This looks really neat and I can immediately think of several use cases for it. I'm pretty cynical and jaded, though, so I went looking for and finally found t

This looks really neat and I can immediately think of several use cases for it. I'm pretty cynical and jaded, though, so I went looking for and finally found the "Security and privacy considerations" section of the FlyWeb (draft) Specification [0]. I'm quite disappointed by what I see there -- or, rather, what I don't see. If Mozilla is to pursue this seriously then, in my opinion, they need to follow a process similar to Internet Drafts [1]. Development of the spec should be opened up to the public, other stakeholders (browser vendors and, of course, users) should be involved, and so on. There was a time when we could remain somewhat confident that a device behind the firewall would not be accessible from the "Internet at large". That was before UPNP [2] and rebinding attacks [3]. As I said, I can quickly think of several use cases that would be perfect for something like this... but history has clearly proven that the privacy and security implications MUST be considered at every step of the way. This beast should be tamed before it has a chance to get away. Myself, I'm going to go ahead and add a new lockPref entry for "dom.flyweb.enabled" to my mozilla.cfg in anticipation of the day that this comes to my browser. (Of course, with Mozilla's track record, they'll probably push FlyWeb heavily for the next year or so, then just abruptly announce one day that they're killing it off.) [0]: https://flyweb.github.io/spec/ https://flyweb.github.io/spec/ [1]: https://en.wikipedia.org/wiki/Internet_Draft https://en.wikipedia.org/wiki/Internet_Draft [2]: https://en.wikipedia.org/wiki/Universal_Plug_and_Play https://en.wikipedia.org/wiki/Universal_Plug_and_Play [3]: https://en.wikipedia.org/wiki/DNS_rebinding https://en.wikipedia.org/wiki/DNS_rebinding