4 ms·

Be careful you don’t mistake that for web standards compatibility. There are many tests in there for non-standard Blink-only APIs that Google implemented unila

Be careful you don’t mistake that for web standards compatibility. There are many tests in there for non-standard Blink-only APIs that Google implemented unilaterally, which both Mozilla and Apple rejected on security and privacy grounds. For instance WebUSB accounts for 845 tests, and WebNFC accounts for 173 tests. Neither of these are web standards, they are Blink-only Google APIs.

LeFantome 2y ago
While I don’t doubt that there are bogus tests in there, looking at how many of them Safari and Firefox pass does not indicate that they have rejected many of them.
- JimDabell 2y ago
  Web NFC: > Status of This Document > This specification was published by the . It is not a W3C Standard nor is it on the W3C Standards Track. — https://w3c.github.io/web-nfc/ https://w3c.github.io/web-nfc/ > We oppose this feature and will not implement it. > We do not believe a permission prompt is a sufficient mitigation for the serious security and privacy risks raised by this specification. In addition, we think exposing direct hardware access to the web is a bad idea and compromises the device-independence of the web platform. — https://lists.webkit.org/pipermail/webkit-dev/2020-January/031007.html https://lists.webkit.org/pipermail/webkit-dev/2020-January/0... > We believe Web NFC poses risks to users security and privacy because of the wide range of functionality of the existing NFC devices on which it would be supported, because there is no system for ensuring that private information is not accidentally exposed other than relying on user consent, and because of the difficulty of meaningfully asking the user for permission to share or write data when the browser cannot explain to the user what is being shared or written. — https://mozilla.github.io/standards-positions/#web-nfc https://mozilla.github.io/standards-positions/#web-nfc WebUSB: > This specification was published by the Web Platform Incubator Community Group. It is not a W3C Standard nor is it on the W3C Standards Track. — https://wicg.github.io/webusb/ https://wicg.github.io/webusb/ > WebKit declined to implement several APIs, including WebUSB, due to concerns over fingerprinting > We have previously stated privacy concerns, thus the concerns: privacy label. We agree with Mozilla's security concerns raised in their standards position issue, thus the concerns: security label. — https://github.com/WebKit/standards-positions/issues/68 https://github.com/WebKit/standards-positions/issues/68 > Because many USB devices are not designed to handle potentially-malicious interactions over the USB protocols and because those devices can have significant effects on the computer they're connected to, we believe that the security risks of exposing USB devices to the Web are too broad to risk exposing users to them or to explain properly to end users to obtain meaningful informed consent. It also poses risks that sites could use USB device identity or data stored on USB devices as tracking identifiers. — https://mozilla.github.io/standards-positions/#webusb https://mozilla.github.io/standards-positions/#webusb
  - jeltz 2y ago
    Yes, they are horrible features that do not belong in a browser but they make up at most 1.41% of the test suite.
ironhaven 2y ago
It may seem like a lot but there are 1.7 million web platform tests. Controversial chrome only web apis are few and far between the common features
IshKebab 2y ago
At this point the web is a de facto standard platform. The whatwg doesn't decide what makes it up any more than w3c did. As well as browsers supporting features not endorsed by whatwg, there are plenty of features that they have endorsed that browser vendors didn't bother with.
- saghm 2y ago
  It's a standard platform, but the platform itself is not standardized, which is the point I think GP was making. The problem isn't that people don't think the web is a standard platform, but that it's hard to quantify what it means to support the web as a platform because of conflicting implementations. Standardization is ostensibly supposed to help with that, but it obviously doesn't perfectly reflect what browsers will actually support. Ultimately it the question comes down to whether people can actually use the browser with the websites they want to connect to, but that's not something that can be quantified easily due to it depending on what features websites are using and which features a browser has implemented, and network effects can make it hard to pin down what's expected at any given time, which is where all of these "imperfect" metrics like calculating some score based on the standards is coming from.
- JimDabell 2y ago
  > At this point the web is a de facto standard platform. Yes, the web is a standard platform, Blink is not. Google can’t just spit out any old privacy-violating, insecure garbage specification and call it a web standard just because it’s what they want to build. Google don’t unilaterally decide what the web is. > there are plenty of features that they have endorsed that browser vendors didn't bother with. Something can’t become a web standard unless there are two independent implementations. It’s part of the standardisation process. It also disqualifies things like Web NFC and WebUSB from being web standards because Google couldn’t convince anybody outside of Google to implement them.
  - IshKebab 2y ago
    I think you misunderstood (or don't know what "de facto" means). > Google don’t unilaterally decide what the web is. They absolutely do.

LeFantome 2y ago

While I don’t doubt that there are bogus tests in there, looking at how many of them Safari and Firefox pass does not indicate that they have rejected many of them.

JimDabell 2y ago
Web NFC: > Status of This Document > This specification was published by the . It is not a W3C Standard nor is it on the W3C Standards Track. — https://w3c.github.io/web-nfc/ https://w3c.github.io/web-nfc/ > We oppose this feature and will not implement it. > We do not believe a permission prompt is a sufficient mitigation for the serious security and privacy risks raised by this specification. In addition, we think exposing direct hardware access to the web is a bad idea and compromises the device-independence of the web platform. — https://lists.webkit.org/pipermail/webkit-dev/2020-January/031007.html https://lists.webkit.org/pipermail/webkit-dev/2020-January/0... > We believe Web NFC poses risks to users security and privacy because of the wide range of functionality of the existing NFC devices on which it would be supported, because there is no system for ensuring that private information is not accidentally exposed other than relying on user consent, and because of the difficulty of meaningfully asking the user for permission to share or write data when the browser cannot explain to the user what is being shared or written. — https://mozilla.github.io/standards-positions/#web-nfc https://mozilla.github.io/standards-positions/#web-nfc WebUSB: > This specification was published by the Web Platform Incubator Community Group. It is not a W3C Standard nor is it on the W3C Standards Track. — https://wicg.github.io/webusb/ https://wicg.github.io/webusb/ > WebKit declined to implement several APIs, including WebUSB, due to concerns over fingerprinting > We have previously stated privacy concerns, thus the concerns: privacy label. We agree with Mozilla's security concerns raised in their standards position issue, thus the concerns: security label. — https://github.com/WebKit/standards-positions/issues/68 https://github.com/WebKit/standards-positions/issues/68 > Because many USB devices are not designed to handle potentially-malicious interactions over the USB protocols and because those devices can have significant effects on the computer they're connected to, we believe that the security risks of exposing USB devices to the Web are too broad to risk exposing users to them or to explain properly to end users to obtain meaningful informed consent. It also poses risks that sites could use USB device identity or data stored on USB devices as tracking identifiers. — https://mozilla.github.io/standards-positions/#webusb https://mozilla.github.io/standards-positions/#webusb
- jeltz 2y ago
  Yes, they are horrible features that do not belong in a browser but they make up at most 1.41% of the test suite.

ironhaven 2y ago

It may seem like a lot but there are 1.7 million web platform tests. Controversial chrome only web apis are few and far between the common features

IshKebab 2y ago

At this point the web is a de facto standard platform. The whatwg doesn't decide what makes it up any more than w3c did. As well as browsers supporting features not endorsed by whatwg, there are plenty of features that they have endorsed that browser vendors didn't bother with.

saghm 2y ago
It's a standard platform, but the platform itself is not standardized, which is the point I think GP was making. The problem isn't that people don't think the web is a standard platform, but that it's hard to quantify what it means to support the web as a platform because of conflicting implementations. Standardization is ostensibly supposed to help with that, but it obviously doesn't perfectly reflect what browsers will actually support. Ultimately it the question comes down to whether people can actually use the browser with the websites they want to connect to, but that's not something that can be quantified easily due to it depending on what features websites are using and which features a browser has implemented, and network effects can make it hard to pin down what's expected at any given time, which is where all of these "imperfect" metrics like calculating some score based on the standards is coming from.
JimDabell 2y ago
> At this point the web is a de facto standard platform. Yes, the web is a standard platform, Blink is not. Google can’t just spit out any old privacy-violating, insecure garbage specification and call it a web standard just because it’s what they want to build. Google don’t unilaterally decide what the web is. > there are plenty of features that they have endorsed that browser vendors didn't bother with. Something can’t become a web standard unless there are two independent implementations. It’s part of the standardisation process. It also disqualifies things like Web NFC and WebUSB from being web standards because Google couldn’t convince anybody outside of Google to implement them.
- IshKebab 2y ago
  I think you misunderstood (or don't know what "de facto" means). > Google don’t unilaterally decide what the web is. They absolutely do.