Edit:

From my other comments, there is the additional implicit opt-in shown by WSS itself on localhost requiring (1) a public DNS record and (2) a valid SSL certificate for that FQDN.

I doubt that there are WSS servers on localhost out there setup with a public DNS record and validating SSL certificate which are not also expecting public traffic.

But on the other hand, blocking secure websocket servers on 127.0.0.1 using a public DNS record and valid SSL certificate, is going too far.

Secure websocket servers on localhost are often implemented precisely for the purpose of being accessed by the public web, and are secured for that purpose. It's very rare to find wss servers on localhost using a public dns record resolving to 127.0.0.1 and a valid ssl certificate (most people seem to think a wss server on localhost is not possible).

So this is bad for users. For example, it will break Dropbox's feature which allows you to open files from within the web app in a native application such as Excel (if you have the file synced on your computer).

If Chrome continue with this, then apps such as Dropbox will have to implement these kinds of features using server proxies. These will be slower and less secure since they will need to be able to guarantee that a TCP connection from a web browser and a TCP connection from a local daemon are from the same machine (this is not easy to do when NAT is involved).

Couldn't that just do that with a custom URL scheme like dropbox:// that's handled by the local app? Or is there more to the feature?

Well, you could just not use Chrome.

I'm noticing a large uptick in "good engineering but terrible design and implementation choices in the name of security", and I wonder what's driving that.

I don't think that was ever the message. Chrome has always been "the fastest browser" rather than anything else, and it has lead to (much-needed IMO) substantial performance improvements from the other camps.

Ahem: "There are a lot of limitations to the kinds of applications that you can build today with web browsers. And the subset of things you can do is different for each browser. If one browser has a cool feature, that doesn't help -- it has to exist across all browsers in order for developers to use it." (Emphasis original)

But yeah, Google says they're not evil, so that makes anything they do non-evil...riiiiight. I have a feeling we're not in Kansas anymore.

- it's safe

- it's fast

- it's stable

- doesn't break the web

All of that in contrast with IE of that time, which failed all four of the above. Currently it's trying to stay somewhat safe, and ditched the other three in the process.

https://www.google.com/googlebooks/chrome/

Many users do not have a choice which browser they use, do not know they even have a choice or do not know how to exercise that choice i.e. download and install a competing browser. Finally you're then left with the massive problem of sites only working on certain browsers.