Post

Something completely underappreciated in how Google Chrome revolutionized the web and security and software in general — was the silent background auto-update + and non-admin user-level installs. It set a bar that changed everything on ability to make progress & address threats. Broke IT paradigms.

Joe Beda

@h.olysh.it

We actually started this with the Windows Google Talk client. We wanted a native app that had a lifecycle similar to the web. The update code got pulled out as a project called Omaha (github.com/google/omaha) and was then used in Chrome.

github.comGitHub - google/omaha: Google Update for WindowsGoogle Update for Windows. Contribute to google/omaha development by creating an account on GitHub.

20/12/24, 3:44 am3 reposts140 likes

Joe Beda

@h.olysh.it

20 Dec 2024

We also released the p2p stack as a project (libjingle) that eventually made it into chrome and exposed as WebRTC.

SwiftOnSecurity

@swiftonsecurity.com

20 Dec 2024

Thank you so much for the reply Joe!

Joe Beda

@h.olysh.it

20 Dec 2024

Of course! More lore: Auto update is *hard*. If you get it wrong you either strand users on old versions or turn it into a DDOS against your update servers.

Joe Beda

@h.olysh.it

20 Dec 2024

An early version hit an internal home page service at Google. The dev (hi Gary) pointed it at a file in his home directory. But there as a bug and, even within Google, it turned into a DDOS against that home page server.

ɐʞsǝS

@trapdoorsec.com

21 Dec 2024

yes indeed, crowdstrike learned this lesson the hard way!

redstormpopcorn

@wasteof.technology

20 Dec 2024

goddamn that is one of the best domains I've seen around here

Kenny MacLeod

@kennymacleod.bsky.social

20 Dec 2024

"Omaha" is a pretty spicy codename