Google to phase out 1990s-era API’s in Chrome by 2014

Starting January 2014, Google will start blocking old 1990s-era plug-ins for its Chrome browser, to prevent crashes and security breaches.

But security engineer Justin Schuh said in a blog post that Google will phase out the old Netscape Plug-in API (NPAPI) gradually.

"Starting in January 2014, Chrome will block webpage-instantiated NPAPI plug-ins by default on the Stable channel," Schuh said.

He said they expect to fully get rid of such plug-ins before the end of 2014.

But he added they will temporarily whitelist the most popular NPAPI plug-ins that are not already blocked for security reasons. These include:

• Silverlight (launched by 15% of Chrome users in August)
• Unity (9.1%)
• Google Earth (9.1%)
• Java (8.9%), already blocked by default
• Google Talk (8.7%)
• Facebook Video (6.0%)

According to Schuh, 1990s-era NPAPI architecture had become a "leading cause of hangs, crashes, security incidents, and code complexity."

He added the web is ready for the transition, noting NPAPI is no longer supported on mobile devices.

Even Mozilla, which makes Chrome's rival browser Firefox, plans to block NPAPI plug-ins in December 2013, he added.

Schuh also cited anonymous Chrome usage data showing only six NPAPI plug-ins were used by more than five percent of users in the last month.

Yet, he said that since it may take time to transition away from NPAPI, "we will be rolling out this change in stages."

Short-term

In the short term, Schuh said users and enterprise administrators can whitelist specific plug-ins.

But eventually, he said NPAPI support will be completely removed from Chrome before 2014 ends, though user feedback may play a role.

"We expect this to happen before the end of 2014, but the exact timing will depend on usage and user feedback. Note that the built-in Flash plug-in and PDF viewer will be unaffected because they don’t use NPAPI," he added.

Chrome web store

Also, Schuh said the Chrome Web Store will also phase out NPAPI support.

"Starting today, no new Apps or Extensions containing NPAPI-based plug-ins will be allowed in the Web Store. Developers will be able to update their existing NPAPI-based Apps and Extensions until May 2014, when they will be removed from the Web Store home page, search results, and category pages," he said.

By September 2014, he said all existing NPAPI-based Apps and Extensions will be unpublished.

Existing installations will continue to work until Chrome fully removes support for NPAPI, he added.

Alternatives

Schuh said there are several alternatives to NPAPI such as NaCl, Apps, Native Messaging API, and Legacy Browser Support.

"Moving forward, our goal is to evolve the standards-based web platform to cover the use cases once served by NPAPI," he said. — VC, GMA News