← Back to context

Comment by josephcsible

6 months ago

https://source.chromium.org/chromium/chromium/src/+/main:chr...

That API is baked into Google Chrome. It's hardcoded to only let google.com use it.

7 comments

josephcsible

Reply
jeffbee  6 months ago

I don't think that is an accurate description. The APIs are available in Chrome to anyone: https://developer.chrome.com/docs/extensions/reference/api/s...

The allowlisting going on here is that normally when you install an extension in Chrome it asks you to confirm the access to those APIs on the sites where the extension wants to run, but this one comes pre-confirmed from the factory. A quick GitHub search finds ~1000 manifest files that list system.cpu, possibly because that API is also in the boilerplate example chrome extension manifest.

  • josephcsible  6 months ago

    That's still just as unfair, though. Google always has access to that information because their extension is preinstalled and you can't disable it, but other websites have no access to that information unless you go out of your way to install a third-party extension to do so.

    • jeffbee  6 months ago

      OK. That's a point of view. I just thought it should be accurately described.

      I think the idea that you will download a web browser from Google and then it won't be able to figure out what model of CPU it is running on is a bit weird, when you think it through. There are lots of features of Chrome that are only "available to Google" for example it will only download updates from Google, unless you've modified its source code.