Re:Firefox Keeps Getting Faster
by soraminazuki on Monday December 11, 2023 @12:09AM
(#38597840)
Take WebMIDI, for example. A website using it would show the following permission prompt in Chrome:
example.com wants to
Control and reprogram your MIDI devices (SysEx)
[Block] [Allow]
According to you, everyone should understand that term to mean example.com can access their device to overwrite the firmware of a MIDI device, turn it into a keyboard, and take full control of the computer. It's feature working as intended and no security issues are involved.
I am so glad both Apple and Mozilla doesn't subscribe to you or Google's definition of "security." These gaping security holes can cause so much damage, and to see these as "features working as intended" shows how disconnected you are with actual users. A browser should never ever include capabilities for full system compromise as one of its features. No permission prompt should ever let that happen.
You also need to consider the inherent danger of exposing hardware to websites when considering whether permission prompts are adequate. Again, hardware aren't designed with the expectation that they'll be exposed to websites. Browser vendors can't possibly be aware of the security implications of doing so for every device out there either. That was one of the core arguments of my previous reply and I wish you hadn't omitted that. Unfortunately, my point about the permission prompt was taken out of context and spun into a "pathological" view that "everybody in the world besides myself" would laugh at.
Lastly, you might want to actually look at the examples I posted. Some of them don't involve permission prompts and enables attack by third parties. Which I believe to be a security issue even under your terms.
I am so glad both Apple and Mozilla doesn't subscribe to you or Google's definition of "security." These gaping security holes can cause so much damage, and to see these as "features working as intended" shows how disconnected you are with actual users. A browser should never ever include capabilities for full system compromise as one of its features. No permission prompt should ever let that happen.
You also need to consider the inherent danger of exposing hardware to websites when considering whether permission prompts are adequate. Again, hardware aren't designed with the expectation that they'll be exposed to websites. Browser vendors can't possibly be aware of the security implications of doing so for every device out there either. That was one of the core arguments of my previous reply and I wish you hadn't omitted that. Unfortunately, my point about the permission prompt was taken out of context and spun into a "pathological" view that "everybody in the world besides myself" would laugh at.
Lastly, you might want to actually look at the examples I posted. Some of them don't involve permission prompts and enables attack by third parties. Which I believe to be a security issue even under your terms.