Browsers in ring 0? Why not, it's 2020, anything could happen. Ditch WASM, more languages support ASM anyhow.
Chromium devs want the browser to talk to devices, computers directly
51–60 of 89 posts
Re: Chromium devs want the browser to talk to devices, computers directly
#52Could we please just fix native software development, so it doesn't suck, rather than adding the kitchen sink to web browsers? Web pages and JavaScript are the only universally trusted medium for sharing information and simple software. Making it possible for news websites to touch ethernet/usb/serial/gpu compromises that. Same goes for optimizations ilke JIT'ing and WebAssembly which have certainly done a great job…
I think WASM will eventually produce the solution (hear me out before you tune out). I've been thinking about this for a while. So we have WASI[0], which doesn't yet address the UI issue, but there's half a dozen at least projects attempting to create runtimes for WASM. If most languages wind up compiling for WASM / WASI I think eventually a good effort could be done towards a WASI-UI or WASUI. Imagine if major OS pl…
Imagine if major OS platforms had a common UI framework that any language can produce a UI
This has been attempted a number of times, both in the browser and without, and it always comes down to people complaining that the widget set isn't "native" in look and feel and operation, and the pendulum swings back the other way.
People used to complain that browser widgets didn't confirm to the OS's UI guidelines. Then you could style them with CSS and things really started looking crappy, then you have web UI frameworks that forgo all that customization (or at least discourages it in the name of ease of development).
Re: Chromium devs want the browser to talk to devices, computers directly
#53Earlier quoted context omitted.
> Why does discord even let users access dev tools? This is trivially easy to disable in prod builds. Even if you disable the usual way to pop the dev tools open in desktop electron mode, this is a dangerous attitude. A malicious client can always edit the DOM, send arbitrary data to your server, read whatever you send back, etc. "Disabling the dev tools" is never the correct solution to any security problem.
I didn’t say that they should do this for security of the execution environment of the code, I’m not sure how you got to that interpretation. The GP said that there is output to tell users not to compromise themselves by blindly pasting unsafe code, which is easily prevented by disabling dev tools altogether, and there is no reason for an end user to have access to dev tools in an electron app. The other replies are…
> there is output to tell users not to compromise themselves by blindly pasting unsafe code
For reference: https://user-images.githubusercontent.com/47160230/51995729-...
This is also present in the Electron version of Discord.
> there is no reason for an end user to have access to dev tools in an electron app.
Certainly there is - there are various user-made applications that take advantage of Discord being built on Electron to allow you to write your own custom styles and scripts.
Re: Chromium devs want the browser to talk to devices, computers directly
#54Earlier quoted context omitted.
My understanding is Signed Exchanges only solve "I want to allow another server to handle requests for my HTTPS server" and not "I want to guarantee the integrity of content coming from my HTTPS server". Did they expand the spec to somehow address the latter?
You could obtain an HTTPS certificate and then only use it for offline signing. That would fulfill the same purpose.
But the platform would not know that this is a code signing certificate - unless something specific is designed.
Re: Chromium devs want the browser to talk to devices, computers directly
#55I don't know; I understand the cynicism here.. But can we assume an optimistic scenario where vendors are able to properly address the security implications and this enables web developers to build all kinds of new applications? I for one would love to be able to write web applications that could, say, control the lights in my house or smart devices. I hate interfacing with my phone to control these types of actions;…
> I for one would love to be able to write web applications that could, say, control the lights in my house or smart devices.
You can also do so, you just need to install some companion software locally for that to work.
Re: Chromium devs want the browser to talk to devices, computers directly
#56Security concerns here are overblown, and this is IMHO more useful than WebRTC. This is how it should have been done to begin with, as well as the ugly hack known as web sockets. There should be some restrictions. No ports under 1024 without asking the user would go a long way. Anyone saying “the web isn’t an application platform” needs to just accept reality. That ship sailed almost 20 years ago.
> That ship sailed almost 20 years ago.
Which would still be some time after the 1024 port distinction stopped being relevant for security.
Re: Chromium devs want the browser to talk to devices, computers directly
#57No.
Re: Chromium devs want the browser to talk to devices, computers directly
#58Could we please just fix native software development, so it doesn't suck, rather than adding the kitchen sink to web browsers? Web pages and JavaScript are the only universally trusted medium for sharing information and simple software. Making it possible for news websites to touch ethernet/usb/serial/gpu compromises that. Same goes for optimizations ilke JIT'ing and WebAssembly which have certainly done a great job…
I think WASM will eventually produce the solution (hear me out before you tune out). I've been thinking about this for a while. So we have WASI[0], which doesn't yet address the UI issue, but there's half a dozen at least projects attempting to create runtimes for WASM. If most languages wind up compiling for WASM / WASI I think eventually a good effort could be done towards a WASI-UI or WASUI. Imagine if major OS pl…
WebAssembly is basically the latest in the line of Java Applets and Macromedia Flash. Maybe it'd be useful if someone built a tiny wasm emulator for x86 linux stdio binaries and posted it on a google cdn. I haven't seen anyone do that yet.
I'm pretty happy with web pages as a GUI framework. If I needed a desktop GUI, I certainly would not want my binaries to be 200megs with Electron. If we're OK trading away drop-down boxes, wizards, and installers, then it's actually possible to build 10kb static native win32+linux+bsd+mac terminal programs using ape. https://justine.storage.googleapis.com/ape.html
Re: Chromium devs want the browser to talk to devices, computers directly
#59Would webkit ever come along with this?
Re: Chromium devs want the browser to talk to devices, computers directly
#60"Note that this capability is already available to Chrome Apps and Extensions and in no scenario will we be handing it out like candy to any website that asks nicely; [the API] will come with a higher barrier to use." Involving Google as a gatekeeper, of course. Google is trying to establish the level of control on the Web it has on Android.
I'm thinking more like WebUSB, where there's a prompt before access to devices is given.
But what is that prompt? an ip and a port?, a local (m)DNS name? is it stored? what happens if the network changes? Do most people even know the names/ip of things on their network?