Root Causes 490: Chrome and Chromium

Episode Transcript

Lightly edited for flow and brevity.

• 

  Tim Callan

  There are a couple words that are used a lot in the world of browsers and internet and the WebPKI and I think almost nobody really understands what they signify and the significance matters. Those are Chrome and Chromium. And I guess we could also throw Google in the mix.

• 

  Jason Soroko

  Goodness. Even you and I, Tim, when we talk about Google's participation at the CA/Browser Forum, what we're really talking about is the Chrome Root Store Program. Chrome is their browser. Google's browser.

• 

  Tim Callan

  The root store belongs to Chrome, not to Chromium. By the way, I've gotten that wrong in this podcast in the past, where the wrong word has come out. So, it's confusing.

• 

  Jason Soroko

  Chromium is an open-source browser technology.

• 

  Tim Callan

  That is the basis of Chrome and Edge, and I'll bet you some other stuff I don't know on the top of my head.

• 

  Jason Soroko

  Brave.

• 

  Tim Callan

  Brave. I didn't know that.

• 

  Jason Soroko

  So, I read something recently from - not going to name names - somebody who should have known better. Everybody makes mistakes. They said, oh well, the Chrome Root Store Program - they said that totally correctly - is making a decision like as part of their rules and therefore all Chromium-based browsers are going to follow suit.

• 

  Tim Callan

  Right.

• 

  Jason Soroko

  Wrong.

• 

  Tim Callan

  Wrong. Edge uses the Windows Root Store.

• 

  Jason Soroko

  There you go.

• 

  Tim Callan

  I don't know what Brave uses. Could be anything. Could be Mozilla.

• 

  Jason Soroko

  Now, little known fact unless you're in the Linux community, but on my Linux box, there's actually a browser, Chromium. So Chromium itself, the word is either the open-source browser technology, or it is actually a browser on Linux.

• 

  Tim Callan

  Now, let me ask you this, because I don't know the answer. Is the Linux Chromium browser based on the Chromium project? I would have figured.

• 

  Jason Soroko

  Yes it is.

• 

  Tim Callan

  But it's a Linux box. So is it using the Mozilla Root Store?

• 

  Jason Soroko

  You got me.

• 

  Tim Callan

  Might be. Most Linux is.

• 

  Jason Soroko

  Most Linux is. Maybe that's why it's called Chromium rather than Chrome.

• 

  Tim Callan

  Well, if it's not from Chrome, it's not made by Google, it's not going to not gonna be called Chrome. That's Google's trademark.

• 

  Jason Soroko

  Well, no. But the thing is, I think that it could have been called Chrome, but then, because it perhaps isn't using the Chrome Root Store Program, it’s using Mozilla's.

• 

  Tim Callan

  Well and I don't believe that anybody outside of Chrome is using the Chrome Root Store Program. Remember, a couple things to know about the Chrome Root Store program. It actually came to the game fairly late. It still does not have 100% adoption. Chrome on iOS uses the Apple root store.

• 

  Jason Soroko

  Yes. It’s just like Chromium probably on Linux using Mozilla.

• 

  Tim Callan

  Probably. Because of that though, Chrome, the browser, is insanely important. And though Chromium, the - what do I want to call it the browser foundation - is even more important because it's got Chrome and then some. From a root store perspective, it looks very different. Like you could look at published market share for the consumer facing browsers, and you'd say, okay, let me get this great straight. Chrome is 70% of the market and Mozilla is 7%. Okay. That means Chrome is 10 times as important as Mozilla. Well, not the root store, because the Mozilla root store touches all kinds of stuff that you don't think of as a classic human facing browser. So it turns into a very different pie chart, depending on what you're looking at.

• 

  Jason Soroko

  Various operating systems really carry a lot of weight.

• 

  Tim Callan

  Microsoft. Like you can't just look at the Edge market share to understand the importance of the Microsoft root store, because the Microsoft root store is sitting in every Windows machine in the world.

• 

  Tim Callan

  Regardless if you're using Edge or not. You’re probably doing something with that root program.

• 

  Tim Callan

  That root program is affecting your computer. Like every auto update. That's not being done by your browser. Just because you say, I'm a Firefox user, that doesn't change what root store does the auto updates.

  There's a bunch of stuff that's being decided by Windows that you don't even have a say in. I think that is a valid and important thing, and it's confusing as hell. Like I said, I go back and look at old podcast episodes and hear myself using the wrong word, and I try to be rigorous about it, and sometimes I think I don't even realize I'm doing it.

• 

  Jason Soroko

  That's why we're doing this episode. It’s to help people to understand what the words are and it really was spurred in my head when I saw somebody say, basically the assumption was all Chromium-based browsers, including Edge, had to follow a specific rules of specific root store. That's not true.

• 

  Tim Callan

  I think there's the other bigger point that we kind of crept into it and we could keep going there if needed, but I think the point is made, is that it actually gets more complex than you would think in terms of what root store is affecting what process.

• 

  Jason Soroko

  That's an important one. That could be a podcast all by itself. I think I'll keep it at this level, Tim. I think there's only one extra level of terminology that I want to bring up, and that's the rendering engine. So Chromium, technically, a rendering engine. What are equivalent peers in the world that we all use? WebKit. That's Safari. So Safari and I would say that Mozilla, Firefox is rendering action rendering is Mozilla. That's where the term Mozilla comes from. It's the rendering engine which gives the name to the root store program.

• 

  Tim Callan

  Also, sometimes you get this phenomenon of, again, a completely invisible, I almost want to say white-labeled. So, for instance, I don't know the answer to this, but what is the browser rendering engine on the PS5? It's one of them.

• 

  Jason Soroko

  Probably a fork of WebKit. I'm gonna bet.

• 

  Tim Callan

  So that's going to come with a root store. What's the rendering engine on the Nintendo Switch? That's going to come with a root store. So think about all the places. If your Smart TV lets you do internet browsing, what's that?

• 

  Jason Soroko

  There are root stores, even if you're not browsing.

• 

  Tim Callan

  Sure. Absolutely, because you're doing the same thing. You're doing software updates and all kinds of stuff. So, it's almost like every piece of electronics in your life that is accessing an internet based connection has a root store, and it's really one of about five, and good luck knowing which one.

• 

  Jason Soroko

  Yet it is fundamentally important in terms of what is trusted by your system. And most of us have no idea what we're trusting. That's an episode for the future, Tim.

• 

  Tim Callan

  Sure. That’s an episode that’s going to need a little research, I think.

• 

  Jason Soroko

  Oh it does.

• 

  Tim Callan

  I don't know. I'm asking questions I just don't know the answer.

• 

  Jason Soroko

  That shows you how complex it is. Like, we're totally, utterly imbued in this, and even we don't know.

• 

  Tim Callan

  We don't know. You’d have to have very specific knowledge. There are people out there right now who know perfectly well the answer to these.

• 

  Jason Soroko

  A lot of it's not public information either.

• 

  Tim Callan

  That's true. That's good point.

• 

  Jason Soroko

  We could go forever on that.

• 

  Tim Callan

  There’s a little meander.