Chromium Blog: 2011

In-App Payments Expands its Borders

Thursday, December 15, 2011

(Cross-posted on the Official Google Code and Commerce Blogs)
Since Google In-App Payments launched in July for developers in the United States, we’ve received great feedback on how easy it is to integrate as well as how simple it is for consumers to use. While the API has been off to a strong start, there’s been a growing demand for availability outside of the United States.
So starting today, we are opening developer enrollment for Google In-App Payments to 17 additional countries. In addition to the United States, developers from Australia, Austria, Belgium, Canada, Denmark, Finland, France, Germany, Ireland, Italy, Japan, the Netherlands, Norway, Portugal, Spain, Sweden, and the United Kingdom can now use the Google In-App Payments API to incorporate an in-context payment experience into applications on the Chrome Web Store and their own sites.

Developers using In-App Payments are seeing strong conversions and revenue streams thanks to these key features:

Ease of use: the short payment process for consumers takes place right in the developer’s app or site.

Large existing user base: there are millions of Google Wallet online users in over 140 countries.

Low fees: developers pay just 5% on all transactions.

You can get started accepting payments in your web apps by following the tutorial and get answers to any questions in the forum. We look forward to expanding to even more countries in the future, as well as continuously working to improve the Google In-App Payments experience.
Posted by Pali Bhat, Product Manager, Google Commerce Team

Games, apps and runtimes come to Native Client

Friday, December 9, 2011

Updated on December 14th with the video of the event.launchedSquare EnixUnity TechnologiesBungieOne code base for all OSsBastionEasy porting of previous workStar Legends
More choices of programming languagesUnityMoaiMonoLuafmodWwiseBullet physics engineHeartwoodSilvertreeExit StrategyDedalordChrome Web Storegonacl.comdiscussion forumsPosted by Christian Stefansen, Product Manager

OpenGL ES 2.0 Certification for ANGLE

Monday, November 28, 2011

we introducedANGLEMapsGLPosted by Vangelis Kokkevis, Software Engineer

A game changer for interactive performance.

Monday, November 21, 2011

incremental garbage collectorhuge progresspeak performanceWebGLnew version of Google Mapsnew gamesdemosinteractive performancestress testdev channelPosted by Vyacheslav Egorov and Erik Corry, Software Engineers

Lossless and Transparency Encoding in WebP

Thursday, November 17, 2011

WebP25–34%Last monthNew lossless mode28% reductionNew transparency mode22% byteshereWebP-Gallerytry it outcodeprovide feedbackPosted by Jyrki Alakuijala, Vikas Arora, and Urvang Joshi, Software Engineers

New Text-to-Speech API for Chrome extensions

Tuesday, October 18, 2011

packaged appchrome.tts.speak('Hello, world!');
chrome.tts.speak('Can you understand me now?', {rate: 0.6});
TTS API docssamples pageChromeVoxTTS DemoTalking Alarm ClockSpeakItTTS Engine APIchrome.tts.speakHTML5 AudioWeb Audio APINative ClientLois TTS - US EnglishFlite SLT Female TTS - US English#chromettsChromium-extensionsPosted by Dominic Mazzoni, Software Engineer

Heading in the right direction with WebGL

Wednesday, October 12, 2011

Editor's note: The Chromium WebGL team worked closely with the Maps team to help make MapsGL a reality. We invited a member of the Maps team to talk about their experience with MapsGL in the hope that it would help inform others who are interested in deploying a large scale WebGL app.first releasedMapsGLWebGLWebGL documentationPosted by Jennifer Maurer, Software Engineer on the MapsGL team

Dart: A language for structured web programming

Monday, October 10, 2011

Cross-posted on the Google Code BlogDartCreate a structured yet flexible language for web programming.Make Dart feel familiar and natural to programmers and thus easy to learn.Ensure that Dart delivers high performance on all modern web browsers and environments ranging from small handheld devices to server-side execution.virtual machinecompilerdartlang.orgPosted by Lars Bak, Software Engineer

New developer tools experimental APIs for Chrome extensions

Monday, October 3, 2011

Chrome Developer Tools

your feedback

Use the dev channel of Chrome as the APIs are still under development;

Enable experimental extension APIs using the chrome://flags page;

List experimental in the permissions list of your extension;

Add a devtools_page field to your extension’s manifest, e.g:

{ "name": ... "minimum_chrome_version": "14.0", "devtools_page": "devtools.html", "permissions": [ "experimental" ... ], ... }docssample extensionsPage Speed for ChromiumPosted by Andrey Kosyakov, Software Engineer

International Success with the Chrome Web Store

Monday, September 26, 2011

expanded the reach20 countriesIn-App Payments APIGraphicly

Audiotool is an online music production app that was built by a team of German developers. They saw the Chrome Web Store as a way to present their app to an international audience. Audiotool’s traffic increased by 20% after launching in the store, and this motivated the team to release another app in the store.

Psykopaint is the brainchild of French developer Mathieu Gosselin. The Chrome Web Store provided Mathieu an opportunity to get his photo painting app noticed outside of France. Traffic to Psykopaint has jumped by 700% since it launched in the store and Mathieu has found that Chrome Web Store users tend to be more engaged than other users.

Finally, Nulab, a Japanese company, launched its online diagramming app, Cacoo, in the store to expand its user base outside Japan. In just a few months after Cacoo was released in multiple languages in the Chrome Web Store, the app already accounts for 20% of Cacoo’s user base.

case studiescode.google.com/chrome/webstorePosted by Alexandra Levich, Product Manager

Google @ GDC Online Oct. 10th-12th

Wednesday, August 31, 2011

Cross posted at the Google Code blog Game Developers ConferenceDeveloper Dayengineers and developer advocates

Chrome Web StoreNative ClientApp EngineIn-App PaymentsGoogle TVAdSenseAdMobGDC Onlinehttp://www.google.com/events/gdc/2011Google Game Developer CentralPosted by Amy Walgenbach, Developer Marketing

Non-Admin Chrome Frame Reaches Stable Channel

Tuesday, August 30, 2011

introducedheredownload pageGoogle groupissue trackerPosted by Greg Thompson, Software Engineer

Getting your app discovered in the Chrome Web Store with new promotional assets.

Thursday, August 25, 2011

Chrome Web Store

(Required) You’ll need to provide us with a large rectangular image to identify your app, in addition to assets you already provide - your app icon and at least one screenshot.

(Optional) You can provide us with an even larger rectangular image format as well.

The screenshot dimensions have grown larger with a wider aspect ratio.

The (optional) marquee image dimensions have also grown larger.

The specification and dimensions for the icon file

image guidelines pagediscussion groupPosted by Shannon Guymon, Product Manager

Register now for New Game, the conference for HTML5 game developers

Thursday, August 25, 2011

Cross posted at the Google Code blogMonster DashAngry BirdsSONARNative Client with 3D lands in Chrome

New Gameregistrationtodayschedule

www.newgameconf.com@newgameconfBocoupearly bird registration pricingSONARPosted by Seth Ladd, Developer Advocate

Native Client Brings Sandboxed Native Code to Chrome Web Store Apps

Thursday, August 18, 2011

Native Clientbeta channelFile APIWebSocketsNative Client sandboxChrome sandboxFAQNative Client sitePortable Native ClientLLVMPosted by Christian Stefansen, Product Manager

Connecting Web Apps with Web Intents

Thursday, August 4, 2011

var intent = new Intent(Intent.EDIT, ‘image/png’, getImageDataURI());
window.navigator.startActivity(intent, loadEditedImage);

// This callback will be called when the service replies with the edited
// image data.
function loadEditedImage(data) {
var image = document.getElementById(‘image’);
setImageData(image, data);
}
<intent
action=”http://webintents.org/edit”
type=”image/*”
/>var intent = window.intent;
memeImg.src = intent.data;

memegenForm.onsubmit = function() {
// Transform the image - meme it.
addMemeTaglines(memeImg, memeTopText, memeBottomText);

// Send the generated meme back to the client.
intent.postResult(getImageData(memeImg));
};postResult()startActivity()exploringexamplesJavaScript shimPosted by James Hawkins, Software Engineer

New WebSocket Protocol: Secure and Extensible

Monday, August 1, 2011

The WebSocket protocol specification is now largely stable, having solved previous security concerns. As such, we’ve updated Chromium to support the latest version (draft-ietf-hybi-thewebsocketprotocol-10) on the dev channel (14.0.835.2). Given that the specification is now in “last-call” and and no further breaking changes are expected, it should now be safe to use WebSockets for production application development.
Please note that the new protocol is incompatible with one which Chromium previously supported (draft-ietf-hybi-thewebsocketprotocol-00), so existing WebSocket-based services may break. Please upgrade your servers to ones which support HyBi 10. Existing JavaScript code still works once the protocol version used by the browser and server match.
The new protocol introduces some exciting new features like binary message support and compression support, but these are not quite ready yet in Chrome and will come shortly - hang tight!
See the specs and discussion at W3C and WHATWG (spec, whatwg list) and IETF (spec, HyBi list) for more detail about the new protocol.
We’re more than happy to hear your feedback, and encourage you to file any bugs you find on our issue tracker.Posted by Takeshi Yoshino, Software Engineer

Chrome Web Store: Now with more international support and with In-App Payments

Monday, August 1, 2011

more users around the worldadditional monetization opportunitiesrecently launchedIn App Payments APIdocssample app complete with source codeour short videolocalize your app listingdeveloper discussion groupPosted by Elvin Lee, Software Engineer

Writing Extensions More Securely

Friday, July 22, 2011

built-in protectionsmanyarticlesMinimize your permissions (*/*) permissions for hosts if you only need to access a couple, and don’t copy and paste your manifest from example code blindly. Review your manifest to make sure you’re only declaring what you need. This applies to permissions like tabs, history, cookies, etc. in addition to host permissions. For example, if all you’re using is chrome.tabs.create, you don’t actually need the tabs permission.

Use content_security_policy in your manifest

Starting in Chrome 14, we will begin supporting Content Security Policy in extensions via the content_security_policy manifest field. This allows you to control where scripts can be executed, and it can be used to help reduce your exposure to cross-site scripting vulnerabilities. For example, to specify that your extension loads resources only from its own package, use the following policy:

"content_security_policy": "default-src 'self'"

If you need to include scripts from specific hosts, you can add those hosts to this property.

Don’t use <script src> with an HTTP URL

When you include javascript into your pages using an HTTP URL, you’re opening your extension up to man-in-the-middle (MITM) attacks. When you do so in a content script, you have a similar effect on the pages you’re injected into. An attacker on the same network as one of your users could replace the contents of the script with content that they control. If that happens, they could do anything that your page can do.

If you need to fetch a remote script, always use HTTPS from a trusted source.

Don’t use eval()

The eval() function is very powerful and you should refrain from using it unless absolutely necessary. Where did the code come from that you passed into eval()? If it came from an HTTP URL, you’re vulnerable to the same issue as the previously mentioned <script> tag. If any of the content that you passed into eval() is based on content from a random web page the user visits, you’re vulnerable to escaping bugs. For example, let’s say that you have some code that looks like this:

function displayAddress(address) { // address was detected and grabbed from the current page
eval("alert('" + address + "')");
}

If it turned out that you had a bug in your parsing code, the address might wind up looking something like this:

'); dosomethingevil();

There’s almost always a better alternative to using eval(). For example, you can use JSON.parse if you want to parse JSON (with the added benefit that it runs faster). It’s worth the extra effort to use alternatives like this.

Don’t use innerHTML or document.write()

It’s really tempting to use innerHTML because it’s much simpler to generate markup dynamically than to create DOM nodes one at a time. However, this again sets you up for bugs in escaping your content. For example:

function displayAddress(address) { // address was detected and grabbed from the current page
myDiv.innerHTML = "<b>" + address + "</b>");
}

This would allow an attacker to make an address like the following and once again run some script in your page:

<script>dosomethingevil();</script>

Instead of innerHTML, you can manually create DOM nodes and use innerText to insert dynamic content.

Beware external content

In general, if you’re generating dynamic content based on data from outside of your extension (such as something you fetched from the network, something you parsed from a page, or a message you received from another extension, etc.), you should be extremely careful about how you use it. If you use this data to generate content within your extension, you might be opening your users up to increased risk.

You can also read a few more examples of the issues discussed here in our extension docs. We hope these recommendations help you create better and safer extensions for everyone.

Posted by Erik Kay, Software Engineer

Chrome Extensions: Now with more powerful scripts and improved proxy management.

Wednesday, July 13, 2011

sample extensionbackground pagechrome.extension.onRequestrewrite the extensionGM_xmlhttpRequestBook Burromatch patternsmatchesexclude_matches@run-ata scriptProxy Extension APIProxyRulesProxy AnywhereProxy SwitchyPlusPosted by Tessa MacDuff and Mihai Parparita, Software Engineers

Using Cross-domain images in WebGL and Chrome 13

Wednesday, July 6, 2011

security issueshaders could be usedupdatedCORSCORS support.crossOriginvar img = document.createElement('img');
img.onload = function(e) { … };
img.crossOrigin = ''; // no credentials flag. Same as img.crossOrigin='anonymous'
img.src = 'http://other-domain.com/image.jpg';ctx.drawImage()origin-clean flagctx.toDataURL()ctx.getImageData().crossOriginvar img = document.createElement('img');
img.onload = function(e) {
ctx.drawImage(img, 0, 0, canvas.width, canvas.height);
var url = canvas.toDataURL(); // Read succeeds, canvas won't be dirty.
};
img.crossOrigin = '';
img.src = 'http://other-domain.com/image.jpg';use of CORSChrome dev channelPosted by Eric Bidelman, Developer Advocate

Cloud Coding and Beyond: Web Development Apps in the Chrome Web Store

Wednesday, June 29, 2011

ChromebooksChrome Web StoreCloud9FileSystemKodingenCodeyAkshelleXo Cloud IDEPHPAnywhere

BuildorLiteBuildorProHandcraftMockingbirdJSFiddle

GitHub IssuesLaunchlist Pro

Chrome Web StorePosted by Michael Mahemoff and Paul Kinlan, Chrome Developer Relations

Introducing Non-Admin Chrome Frame

Monday, June 20, 2011

releasedannouncedhereChrome Frame FAQdiscussion groupissue trackerPosted by Robert Shield, Software Engineer

Testing Chromium: AddressSanitizer, a fast memory error detector.

Wednesday, June 15, 2011

Valgrindhundreds of significant bugsAddressSanitizer

A compiler which performs instrumentation - currently we use a modified LLVM/Clang and we're trying to contribute our code to the core LLVM package.

A run-time library that replaces malloc(), free()and friends.

malloc()free()SPEC CPU2006average slowdownarticleAddressSanitizer home pagepagePosted by Kostya Serebryany, Software Engineer

New Chromium security features, June 2011

Tuesday, June 14, 2011

Chromium 11: strong random numbers for the webwindow.crypto.getRandomValuesChromium 12: user-specified HSTS preloads and certificate pins

It’s an exciting feature but we’d like to warn that it’s easy to break things! We recommend that only experts experiment with net internals settingsChromium 13: blocking HTTP auth for subresource loadsChromium 13: Content-Security-Policy supportContent Security PolicyChromium 13: built-in certificate pinning and HSTSsslstrip-typerecent incidentsChromium 13: defenses for self-XSS via javascript URLsStill hiring!job postingPosted by Chris Evans of the Google Chrome Security Team. With thanks to Adam Barth, Adam Langley, Cris Neckar and Tom Sepez for implementing the above features.

Prerendering in Chrome

Tuesday, June 14, 2011

announced earlier todaydid click onthis sample pagepage visibility APIUsing the Page Visibility APIWeb Developers' Guide to Prerendering in ChromePosted by Alex Komoroske

Chrome Developer Tools: Put JavaScript memory under control

Friday, May 27, 2011

Task Manager

Memory GraphTimeline panelopen Developer Tools

The most functional tool in controlling JavaScript memory usage and finding leaks is the new powerful Heap Profiler available in Chrome Dev Channel. To get a heap snapshot, open the Profiles panel in Developer Tools and press the “Take heap snapshot” button:

Snapshots contain every object from the JavaScript heap, so you can explore them in detail and find out how much memory every object of your application consumes. The heap profiler also offers the following features:

snapshots diffing
grouping objects by constructor
calculating retained sizes of objects
showing dominators tree
revealing paths to GC roots or window objects

In addition, the heap profiler takes into account native DOM nodes, and allows you to uncover DOM-related memory leaks.

It is also possible to measure how much JavaScript memory is currently used from within the page itself. You can sample values from the performance.memory window property at different points of your application lifetime. Please note, that the property does not report anything, unless you run Chrome with --enable-memory-info command-line argument.

For a more complete reference on working with the Chrome Developer Tools heap profiler, check out the tutorial.

[1]: How to invoke the context menu in the Chrome Task Manager:

Windows: Right click on any part of the grid;
Linux: Right click on the grid itself;
Mac: Ctrl+Right click on column headers

Posted by Mikhail Naganov, Software Engineer

WebP in Chrome, Picasa, Gmail With a Slew of New Features and Improvements

Friday, May 20, 2011

Since we announced WebP, a new image format based on WebM technology and the VP8 codec, we’ve been working hard with the open web community to improve and enhance it. Today we are happy to share news about a few new features and expanded support for WebP.
New Features
WebP's compression algorithms have been significantly improved while remaining completelycompatible with the previous releases. We hope the quality of a few sample images in the new gallery will delight you.
On the decoding side, we have integrated a fancy upsampler. Fancy upsampling reduces the pixelation of strong edges. You can see this feature when you zoom in, for example on a WebP image with red edges converted from this PNG original:

Without fancy upsampling: strong stair-like pattern

We also introduced the ability to incrementally decode the data as your computer downloads it from the web, a feature that allows the browser to display images without having to wait for the whole file to download. This feature is already enabled in Chrome 12.
On the encoding side, to further improve quality, we focused on segmenting the picture into areas with similar compressibility. For each of these segments, we tune the amount of compression and filtering differently, and bits are redistributed where they are most useful. Take for instance the image reproduced below [1]:

The easy segment contains lot of disparate signals and can be compressed more than the difficult one, which will be assigned more bits. In this example, the encoder only used two segments. By using even more segments (up to four), WebP is now able to retain many of the original details of the image [2]. This is in contrast to the frequent ringing artifacts one can clearly see in JPEG images.
The uneven distribution of bits between difficult and easy area is controlled in the new encoder using the -sns parameter, short for Spatial Noise Shaping. Its value can be set from 0 to 100 (0 meaning OFF) and with a default of 80. Note that when you enable SNS, PSNR may be degraded, but the overall visual quality is much improved.
We’ve added simple encoding and decoding example binaries to the libwebp library. In addition, we’ve added JNI support that allows Java programs to decode WebP images. Next up is transparency, also known as Alpha channel; we’re experimenting with it now and planning to add it to the next stable version of the codec. In parallel, we continue to improve the codec’s speed and will release a complete specification for the metadata format.
Increased adoption
WebP is now natively supported in Chrome and Opera. Google products including Gmail and Picasa Web Albums, have also added support to WebP so you can share, send and receive WebP images. WebP support is coming to AppEngine. In addition, Google Instant Previews now store images in WebP to reduce their storage needs.
Users that want to manipulate WebP images can now do so using software developed by the community including Pixelmator, ImageMagick, the WebP format plugin for Photoshop and the Java VP8 decoder. The open-source community has also contributed support for Mac OS X with MacPorts packages, Linux Debian, OpenSUSE and Gentoo packages and the Apache HTTP Server. On Windows, users who want to view WebP images natively, can download the WebP codec. This codec brings WebP support to such software as Microsoft Office 2010, Windows Media Center and Photo Edit.
The new features, quality improvements and increased adoption of WebP get us excited about its future. As always, we’re looking for more feedback as well as code contributions from the community. Let us know on the mailing list how your experiments are panning out and what new features you’d like to see in the future.

Image credits:

[1]: "Kayaker at Ekstremsportveko 2010, Voss". Image Author: Kjetil Birkeland Moe. Reproduced with permission of the author. PNG source, and Blog post by author with comparison of JPEG and WebP.

[2]: A storm at Pors-Loubous, Plogoff, Finistère, France. Image Author: Henri Camus. Permission: CC-BY; CC-BY-1.0. Source: http://commons.wikimedia.org/wiki/File:A_storm_at_Pors-Loubous.jpg

Posted by Richard Rabbat, Product Manager and Pascal Massimino, Software Engineer

Chromium Blog