Ausnahme gefangen: SSL certificate problem: certificate is not yet valid ๐Ÿ“Œ Chrome 85: Upload Streaming, Human Interface Devices, Custom Properties with Inheritance and More

๐Ÿ  Team IT Security News

TSecurity.de ist eine Online-Plattform, die sich auf die Bereitstellung von Informationen,alle 15 Minuten neuste Nachrichten, Bildungsressourcen und Dienstleistungen rund um das Thema IT-Sicherheit spezialisiert hat.
Ob es sich um aktuelle Nachrichten, Fachartikel, Blogbeitrรคge, Webinare, Tutorials, oder Tipps & Tricks handelt, TSecurity.de bietet seinen Nutzern einen umfassenden รœberblick รผber die wichtigsten Aspekte der IT-Sicherheit in einer sich stรคndig verรคndernden digitalen Welt.

16.12.2023 - TIP: Wer den Cookie Consent Banner akzeptiert, kann z.B. von Englisch nach Deutsch รผbersetzen, erst Englisch auswรคhlen dann wieder Deutsch!

Google Android Playstore Download Button fรผr Team IT Security



๐Ÿ“š Chrome 85: Upload Streaming, Human Interface Devices, Custom Properties with Inheritance and More


๐Ÿ’ก Newskategorie: Programmierung
๐Ÿ”— Quelle: blog.chromium.org

Unless otherwise noted, changes described below apply to the newest Chrome beta channel release for Android, Chrome OS, Linux, macOS, and Windows. Learn more about the features listed here through the provided links or from the list on ChromeStatus.com. Chrome 85 is beta as of July 23, 2020.

Fetch Upload Streaming

Fetch upload streaming lets web developers make a fetch with a ReadableStream body. Starting in Chrome 85, it's available for an origin trial.

Previously, you could only start a request once you had the whole body ready to go. But now, you can start sending data while you're still generating the content, improving performance and memory usage.

For example, an online form could initiate a fetch as soon as a user focuses a text input field. By the time the user clicks enter, fetch() headers would already have been sent. This feature also allows you to send content as it's generated on the client, such as audio and video. For more information, see Streaming requests with the fetch API.

See the Origin Trials section for information on signing up and for a list of other origin trials starting in this release. This origin trial is expected to run through Chrome 87 in January 2021.

WebHID API

There is a long tail of human interface devices (HIDs) that are too new, too old, or too uncommon to be accessible by systems' device drivers. The WebHID API solves this by providing a way to implement device-specific logic in JavaScript. In Chrome 85, it's available for an origin trial.

An HID is one that takes input from or provides output to humans. Examples of devices include keyboards, pointing devices (mice, touchscreens, etc.), and gamepads.

The inability to access uncommon or unusual HID devices is particularly painful when it comes to gamepad support. Gamepad inputs and outputs are not well standardized and web browsers often require custom logic for specific devices. This is unsustainable and results in poor support for the long tail of older and uncommon devices.

We're working on an article to show you how to use the new API. In the meantime, we've found some demos from a few eager engineers that you can use to try the new API. To see those demos, check out Human interface devices on the web: a few quick examples.

See the Origin Trials section for information on signing up and for a list of other origin trials starting in this release. This origin trial is expected to run through Chrome 87 in January 2021.

Windows Support for getInstalledRelatedApps()

The navigator.getInstalledRelatedApps() method determines whether a site's corresponding native app is installed. This allows customization of a user experience for already-installed apps. For example, users can be redirected from a product marketing page directly into an app. Functionality can be centralized to prevent users from seeing duplicate notifications and save developers from maintaining two code bases. Sites can even avoid prompting for installation of a PWA if a native app is already on a user's device.

It does all this while protecting user privacy. Entries in the web app manifest and the Android manifest file ensure that sites cannot use the API to request arbitrary information about users' installed apps.

This method was implemented on Android in Chrome 80. Starting in Chrome 85, it's available on Microsoft Windows. This addition is the result of work from Microsoft. For details on using this method, see Is your app installed? getInstalledRelatedApps() will tell you!.

@property

CSS Houdini is a set of APIs and CSS features that exposes the CSS rendering engine. It lets developers create new CSS features without waiting for a native implementation in browsers. CSS Houdini's @property rule is part of the CSS Properties and Values API, which allows defining custom properties with inheritance, type checking, and default values. The first part of this API, CSS.registerProperty(), was implemented in Chrome 78. That method's capabilities are now available in stylesheets through the @property.

Take the image below, for example. What you're seeing is a transition created with a CSS custom property. In addition to being impossible without the new API, this transition is also type safe. For more information, see @property: giving superpowers to CSS variables.

Origin Trials

In addition to those listed above, this version of Chrome introduces the new origin trials described below. Origin trials allow you to try new features and give feedback on usability, practicality, and effectiveness to the web standards community. To register for any of the origin trials currently supported in Chrome, including the ones described below, visit the Origin Trials dashboard. To learn more about origin trials themselves, visit the Origin Trials Guide for Web Developers.

New Origin Trials

Declarative Shadow DOM

A declarative API to allow the creation of shadow roots using only HTML and no Javascript. This API allows Web Components that use Shadow DOM to also make use of server-side rendering (SSR), to get rendered content on screen quickly without requiring Javascript for shadow root attachment. The origin trial is expected to run through Chrome 87 in January 2020.

RTCRtpEncodingParameters.adaptivePtime Property

The RTCRtpEncodingParameters.adaptivePtime property lets a sender in a real-time communication (RTC) system enable or disable adaptive packet rates. Because the packet rate is a big determining factor to the overall bitrate of an audio stream, an optimal congestion control is needed to adapt the packet rate. The audio packet rate is analogous to the video frame rate, which also plays an important role in the video bitrate adaptation.

Although adaptive packet rate may be ubiquitously beneficial, we need this API for applications to enable and disable it, since, otherwise, it may introduce interoperability problems. Some implementations have taken a fixed packet rate as an assumption, and thus may fail or perform sub-optimally with an adaptive packet rate. The origin trial is expected to run through Chrome 87 in January 2020.

Portals

Portals enable seamless navigations between sites or pages by allowing a page to show another page as an inset. For more information, see Hands-on with Portals: seamless navigation on the Web. The origin trial is expected to run through Chrome 86 in early November.

Other Features in this Release

App Shortcuts

App shortcuts are now available on desktop in addition to Android, which debuted in Chrome 84. This feature improves users' productivity and facilitates reengagement with key tasks by providing quick access to common actions. For sites that are already Progressive Web Apps, creating shortcuts requires only adding items to the web app manifest. This addition is the result of work from Microsoft. For more information, see Get things done quickly with app shortcuts.

Autoupgrade Mixed Content

Chrome is now auto-upgrading images served over HTTP from HTTPS sites by rewriting URLs to HTTPS without falling back to HTTP when secure content is not available. Chrome has been auto-upgrading audio and video content since version 80.

AVIF Image Decode

Adds support for decoding AVIF content natively using existing AV1 decoders. AVIF is a next generation image format standardized by the Alliance for Open Media. There are three primary motivations for supporting AVIF:

  • Reducing bandwidth consumption to load pages faster and reduce overall data consumption. AVIF offers significant file size reduction for images compared with JPEG or WebP.
  • Adding HDR color support. AVIF is a path to HDR image support for the web. JPEG is limited in practice to 8-bit color depth. With displays increasingly capable of higher brightness, color bit depth, and color gamuts, web stakeholders are increasingly interested in preserving image data that is lost with JPEG.
  • Supporting ecosystem interest. Companies with a large web presence have expressed an interest in shipping AVIF images on the web.

Changes to Persistent Storage for Installed Web Apps

Getting persistent storage is easier and more predictable for installed web apps, including PWAs and Trusted Web Activities. If an installed web app requests persistent storage by calling navigator.storage.persist(), it will be granted automatically. Other sites will continue to use the existing heuristics.

CSS

Color Adjust: Remove 'only' and Support 'dark' for Preferred 'light' for color-scheme

Chrome made two changes to match those made in the CSS Color Adjustment level 1 spec.

  • The 'only' keyword is no longer special and is treated as a <custom-ident> as any other unknown color-scheme. The 'only' keyword was previously only allowed in combination with 'light', but had otherwise no effect in Chrome.
  • Page authors can now use dark-themed UA rendering even when the preferred color-scheme is 'light'. The new behavior is:
    • color-scheme: light -> always light
    • color-scheme: dark -> always dark
    • color-scheme: light dark -> select the preferred scheme

This means content which has a dark theme in its CSS will be able to match it with dark themed UA controls.

This change improves interoperability with WebKit which already had this behavior for 'color-scheme: dark'.

content-visibility Property

Adds a CSS property called content-visibility, which allows automatic or script management of content visibility. When hidden, the element's contents (subtree or replaced element contents) are not drawn or hit-tested and have CSS containment applied, allowing for rendering optimizations. The 'auto' keyword allows for the user-agent to manage content visibility based on proximity to the viewport, whereas the 'hidden' keyword allows full script control of content visibility.

counter-set

CSS counter-set is an additional property introduced in CSS Lists Module Level 3 to control counters by setting an existing counter to a specified value. This builds on other implemented counter control properties, specifically counter-reset (which creates a new counter with a specified value) and counter-increment (which increments an existing counter by a specified amount). This feature is needed for precise counter control, since otherwise it is not possible to set an existing counter to a value other than figuring out how to increment or decrement it.

Event Timing API

The Event Timing API enables web developers to measure event latency both before and after the page load. Monitoring event latency requires an event listener. This precludes measuring event latency early in page load, and adds unnecessary performance overhead. For more information, see Detect inactive users with the Idle Detection API.

Expose Picture-in-Picture Window in leavepictureinpicture event

(Desktop only) The leavepictureinpicture event now exposes a reference to pictureInPictureWindow so that web developers no longer need to keep a global reference to that object.

Named pages with page-orientation

Support is added for several CSS properties and descriptors for printing.

  • The 'page' CSS property.
  • Named pages. For example: @page foobar {}
  • The 'page-orientation' descriptor with values 'upright' (default), 'rotate-left', or 'rotate-right'.

Referrer Policy: Default to strict-origin-when-cross-origin

Web developers may specify a referrer policy on their documents, which impacts the Referer header sent on outgoing requests and navigations. When no such policy is specified, Chrome will now use strict-origin-when-cross-origin as the default policy, instead of no-referrer-when-downgrade. On cross-origin requests made from documents without a specified referrer policy, this reduces the Referer header to the initiating origin.

Update Fallback Content's Behavior for ImageInputType and HTMLImageElement

Changes the behavior of fallback content for ImageInputType and HTMLImageElement. Such content will now render exactly the same as alt text would.

Update the Behavior of the "disabled" Attribute for HTMLLinkElement

Corrects several spec inconsistencies related to the <link> tag's disabled attribute.

  • Values for the disabled attribute were not accessible through document.stylesheets.
  • Toggling the disabled attribute to false then back to true caused it to appear and remain in document.stylesheets.
  • The only way to enable an alternate stylesheet was by disabling, then reenabling it.
  • Disabled links were not setting link.ownerNode to null.

These behaviors are eliminated in compliance with a spec update.

Web Bluetooth writeValueWithResponse() and writeValueWithoutResponse()

Adds two new methods, writeValueWithResponse() and writeValueWithoutResponse(), which resolve several issues with the existing method for writing to GATT characteristics and enable developers to control whether the device returns a response. The existing writeValue() method will remain for backwards compatibility, but its use is discouraged. The following problems with the existing method have been corrected:

  • It does not allow specifying the type of GATT characteristic write that should be used. This is particularly a problem for devices that support both write types. Writing without response is often desirable for performance reasons, however on most platforms, writing with response is used by default.
  • The ability to write with or without response is platform-specific. Currently most platforms prefer writing with a response, but Android prefers writing without a response if both types are available.
  • On most platforms, the current implementation depends on the device correctly reporting the available GATT characteristic write types via GATT characteristic properties. If these properties are not set, the characteristic cannot be written to.

The new APIs also do not depend on the GATT characteristic properties being set correctly which allows working around buggy Bluetooth devices.

WebAssembly BigInt Integration

WebAssembly now imports and exports WebAssembly function parameters of type i64 using BigInt.

WebAuthn getPublicKey(), getPublicKeyAlgorithm() and getAuthenticatorData()

Several methods from the Web Authentication Level 2 spec have been added.

  • getPublicKey() and getPublicKeyAlgorithm() save sites from parsing Concise Binary Object Representation (CBOR) and CBOR Object Signing and Encryption (COSE) in order to use security keys. CBOR and COSE are somewhat obscure at this time and there's no need for most sites to have to worry about them as the browser is capable of translating them into more standard formats.
  • getAuthenticatorData() returns the authenticator data contained within attestationObject.

JavaScript

This version of Chrome incorporates version x.x of the V8 JavaScript engine. It specifically includes the changes listed below. You can find a complete list of recent features in the V8 release notes.

JavaScript Logical Assignment Operators

Adds the logical assignment operators ||=, &&=, and ??= to JavaScript. This rounds out the compound assignment operators to also include logical binary operators. Currently only mathematical and bitwise binary operators are supported. This improvement is for shipping terser, clearer JavaScript. For more information, see Logical assignment.

Promise.any() and AggregateError

Adds two new JavaScript features to V8. Promise.any() accepts an iterable of promises and returns a promise that is fulfilled by the first given promise to be fulfilled, or rejected with an AggregateError holding the rejection reasons if all of the given promises are rejected. AggregateError is a support class that aggregates one or more errors into a single object.
This rounds out standard JS support for commonly available Promise combinators already available in userland libraries.

String.prototype.replaceAll()

JavaScript now has support for global substring replacement through the new String.prototype.replaceAll() method.

Deprecations, and Removals

This version of Chrome introduces the deprecations and removals listed below. Visit ChromeStatus.com for lists of current deprecations and previous removals.

AppCache Removal Begins

Chrome 85 starts a spec-mandated turn down of AppCache in Chrome. For details and instructions for managing the transition gracefully, see Preparing for AppCache removal. For information on a feature that will help you identify uses of this and other deprecated APIs, see Know your code health.

Reject insecure SameSite=None cookies

Use of cookies with SameSite set to None without the Secure attribute is no longer supported.
Any cookie that requests SameSite=None but is not marked Secure will be rejected. This feature started rolling out to users of Stable Chrome on July 14, 2020. See SameSite Updates for a full timeline and details. Cookies delivered over plaintext channels may be cataloged or modified by network attackers. Requiring secure transport for cookies intended for cross-site usage reduces this risk.

...



๐Ÿ“Œ Chrome 85: Upload Streaming, Human Interface Devices, Custom Properties with Inheritance and More


๐Ÿ“ˆ 94.02 Punkte

๐Ÿ“Œ Mastering CSS Custom Properties: The Senior Developer's Approach to CSS Custom Properties.


๐Ÿ“ˆ 50.57 Punkte

๐Ÿ“Œ What is Inheritance in OOP in Python? What are the Different Types of Inheritance


๐Ÿ“ˆ 43.05 Punkte

๐Ÿ“Œ Chrome 105 Beta: Custom Highlighting, Fetch Upload Streaming, and More


๐Ÿ“ˆ 33.1 Punkte

๐Ÿ“Œ Chrome 105 Beta: Custom Highlighting, Fetch Upload Streaming, and More


๐Ÿ“ˆ 33.1 Punkte

๐Ÿ“Œ New in Chrome 85: CSS Properties, content-visibility, getInstalledRelatedApps(), and lots more!


๐Ÿ“ˆ 27.25 Punkte

๐Ÿ“Œ Custom repository properties: Organization, policy, and security at scale


๐Ÿ“ˆ 27.07 Punkte

๐Ÿ“Œ Mixins (Multiple inheritance) | More Python for Beginners [10 of 20]


๐Ÿ“ˆ 26.26 Punkte

๐Ÿ“Œ Samsung's Lee Family To Pay More Than $10.8 Billion Inheritance Tax


๐Ÿ“ˆ 26.26 Punkte

๐Ÿ“Œ Abandoning Open Skies: Trump Would Be Squandering More of Our Security Inheritance


๐Ÿ“ˆ 26.26 Punkte

๐Ÿ“Œ Demo: Inheritance | More Python for Beginners [9 of 20]


๐Ÿ“ˆ 26.26 Punkte

๐Ÿ“Œ Inheritance | More Python for Beginners [8 of 20]


๐Ÿ“ˆ 26.26 Punkte

๐Ÿ“Œ The Strategy Guide to CSS Custom Properties


๐Ÿ“ˆ 25.28 Punkte

๐Ÿ“Œ Understanding CSS Custom Properties


๐Ÿ“ˆ 25.28 Punkte

๐Ÿ“Œ Color & Custom Properties - Designing in the Browser


๐Ÿ“ˆ 25.28 Punkte

๐Ÿ“Œ Creating A High-Contrast Design System With CSS Custom Properties


๐Ÿ“ˆ 25.28 Punkte

๐Ÿ“Œ CSS Timeline with Custom Properties


๐Ÿ“ˆ 25.28 Punkte

๐Ÿ“Œ Exploring Variables in CSS (custom properties)


๐Ÿ“ˆ 25.28 Punkte

๐Ÿ“Œ New in Chrome 78: New origin trials, CSS Properties and Values API, and fresher service workers!


๐Ÿ“ˆ 24.31 Punkte

๐Ÿ“Œ How to Implement Interface Properties in C#


๐Ÿ“ˆ 23.71 Punkte

๐Ÿ“Œ CVE-2023-29055 | Apache Kylin up to 4.0.3 Server Config Web Interface kylin.properties cleartext transmission


๐Ÿ“ˆ 23.71 Punkte

๐Ÿ“Œ Samsung heir and family to pay $10.8 billion in inheritance tax


๐Ÿ“ˆ 23.31 Punkte

๐Ÿ“Œ The Seven Properties of Highly Secure Devices - Microsoft Research


๐Ÿ“ˆ 22.79 Punkte

๐Ÿ“Œ [$] The properties of secure IoT devices


๐Ÿ“ˆ 22.79 Punkte

๐Ÿ“Œ CVE-2023-32116 | TotalPress.Org Custom Post Types, Custom Fields & More Plugin up to 4.0.12 on WordPress cross site scripting


๐Ÿ“ˆ 22.52 Punkte

๐Ÿ“Œ Scam Alert: Anatomy Of An Inheritance Fraud Letter


๐Ÿ“ˆ 21.53 Punkte











matomo