Re: [chromium-dev] Re: opening local files with chrome from command line, relative paths

2010-01-13 Thread Chris Evans
On Wed, Jan 13, 2010 at 8:36 AM, Evan Martin wrote: > Since the proposed vulnerability is that I have cd'ed into a specially > crafted malicious directory then type out "google-chrome > some-particular-url", at which point I will end up at a file:// URL > under the attacker's control, I am skepti

Re: [chromium-dev] Interesting performance characteristics of http://a.qoid.us/google.html

2010-01-11 Thread Chris Evans
On Mon, Jan 11, 2010 at 11:01 PM, Evan Martin wrote: > On Mon, Jan 11, 2010 at 9:04 PM, Chris Evans wrote: > > The other browsers do not support the CSS used / required for this demo. > > There was a similar version, but using SVG animation to do something very > > sim

[chromium-dev] Interesting performance characteristics of http://a.qoid.us/google.html

2010-01-11 Thread Chris Evans
Hi, I found this interesting: http://a.qoid.us/google.html Because it's clearly very non-JavaScript focused (just a CSS rotation) and yet the browsers exhibit very different performance characteristics. All on my underpowered Windows laptop, Chrome 3 & 4: smooth. Very nice anti-aliased accurate

[chromium-dev] Proposal for small changes to the "Severity Guidelines for Security Issues"

2010-01-03 Thread Chris Evans
Hi, In the absence of any objections, we'll update the guidelines to reflect the edits below (in bold). The focus here is to bring us inline with industry ratings (having spoken to Microsoft and looking at Mozilla's guidelines). The key change is to rate sandbox escape issues as "High". Cheers C

[chromium-dev] Re: Spellchecker and memory-mapped dicts

2009-10-22 Thread Chris Evans
On Thu, Oct 22, 2009 at 2:22 PM, Brett Wilson wrote: > > On Thu, Oct 22, 2009 at 1:39 PM, Evan Stade wrote: > > > > Hi all, > > > > At its last meeting the jank task force discussed improving > > responsiveness of the spellchecker but we didn't come to a solid > > conclusion so I thought I'd bri

[chromium-dev] Re: Spellchecker and memory-mapped dicts

2009-10-22 Thread Chris Evans
There's also option 3) Pre-fault the mmap()ed region in the file thread upon dictionary initialization. On Linux at least, that may give you better behaviour than malloc() + read() in the event of memory pressure. Cheers Chris On Thu, Oct 22, 2009 at 1:39 PM, Evan Stade wrote: > > Hi all, > >

[chromium-dev] Re: Wanted: anonymous FTP servers running rare software

2009-09-10 Thread Chris Evans
On Thu, Sep 10, 2009 at 3:32 PM, Paweł Hajdan Jr. wrote: > If you want to help make Chromium better, read on. You probably know we're > developing a new FTP stack: > http://blog.chromium.org/2009/09/new-ftp-implementation-goes-live.html > Currently we're using directory listing parsing routines fr

[chromium-dev] Re: Are we going to support active FTP?

2009-09-09 Thread Chris Evans
On Wed, Sep 9, 2009 at 10:53 AM, Paweł Hajdan Jr. wrote: > This is http://code.google.com/p/chromium/issues/detail?id=3073 . I think > it's not so hard to implement it (and probably not so high priority either), > but are there any potential security (or other) problems? Like with PASV, you need

[chromium-dev] Re: Handling bad messages in the browser

2009-07-15 Thread Chris Evans
On Jul 13, 1:57 pm, cpu wrote: > (hoping this does not generate a firestorm) > > If you are writing code that gets called from IPC_MESSAGE_HANDLER, in > other words you are writing or reviewing an IPC message handler, > please: > > 1- Consider the possibility of receiving a bad message (i.e a mes

[chromium-dev] Re: Linux developers: you need to read this

2009-07-15 Thread Chris Evans
On Jul 14, 7:26 pm, Adam Langley wrote: > On Tue, Jul 14, 2009 at 7:18 PM, Jeremy Orlow wrote: > > Wait...so is this something every linux Chromium developer is going to have > > to do forever? > > You only need to do it once and, if you don't, you just run without a sandbox. > > Also, the SUID s

[chromium-dev] Re: Javascript scope within PAC files?

2009-07-14 Thread Chris Evans
On Jul 14, 12:23 pm, Jim Roskind wrote: > I tend to think incognito mode as a personal (and very private) decision. >  As a result, I'd tend to prefer that it be very difficult to leak such > status further than absolutely necessary. Any web page that wishes can determine if you are (likely) in

[chromium-dev] Re: HTML5 Web Socket design doc

2009-06-24 Thread Chris Evans
On Jun 24, 2:32 am, Fumitoshi Ukai (鵜飼文敏) wrote: > Hi, > > yuzo, tyoshino and I start working to implement HTML5 Web Socket and write > design docs > > WebKit part:http://docs.google.com/View?id=dfm7gfvg_0fpjg22gh > Chromium part:http://docs.google.com/View?id=dfm7gfvg_1dm97qxgm > > We'll send

[chromium-dev] Re: HTML5 Web Socket design doc

2009-06-24 Thread Chris Evans
On Jun 24, 2:32 am, Fumitoshi Ukai (鵜飼文敏) wrote: > Hi, > > yuzo, tyoshino and I start working to implement HTML5 Web Socket and write > design docs > > WebKit part:http://docs.google.com/View?id=dfm7gfvg_0fpjg22gh > Chromium part:http://docs.google.com/View?id=dfm7gfvg_1dm97qxgm > > We'll send

[chromium-dev] Re: HTML5 Web Socket design doc

2009-06-24 Thread Chris Evans
On Jun 24, 2:32 am, Fumitoshi Ukai (鵜飼文敏) wrote: > Hi, > > yuzo, tyoshino and I start working to implement HTML5 Web Socket and write > design docs > > WebKit part:http://docs.google.com/View?id=dfm7gfvg_0fpjg22gh > Chromium part:http://docs.google.com/View?id=dfm7gfvg_1dm97qxgm > > We'll send