What is so special about the browser that this one place you don't want apps to function? If I couldn't do it in the browser, then I'd have 5x more work to build my app for all the platforms I support. It wouldn't stop my app being made, it would just cost more. What possible purpose is there to artificially inflate the cost of development?
Or are you under some illusion that native apps are not tracking you?
"You're the only person here, and I can clearly see your face, Jerry. And now I need to make you a new set of gloves."
Native apps can in theory do everything and more a web app does...but there is a big difference between an app platform which mostly serves to protect sec. interests and one which serves primarily ad networks and data brokers.
'it would just cost more' - fantastic, we want to discourage widespread data trawling, things costing more is an excellent way to do that.
As would a full read-write access to the system, no doubt.
This is where the disconnect is. I am not saying "I don't want apps to function". I am saying "app developers request way too much data, and could absolutely live without most of it". I don't care if your and my jobs are made harder. Boo-hoo. The world does not revolve around software developers. We don't do ethical things only when it's convenient.
"Or are you under some illusion that native apps are not tracking you?"
This sentiment clearly also applies to native applications. Clearly, system calls weren't designed with invasive data collection in mind. This is why I support what Apple is doing in its latest updates. Give an inch, and a greedy dev will take a mile.
"It wouldn't stop my app being made, it would just cost more."
If a system is not perfect, we're not allowed to adopt it? Good, let it cost 5x as much.
This whole conservation thread has been about `navigator.hardwareConcurrency`. I understand what you're saying (browser apps shouldn't have access to this field and native apps should also have the same anti-fingerprinting restrictions you want for browser apps) to mean that even native applications shouldn't be allowed to know the number of threads they can run. That would cripple lots of software.
If that's not what you're saying, then I re-iterate my question to another user from down-thread: what is your proposal? How would you suggest we make it possible to maximize software performance without leaking the user's fingerprint?
I submit that, whatever proposal you make, would either not significantly impact fingerprintability or be fundamentally useless for running software. It's not just that the systems that we have are imperfect, it is that the ideal is impossible to achieve.
Browsing habits alone identify you. Ad networks and shady app developers collude on the backend, selling their databases to each other. No browser-side security policy could prevent it. If you could force a fantasy world where all software running on your local machine was written exclusively by your own self, including a browser that could only send GET requests that you initiate from the address bar, or linked images from the same domain--100% trust in your local systems, 100% trust in no transmission of internal state--you're still completely trackable.
This is why I call it privacy fetishism. You can't create a technology solution to this problem. The very act of connecting to the network requires you put a huge degree of trust into the organizations that run the stuff you're connecting to, otherwise even benevolent actors won't be able to deliver the products and fulfill the services you actively request of them. You want privacy? You will have to stop doing business with anyone doing business with Facebook.
I'm not saying "give up on privacy and share everything in the open". I'm saying these foolhardy attempts at obscuring identity online do nothing torwards their goal, can do nothing torwards their goal, and only achieve making the browser a bad platform for software. All else being equal, I'd rather the browser be good at running software.