I agree with the change in theory (although as a side-note I wish users had more control over cookie/request headers, and it wasn't just site-operators that cou

I agree with the change in theory (although as a side-note I wish users had more control over cookie/request headers, and it wasn't just site-operators that could set policies). It's a reasonably obvious oversight that cookies aren't same-site by default, and the thoughts behind this seem pretty solid. There's even a good point that I've seen made that secure-by-default might give browsers/blockers a useful metric for identifying likely tracking cookies. I have no objections on that front. I wish the Chromium team was working more with other browsers to make this a more coordinated change. At the same time, I don't think that there would be significantly less breakage if it was. No matter what, this is 100% going to break websites -- there is just no way to roll out a change like this without disrupting operations. It's gonna be a mess, and it would still be a mess even if all the browsers rolled out this change together. It feels kind of like the JS ``typeof null === "object"`` stuff. Everyone agrees the existing behavior is wrong, but we're not sure when and how to fix it. So I'm a little conflicted. I understand completely why the Chromium team wants this, and I also understand why some people are going to be upset about it. Blocking CSRF by default in a browser is really good. We'd also really like to avoid breaking the existing web. It's complicated.