I hate this shit, I've only seen the sketchiest sort of spyware, like discord, do it. Browsers should forbid it, since it's a blatant end-run around the limita

I hate this shit, I've only seen the sketchiest sort of spyware, like discord, do it. Browsers should forbid it, since it's a blatant end-run around the limitations a 'web app' would normally have. Furthermore, browsers even having this ability facilitates inter-protocol exploitation. It's not only local webservers that are put at risk by this, other sorts of local servers can be attacked as well. See CVE-2016-8606 for an example of a browser being used to attack a guile repl.