Comodo Chromodo 42 release candidate is now available for download

When you sign in to Chrome and enable sync, Chrome keeps your information secure by using your Google Account credentials to encrypt your synced passwords. Alternatively, you can choose to encrypt all of your synced data with a sync passphrase. This sync passphrase is stored on your computer and isn't sent to Google.
https://support.google.com/chrome/answer/1181035 With a passphrase your data should be private.

Google Chrome & Privacy - Browsing Safely (YouTube)
I don’t find it too worrying.

I would like to know more about the expansion of the “Ad Sanitizer”.
P.s. Why “Adtrustmedia” refused from “Privdog” as an extension in your browser (recent versions), and then release the “Ad Sanitizer”, already as an extension for the browser?!

[attachment deleted by admin]

Hi Sanya,

As pointed out by JoWa, currently there is no need to implement a custom sync system since your sync-able preferences are obscured with a pass-phrase. If it wasn’t the case we wouldn’t offer it.

As you noticed there are some features that collects data on your local computer. Safe Browsing is one of them, as stated in video shared by JoWa, checks against malicious urls list is obscured, however if you allow Safe Browsing client in Chrome to send reports, you somehow let Chrome know about your navigation. So we removed this option from Chromodo and Dragon.

Besides this reporting, we strongly rely on Chrome Safe Browsing, that I think we should improve. If you look at public API offered by Google you’ll see that there is only 3 list available publicly. Safe Browsing Update API (v4)  |  Safe Browsing APIs (v4)  |  Google for Developers.
However, Chrome/Chromium uses 10 different lists which includes additional whitelists/blacklists yet not public. Personally, I do not feel comfortable with it, we have discussed this issue with our Product Manager as well. In version 42, we have to rely on all these lists for the sake of your security, because there are crucial information such as blacklisted extensions, infected binary url list etc. which we cannot replace right now.

Additionally there is a metric service, which collects metrics based on actions that you did send and send them to Google. Actions can be listed through chrome://user-actions/. We disabled the client so that no information is sent to Google, but in the following releases we would like to avoid gathering user actions as well.

And the most imported one I think is that we disabled Field Trials. On each installation of chrome/chromium a random set of experimental features are enabled by default. If you want disable it, you have to do it with a command line switch. We completely removed Field Trials from Chromodo and Dragon, so that it cannot be activated/deactivated. See the links below for details and you can read the Chrome EULA about field trials as well.

Hi slimka,
You have every right to complain about, and I personally apologize for the inconveniences that we brought. But sometimes we had to make choices to keep up with our road map. For the last 4-6 moths we are trying to change/complete our browser product line, and we had to make radical and drastic changes to make it work and keep up with Chromium version. Internationalization/localization, and string resource generation are two of them. We successfully overwrite the resource generation, unfortunately we couldn’t pay much more attention to internationalization and localization. After Dragon release, a patch that fixes localization issues will be released for both Chromodo and Dragon.

Edit: Portable option will be available in next releases of Dragon and Chromodo.

In Comodo we trust.

Hi Raven656,
Thanks for the feedback. We had the similar issue during development, and according to the test results it looks fine. But I’ll re-open this issue, so that we can work on it with internalization/localization changes. We might request some additional inputs as well.

Regards.

Hi guys,

Just installed Chromodo 42, it looks promising! Everything is working fine and fast. Thank you. :wink:

I need some information regarding Java. I tried to download from their site, but looks like Chrome do not support anymore! Any idea what to do? Does the latest Chrome comes with its own plugin? There are some explanations on Java website, but don’t want to create problems on Chromodo.

thnx

Hi tonialb,
A temporary workaround is to type chrome://flags/#enable-npapi into the address bar and enter.
Select enable of the highlighted entry and relaunch the browser.

Note: The above workaround will most likely be removed from version 45 and above.

Kind regards.

Found another Bug…if I enable Audio EQ Extension (HTML5 Audio Equalizer), all my youtube videos lose their audio and keeps on mute until I disable the extension and refresh the page, this doesn’t happen in Dragon 36/Slimjet core 42.

Cannot wait for Dragon 42. <3

OK, thanks.

Hi. Would be grateful! :slight_smile:
P.s. If a conversation about “Ad Sanitizer”.

Thanks a lot for you answer & for your work about the CD! I’m very glad to read it :azn:

the icon looks blank in the taskbar of win 8.1 x64

Nice release! Works very well with Win 8.1. Thanks.

Too bad we didn’t get Dragon instead of Chromodo. :frowning:

Chrome 43 is out.

And you have to rub it on our faces because?
The developers know that, they use the latest builds that they work on, so they know that they are behind versions.
Mentioning what version is out, when it is out from Chrome, is not necessary.

Hi Siketa,
Remembering the Comodo browser Developers have only recently joined forces, they will become more efficient with time. :slight_smile:

Kind regards.

What people worry about with release cycle, is the fact that high risk to severe risks can be not patched. Not to mention usability bugs.
The problem lies in the fact that Google is a multi-million dollar company, and has a decently sized crew working on their products, where as Comodo does not, and will never be able to compete, and or keep up. 42 was out for a bit, before the release of Chromodo Beta, which by the time it hit RC, Chrome had updated again. I seriously do not see Comodo being able to keep up with the release cycle. This is just my opinion though.

Testing of the Beta Chromodo, i stumbled across a few things that bothered me, the biggest being that it seemed the flash player plugin could not hold its own when it came to rendering 1440p or 4k videos. Those same videos on the same system, run with Google Chrome render just fine. This is just an example. Below is a list of some of the fixed bugs in this latest release, just to give an idea.

That vulnerability is one of 37 bugs fixed in version 43 of Chrome. Six of those flaws are rated as high risks and Google paid out more than $38,000 in rewards to researchers who reported vulnerabilities to the company. Among the other serious vulnerabilities are cross-origin bypasses and three use-after-free vulnerabilities.

Google has not yet released the details of the vulnerabilities, so the nature and location of the sandbox-escape bug aren’t clear. The company waits until most users have updated to the new version before releasing complete details of the vulnerabilities.

Here are the public bugs fixed in Chrome 43:

[$16337][474029] High CVE-2015-1252: Sandbox escape in Chrome. Credit to anonymous.

[$7500][464552] High CVE-2015-1253: Cross-origin bypass in DOM. Credit to anonymous.

[$3000][444927] High CVE-2015-1254: Cross-origin bypass in Editing. Credit to armin@rawsec.net.

[$3000][473253] High CVE-2015-1255: Use-after-free in WebAudio. Credit to Khalil Zhani.

[$2000][478549] High CVE-2015-1256: Use-after-free in SVG. Credit to Atte Kettunen of OUSPG.

[481015] High CVE-2015-1251: Use-after-free in Speech. Credit to SkyLined working with HP’s Zero Day Initiative

[$1500][468519] Medium CVE-2015-1257: Container-overflow in SVG. Credit to miaubiz.

[$1000][450939] Medium CVE-2015-1258: Negative-size parameter in Libvpx. Credit to cloudfuzzer

[$1000][468167] Medium CVE-2015-1259: Uninitialized value in PDFium. Credit to Atte Kettunen of OUSPG

[$1000][474370] Medium CVE-2015-1260: Use-after-free in WebRTC. Credit to Khalil Zhani.

[$500][466351] Medium CVE-2015-1261: URL bar spoofing. Credit to Juho Nurminen.

[$500][476647] Medium CVE-2015-1262: Uninitialized value in Blink. Credit to miaubiz.

[$500][479162] Low CVE-2015-1263: Insecure download of spellcheck dictionary. Credit to Mike Ruddy.

[$500][481015] Low CVE-2015-1264: Cross-site scripting in bookmarks. Credit to K0r3Ph1L.

Completely unnecessary to develop 2 Chrome based browser. Concentrate on one in the future !ot!