[cap-talk] Google Chrome - web browser with sandboxed rendering

[Marcus Brinkmann]

At Tue, 02 Sep 2008 13:10:28 -0700,
Jed Donnelley <capability at webstart.com> wrote:
> 2.  At the bottom right of page 27:
> 
> http://books.google.com/books?id=8UsqHohwwVYC&printsec=frontcover#PPA27,M1
> 
> there is an explicit reference to Vista, "vista uses a modified version
> of the biba security model which uses three levels."  Doesn't it seem a
> bit odd that Vista would be referenced specifically as an OS - even beyond
> the more generic "Windows" - but that no other operating systems are
> referenced?

The initial release of Chrome is for Windows only, Linux and MacOS are
planned.  You can download the source code here and check for yourself
how they jailed it:

http://build.chromium.org/buildbot/archives/chromium.tgz

(from http://dev.chromium.org/developers/how-tos/getting-started)

it's a hefty 429MB compressed, so I don't have a quick answer, sorry.

> 4.  The discussion of plugins (also starting on page 29 at the bottom)
> suggests that dealing with them (running them securely) is an
> unsolved problem.  The comic says that with some help from plugin
> makers they can reduce the trust that plugins need.  Might this be
> an opportunity for POLA?

Obviously many plugins can make extensive use of the native OS interface.

> 6.  On page 31 (top right):
> 
> http://books.google.com/books?id=8UsqHohwwVYC&printsec=frontcover#PPA31,M1
> 
> there is what seems to me a rather odd use of the first person
> singular in a reference to seemingly incomplete work, "so I
> worked on ripping plugins out of the rendering process
> and putting them in a separate process all their own."
> 
> Who is the "I" in the above?  Is that work complete or did some
> work on it get done but the project remained incomplete?

The persons displayed in the comic book are real developers working at
Google, although they have been beautified a bit (made thinner, etc).
So the "I" would be that particular person displayed on that page in the comic.
 
> Finally there's the question about the relationship between
> Firefox and Chrome?  Is there any?  If not, why not?

According to Google, some components in Chrome come from Firefox.  The
bigger picture of course is that Google controls Chrome but not
Firefox, and it is essential to Google's advertisement-based business
model to control how web content is presented to users and to measure
the user's behaviour in response to the information displayed.
Welcome to browser war 2.0.

Thanks,
Marcus