Google Chrome

Google started it. When Google launched the Chrome browser some three years ago, one of the key security features was automatic updating. New code releases are downloaded in the background while the browser is running, and applied the next time the user re-starts the browser.

Google argues that this boosts security, compared with the splash screens and user dialogs of other browsers. Faced with the choice of (1) waiting for update code to download, waiting for the update to install, and waiting for the browser to restart, or (2) clicking “Cancel” and continuing to the page they wanted to reach when they launched the browser, many (too many) users choose option 2. The result? Out-of-date browser versions with unpatched security vulnerabilities.

Microsoft has now announced the introduction of silent updating for Internet Explorer, and Mozilla expects to bring out silent updates for Firefox in an as-yet unspecified future release.

Not everybody’s happy. Enterprise IT operations, particularly end-user support teams, will be in the front line when users find themselves unable to access a business-critical application which turns out not to be compatible with the latest version of the user’s favorite browser.

As long as users were primarily sat in front of corporate-issue MS Windows desktops, updates were under the control of the IT department. New browser releases could be tested against business applications for compatibility before being deployed to the desktop. In the age of BYOD, however, support and maintenance of the end-point environment is in the hands of the user; you can’t impose a locked-down corporate configuration on a device owned by the employee.

AirShip, the enterprise browser, has been designed to give control back to the IT department. The AirShip browser can be installed on a range of end-point technologies. It supports concurrent execution of multiple browser configurations, centrally managed and deployed to end user devices. With AirShip, the user connects to enterprise applications using the optimum browser release and configuration as defined by the system administrator. And AirShip can happily coexist with industry-standard browsers, so end-users can enjoy the latest release of their favorite browser for personal use while AirShip delivers a managed environment for professional use.

Most of the browsers are impacted by security issues in early July.

• After the vulnerability in the Video Control component which is still not patched by Microsoft, it is now the Office Web Components Control which is actively exploited on Internet to take ownership of Internet Explorer by executing remode code… [Microsoft Security Advisory 973472]
• Mozilla has quickly published Firefox 3.5.1 to fix a critical vulnerability in the Javascript engine which can be used to execute remote code. Since then, a new vulnerability has been discovered but Mozilla argue that it is not exploitable, it is just a DoS vulnerability…
• Google has published in advance a new version (2.0.172.37) of Google Chrome which fix two critical vulnerabilities discovered by the Google security team (not yet public). On these two vulnerabilities, the sandbox technology used by Google is only able to mitigate one…
• Apple has fixed two critical vulnerabilities in Safari 4.0.2 : cross-site scripting, denial of service and remote code execution…

Last week Google finally got around to announcing what we’ve all been expecting since the launch of the Google Chrome browser — the Google Chrome Operating System. No surprise, really, the hints were there in the generous use of operating system terminology (Process Manager, Address Space, Garbage Collector etc) to describe browser features. No surprise either given Google’s historic focus on developing and delivering new services over the web. You’re using GMail for your email and calendar, you use Google Apps for your office applications, you use Picasa to touch-up your photos and you browse the web using Google Chrome; what do you need a full-featured local OS for when you can do everything via the browser? The temptation proved too strong for Google to resist and the result is now here, essentially a Linux kernel with a user interfaced based on the Google Chrome browser.

Google isn’t the first company to develop a solution of this type, and examples such as Good OS or jolicloud are worth taking a look at. The difference, of course, is that when Google has the resources and the clout to really impact the market.

So how does the commonIT team view this? Well, you can tell we’re not surprised. In practice this is one more sign that we’re merely at the beginning of a revolution in IT systems architectures, with the re-centralization of applications and data, accessed via the browser. As far as we’re concerned where there’s change, there are opportunities; but we’ll talk about that some other time