Charlie Reis chose Rice University in 1998 because he wanted to study computer science. “I probably started to program around age seven or eight,” said Reis, “and Rice was attractive to me because it had a strong CS program. I was intending to get a job right after my undergraduate program; going to grad school hadn’t even occurred to me.”
His introductory CS courses were taught in the Scheme programming language, and the assignments forced him to think about solutions from a mathematical perspective. “I also had to get rid of the bad habits I’d picked up on my own,” he said.
The opportunity to pursue a fifth-year master’s degree arose when he was a senior. He said, “I did an independent project –working on an educational programming environment called DrJava– with Corky Cartwright, and I was taking a distributed systems course. Part of the class involved reading research papers.
“Reading the papers and working with Corky got me really interested in the research side of things, and then I learned I could keep working on DrJava source code in the fifth-year master’s program.”
Reis was exploring educational uses of DrJava as part of his research and was simultaneously a student and TA for COMP 312. As a student, he was working on the DrJava source code to make it powerful enough for production programming. As a TA, he was helping junior and senior students extend and maintain a program with real customers: younger students at Rice and at other schools who were using DrJava in introductory programming courses.
“Eric Allen was Corky’s Ph.D. student for that project, and we had a lot of fun adding to DrJava and working out the bugs. We published a paper on our findings about how to teach production programming by having students maintain a real open source project, and I presented it at SIGCSE 2003.”
While Reis was completing his master’s at Rice, he realized he had an interest in getting a Ph.D. but was unsure of where to focus his research. Peter Druschel, another Rice CS professor, helped him think through his options.
“My overarching theme was to help people write programs with fewer bugs, and that would likely be in the area of languages, systems, or software engineering,” said Reis. “Peter gave me a lot of good advice. He pointed out that the University of Washington was strong in many of those areas, and Seattle was also a place I’d enjoy living. One of the other benefits of UW’s program was being able to apply without having to choose a specific adviser, particularly since I had not yet determined my area of focus.”
Reis attributes much of his industry success to his Ph.D. training. He said the program helped build up the skills he needed for work, like leading projects, choosing good problems to work on, knowing how to evaluate your solutions, and being able to communicate your results.
More importantly, it positioned him at the right place and right time to catch the eye of the Chrome team at Google.
“I’d written a paper saying web browsers should use multiple OS processes, but I submitted it to a conference committee that did not find it compelling, so it was not accepted. I got an internship offer to work on Google Chrome instead.”
Charlie Reis, outside his office in Google’s Seattle campus.
Reis said he first looked into browsers as an undergraduate at Rice, where students built their own browsers in COMP 314. “You discover how surprisingly complex the browser is just for rendering a simple web page,” he said.
But it was a project he worked on with UW systems professors that led him to reconsider how browsers should be built. They were researching Ajax websites around the time that Google Maps was becoming popular. Web pages were becoming more interactive, behaving more like applications than documents.
“We were asking, ‘How would browsers fail as web pages got more complex?’ Web pages were requiring more resources, tabs were competing with each other, and encountering a problem in one tab might make the whole browser lock up or crash,” said Reis.
“That research led to a set of projects that were systems and security related. We designed a multi-process browser, proposed defenses for cross-site scripting, and studied how web pages were being modified in-flight. These took shape in my thesis as ways to look at web browsers as operating systems, offering better ways to define what a program is on the web.“
His internship with Google began about nine months before Chrome was officially launched. At the time, Chrome was a multi-process browser only in terms of keeping tabs separate from each other. Reis added the ability for a given tab to navigate cross-process as it goes to a new website.
Reis said, “I was trying to establish more separation between the sites you visit, while dealing with subtlety about how pages work –like when multiple tabs sometimes need to share a process to script each other, while other times they can never safely share a process because of security issues.”
That internship and his research laid the groundwork for much of Reis’s career work in navigation, security, and process models. After graduating, Reis returned to Google full-time to work on Chrome. His thesis work on separating websites eventually grew into a multi-year Chrome Site Isolation project.
“One of the hardest challenges we faced centered around web pages that contained cross-site subframes. To have Chrome’s sandbox keep them secure, you need to put the subframes in a different process. We’ve had to refactor an enormous amount of Chrome’s code to support this. Features in the browser can’t assume all of a page’s frames are in the same process anymore, but as a result, there can be a much stronger security boundary between websites in the browser. For example, a bad ad in a news article would have a much harder time reaching your Google or Facebook accounts, even if the ad’s author knew of a browser security bug to exploit.”
This defense-in-depth approach has proven relevant for unforeseen security problems as well, such as the Spectre vulnerabilities affecting CPUs that were revealed in early 2018. When enabled, Chrome’s Site Isolation feature helps limit the amount of cross-site data such attacks can steal within the browser.
Reis has found plenty of challenges at Google during his career there. “I’ve been very happy with the projects I’ve worked on with Chrome for the last nine years,” said Reis. “But it’s also refreshing to me to know there are so many other opportunities at Google. I can explore them any time I’m ready for that.
“There are entirely different problems on the server side, which I haven’t seen while working on a client side product. I’ve enjoyed seeing Chrome grow from an experimental project to something that has really taken off. It’s provided me space to do big research projects and to build up a team for that, and there have been many opportunities that have kept me interested in what I’m doing. Someday I may switch to something else, but in the meantime, I still have a lot of interesting problems to solve.”
Charlie Reis completed his B.A. in Computer Science in 2002 and his M.S. in 2003.