Hacker News Reader

Yeah this is a non issue. It’s like any dev environment letting you overrule things by supplying an environment variable or similar.

Remember that if you have access to run a shell command, you have access to rm -rf /*.

Yes true, the chrome flags are the least of your problems then!

> Simply starting chrome with a `--remote-debug`

I wouldn't call that "simple". Sounds like fine behavior given non-devs generally don't even know how to run Chrome with custom flags and developers know that remote debugging generally means remote execution with data/memory access. Would you prefer a better flag name or lock remote debugging to a subset of tabs?

That's true, I suppose as long as there's indication that the mode is enabled, a warning or something (haven't tested it myself yet).

If the desktop launcher was modified to include that flag, then you would never know while browsing right? Maybe I'm just paranoid...

I'm not a security expert, but if you are at that point that I suspect you have bigger problems than start up flags being modified