Chrome 31 Beta: Android Application Shortcuts, requestAutocomplete(), and PNaCl

Thursday, October 03, 2013

The developer updates in today’s Chrome Beta enable a seamless Android web app experience, smoother web payment flows, and portable native code in desktop Chrome. Unless otherwise noted, changes apply to desktop versions of Chrome and Chrome for Android.

Application shortcuts in Chrome for Android

Application shortcuts allow users to add website shortcuts to their Android home screen. Sites launched in this way will open in a normal Chrome for Android window, unless they include the mobile-web-app-capable meta tag. Those sites will instead open in a special fullscreen Chrome for Android window that doesn't display tabs, buttons, menus, or the Omnibox. Try adding a shortcut to weight.aerotwist.com to see this in action:



Payment requestAutocomplete() on Chrome for Android, Windows, Chrome OS

requestAutocomplete() makes it easier for users to fill out online forms by offering web developers programmatic access to the browser’s autocomplete information (with the user’s explicit permission).

For this first release, we’ve made it work for web payments. On sites with requestAutocomplete(), users will be able to either use their existing payment data stored with the browser or enter new details through a browser-provided interface. As a developer, you can continue processing payments with your existing payment processor.


This feature will be rolling out to Beta users in Android, Windows, and Chrome OS in the coming days. A Mac version will be included in a future release.

PNaCl on desktop versions of Chrome

Over the last few years, web applications have benefited tremendously from more powerful processors and faster browsers. For developers looking to improve performance even further, Portable Native Client (PNaCl) now offers the ability to execute native code in the browser. Developers can compile C/C++ code--even complex existing code bases--into a single executable that runs across all desktop versions of Chrome and Chrome OS, no user installation required. PNaCl combines the portability of the web with the performance of native code. For more information, check out gonacl.com.

New Chrome Apps APIs

With URL handlers for apps, Chrome App developers can now specify URLs to be handled by a Chrome App. For example, a document link on a website could open a document editor Chrome App. This gives users more seamless entry points into their favorite Chrome Apps.

Directory access for Apps allows Chrome Apps to access and write to user-approved folders. This feature can be used to share files between a Chrome App and a native app. For example, a Chrome App code editor could modify files managed by a native Git client. Check out the demo to see it in action.

Other new features in this release
Visit chromestatus.com for a complete overview of Chrome’s developer features, and circle +Google Chrome Developers for more frequent updates. We hope you enjoy this Beta release as much as we’ve enjoyed working on it!

Posted by Dan Alcantara, Software Engineer and Screen Real Estate Agent

Saying Goodbye to Our Old Friend NPAPI

Monday, September 23, 2013

The Netscape Plug-in API (NPAPI) ushered in an early era of web innovation by offering the first standard mechanism to extend the browser. In fact, many modern web platform features—including video and audio support—first saw mainstream deployment through NPAPI-based plug-ins.

But the web has evolved. Today’s browsers are speedier, safer, and more capable than their ancestors. Meanwhile, NPAPI’s 90s-era architecture has become a leading cause of hangs, crashes, security incidents, and code complexity. Because of this, Chrome will be phasing out NPAPI support over the coming year.

We feel the web is ready for this transition. NPAPI isn’t supported on mobile devices, and Mozilla plans to block NPAPI plug-ins in December 2013. Based on anonymous Chrome usage data, we estimate that only six NPAPI plug-ins were used by more than 5% of users in the last month. Still, we appreciate that it will take time to transition away from NPAPI, so we will be rolling out this change in stages.

Starting in January 2014, Chrome will block webpage-instantiated NPAPI plug-ins by default on the Stable channel. To avoid disruption to users, we will temporarily whitelist the most popular NPAPI plug-ins that are not already blocked for security reasons. These are:

  1. Silverlight (launched by 15% of Chrome users last month)
  2. Unity (9.1%)
  3. Google Earth (9.1%)
  4. Java (8.9%) *
  5. Google Talk (8.7%)
  6. Facebook Video (6.0%)
* Already blocked by default for security reasons. 

In the short term, end users and enterprise administrators will be able to whitelist specific plug-ins. Eventually, however, NPAPI support will be completely removed from Chrome. We expect this to happen before the end of 2014, but the exact timing will depend on usage and user feedback. Note that the built-in Flash plug-in and PDF viewer will be unaffected because they don’t use NPAPI.

The Chrome Web Store will also be phasing out NPAPI support. Starting today, no new Apps or Extensions containing NPAPI-based plug-ins will be allowed in the Web Store. Developers will be able to update their existing NPAPI-based Apps and Extensions until May 2014, when they will be removed from the Web Store home page, search results, and category pages. In September 2014, all existing NPAPI-based Apps and Extensions will be unpublished. Existing installations will continue to work until Chrome fully removes support for NPAPI.

There are several alternatives to NPAPI. In cases where standard web technologies are not yet sufficient, developers and administrators can use NaCl, Apps, Native Messaging API, and Legacy Browser Support to transition from NPAPI. Moving forward, our goal is to evolve the standards-based web platform to cover the use cases once served by NPAPI. 

Justin Schuh, Security Engineer and Plug-in Retirement Planner

Chrome App Launcher Developer Preview for Mac OS X

Thursday, September 05, 2013

Chrome Apps now bring the best of productivity, games and more to your desktop. The Chrome App Launcher is available for Windows and Chrome OS, and today we're unveiling the launcher for Mac OS X on the Chrome Developer Channel.

The launcher provides an easy way to find and launch your Chrome Apps, while at the same time integrating closely with the operating system so that your Chrome Apps behave and feel just like regular native ones. For example, on Macs you can find your Chrome Apps in the launcher, Applications folder, in the Dock and when you do a Spotlight search—just like any other Mac app that you already use.


To get the launcher, just install a Chrome App from the Chrome Web Store, such as this text editor or note-taking app. The first time you install an app, the launcher will show up as an icon in the Dock. Chrome Packaged Apps for the Mac are available in the dev channel of Chrome and will be launched to stable channel soon.

In the meantime, you can build your own packaged app, upload it to the Chrome Web Store and give all of your users access to it via a direct link. Have questions about this or any other Chrome Apps features? We always welcome your feedback on Stack Overflow, our G+ Developers page, or our developer forum.

Posted by Joe Marini, Chrome Developer Advocate and Apps Aficionado

Another step toward faster search in Chrome

Monday, August 26, 2013

When you’re searching for information, speed matters. We’re always thinking about how to shave milliseconds from every search you do, throughout our products. Last year, we started testing a feature in Chrome to make searching from a new tab faster and simpler. If you use Chrome’s Developer or Beta installs, you may have already seen this in action. Many thanks for your feedback, which has helped us continue to hone the look and feel, and improve average time from query to answer — meaning you can find what you’re looking for even more quickly than before.

 

These early results are encouraging but we’re still turning dials under the hood. While we work we’ll be expanding to a small set of people using the stable channel of Chrome on Windows, Mac and Chromebooks, who have Google set as default search engine. As this experimental feature includes open APIs, any search engine may integrate with the new ‘new tab’ page in Chrome. Keep the feedback coming.

Posted by Anantica Singh, Product Manager

Chrome 30 Beta: A richer web on Android

Thursday, August 22, 2013

Today we launched Chrome 30 on the Beta channel. This release introduces several new developer features for Chrome Apps and Chrome for Android Beta.

WebGL in Chrome for Android

WebGL is a JavaScript API for rendering interactive 3D graphics and 2D graphics. It is now enabled by default in Chrome for Android Beta running on devices with high-end mobile GPUs (this includes Nexus 4 and Nexus 7). Try it out with this racer WebGL demo and others:


DeviceMotion Events in Chrome for Android

This release introduces the device motion part of the Device Orientation API in Chrome for Android Beta. DeviceMotion events provide you information about device acceleration and rotation rates. Check out isthisanearthquake.com to see them in action.

Media Source Extension in Chrome for Android

The MediaSource API allows JavaScript to generate media streams for playback, which enables use cases such as adaptive streaming and time-shifting live streams. It is now enabled by default in Chrome for Android running on Jellybean or higher. This API is especially useful for streaming to mobile devices, where connectivity is often constrained and unpredictable. Play with it on this demo page.

Chrome Apps APIs

Chrome Apps support a few new APIs in this release, including webview.request, media gallery write support, and downloads. Chrome App developers can also now use Chrome Web Store managed in-app payments.

Other platform features in this release

Unless otherwise noted, the changes described below apply to desktop versions of Chrome and Chrome for Android:
  • Support for the WebRTC Device Enumeration API allows users to change their microphones and/or camera on the fly without having to restart the WebRTC call.
  • DevTools now supports CSS source maps (also known as preprocessors).
  • Chrome will now match the behavior of IE and not honor the Refresh header or tags when the URL to be refreshed to has a javascript: scheme. This is done to close down one more XSS vector against poorly constructed sites.
  • Two new experimental features landed behind a flag on Chrome for Android: Web Speech API (recognition) and the Vibration API.
Visit chromestatus.com for a complete overview of Chrome’s developer features, and circle +Google Chrome Developers for more frequent updates.

Posted by Sami Kyöstilä, Software Engineer and Mobile Pixel Wrangler

Security rewards at Google: Two MEEELLION Dollars Later

Monday, August 12, 2013

[Cross-posted from the Google Online Security Blog]

One of Google’s core security principles is to engage the community, to better protect our users and build relationships with security researchers. We had this principle in mind as we launched our Chromium and Google Web Vulnerability Reward Programs. We didn’t know what to expect, but in the three years since launch, we’ve rewarded (and fixed!) more than 2,000 security bug reports and also received recognition for setting leading standards for response time.

The collective creativity of the wider security community has surpassed all expectations, and their expertise has helped make Chrome even safer for hundreds of millions of users around the world. Today we’re delighted to announce we’ve now paid out in excess of $2,000,000 (USD) across Google’s security reward initiatives. Broken down, this total includes more than $1,000,000 (USD) for the Chromium VRP / Pwnium rewards, and in excess of $1,000,000 (USD) for the Google Web VRP rewards.

Today, the Chromium program is raising reward levels significantly. In a nutshell, bugs previously rewarded at the $1,000 level will now be considered for reward at up to $5,000. In many cases, this will be a 5x increase in reward level! We’ll issue higher rewards for bugs we believe present a more significant threat to user safety, and when the researcher provides an accurate analysis of exploitability and severity. We will continue to pay previously announced bonuses on top, such as those for providing a patch or finding an issue in a critical piece of open source software.

Interested Chromium researchers should familiarize themselves with our documentation on how to report a security bug well and how we determine higher reward eligibility.

These Chromium reward level increases follow on from similar increases under the Google Web program. With all these new levels, we’re excited to march towards the new milestones and a more secure web.

Posted by Chris Evans and and Adam Mein, Master of Coin

Long live Chrome Web Lab

Friday, August 09, 2013

After just one short year and over half a million visitors to the Web Lab exhibition in the Science Museum in London, the lab will close it doors to the public this coming Sunday evening.

Today, with the help of our friends at Tellart and B-Reel, we are open sourcing the two most popular and interactive experiments of the Chrome Web Lab: Universal Orchestra and Sketchbots.

Web Lab was hosted both physically in the museum and virtually online. We learned a lot about building physical exhibits that interact with App Engine and use the latest web technology in Chrome to let users control real hardware. Now that we've open sourced the code, we're excited to show you how we did it.

The Orchestra

The Orchestra was made up of eight custom-built robotic instruments that let you make music with others from anywhere in the world. Now, you can use the same code that was deployed in the exhibit and host your own miniature Orchestra. All you'll need is an Arduino and the plans for a new dinky replica we created especially for this open source project.  We have even integrated WebRTC so you can form your own band from anywhere in the world.  Don’t worry if you're not a hardware expert because we have a full software version too.


The Sketchbot

The Sketchbot was an electronic arm that received over 5,000 commands per second to etch an outline of your face in the sand. The Open Source project includes the code and the hardware designs to build a replica of the Web Lab.  For developers like me who are soldering iron challenged, we have also included instructions and code to build a BergCloud LittlePrinter and a pure software only version.



If you’ve got the maker itch and want to build a Web Lab replica, integrate hardware that we had never envisaged, or are just curious about how we made the Web Lab, you can grab the code from Github.
Be sure to share what you do with the code in our G+ Community.

Paul Kinlan - Chrome Developer Advocate, Open Sourcerer and Wannabe Maker.