Service Workers: an Introduction
developers.google.com
Service Workers: an Introduction
1–10 of 23 posts
Re: Service Workers: an Introduction
#2This seems like a security nightmare. I sincerely hope there's a way to just turn off "offline experience" in Chrome before service workers become widespread. The browser is a dangerous place to execute software. I suppose native apps can be just as insecure, but I worry about an ecosystem with many neighbors (web apps, extensions, plugins, add-ons, etc) running in the same process. It's much more likely one web app can steal my passwords from LastPass, for example, without knowing it. The chain of vectors just feels really dangerous.
Re: Service Workers: an Introduction
#3this seems unnecessary as you need a html file and browser to bootstrap anyway. There is more to it though, it can continue to run after the browser has exited and intercept push mesages.
Re: Service Workers: an Introduction
#4Oops. I thought this might be an attempt at rapprochement with their janitorial staffs. Perhaps the wrong nomenclature for our new era.
Re: Service Workers: an Introduction
#5This seems like a security nightmare. I sincerely hope there's a way to just turn off "offline experience" in Chrome before service workers become widespread. The browser is a dangerous place to execute software. I suppose native apps can be just as insecure, but I worry about an ecosystem with many neighbors (web apps, extensions, plugins, add-ons, etc) running in the same process. It's much more likely one web app…
I think the line:
> It's a JavaScript Worker, so it can't access the DOM directly. Instead, a service worker can communicate with the pages it controls by responding to messages sent via the postMessage interface, and those pages can manipulate the DOM if needed.
gives me some hope that it's intended to be isolated from all other tabs (including the one that started it!).
There will be bugs, of course, but it looks to me like they're starting from a secure position, which gives me hope.
Re: Service Workers: an Introduction
#6I haven't read the specs, can you spawn multiple service workers on a single page ?
If yes, what are the security measures to stop a rogue site to blow up your browser ?
Re: Service Workers: an Introduction
#7I haven't read the specs, can you spawn multiple service workers on a single page ? If yes, what are the security measures to stop a rogue site to blow up your browser ?
Only one service worker per scope, the newest kicks out any older ones.
Re: Service Workers: an Introduction
#8Regarding HTTPs: there is https://test.bi
Re: Service Workers: an Introduction
#9Note that this is the low-level API. For most people, I think, the recommended approach is to use libraries instead. Google itself has released sw-toolbox and sw-precache. There’s also a web-push server module for push messages.
Re: Service Workers: an Introduction
#10This seems like a security nightmare. I sincerely hope there's a way to just turn off "offline experience" in Chrome before service workers become widespread. The browser is a dangerous place to execute software. I suppose native apps can be just as insecure, but I worry about an ecosystem with many neighbors (web apps, extensions, plugins, add-ons, etc) running in the same process. It's much more likely one web app…
Sandboxing means that plugins are not running in the same process at all.