Kutulutsidwa kwa Chrome 79

Google представила kumasulidwa kwa msakatuli Chrome 79... Nthawi imodzi zilipo kutulutsidwa kokhazikika kwa projekiti yaulere Chromium, yomwe imakhala ngati maziko a Chrome. Msakatuli wa Chrome chosiyana kugwiritsa ntchito ma logo a Google, kukhalapo kwa dongosolo lotumizira zidziwitso pakagwa ngozi, kutha kutsitsa gawo la Flash mukapempha, ma module osewera otetezedwa (DRM), kachitidwe kokhazikitsa zokha zosintha ndi kufalitsa pakufufuza. Zithunzi za RLZ. Kutulutsidwa kotsatira kwa Chrome 80 kuyenera kuchitika pa February 4.

waukulu kusintha в Chrome 79:

• adamulowetsa Chigawo Choyang'ana Mawu Achinsinsi, chopangidwa kuti chiwunikire mphamvu ya mawu achinsinsi ogwiritsidwa ntchito ndi wogwiritsa ntchito. Mukayesa kulowa patsamba lililonse la Password Checkup amakwaniritsa kuyang'ana malowedwe ndi mawu achinsinsi motsutsana ndi nkhokwe yamaakaunti osokonekera ndi chenjezo ngati mavuto apezeka (kuyang'ana kumachitika kutengera mawu a hashi kumbali ya wogwiritsa ntchito). Chekecho chimachitika motsutsana ndi nkhokwe yomwe ili ndi maakaunti opitilira 4 biliyoni omwe adawonekera m'malo osungidwa a ogwiritsa ntchito. Chenjezo limawonekeranso poyesa kugwiritsa ntchito mawu achinsinsi ngati "abc123". Kuti muwongolere kuphatikizidwa kwa Password Checkup, malo apadera akhazikitsidwa mu gawo la "Sync and Google Services".
• Ukadaulo watsopano wodziwira zachinyengo munthawi yeniyeni waperekedwa. M'mbuyomu, kutsimikizira kunkachitika ndikupeza mndandanda wakuda wa Safe Browsing womwe watsitsidwa kwanuko, womwe umasinthidwa pafupifupi mphindi 30 zilizonse, zomwe zidakhala zosakwanira, mwachitsanzo, pakusinthidwa pafupipafupi ndi omwe akuwukira. Njira yatsopanoyi imakulolani kuti muyang'ane ma URL pa ntchentche ndi cheke choyambirira motsutsana ndi whitelists omwe amaphatikizapo ma hashes a masauzande ambiri otchuka omwe ali odalirika. Ngati tsamba lomwe likutsegulidwa silili pamndandanda woyera, msakatuli amayang'ana ulalo pa seva ya Google, ndikutumiza ma bits 32 oyambilira a SHA-256 hash ya ulalo, momwe zotheka zamunthu zimadulidwa. Malinga ndi Google, njira yatsopanoyi ikhoza kupititsa patsogolo machenjezo a malo atsopano achinyengo ndi 30%.
• Adawonjezera chitetezo chokhazikika pakusamutsa mbiri ya Google ndi mawu achinsinsi omwe amasungidwa mumanejala achinsinsi kudzera pamasamba achinyengo. Ngati muyesa kulemba mawu achinsinsi osungidwa patsamba lomwe mawu achinsinsiwo sagwiritsidwa ntchito nthawi zambiri, wogwiritsa ntchitoyo adzachenjezedwa za chinthu chomwe chingakhale chowopsa.
• Kulumikizana pogwiritsa ntchito TLS 1.0 ndi 1.1 tsopano kukuwonetsa chizindikiro cholumikizira chosatetezeka. Thandizani kwathunthu TLS 1.0 ndi 1.1 adzakhala olumala mu Chrome 81, yokonzekera Marichi 17, 2020.
• Onjezani kuthekera koyimitsa ma tabo osagwira ntchito, kukulolani kuti mutsitse zokha kuchokera pazakumbukiro zomwe zakhala kumbuyo kwa mphindi zopitilira 5 ndipo osachita zazikulu. Chigamulo chokhudza kukwanira kwa tabu inayake kuti azizizira amapangidwa potengera heuristics. Kuyatsa ntchitoyi kumayendetsedwa ndi mbendera ya "chrome://flags/#proactive-tab-freeze".
• Wotetezedwa Kuletsa zophatikizika pamasamba zotsegulidwa pa HTTPS kuwonetsetsa kuti masamba omwe atsegulidwa pa https:// ali ndi zinthu zokhazo zomwe zalowetsedwa panjira yotetezeka yolumikizirana. Ngakhale mitundu yowopsa kwambiri yazinthu zosakanizika, monga zolembedwa ndi ma iframe, zatsekedwa kale, zithunzi, mafayilo amawu ndi makanema amatha kutsitsidwa kudzera pa http: //. Chizindikiro chophatikizika chomwe chidagwiritsidwa ntchito kale pazoyika zotere zidapezeka kuti sizothandiza komanso zosocheretsa kwa wogwiritsa ntchito, chifukwa sizipereka kuwunika kosadziwika bwino kwa chitetezo chatsambalo. Mwachitsanzo, kudzera mukuwononga zithunzi, wowukira atha kulowa m'malo mwa ma Cookies otsata ogwiritsa ntchito, kuyesa kugwiritsa ntchito zomwe zili pachiwopsezo mu ma processor azithunzi, kapena kupanga zabodza posintha zomwe zaperekedwa pachithunzichi. Kuti mulepheretse kutseka kwa zigawo zosakanikirana, malo apadera awonjezeredwa, omwe angapezeke kudzera mu menyu omwe amawoneka mukadina chizindikiro cha loko.
• Anawonjezera luso loyesera kugawana zomwe zili pa bolodi pakati pa desktop ndi mitundu yam'manja ya Chrome. Nthawi zina Chrome yolumikizidwa ndi akaunti imodzi, mutha kupeza zomwe zili mu clipboard yachipangizo china, kuphatikiza kugawana bolodi pakati pa mafoni ndi makompyuta. Zomwe zili mu clipboard zimasungidwa mwachinsinsi pogwiritsa ntchito kubisa kochokera kumapeto, komwe kumalepheretsa kuti mawu azitha kupezeka pa seva za Google. Ntchitoyi imayatsidwa kudzera muzosankha chrome://flags#shared-clipboard-receiver, chrome://flags#shared-clipboard-ui ndi chrome://flags#sync-clipboard-service.
• Mu adilesi ya adilesi nthawi zina (mwachitsanzo, posunga mawu achinsinsi) pomwe kulumikizana kwa mbiri kuzimitsidwa, kuwonjezera pa avatar, dzina la akaunti yapano ya Google likuwonetsedwa kuti wosuta adziwe bwino akaunti yomwe ikugwira ntchito.
• Amatsegulidwa kwa 1% ya ogwiritsa ntchito thandizo "DNS pa HTTPS" (DoH, DNS pa HTTPS). Kuyesaku kumakhudza okhawo omwe makonzedwe adongosolo adatchula kale opereka DNS omwe amathandizira DoH. Mwachitsanzo, ngati wosuta ali ndi DNS 8.8.8.8 yotchulidwa pazikhazikiko zamakina, ndiye kuti ntchito ya Google ya DoH (“https://dns.google.com/dns-query”) idzayatsidwa mu Chrome; ngati DNS ndi 1.1.1.1. XNUMX, ndiye DoH Cloudflare service ("https://cloudflare-dns.com/dns-query"), etc. Kuti muwone ngati DoH yayatsidwa, zochunira za "chrome://flags/#dns-over-https" zimaperekedwa. Njira zitatu zogwirira ntchito zimathandizidwa: zotetezeka, zodziwikiratu komanso zozimitsa. Munjira "yotetezedwa", olandila amatsimikiziridwa potengera zomwe zidasungidwa kale (zolandilidwa kudzera pa intaneti yotetezedwa) ndi zopempha kudzera pa DoH; kubweza ku DNS wamba sikugwiritsidwa ntchito. Mu "automatic" mode, ngati DoH ndi cache yotetezedwa palibe, deta ikhoza kutengedwa kuchokera ku cache yosatetezedwa ndikufikiridwa kudzera mu DNS yachikhalidwe. Mu "off" mode, cache yogawidwa imafufuzidwa poyamba ndipo ngati palibe deta, pempholo limatumizidwa kudzera mu dongosolo la DNS.
• Anawonjezera zoyeserera thandizo kusungitsa zomwe zalembedwa posintha masamba pogwiritsa ntchito mabatani akutsogolo ndi kumbuyo, zomwe zingachepetse kwambiri kuchedwa panthawi yamtunduwu chifukwa cha kusungitsa kwathunthu kwa tsamba lonse, zomwe sizikufuna kubwerezanso ndikutsitsa zinthu. Kukhathamiritsa kumawonekera makamaka mu mtundu wa zida zam'manja, pomwe kuchuluka kwa magwiridwe antchito kumafika 19%. Njirayi imathandizidwa pogwiritsa ntchito njira ya "chrome://flags#back-forward-cache".
• Zachotsedwa kukhazikitsa "chrome://flags/#omnibox-ui-hide-steady-state-url-scheme-and-subdomains", zomwe zimalola kubweza chiwonetsero cha protocol mu bar ya adilesi (tsopano maulalo onse amawonetsedwa nthawi zonse popanda https : // ndi http:/ /, komanso opanda "www.").
• Zomanga za Windows zimaphatikizanso sandboxing yamasewera omvera. Kuwongolera ngati kudzipatula kwayatsidwa, AudioSandboxEnabled katundu akuperekedwa.
• Zida zoyang'anira mabizinesi apakati zimaphatikizira kutha kufotokozera malamulo omwe amawongolera kuchuluka kwa kukumbukira komwe msakatuli angawononge ma tabo akumbuyo asanatsitsidwe. Memory yomwe imatulutsidwa mutatsitsa tabu imakhalapo kuti igwiritsidwe ntchito, ndipo zomwe zili mu tabu zimakwezedwanso pamene mukusintha.
• Linux imagwiritsa ntchito purosesa yotsimikizira satifiketi, yomwe imalowa m'malo mwa makina a NSS omwe amagwiritsidwa ntchito kale. Pakadali pano, purosesa yomwe idamangidwayo ikupitilizabe kugwiritsa ntchito sitolo ya NSS panthawi yotsimikizira, koma imayika zofunikira kwambiri mukakonza ziphaso zolembedwa molakwika komanso padera (masatifiketi onse ayenera kutsimikiziridwa ndi oyang'anira certification).
• Mu Baibulo kwa Android nsanja anawonjezera Kutha kugawira zithunzi zosinthika pamapulogalamu oyika omwe akuyenda mu Progressive Web Apps (PWA). Zithunzi zosinthika zimatha kusintha mawonekedwe ogwiritsidwa ntchito ndi wopanga chipangizocho, mwachitsanzo, kukhala ozungulira, makwerero, kapena okhala ndi ngodya zosalala.
• Awonjezedwa API Chida cha WebXR, yomwe imapereka mwayi wopeza zigawo zopangira zenizeni komanso zowonjezereka. API imakulolani kuti mugwirizanitse ntchito ndi magulu osiyanasiyana a zida, kuyambira pamutu wokhazikika ngati Oculus Rift, HTC Vive ndi Windows Mixed Reality, kupita ku mayankho otengera mafoni monga Google Daydream View ndi Samsung Gear VR. Mapulogalamu omwe API yatsopano ingagwire ntchito ikuphatikiza mapulogalamu owonera kanema mu 360 ° mode, machitidwe owonera malo amitundu itatu, kupanga makanema apakanema owonetsera makanema, kuchita zoyeserera popanga mawonekedwe a 3D a masitolo ndi magalasi;
  

• Mumayendedwe Oyambira Mayesero (zoyeserera zomwe zimafunikira padera kuyambitsa) ma API angapo atsopano aperekedwa. Origin Trial amatanthauza kuthekera kogwira ntchito ndi API yotchulidwa kuchokera ku mapulogalamu omwe adatsitsidwa kuchokera ku localhost kapena 127.0.0.1, kapena mutalembetsa ndi kulandira chizindikiro chapadera chomwe chili chovomerezeka kwa nthawi yochepa pa tsamba linalake.
  • Pazinthu zonse za HTML, chikhalidwe cha "rendersubtree" chikuperekedwa, chomwe chimatsimikizira kuti kuwonetsera kwa chinthu cha DOM kukhazikika. Kukhazikitsa mawonekedwe kukhala "osawoneka" kudzalepheretsa zomwe zili mu chinthucho kuti zisaperekedwe kapena kuwunikiridwa, kulola kumasulira kokwanira. Ikakhazikitsidwa ku "activatable", msakatuli amachotsa mawonekedwe osawoneka, perekani zomwe zili ndikuziwonetsa.
  • Njira yowonjezera ya API Wake loko kutengera njira ya Promise, yopereka njira yotetezeka kwambiri yowongolera kuyimitsidwa kwa zotchingira zodzitchinjiriza ndikusintha zida kumachitidwe opulumutsa mphamvu.
• Anakhazikitsa luso logwiritsa ntchito malingaliro autofocus pazinthu zonse za HTML ndi SVG zomwe zitha kukhala ndi chidwi cholowera.
• Kwa zithunzi ndi makanema otetezedwa Werengetsani chiŵerengero cha mawonekedwe potengera M'lifupi kapena kutalika kwake, zomwe zingagwiritsidwe ntchito kudziwa kukula kwa chithunzicho pogwiritsa ntchito CSS pa siteji pomwe chithunzicho sichinasinthidwe (amathetsa vuto pomanganso tsamba pambuyo potsitsa zithunzi).
• Anawonjezera katundu wa CSS font-kuwala-sizing, yomwe imayika zokha kukula kwa font mu ma coordinates owoneka "opsz", ngati mawonekedwe amathandizira. Mawonekedwewa amakulolani kuti musankhe mawonekedwe oyenera a glyph pakukula kwake, mwachitsanzo, gwiritsani ntchito ma glyphs osiyanasiyana pamitu.
• Anawonjezera katundu wa CSS mndandanda-mtundu-mtundu, zomwe zimakulolani kugwiritsa ntchito zizindikiro zilizonse m'malo mwa mindandanda yamagulu, mwachitsanzo, “-“, “+”, “★” ndi “▸”.
• Ngati sizingatheke kuchita Worklet.addModule (), chinthu tsopano chabwezedwa ndi chidziwitso chatsatanetsatane cha vutolo, zomwe zimakuthandizani kuti muwone bwino chomwe chayambitsa cholakwikacho (zovuta ndi kulumikizana kwa netiweki, mawu olakwika, ndi zina zambiri. .).
• Anasiya kukonza zinthu powasuntha pakati pa zolemba. Mukasamutsa pakati pa zikalata, kuchitidwa kwa zochitika zokhudzana ndi script "zolakwika" ndi "load" zimayimitsidwanso.
• Mu JavaScript injini V8 zidachitidwa Kukhathamiritsa kwa kasamalidwe kosintha koyimira minda muzinthu, zomwe zimapangitsa kuti AngularJS code iphatikizidwe mu Speedometer test suite ikuyenda 4% mwachangu.
  

• V8 imakonzekeretsanso kukonza kwa ma getters omwe amafotokozedwa mu ma API omangidwira, monga Node.nodeType ndi Node.nodeName, pakalibe chogwirizira IC (inline caching). Kusinthaku kunachepetsa nthawi yogwiritsidwa ntchito pa IC nthawi yothamanga pafupifupi 12% poyendetsa mayeso a Backbone ndi jQuery kuchokera ku Speedometer suite.
  

• Zotsatira za njira ya OSR (yotchedwa on-stack replacement) imasungidwa, yomwe imalowa m'malo mwa kachidindo kokonzedweratu panthawi yogwira ntchito (imakupatsani mwayi woti muyambe kugwiritsa ntchito kachidindo kamene kamakhalapo kwa nthawi yayitali osadikirira kuti ayambenso). Caching ya OSR imapangitsa kuti zitheke kugwiritsa ntchito zotsatira zokhathamiritsa mukayambiranso ntchitoyi, popanda kufunikira kokonzanso.
  M'mayesero ena, kusinthaku kudakulitsa magwiridwe antchito ndi 5-18%.
  

• Kusintha kwa zida za opanga mawebusayiti:
  Wawonekera debugging mode kuti mudziwe zifukwa zoletsera pempho kapena kutumiza Cookie.
  
  • Mu chipika chokhala ndi mndandanda wa Cookie, kuthekera kowonera mwachangu mtengo wa Cookie yosankhidwa wawonjezedwa ndikudina pamzere wina.
    

  • Kuwonjeza kuthekera kofananiza makonda osiyanasiyana amitundu yokonda-chiwembu ndi mafunso atolankhani omwe amakonda-ochepetsedwa (mwachitsanzo, kuyesa momwe tsambalo lili ndi mutu wamdima wakuda kapena zotsatsira zoyimitsidwa).
    

  • Mapangidwe a tsamba la Coverage akhala amakono, kukulolani kuti muwunikire kachidindo kogwiritsidwa ntchito koma osagwiritsidwa ntchito. Adawonjezera kuthekera kosefa zambiri ndi mtundu wake (JavaScript, CSS). Chidziwitso chogwiritsa ntchito ma code chimawonjezedwa mukamawonetsa mawu akuchokera.
    

  • Anawonjezera kuthekera kothetsa zifukwa zofunsira chida china cha netiweki mutatha kujambula zochitika zapaintaneti (mutha kuwona kutsatizana kwa kuyimba kwa nambala ya JavaScript komwe kunayambitsa kutsitsa).
    

  • Onjezani "Zikhazikiko> Zokonda> Magwero> Mapangidwe Osasinthika" kuti mudziwe mtundu wa indentation (mipata ya 2/4/8 kapena ma tabu) mu code yomwe ikuwonetsedwa mu Console and Sources panels.

Kuphatikiza pazatsopano ndi kukonza zolakwika, mtundu watsopanowu umachotsa ziwopsezo za 51. Zofooka zambiri zidadziwika chifukwa choyesera zokha pogwiritsa ntchito AddressSanitizer, MemorySanitizer, Control Flow Integrity, LibFuzzer ndi zida za AFL. Nkhani ziwiri (CVE-2019-13725, kupeza kukumbukira komasulidwa kale mu code yothandizira Bluetooth, ndi CVE-2019-13726, mulu kusefukira mu manejala achinsinsi) amalembedwa ngati ovuta, mwachitsanzo. kukulolani kuti mulambalale milingo yonse yachitetezo cha asakatuli ndikuchita ma code pa system kunja kwa sandbox. Aka ndi nthawi yoyamba kuti mavuto awiri ovuta adziwike mkati mwachitukuko chomwecho mu Chrome. Chiwopsezo choyamba chinapezeka ndi ofufuza ochokera ku Tencent Keen Security Lab ndi anasonyeza pa mpikisano wa Tianfu Cup, ndipo wachiwiri adapezeka ndi Sergei Glazunov kuchokera ku Google Project Zero.

Monga gawo la pulogalamu yolipira mphotho zandalama pozindikira zovuta zomwe zatulutsidwa pano, Google idapereka mphotho 37 zokwana $80000 (mphotho imodzi ya $20000, mphotho imodzi ya $10000, mphotho ziwiri za $7500, mphotho zinayi za $5000, mphotho imodzi ya $3000, mphotho ziwiri $2000 ndi mphoto zisanu ndi zitatu za $1000). Kukula kwa mphotho 500 sikunadziwikebe.

Source: opennet.ru