5 ms·

Because it makes no difference if the hole is small or large. To an attacker its the same size.

• dmitriid 5y ago
  It does make the difference. You don't deliberately increase the surface of attack if you can help it.
  • admax88q 5y ago
    I feel like your speaking in atitides, but not looking at this situation specifically. If I can unlock your computer with your password or with the word "hello" and you have no intention of removing the "hello" feature, would you not agree that we might as well remove the password entirely? How do we increase the attack surface of service workers by adding background sync, when we can get nearly identical behaviour using push? If you goal is purely to not increase the attack surface, you might as well never add any new APIs ever.
    • admax88q 5y ago
      s/atitides/platitudes
    • dmitriid 5y ago
      If you're going down the analogies rabbit hole: let's say your front door is unlocked. Should you then just open all your windows because, you know, everyone already has access to your house? > when we can get nearly identical behaviour using push? The devil is in the details: is it nearly identical behaviour? How nearly is it identical? I personally don't know.
      • admax88q 5y ago
        One wakes up the background page on a timer, the other wakes it up based upon a external controllable trigger. It's trivial to fire that external trigger based upon a timer.