4 ms·

Maybe I'm an Apple fan boy, but the list of features WebKit mark as "Not considering" [0] are indeed features I can see become awful security / usability proble

Maybe I'm an Apple fan boy, but the list of features WebKit mark as "Not considering" [0] are indeed features I can see become awful security / usability problems. Like WebUSB, that just can't end well... [0]: https://webkit.org/status/#?status=not%20considering https://webkit.org/status/#?status=not%20considering

archi42 7y ago
Maybe Apple just doesn't need this for anything (yet)?
- josteink 7y ago
  Nobody needs this. Nobody should need to enumerate low-level things like devices from a fucking web-browser. Make a real native app all the other decent people if you need this. Let the user assess the risk that way, and see how the market votes.
  - IshKebab 7y ago
    Rubbish. There are plenty of really cool use cases for this. For example combined with the physical web you can literally walk up to something, get a notification on your phone that it exists (yes there are spam concerns), tap the notification, and control it directly through your web browser. The device doesn't need internet connectivity and you didn't need to install an app. That's great for one-off things that you only interact with once.
    - jborichevskiy 7y ago
      I wonder if it can improve the setup flow for devices like wireless speakers where there's a whole guided process for powering it on, pairing it, connecting to its wifi network, changing settings, etc.
  - nexuist 7y ago
    >Make a real native app all the other decent people if you need this. Who is going to pay for this? How many ideas will die because nobody can afford to pay for 3+ native developers across Windows/Mac/Linux? How many teams will decide to axe Linux support because it's not worth it? Why develop natively when you can just hire one JS developer to write once, deploy anywhere? Native apps failed to democratize the market. We are stuck with platform-specific applications that will remain intertwined with their vendor of choice presumably forever. PWA or bust.
  - hombre_fatal 7y ago
    > Make a real native app all the other decent people if you need this. Eh, I'd much rather just visit a website where I have actual control (ublock, noscript, developer console) than download and install yet another native app black box.
  - archi42 7y ago
    Well, I'd suppose if this becomes a web standard, it will come with an eventually stable API. And I wholeheartedly vote for "write a (lovely) webpage that still functions in a decade" over "write an app that might be (breaking) with the next generation of mobile phones (API changes, new OS,...)". Especially if I build any of that myself, and instead have some closed, physical thing I bought which depends on an external controller. (parent can replace the "" with whatever he likes, but since I find swearing doesn't quite fit HN, I've put some more appropriate terms next to them)
simion314 7y ago
If an app really needs the feature it will have to distribute a native binary (like you have/had with some web video/screenshare) so do you prefer to have some applications that each one has to offer a Windows and Mac binary (no Linux or mobile) ? IMO this API should be off by default. Then you would get a native popup when an application is trying to access them for an user to approve it, like this was something Falsh did many years back when you attempted to access the webcam or microphone. Speaking of Flash there were pages that had to use an invisible Flash player(or Java apple) to work around missing features of browsers. So personally I would like if it would be possible to have a browser based, cross platform wideo chat, screen sharing or other cool application as long is using free standards(I mean real ones not Chrome/Google wants it so is a standard now ) . Sorry for the long response.
- josteink 7y ago
  > If an app really needs the feature it will have to distribute a native binary (like you have/had with some web video/screenshare) so do you prefer to have some applications that each one has to offer a Windows and Mac binary (no Linux or mobile) ? Yes. 100%. And I say that as a Linux-user. If someone needs access to low level system and platform specific stuff, I would like to have that confined and isolated in an app 100% separate from my browser, which is already having a hard time staying secure. That will also make such apps harder to make, so people will not make the decision to require such APIs lightly, or “just” to profile a user. This is the same position I have on WebDRM, and the way WebDRM has gone only solidifies my stance.
  - z3t4 7y ago
    The growing complexity of browsers make security harder. But at the same time - mainstream platforms are also getting more limited in the name of security. It's almost impossible for a power user to fix something themselves. They have to install an app, or root their device. The alternative is not really downloading a random binary, you can no longer do that. The only alternative to get shit done is to go buy a Linux compatible PC and learn some programming. 20 years ago the security was terrible, but you could fix things yourself without being a developer. No matter how much systems are limited, security issues persist. If you are worried that your browser is insecure, switch to a more secure browser that doesn't have those features, or disable the features in the browser you already use. As a developer I could write detailed instructions on my website how to install Linux, what OS and packages to use, instructions for git clone etc. Or I could just have a button that the user can click on.

archi42 7y ago

Maybe Apple just doesn't need this for anything (yet)?

josteink 7y ago
Nobody needs this. Nobody should need to enumerate low-level things like devices from a fucking web-browser. Make a real native app all the other decent people if you need this. Let the user assess the risk that way, and see how the market votes.
- IshKebab 7y ago
  Rubbish. There are plenty of really cool use cases for this. For example combined with the physical web you can literally walk up to something, get a notification on your phone that it exists (yes there are spam concerns), tap the notification, and control it directly through your web browser. The device doesn't need internet connectivity and you didn't need to install an app. That's great for one-off things that you only interact with once.
  - jborichevskiy 7y ago
    I wonder if it can improve the setup flow for devices like wireless speakers where there's a whole guided process for powering it on, pairing it, connecting to its wifi network, changing settings, etc.
- nexuist 7y ago
  >Make a real native app all the other decent people if you need this. Who is going to pay for this? How many ideas will die because nobody can afford to pay for 3+ native developers across Windows/Mac/Linux? How many teams will decide to axe Linux support because it's not worth it? Why develop natively when you can just hire one JS developer to write once, deploy anywhere? Native apps failed to democratize the market. We are stuck with platform-specific applications that will remain intertwined with their vendor of choice presumably forever. PWA or bust.
- hombre_fatal 7y ago
  > Make a real native app all the other decent people if you need this. Eh, I'd much rather just visit a website where I have actual control (ublock, noscript, developer console) than download and install yet another native app black box.
- archi42 7y ago
  Well, I'd suppose if this becomes a web standard, it will come with an eventually stable API. And I wholeheartedly vote for "write a (lovely) webpage that still functions in a decade" over "write an app that might be (breaking) with the next generation of mobile phones (API changes, new OS,...)". Especially if I build any of that myself, and instead have some closed, physical thing I bought which depends on an external controller. (parent can replace the "" with whatever he likes, but since I find swearing doesn't quite fit HN, I've put some more appropriate terms next to them)

simion314 7y ago

If an app really needs the feature it will have to distribute a native binary (like you have/had with some web video/screenshare) so do you prefer to have some applications that each one has to offer a Windows and Mac binary (no Linux or mobile) ? IMO this API should be off by default. Then you would get a native popup when an application is trying to access them for an user to approve it, like this was something Falsh did many years back when you attempted to access the webcam or microphone. Speaking of Flash there were pages that had to use an invisible Flash player(or Java apple) to work around missing features of browsers. So personally I would like if it would be possible to have a browser based, cross platform wideo chat, screen sharing or other cool application as long is using free standards(I mean real ones not Chrome/Google wants it so is a standard now ) . Sorry for the long response.

josteink 7y ago
> If an app really needs the feature it will have to distribute a native binary (like you have/had with some web video/screenshare) so do you prefer to have some applications that each one has to offer a Windows and Mac binary (no Linux or mobile) ? Yes. 100%. And I say that as a Linux-user. If someone needs access to low level system and platform specific stuff, I would like to have that confined and isolated in an app 100% separate from my browser, which is already having a hard time staying secure. That will also make such apps harder to make, so people will not make the decision to require such APIs lightly, or “just” to profile a user. This is the same position I have on WebDRM, and the way WebDRM has gone only solidifies my stance.
- z3t4 7y ago
  The growing complexity of browsers make security harder. But at the same time - mainstream platforms are also getting more limited in the name of security. It's almost impossible for a power user to fix something themselves. They have to install an app, or root their device. The alternative is not really downloading a random binary, you can no longer do that. The only alternative to get shit done is to go buy a Linux compatible PC and learn some programming. 20 years ago the security was terrible, but you could fix things yourself without being a developer. No matter how much systems are limited, security issues persist. If you are worried that your browser is insecure, switch to a more secure browser that doesn't have those features, or disable the features in the browser you already use. As a developer I could write detailed instructions on my website how to install Linux, what OS and packages to use, instructions for git clone etc. Or I could just have a button that the user can click on.