New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 881367 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows , Mac
Pri: 2
Type: Bug



Sign in to add a comment

ExtensionSettings policies are too big for supported distribution mechanisms (Windows registry, macOS configuration profile)

Reported by samuel.k...@airbnb.com, Sep 6

Issue description

UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3534.4 Safari/537.36

Steps to reproduce the problem:
1. Generate a decently sized ExtensionSettings policy with a few hundred extensions worth of policy.
2. As JSON, you will end up with a very repetitive file which is a few megabytes in size.
3. Place this into the registry on Windows or converted into a configuration profile on macOS.

What is the expected behavior?
It should be possible to craft an advanced policy using ExtensionSettings which is actually deployable.

What went wrong?
These policies end up being way too large for the places which they end up in, and cause the operating systems to have performance issues. 

On macOS, the configuration profile which I generated for this policy is in the ~5MB range, which will install, but causes the Profiles pane in System Preferences to hang for 60+ seconds when trying to preview the profile.  Other profiles interactions are hindered as well.

On Windows, registry strings have been traditionally 1MB, but can now be bigger https://docs.microsoft.com/en-us/windows/desktop/sysinfo/registry-element-size-limits.  Even so, Microsoft states "Long values (more than 2,048 bytes) should be stored in a file, and the location of the file should be stored in the registry. This helps the registry perform efficiently."

With policy sizes being this large, it becomes very hard for us to actually use them.

Did this work before? N/A 

Chrome version: 70.0.3534.4  Channel: dev
OS Version: OS X 10.14.0
Flash Version: 

This is highly compressible data - my policy is able to compress to about 2% of its original size.  While it might hurt a bit of transparency, I think that a good option here would be to support this key as Base64 gzip compressed data.  This could be as a string, but could also be through the data type on macOS which is natively supported in configuration profiles.  Placing a file on the disk probably isn't the best as it wouldn't work on Chrome OS.
 
Labels: Enterprise-Triaged OS-Windows
Owner: privard@chromium.org
Status: Assigned (was: Unconfirmed)
feature request. give to privard@ to further triage.
Cc: georgesak@chromium.org goanuj@chromium.org rdevlin....@chromium.org jawag@chromium.org
We are planning to look into improving ExtensionSettings blacklist and whitelisting options early next year, with the goal of reducing the overall size and complexity. Are there specific whitelisting or blacklisting dimensions that would help you reduce the number of rules applied?

For example, we have been considering adding the ability to blacklist / whitelist by extension developer, and by extension category.

Would this help reduce the overall size of your ExtensionSettings policy?

Sign in to add a comment