The latter point? Yeah, there's a few things I can point to: - PNaCl, which was essentially Chrome's ActiveX. Thankfully going away in the near future, after n

The latter point? Yeah, there's a few things I can point to: - PNaCl, which was essentially Chrome's ActiveX. Thankfully going away in the near future, after nobody else implemented it. See https://www.cnet.com/news/mozilla-coder-chrome-violates-googles-own-blink-principles/ https://www.cnet.com/news/mozilla-coder-chrome-violates-goog... - The severe limits applied to the webRequest extension API, breaking extensions such as uBlock Origin, without cross-browser consensus: https://blog.mozilla.org/addons/2019/09/03/mozillas-manifest-v3-faq/ https://blog.mozilla.org/addons/2019/09/03/mozillas-manifest... - General implementation of new technologies in the browser, without a proper spec/consensus. See <portal>, which has introduced tangible security vulnerabilities into the browser: https://research.securitum.com/security-analysis-of-portal-element/ https://research.securitum.com/security-analysis-of-portal-e... - Signed HTTP Exchanges and AMP. The controversy around these two has already been well-documented. - Poorly thought out plans to roll-out default SameSite behaviour whilst a glaring bug was present in Safari which would be exacerbated by the behaviour change (requiring SameSite=None). I'm all for preventing CSRF by default, but these sort of changes should be planned and implemented considerately. See https://news.ycombinator.com/item?id=20905396 https://news.ycombinator.com/item?id=20905396 - Poor implementation of CT reporting which sent spurious reports to sysadmins even after the policy was supposed to have expired. See https://crbug.com/786563 https://crbug.com/786563