The whole act of downloading and installing?

For desktop apps, you have to do that.

For webapps, you just have to visit a page (or even not, thanks to XSS).

And while we install 2-5 or maybe 20 apps per year (at most, some don't install anything after they get their PCs), we visit 100s of pages each day, and 1000s each month.

Also, while we can realistically restrict our app downloads to legitimate sources (the App Store, the product's webpage etc), we read stuff from all over the place -- that's what links are there for.

It really looks like they are doing this right. Fully behind permissions that are already protected against clickjacking, very limited scope, requires HTTPS, and is being implemented with security as a first priority.

People are acting like access to USB is something that no PC should ever do...

Except that most people will easily dismiss the "are you sure" warnings to the point that I could see browser developers eventually defaulting that to enabled and not asking ("it's for better UX!")

The desktop is unfortunately moving in a similar direction (witness all the telemetry in Windows 10, etc.) but there at least seems to be a greater notion of user control than with what browsers are turning into.

Hell people are still complaining about full screen permissions pop-ups and no browser has gotten rid of them yet because they know the problems that could come from it.

If anything there is a push to go the other direction, making previously "enabled by default" things behind permissions.

https://news.ycombinator.com/item?id=7677898

https://news.ycombinator.com/item?id=5968237

You're right that they're (ostensibly) placing emphasis on permissions at the moment, but I don't see that staying the same if websites start adopting and using these features in any quantity.

Well, WebRTC is enabled by default. Exposes your real IP, and allows anyone to portscan your whole LAN.

And that was actually the feature I had in mind in my last paragraph. There is a pretty big push to put it behind a permissions window (at least for local network access).

If such a big mistake is made – releasing info about devices in the LAN, de-anonymizing people, and releasing location data – then what mistakes will be made with WebUSB or WebFilesystemAccess?

I seriously don’t want anything to ever have access to anything unless I grant it.

There’s a reason UNIX has no execute permissions by default for files, and a reason why I use SELinux.

This whole browser shit destroys the whole security model.

I could ask you why SELinux is necessary in the first place, but the fact is that mistakes are made and learned from, and additional software is made to fill in the gaps.

If you want that amount of control, there are plugins that grant it, and using a plugin is much like using SELinux to fill in gaps or mistakes in the platform.

Software will never be bug free, and that's not an excuse to never write anymore software.

Fun conversation: I asked someone involved with WebRTC for a real, non-video example, and they honestly suggested "maybe your browser wants to talk to your fridge and would benefit from data channel encryption". So far out of touch with reality.

Wouldn't surprise me in the least if, for instance, this ends up allowing enumeration by default or something else.