Source
r/k12sysadmin•
cawfee

If you're using DRC Insight for testing on ChromeOS, cap your auto updates to 79

Bulletin received this morning:

https://content.govdelivery.com/accounts/MIMDE/bulletins/27a7f7b

We managed to catch this before any of ours updated to v80 (thankfully). Nobody wants to be the person with a bucket of flash drives having to manually roll back 3600 Chromebooks during testing season.

Some more info from Skyward:

On Tuesday, February 4, 2020, Google will release version 80 of its Chrome browser, which contains security-related changes that could negatively affect many web applications, including SMS 2.0. We will be releasing a group RMA on Friday, January 31st, 2020, which will account for these changes in the Chrome browser. It is important that all SMS 2.0 customers load this update before Tuesday, February 4th, 2020 to ensure continued operation of your SMS 2.0 environment.

Additionally, as mentioned earlier, many web applications will be impacted by this change. The group RMA mentioned here will ensure that SMS 2.0 continues to function properly after the Chrome update; however, any other web-based software product that your district uses in addition to SMS 2.0 may be negatively impacted by this change as well, including any custom web applications that you have written internally. We are attempting to contact Skyward partners and other software vendors known to interoperate with SMS 2.0; however, we recommend you also contact other vendors whose software you use, especially those that use some form of Single Sign On (SSO), to ensure that they are aware of this upcoming change and have made whatever changes are necessary to their software.

For additional information about this change in Google Chrome, see the following blog post from Google: https://blog.chromium.org/2019/10/developers-get-ready-for-new.html

Posted Feb 7, 2020, 3:56 PM UTC · edited

6134
philphan25•

A system update and DRC breaking...name a more iconic duo.

17
jay0lee•

Note that the admin console now allows you to force devices to roll back to an older Chrome OS version. It's the setting just below the device version pinning. This does currently involve a powerwash of the devices so it's not for the faint of heart but it's WAAAAY better than USB recovery of a whole bunch of devices.

https://support.google.com/chrome/a/answer/3168106?hl=en

15
iihacksx•

I'm looking for that option but I don't see it? And the link you posted also doesn't seem to mention this.

Am i just totally missing something or are you on a different version than me?

3
roushbombs•

It’s not just you. I don’t see any mention of it in the support article and it’s not an option in our admin console.

3
iihacksx•

Thank you! I thought it was just me being blind. We are always just on stable and don't sign up for any beta.

1
krisleslie•

You are a saint didn’t know. I just disabled it so they wouldn’t go past 79.

2
TechxNinjaK12 Field Tech & MDT User•

Saved my skin over here. Many thanks.

11
pilkenWorking Educational IT for 21 years•

Thanks for the HU - we're capped at 79!

8
krisleslie•

Already did - hate they waited till the last friggin minute to “notify” us.

DRC in my opinion sucks.

7
deeds4life•

Love it. Can't make our app work with latest security policies so lets put it on end users to not be secure until testing is done just so our app works.

4
Jabbey15•

Still capped at version 76 :). Won’t allow another update till June, will cap at 79.

3
geoff5093Network Administrator•

That's pretty scary given all the major vulnerabilities in Chrome OS that MS-ISAC sends out.

6
Jabbey15•

Not really, most of the vulnerabilities are listed for Google Chrome browser running on a desktop. Very few are listed for ChromeOS on a chromebook.

3
krisleslie•

Exactly

2
LDSK_Blitznot the internet police•

I’ve never seen an ISAC report on ChromeOS itself. Chrome browser itself? Oh yeah. That’s the price you pay for becoming the most popular browser.

Currently, ChromeOS is hardened incredibly well, but only because of an ROFS. In due time...

1
DerpyNirvash•

Why so far back?

4
nxtiak•

76-78 has a lot of major issues. v79 is pretty good.

1
ParkerGuitarGuy•

Whoa, thanks for posting this! I just restricted ours to 79. Not sure yet if any are on 80, but I'm sure this limits the scope of damage. Great find, OP!

3
tibble137•

It’s reaaaaally irresponsible for them to suggest this. Updates are important. Security issues are real!

3
[deleted]•

[deleted]

3
cawfeeOPOS X & Everything Else Sysadmin•

The DRC notice went out at ~1 PM EST today; we found out through a regional group around 8 AM and the linked MDE release was sent at 10 AM. I think the best approach is to subscribe to as many sources as possible to catch things like this early!

3
[deleted]•

[deleted]

1
GezusK•

Maybe someone should show DRC how to access the beta channel. At least they could notify us quicker then.

3
jdsok•

I called ours last week at 79.

Has anyone had the guts to experiment with Clever-accessed sites using Clever (Google) SSO in v80 yet?

2
wapacza•

I'm hoping we find out why this was missed, when beta channel for chromeos has had 80 for at least a month and dev channel has had 80 out for 2 months.

2
ilikeyoureyesDirector•

We are writing to let you know about an important issue with the upcoming release of the Chrome 80 operating system (OS) for Chromebooks and Chromeboxes. During our review of the DRC INSIGHT Secure Browser on the upcoming release of Chrome OS 80, we discovered an issue that blocks users from accessing assessments through the Secure Browser on Chromebooks and Chromeboxes. Until a resolution to this issue has been identified and implemented, DRC advises sites to immediately disable automatic operating system updates. This ensures that Chromebooks and Chromeboxes cannot update to version 80 of Chrome OS. Chromebooks and Chromeboxes that update to Chrome 80 before a resolution has been implemented will not be able to be used for DRC INSIGHT Secure Browser-based testing.

1
IngsocInnerParty•

Ours have been capped for a couple of months thanks to a warning from ISBE. Does anyone know of a way to make new update keys with an older OS? I'm afraid I'm going to lose the two I have. lol

1
cawfeeOPOS X & Everything Else Sysadmin•

I haven't tried it recently, but the steps from this post may still work:

https://www.reddit.com/r/k12sysadmin/comments/6zmujg/comment/dmwts0m

1
jay0lee•

that's old info, it's now possible to roll devices back to the version you are pinning them to, see my post above.

Regarding recovery keys for old versions, you can grab the old recovery image from cros-updates-serving.appspot.com (recovery images per device are to the right). Then in the recovery tool under the gear icon there's an option to use a local image to create the recovery drive.

1
mikegonzalez62•

Just disabled this, thanks OP

1
Much2sneaky•

Well I've got them capped now but I know a bunch of our Chromebooks have updated to 80 and some desktops have also.

1
jobe_br•

ChromeOS stable is still 79 at the moment. Only the beta channel has 80. Only Chrome desktop (Mac/win/Linux) has 80 on stable. If you have chromebooks on 80, they’re on the beta channel.

2
Much2sneaky•

Yeah the chromebooks were set to beta channel and I changed it to stable channel. Even though version 80 is stable on desktop it still won't work on them. I set a policy in GPO to keep desktops from updating Chrome. Also set a policy to roll them back to 79 but not sure if it will work.

1
jobe_br•

It looks like the bulletin only applies to Chromebooks, FYI.

1
[deleted]•

[removed]

1
danger_bears•

I read last week on here that TestNAV would also not function on v80. Has anyone heard otherwise? Pearson hasn't responded.

1