Hacker News Reader

Comment by Waterluvian | Hacker News Reader

Is the browser sandbox going to keep growing until it's pretty much a somewhat pared down desktop virtual machine?

Not implying this is good or bad.

One particular browser vendor has a particularly strong incentive to push more and more computing "access" through their own controlled channels, core of which is making "everything" accessible through a browser (for some values of accessible and for some values of browser)

WebRTC started at Google, and oh wait it can expose local network information without so much as a prompt or notice?

WebUSB started at Google and the security section of the spec basically says "some truly evil shit could happen via this API. Because of that, the spec leaves any notification or prompting about access to devices up to implementors. "may display a permission prompt" is not something you want to see on anything providing a website access to your local devices.

and now we have WebBluetooth.. oh look. 4 Google staff contributors with 97% of the commits to the spec doc repo. Oh look and the security section also basically says "this shit could seriously fuck up your monday my man".

Never make the mistake of thinking that Google gives two shits about the security of the people using it's $0 services/products. This is a company that force included Flash Player as the rest of the world was finally ready to give up that piece of shit, and still ships it today.

They should care about security. Exploited machines do disrupt their business (e.g. spam, hacked websites, hijacked extensions).

Unless the spam/hack/hijack just happens to block Google tracking cookies and prevent access to Google web properties, no it doesn't disrupt their business at all.

Google's business is selling web ads.

This talk revolves around exactly this question: https://www.destroyallsoftware.com/talks/the-birth-and-death...