Thanks
Anshul

Security Now = Steve Gibson is impressed by the possibilities created by Chrome’s underlying architecture, but he is extremely unimpressed by its total lack of critically important security and privacy features.

After listening to this podcast, I have uninstalled Chrome.

"Steve: It’s nuts. I mean, it is nuts, Leo. And if nothing else, look at the adoption rate. Almost, well, 1.57, 1.6 percent people used it. And I and a lot of other people said, okay, well, no thank you. I’m not using something that is by default storing the passwords I use for logging on and giving me no ability to protect that storage from somebody who might have access to my browser at any time in the future. I mean, that’s crazy. It’s just crazy.

Also no provision in cookie handling for distinguishing between session and permanent cookies. Even IE, again, you’re able to say, look, I don’t mind session cookies, that is, cookies that are persistent only while I’m using the browser, as long as you throw them all away at the end. Other browsers provide that. No provision for handling sites individually. I mean, I truly - I don’t get what they’re thinking, who they’re aiming this at because IE users, who we might say, okay, are just not going to move away, and they’re not clued in to security and privacy, so they just stay with IE, well, they’re not apt to use some other browser. They’re not going to move from IE. People who do, do for a reason, because they want these additional features. And Chrome doesn’t have any of them. I mean, any of them. It just boggles my mind. Oh, yeah, I just - and no scripting management, weak cookie handling, I don’t know, I’m just… "

http://attackingcitizen.blogspot.com/

1) Their EULA controversy was the result of some lazy-ass copying and pasting from other apps.

2) Their version of open-source is not really open-source. I had the same thoughts concerning parallels with Opera’s widgets. Overall Google is going to dictate the evolution of the browser because it was made ultimately to work with google apps, and they control the source of google apps, google api be damned. Major trunk changes will always be at their whim, leaving independent developers in the dark.

3) All the security disappointments you have talked about, Giorgio.

4) Like you, it’s speed is not impressive compared to FF3.1 nightly builds w/ Tracemonkey turned on.

5) The ultimate snub to Microsoft would’ve been to create a Gecko browser to facilitate add-on development and compatibilities so fast that it would quickly make IE7 and IE8 a joke, as well as Safari, which is run by Apple, another corporation that, since you have to send your machine in to be repaired, insists that they still own your computer and not you.

I agree 100% with your Chrome assessment, although if forced I would probably say the Application mode (and the ease in creating new application "links"/icons trumps the Task Manager as my favorite feature.

Unfortunately I still really can’t get my mind around why they just didn’t pitch in on the development effort to the Firefox team rather than further clutter the browser world with yet another extensionally-challenged entry.

I almost wonder whether behind the scenes perhaps there was friction between the Google and Mozilla folks (e.g. perhaps the Firefox team differed on priorities or design direction) and eventually Google just decided to forge their own path.

Many thanks for NoScript, and warmest regards,

Jack Stonewall

PS. As a Canadian, and assuming you’ve still got some of that maple syrup around, may I suggest trying it in your tea…. that is, assuming you Italians drink tea ;)

Regarding sandboxing, it’s all but a new concept.
Oversimplifying, Google’s Sandbox FAQ itself is quite eloquent:

Is the sandbox like what you get with the Java VM?
Yeah, kind of… except that to take advantage of the Java sandbox, you must rewrite your code to use Java. With our sandbox you can add sandboxing to your existing C/C++ applications. Because the code is not executed inside a virtual machine, you get native speed and direct access to the Windows API.

[Safe] like the Java VM, but with direct access to the Windows API :)

On a side note, I said I “do like” one feature, I “really love” another and I’m just “not impressed” with security. Is this “bashing”?

@Romain
Integrating a native NoScript-like is almost surely possible, and probably enjoyable as well, looking at the quality of the codebase. But I’m afraid it would require a Chromium fork, since I cannot see a compelling business incentive for Google to accept such a thing in the “official” Chrome, considering the potential damage for Doubleclick and AdSense.