Feeds

Chrome: A new force for web applications?

Promise through the froth

3 Big data security analytics techniques

Another interesting feature in relation to Flash is the Canvas element. This was invented by Apple for Safari, which also uses WebKit, and is part of HTML 5. Canvas lets browser applications paint arbitrary graphics, just as you can in Flash or in native code applications. A note to the official specification adds that "a future version of this specification will probably define a 3d context (probably based on the OpenGL ES API)". Speculative - but clearly Canvas has the potential to reduce the need for plug-ins like Flash or Silverlight.

Firefox also supports Canvas, but what about Internet Explorer? You guessed: it is missing, though there are clever wrappers which use IE's VML graphics library to emulate Canvas.

A side-effect of Chrome is that despite its large market share Microsoft risks finding IE marginalised for the lack of features such as compiled Javascript and the Canvas element.

Google has made Chrome quick to install, with no restart needed, and we may see websites that treat it almost like a plug-in: "Install Chrome to view this site."

The other big feature for application developers is Gears, which can enable offline functionality through a local store and web server, as well as Sqlite and the desktop integration mentioned above.

Google has made much ballyhoo over security and robustness in Chrome, thanks to its process isolation for tabs and running processes with restricted permissions. There are echoes of Microsoft's protected mode for IE7, and its tab isolation in IE8.

Reading the white paper on Chrome security, it is interesting to note how security in Chrome's current implementation is closely tied to Windows features, which is probably a good thing since Windows poses unique security challenges thanks to its poor history of users running with local administrator rights.

While this is good progress, Gears security strikes me as a concern. Gears lets web applications write to the user's hard drive, though only in areas that are part of the user's profile, and isolated by site origin. The idea is that only trusted sites are allowed to use Gears.

Chrome built in Visual Studio 2005

Chromium, the open source Chrome project, ready for Visual Studio 2005

However, with popular applications like WordPress starting to use Gears as an option for enhancing performance by caching data, there is the possibility of all sorts of sites inviting the user to enable Gears. What if a hijacked site used the desktop API to install malicious desktop shortcuts, or worse? Although Gears enables new possibilities for developers, I suspect the security aspect needs more examination.

Another snag with Chrome is that currently it does not support any extension API. Google said it will do in future, though bearing in mind that one popular extension might be an ad blocker, perhaps it will not hasten in this.

Finally, one significant Chrome advantage for developers is that all the code can easily be downloaded. Configuring a machine to build some open source projects successfully can be a challenge. But Chromium is delivered as a Visual Studio 2005 solution, and its main dependency is the Windows SDK. This gives developers the ability to debug and profile code at the deepest level.

Chrome, then, is a significant new force in web application development. ®

SANS - Survey on application security programs

More from The Register

next story
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Batten down the hatches, Ubuntu 14.04 LTS due in TWO DAYS
Admins dab straining server brows in advance of Trusty Tahr's long-term support landing
Microsoft lobs pre-release Windows Phone 8.1 at devs who dare
App makers can load it before anyone else, but if they do they're stuck with it
Half of Twitter's 'active users' are SILENT STALKERS
Nearly 50% have NEVER tweeted a word
Oh no, Joe: WinPhone users already griping over 8.1 mega-update
Hang on. Which bit of Developer Preview don't you understand?
Internet-of-stuff startup dumps NoSQL for ... SQL?
NoSQL taste great at first but lacks proper nutrients, says startup cloud whiz
Windows 8.1, which you probably haven't upgraded to yet, ALREADY OBSOLETE
Pre-Update versions of new Windows version will no longer support patches
Microsoft TIER SMEAR changes app prices whether devs ask or not
Some go up, some go down, Redmond goes silent
Red Hat to ship RHEL 7 release candidate with a taste of container tech
Grab 'near-final' version of next Enterprise Linux next week
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.