Hacker News Reader

Comment by ryandrake | Hacker News Reader

It's insane that browsers just hand over API access to my microphone and/or camera to rando web developers. Yes, I know things like Zoom exist. IMO software like that simply shouldn't be possible on browsers, period.

Making the browser into a general purpose system SDK was a mistake--maybe the biggest mistake in personal computing's history.

View on HN

I do not have the Zoom app in any form installed. I'd much rather use it in the browser. When I close the tab, Zoom is gone. After the COVID era bullshit of Zoom installing a utility that gives root access to anything, I've never installed it. Luckily, all of that came out before I started using Zoom.

There's a solution to both:

1. Not make web browser general-purpose runtimes for arbitrary software.

2. OS builds a general-purposes runtime that's completely sandboxed. So users can run more complex software without needing to worry about cruft being installed on their system.

Unfortunately, browser builders have decided that web browsers are #2.

What is the practical difference if the OS provides your general-purpose sandboxed runtime instead of the browser? The browser is already a product being developed by the same organization as the OS for a significant chunk of people.

iOS -> Safari

Android -> Chrome

Windows -> Edge (based on Chromium, so fixes in Edge make their way into Chrome too)

The sandboxed application would be something you explicitly chose to run. When the browser is the platform, every web page you visit has access to the general-purpose runtime. (Of course permission checks e.g. for microphones exist.)

Why do you still need an explicit install step if everything is correctly sandboxed? If your only answer is you don't trust the sandbox then you shouldn't trust the one provided by the OS, either. Your browser's sandbox is tested way more than anything else.

They don't "just hand over access". If anything, browsers pioneered permissions for mic and camera on desktops, having them several years earlier before windows even got around to having these things restricted under permissions.

This issue is about audio output. Audio and video input are both behind per-site permissions.

Also, people can and should go to the firefox settings > Permissions and data > Autoplay and change the Default for all websites to "Block Audio" (at least).

You can set per-hostname exceptions if you like! CTRL + I > Permissions

> You can set per-hostname exceptions if you like! CTRL + I > Permissions

1. Thank you, that's very nice to know about.

2. I really wish this was exposed more directly, probably from the permissions button that is already in the address bar. I can't believe Chrome does this better.

You can access page info through address bar shield > connection secure > more site information too. It used to be easier to access from there, but they redesigned that at some point I think.

Unfortunately that still gives another data point for fingerprinting.

Reply on news.ycombinator.com