote:
| No, this is used by Google Meet right now. Open the
| "Troubleshooting" panel in meet.google.com in Chrome, and
| you'll see live system wide CPU usage reporting :)
| mike_hearn wrote:
| Right, Meet is derived from the Hangouts codebase, I still
| think they'll probably just delete it. Meet is a stable
| product, how valuable is this special privilege now?
| badgersnake wrote:
| It works perfectly well in Firefox without it, so I guess
| not much.
| ehPReth wrote:
| unsure how it's reported back now, but I believe (it's been
| a while since i've dug in there) it's also exposed as a
| metric for Google Workspace administrators to monitor
| client perf during said calls as well
|
| (but yeah it would just be easier to yoink it)
| refulgentis wrote:
| This is interesting to me because you have all the right
| facts and are reasoning well with them. But, we end up at:
| "Yeah you're right it wasn't killed, just a rebrand, so
| they'll probably just delete the code for it"
|
| I worked at Google, and I can guarantee ya people don't go
| back and change names in old code for the latest rebrand
| done for eyewash 4 layers above me. Not out of laziness,
| either, it just has 0 value and is risky.
|
| Also, video conference perf was/is a pretty big deal (c.f.
| variety of sibling comments pointing out where it is used,
| from gSuite admin to client app). It is great on ye olde
| dev machine but it's very, very hard on $300
| WintelChromebook thrown at line-level employees
|
| FWIW, they shouldn't have hacked this in, I do not support
| it. And I bet they'll just delete it anyway because it
| shouldn't have been there in the first place. Some line-
| level employee slapped it in because, in the wise words of
| Ian Hickson: "Decisions went from being made for the
| benefit of users, to the benefit of Google, to the benefit
| of whoever was making the decision."
| lupire wrote:
| Google videoconferencing runs astronomically better on a
| $300 Chromebook than on a $2500 Intel Mac.
| refulgentis wrote:
| Heh, 100% agree. I switched to Chromebook went WFH
| started because of it. It couldn't handle it on an
| external display but at least it wasn't painfully bad
| mike_hearn wrote:
| Sure, I was sloppy in my use of the term "dead". Hangouts
| the product/brand ceased to exist, Hangouts the codebase
| lives on. It was ever thus. I worked at Google too,
| y'know ;)
| refulgentis wrote:
| Cheers
| shadowgovt wrote:
| This decision was to the benefit of users if it got
| videoconferencing off the ground before Zoom came along.
|
| (I swear, sometimes I think the Internet has goldfish-
| memory. I remember when getting videoconferencing to work
| in a browser was a miracle, and why we wanted it in the
| first place).
| refulgentis wrote:
| Okay.
|
| Pretending you said something conversational, like: "is
| that quote accurate in this case? The API may have
| literally enabled the creation of video conferencing. I,
| for one, remember we didn't used to have it."
|
| I see.
|
| So your contention is:
|
| - if anyone thinks a statsd web API, hidden in Chrome,
| available only to Google websites is worth questioning
|
| - they're insufficiently impressed by video conferencing
| existing
|
| If I have that right:
|
| I'm not sure those two things are actually related.
|
| If you worked at Google, I'm very intrigued by the idea
| we can only collect metrics via client side web API for
| statsd, available only to Google domains.
|
| If you work in software, I'm extremely intrigued by the
| idea video conferencing wouldn't exist without client
| site web API for statsd, available only to Google
| domains.
|
| If you have more details on either, please, do share
| shadowgovt wrote:
| Scoping the data collection to Google domains is a
| reasonable security measure because you don't want to
| leak it to everybody. And in general, Google does operate
| under the security model that if you trust them to drop a
| binary on your machine that provides a security sandbox
| (i.e. the browser), you trust them with your data because
| from that vantage point, they could be exfiltrating your
| bank account if they wanted to be.
|
| But yes, I don't doubt that the data collection was
| pretty vital for getting Hangouts to the point it got to.
| And I do strongly suspect that it got us to browser-based
| video conferencing sooner than we would have been
| otherwise; the data collected got fed into the eventual
| standards that enable video conferencing in browsers
| today.
|
| "Could not have" is too strong, but I think "could not
| have this soon" might be quite true. There was an
| explosion of successful technologies in a brief amount of
| time that were enabled by Google and other online service
| providers doing big data collection to solve some
| problems that had dogged academic research for decades.
| stefan_ wrote:
| It was just updated to extension manifest v3 version and
| someone went to the trouble of having some sort of field
| test id mess for it on top of all the nonsense. Doesn't
| seem like anyone is planning to get rid of it anytime soon.
|
| But the Git history of it is fascinating, starting at the
| initial merge that got it in that went with the old school
| trick of "just call X to explain why this is needed" to get
| your stuff merged. Then every non-trivial change ever to it
| is inevitably auto-reverted due to some failure before
| being resubmitted, this must be the "unparalleled Google
| developer environment" in action - nobody can or bothers to
| run the tests on a piece of software this big. Half the
| commits are various formatting nonsense. One third is my
| favorite - someone making a change to an extension API only
| to realize the fucking hangout guys sneaked an actual
| extension into the code base and they will have to update
| that one to reflect their change. I can feel their anger
| personally.
| cxr wrote:
| In principle, that's something that could be allowed without
| giving access "to" Google/the site owner--even allowing the
| site author to provide their own functions for formatting and
| drawing the values--and thus could be allowed for _any_
| website. Designing and implementing it is a fun technical
| problem, so it's a wonder why it wasn't, considering the
| motivations of a typical programmer (and those at Google
| especially).
| wrs wrote:
| How would you make an API accessible on the browser side
| but prevent the return values from being sent to the
| server? Somebody would surely find a way to use it for user
| fingerprinting.
|
| Edit: I guess if you only want to make a local debug tool,
| you could make it callable only from a completely isolated
| sandbox. Maybe?
| derefr wrote:
| > How would you make an API accessible on the browser
| side but prevent the return values from being sent to the
| server?
|
| Create an API for starting a "performance-metrics
| visualization Service Worker", that takes two things from
| a page as input:
|
| 1. the service-worker script URL
|
| 2. the handle of a freshly-allocated WebGL Canvas (which
| may or may not already be attached to the DOM, but which
| has never yet received any WebGL calls.) This Canvas will
| have its ownership moved to the Service Worker, leaving
| the object in the page as only an opaque reference to the
| Canvas.
|
| The resulting Service Worker will live in a sandbox such
| that it 1. doesn't have network access, 2. can _receive_
| postMessage calls, _but not make them_ ; and 3. doesn't
| have any write access to any storage mechanism. Other
| than drawing on the Canvas, it's a pure consumer.
|
| Also, obviously, this special sandbox grants the Service
| Worker the ability to access this performance API, with
| the metrics being measured in the context of the page
| that started the Worker.
|
| The Service Worker is then free to use the info it
| gathers from making perf API calls, to draw metrics onto
| the moved Canvas. It's also free to change how/what it's
| drawing, or quit altogether, in response to control
| messages posted to it from the page.
|
| The page can't introspect the moved Canvas to see what
| the Service Worker has drawn. All it can do is use the
| Canvas's now-opaque handle to attach/detach it to the
| DOM.
| TekMol wrote:
| The worker could still send the data back to the page via
| side-channels.
|
| For example by using up resources like the cpu, the gpu
| or ram in timed intervalls. The page would then probe for
| the performance fluctuations of these resources and
| decode the data from the pattern of the fluctuations.
| derefr wrote:
| If a page can already deduce performance fluctuations all
| on its own, then you don't _need_ a special access-
| limited performance API, do you? Just have the page do
| whatever you 're imagining could be done to extract this
| side-channel info on the performance of the host -- and
| then leak the results of that measurement over the
| network directly.
|
| (I imagine, if such measurements done by pages are at-all
| distinguishable from noise, that they are already being
| exfiltrated by any number of JS user-fingerprinting
| scripts.)
| oooyay wrote:
| The browser has CORS and CSRF to sandbox similar
| activities to this.
| Cthulhu_ wrote:
| Could it be that it tracks CPU / GPU usage etc to finetune what
| quality video streams to use? It's nonstandard but I can well
| imagine a native app would do this as well.
| kderbyma wrote:
| That was one reason I don't use Chrome. They clearly do special
| stuff on their sites. And spyware is guaranteed with chrome
| dijit wrote:
| This kind of thing is common, there was a file called tweaks.cpp
| which had a list of domains that had slightly different
| behaviours.
|
| That file was very telling to be honest and was well commenter.
| Firefox has a similar file.
| locallost wrote:
| Is this how they implement features like pinning a live game
| score in your phone from the browser? I always wondered how they
| do that.
| Pesthuf wrote:
| Safari also has some Apple specific features, like being able to
| show a special dialog for logging into other websites with your
| Apple account that works differently from passkeys or password
| autofill, or the redirect based flow they make other browsers go
| through.
|
| Always wondered how it's implemented in JS. WebAuthn with
| proprietary arguments...?
| oissla wrote:
| bot detection?
| sreejithr wrote:
| If you're still using Chrome in 2024, you're a fool.
| theshrike79 wrote:
| And this is why we should all boycott Chromium based browsers.
|
| It's turning (and mostly has already turned) into the new
| Internet Explorer.
|
| Use Safari or Firefox, or any other browser that's not based on
| Chromium.
| Hizonner wrote:
| Google really needs to be broken up. Into 5 or 6 totally
| independent pieces.
| throwaway4good wrote:
| Isn't Google chrome open source?
|
| It should be possible to point to the source code of whatever
| google.com extensions that may exist.
|
| Or is this only available in the packaged distributions of
| Chrome?
| throwaway4good wrote:
| https://chromium.googlesource.com/chromium/src.git
| poikroequ wrote:
| I think there are a few bits and pieces which may not be open
| source, such as those for DRM.
| cletus wrote:
| I might be able to shed some light on this (disclaimer: Xoogler).
|
| I worked for a time on Google's internal videoconferencing
| platform, called GVC. This was in 2010-2011 at a time when a lot
| of the company's VC equipment was proprietary, specifically Cisco
| Tandberg units. These were expensive and would be expensive to
| roll out to thousands of meeting rooms.
|
| around this time a different team was developing Hangouts. It's
| been awhile so my memory may be off but I think it was called
| Google Meet at the time? or maybe that was later? It's hard to
| keep track. I think Hangouts was the name adopted when Google+
| came along and rolled Hangouts into its product offering.
|
| There were different configurations of GVC but the most common
| were these All-in-One ("AIO") monitor/computer combos. It was a
| full Intel PC. So the GVC platform was a custom Linux distro. The
| system was designed so GVCs could talk to Google services, which
| was nontrivial, and so software updates could be rolled out. It
| kept old distros too in case one didn't boot. These GVCs had to
| be named and a whole bunch of other issues.
|
| Additionally they needed support for various hardware like a
| touch panel to dial. Larger units required larger PTZ camera
| support and support for various microphones.
|
| Anyway, Hangouts became the stack GVC was built on. This
| ultimately replaced virtually all Tandbergs and saved a fortune.
| This system was certainly still in use by 2017. I can't speak for
| later.
|
| Monitoring was a part of all this. So when I see there are
| *.google.com specific APIs, we need to be sure we're talking
| about this accurately. Like can Google query any Chrome instance
| in the world? Or is it only from/to google.com? I don't know the
| answer and the Tweet doesn't specify.
|
| But given the name hangouts_services and the domain restriction I
| consider it highly likely this is purely to support monitoring
| embedded Chrome for GVC. I could be wrong.
| deanCommie wrote:
| Fascinating!
|
| So it's possible most of Google didn't even know this was
| possible until know.
|
| Until know.
|
| Now there's probably DOZENS of Product Managers approaching
| their product's tech lead going "OK, now...hear me out...."
| kweingar wrote:
| There are zero product managers who read this Twitter thread
| about a random decade-old Chromium hack and will do anything
| about it.
| hot_gril wrote:
| I don't think it's this. Tried a Meet call in Firefox just now.
| If you click the troubleshooting button, there's a CPU chart
| greyed out that says "try Chrome to see your CPU usage." Sure
| enough, in Chrome you can view how much CPU Meet is using, or
| maybe it's systemwide idk, either way I don't think is
| available through regular APIs. Edit: Definitely systemwide as
| confirmed with some `yes` background tasks.
|
| P.S. The naming confusion always comes up. GVC is such a nice
| clear name.
| tedivm wrote:
| This seems pretty unequivocal then- they're clearly using
| this to provide additional functionality to their own
| applications (at least Meet) that other companies who don't
| control the browser can't match.
| filoleg wrote:
| This is not the case. That API is available to any
| extensions for chrome. Including those made by other
| companies that don't control the browser.
|
| Here[0] are the docs for the specific one discussed above,
| for example.
|
| 0. https://developer.chrome.com/docs/extensions/reference/a
| pi/s...
| upwardbound wrote:
| Other extensions, not other websites. This functionality
| is a feature of the Google Meet _website_ that other
| video conferencing _websites_ cannot offer.
| vineyardmike wrote:
| Unequivocally, why can't other video chat companies provide
| their own browser? They could presumably fork chromium and
| change a single string (if it's really just
| "*.google.com").
|
| Obviously that'd go nowhere and no one would use it, but I
| can't imagine this really matters to any competitor
| anywhere.
| doe_eyes wrote:
| > Like can Google query any Chrome instance in the world? Or is
| it only from/to google.com?
|
| I'm sorry, I don't understand the distinction you're trying to
| make? Yes, it sounds like the API is exposed just to the
| content running on *.google.com, but that's still a lot like
| "Google can query any Chrome instance" (that visits their site,
| which is approximately the same, especially since Chrome pulls
| in NTP content from Google by default).
|
| I don't think this is being used maliciously, but it's still
| problematic if Google can troubleshoot problems this way, and
| their competitors in the same space can't. There's no API for
| Zoom, right?
| warkdarrior wrote:
| That API is available to all extensions. So Zoom could create
| an extension that uses that API and get their users to
| install that extension and approve the permission for that
| API.
| danShumway wrote:
| Is there a reason why Google can't get its users to install
| the extension and approve the permission for that API?
|
| I would theorize the reason Google doesn't go through that
| process is that it's unrealistic to expect users en mass to
| do that, and the only way to get wide rollout would be to
| build it into a browser by default and then for good
| measure to hide the fact that it's installed -- something
| which, notably, Zoom can't do.
|
| But I mean, if it's no big deal to get users to install an
| extension, then Google can stop bundling it by default and
| instead ask users to install it, right?
| madeofpalk wrote:
| I never worked at Google.... but this doesn't track for me.
|
| You're saying the reason the 'retail' Google Chrome has this
| bundled plugin is so Google can get observability on CPU usage
| on internal appliances for an internal video conferencing
| platform?
| cletus wrote:
| I'm reading the tea leaves here. I have no direct knowledge
| of the situation. I'm retelling a story that seems (at least
| to me) to be consistent with what little information is here.
| There's plenty you can criticize Google on but I'm not sure
| this qualifies. Let's not attribute malice without cause. Or
| even negligence. It's fair to ask if this needs to be here
| still and what it's for. Let's just not fly off the handle
| prematurely.
|
| As for "retail" Chrome having this plugin, it would make
| total sense. Chrome is a massive codebase. Maintaining a fork
| is a significant amount of effort. It would be far easier to
| add APIs to Chrome and whitelist them for only google.com
| extensions/JS.
| stefan_ wrote:
| It's a nice story but it doesn't plausibly have any remote
| connection to this. I'm sure the people running the GCV
| platform with a custom Linux distro have some other way of
| reporting machine stats than literally "put our custom
| extension into every Chrome install ever".
|
| You can try it for yourself, just
| chrome.runtime.sendMessage("nkeimhogjdpnpccoofpliimaahmaaome",
| {"method":"cpu.getInfo"}, (resp) => { console.log(resp); });
|
| on any *.google.com page.
| asr wrote:
| So the concern is that Google is making Hangouts better in a way
| that is hard for competitors to replicate? (And by "hard," I
| mean, "competitors have to ask users to install something," not
| hard in any HN-relevant sense of the word.) This forum sure has a
| lot of wanna-be Handicapper Generals.
| https://en.wikipedia.org/wiki/Harrison_Bergeron
| yjftsjthsd-h wrote:
| If it's easy for users to just install the extension, then
| obviously there's no point in Google doing this in the first
| place. The fact that they bothered sounds like a pretty
| compelling argument for it being worth caring about.
| daitangio wrote:
| I stopped using Chrome as my primary & only browser. Too much
| power in one hand?
| benced wrote:
| This API either shouldn't exist or should be Google only. It
| would be an absolute disaster if everyone had access to it.
| poikroequ wrote:
| Is it not Google only?
___________________________________________________________________
(page generated 2024-07-09 23:01 UTC)