11–20 of 89 posts
Involving Google as a gatekeeper, of course.
Google is trying to establish the level of control on the Web it has on Android.
- I can install once and check signature.
- I can store them in a backup for later forensics if they do something bad.
- I can firewall the process only to required services.
- I can disable outside network access for local process.
- I can analyze what it does before and after the fact.
- They can be scanned by a malware scanner / virus scanner.
Web apps:
- need network access to load (and probably at runtime?),I cant firewall off...
- can be refreshed by app provider - targetted to a specific user.
- Traffic is bundled together with chromium?
- I have no clue after the fact what happened. I cant sniff https traffic that app used to load its code...
Bad App owners should be considered as well... or well intentioned but hacked ones...
Until widespread code-signing exists on the web this seems incredibly reckless to expose. Even if you require https and put it behind a modal, history has shown that both of those measures are not impenetrable barriers to attackers and raw sockets open up a whole new set of attacks. HTTPS is basically useless for authenticating dangerous code: There are thousands of https domains out there that you can easily put you…
> Until widespread code-signing exists on the web this seems incredibly reckless to expose. [...] HTTPS is basically useless for authenticating dangerous code: There are thousands of https domains out there that you can easily put your own code onto, and many of them have EV/DV certificates with reputable names like GitHub attached to them so there won't be any obvious red flags other than the text of the domain name…
So, it's harder for an attacker to get their code signed using your certificate. Hacking into the website would be useless; they'd have to get the code into the development environment.
Or to put it another way, an HTTPS server automatically signs any file that it serves. That's too easy.
"Note that this capability is already available to Chrome Apps and Extensions and in no scenario will we be handing it out like candy to any website that asks nicely; [the API] will come with a higher barrier to use." Involving Google as a gatekeeper, of course. Google is trying to establish the level of control on the Web it has on Android.
Why do you think PWA's are being pushed so hard by google? So people can build PWA's that also run on Chromebooks. No need for native apps
Earlier quoted context omitted.
Why does discord even let users access dev tools? This is trivially easy to disable in prod builds. Seems odd. Is there a valid use case?
> Why does discord even let users access dev tools? This is trivially easy to disable in prod builds. Even if you disable the usual way to pop the dev tools open in desktop electron mode, this is a dangerous attitude. A malicious client can always edit the DOM, send arbitrary data to your server, read whatever you send back, etc. "Disabling the dev tools" is never the correct solution to any security problem.
Earlier quoted context omitted.
Why does discord even let users access dev tools? This is trivially easy to disable in prod builds. Seems odd. Is there a valid use case?
I assume the parent is referring to the web version, where a big warning is output on the console of the browser’s built-in dev tools. I don’t know of any way for a website to disable the browser’s dev tools.
"Note that this capability is already available to Chrome Apps and Extensions and in no scenario will we be handing it out like candy to any website that asks nicely; [the API] will come with a higher barrier to use." Involving Google as a gatekeeper, of course. Google is trying to establish the level of control on the Web it has on Android.
Google just wants browsers to become more powerful cuz then more people will use Chromebooks. since everything can be done on a browser. Why do you think PWA's are being pushed so hard by google? So people can build PWA's that also run on Chromebooks. No need for native apps
"Note that this capability is already available to Chrome Apps and Extensions and in no scenario will we be handing it out like candy to any website that asks nicely; [the API] will come with a higher barrier to use." Involving Google as a gatekeeper, of course. Google is trying to establish the level of control on the Web it has on Android.
Google just wants browsers to become more powerful cuz then more people will use Chromebooks. since everything can be done on a browser. Why do you think PWA's are being pushed so hard by google? So people can build PWA's that also run on Chromebooks. No need for native apps
This has little to do with Chromebooks. Google just want to be the single purveyor of the web, period. They already have the most popular browser. Firefox and Safari fought them on quite a few fronts [1]. Then Edge became Chrome. Now Mozilla basically laid off everyone. Safari only exists on MacOS and iPhones (a large market, yes, but small in the grand scheme of things).
Chrome will only accelerate its blatant disregard of anyone and push more and more internally developed barely tested crap.
[1] https://mozilla.github.io/standards-positions/ scroll down to harmful. Of course, many of those considered harmful are already implemented in Chrome. WebUSB, enabled by default in Chrome 61. Signed HTTP Exchanges, enabled by default in Chrome 73. Media Feeds, enabled by default in Chrome 85. And so on