Chromium devs want the browser to talk to devices, computers directly

This has been attempted a number of times, both in the browser and without, and it always comes down to people complaining that the widget set isn't "native" in look and feel and operation, and the pendulum swings back the other way.

People used to complain that browser widgets didn't confirm to the OS's UI guidelines. Then you could style them with CSS and things really started looking crappy, then you have web UI frameworks that forgo all that customization (or at least discourages it in the name of ease of development).

I'm pretty happy with web pages as a GUI framework. If I needed a desktop GUI, I certainly would not want my binaries to be 200megs with Electron. If we're OK trading away drop-down boxes, wizards, and installers, then it's actually possible to build 10kb static native win32+linux+bsd+mac terminal programs using ape. https://justine.storage.googleapis.com/ape.html

The OS will become a set of poorly debugged device drivers?

Frankly, it is hard to imagine a more hellish future for personal computing than that.

This has little to do with Chromebooks. Google just want to be the single purveyor of the web, period. They already have the most popular browser. Firefox and Safari fought them on quite a few fronts [1]. Then Edge became Chrome. Now Mozilla basically laid off everyone. Safari only exists on MacOS and iPhones (a large market, yes, but small in the grand scheme of things).

Chrome will only accelerate its blatant disregard of anyone and push more and more internally developed barely tested crap.

[1] https://mozilla.github.io/standards-positions/ scroll down to harmful. Of course, many of those considered harmful are already implemented in Chrome. WebUSB, enabled by default in Chrome 61. Signed HTTP Exchanges, enabled by default in Chrome 73. Media Feeds, enabled by default in Chrome 85. And so on

They care about people using Google - Chrome, Gmail, Android, etc, but Chromebooks are not some sort of "endgame".

seems like reinventing the wheel.

> "It has always been my goal to have OpenPGP support included in the core Thunderbird product."

Even if you disable the usual way to pop the dev tools open in desktop electron mode, this is a dangerous attitude. A malicious client can always edit the DOM, send arbitrary data to your server, read whatever you send back, etc. "Disabling the dev tools" is never the correct solution to any security problem.

So, it's harder for an attacker to get their code signed using your certificate. Hacking into the website would be useless; they'd have to get the code into the development environment.

Or to put it another way, an HTTPS server automatically signs any file that it serves. That's too easy.

If features require combination of https + code signing, you now need to not only get a file on the server, but you need to sign it. For high privilege APIs you would likely also want to do certificate approval like Windows does, where it shows you the certificate and asks whether you want to approve and whether you want to trust the signer. In many cases websites are loading code off a CDN, so the domain name of the website isn't actually important: the identity of the code's author is important and its integrity is important.

You could also configure your server to pin a given code signing certificate or set of certificates, and thus even if someone manages to get code onto your server that they signed, it wouldn't run.

Modern web platform APIs do have a way to specify expected hashes when loading external resources, so you can protect yourself against a third party (like a CDN) being compromised - but this does nothing if your server gets compromised, because they can just change the hash.

To your point about privacy, yeah I also agree. I think the real evil here is how implicit the exploitation of trust is with using Chrome and Google services. Ideally the privacy disclaimers should be more pronounced and end users should know what exactly they're giving up by using these products.

I come from the Chinese mindset where privacy doesn't have the capital P like it does in the US. Most Chinese are fine with the government and private industry infiltrating their lives if the net effect is that their lives are improved. I think a lot of them have not fully weighed the cost-benefit analysis properly, and who knows if there ever will be a tipping point event where people decide technology has too deep a hand in their inner-lives.

I think most people in the US have yet to encounter the potentially dire consequences of the slow erosion of their privacy. Who knows, maybe the net effect for most consumers will always be positive. I'm still using Chrome, Gmail, and am locked into Google's net, but I like to think it's something I'm cognizant of, and paying attention to from far away.