3 ms·
> As the article says, you need to disallow every single permission individually because the spec has no "deny all" option Yes, and I agree that a deny-all opt
by danpalmer 3y ago
> As the article says, you need to disallow every single permission individually because the spec has no "deny all" option
Yes, and I agree that a deny-all option makes sense in general, but my point is that denying YouTube access to the camera seems nonsensical.
It betrays a bad-faith viewpoint that is in my opinion, one not based in evidence or experience. What is the threat model? I can't see one that makes sense in the context of YouTube being a large consumer product oriented company.
- animuchan 3y ago[Principle of least privilege][1] is widely accepted to be a good practice, so I'm not sure about the bad faith argument. In the same way my apartment door is locked because it's the safe default, and not because my neighbors are known to be criminals. [1]: https://en.wikipedia.org/wiki/Principle_of_least_privilege https://en.wikipedia.org/wiki/Principle_of_least_privilege