5 ms·

> I wish software was secure by design, like browsers are. I don't. Browsers are already close to "security or utility, pick one"[0] if you try to go beyond th

> I wish software was secure by design, like browsers are. I don't. Browsers are already close to "security or utility, pick one"[0] if you try to go beyond the TV + form filling appliance experience. I don't want this kind of thinking to leak out to all software I use. Like, I'm happy to be able to write: find . -type f [stuff] -exec rg 'foobar' {} + without worrying about rg (or anything) refusing to run because its vendor didn't set up Access-Control-Allow-Origin header correctly, or similar such bullshit that's just commonplace whenever you try to operate (instead of consuming) or integrate anything on the web. And no, I don't want to have to buy a domain and publicly spell out my computers and get them legit certificates just so they're allowed to talk with each other when physically next to each other and on the same LAN. I don't want my OS to start looking like Android either, where everything is hidden and nothing is allowed to talk to anything else - i.e. literally the opposite of the promise Android started with. -- [0] - Security and usefulness are fundamentally opposing forces. In the limit, the most secure computer system is a dead rock.

alternatex 2y ago
First time I see someone criticize Access-Control-Allow-Origin. You do realize it prevented countless script injection attacks from affecting users? Most of whom are not people who are on the web for the purposes of hacking random integrations. Also seems like your idea of integration is using someone else's server without permission.
- TeMPOraL 2y ago
  > First time I see someone criticize Access-Control-Allow-Origin. From the POV of API integrations it's basically annoyance. It doesn't prevent or discourage using an endpoint from scripts and applications except browsers, which voluntarily handle it and also don't give the end-user any control over it. > You do realize it prevented countless script injection attacks from affecting users? I do. We're talking about making software as secure as web browsers. I can begrudgingly accept that the World Wide Web is what it is because it is World Wide, but I don't want any of this bullshit to spill over to general-purpose personal computers. It's bad enough that we increasingly do most of our computing in the browsers. > Also seems like your idea of integration is using someone else's server without permission. Not server but software, and the very phrasing of it is... I don't know where to even begin addressing it. I am not and am never gonna ask permission to use software for whatever purpose I want. That's, like, the basic philosophy of computing. Integrations - voluntary or not - are basically an extension of that. Adversarial interoperability is a sad necessity today, but we're not even talking about that - we're talking transplanting "browser security" like CORS to places and use cases where it would be mostly annoying, leaving users at the mercy of the software provider to kindly relax the security flag a bit.
botanical76 2y ago
Android has very good reason to have such strict process isolation. For example, that third party calculator app I downloaded shouldn't be able to interface with my bank app. That said, I do feel it (Google) has used security as an excuse to build a walled garden. How would you do Android differently?

alternatex 2y ago

First time I see someone criticize Access-Control-Allow-Origin. You do realize it prevented countless script injection attacks from affecting users? Most of whom are not people who are on the web for the purposes of hacking random integrations. Also seems like your idea of integration is using someone else's server without permission.

TeMPOraL 2y ago
> First time I see someone criticize Access-Control-Allow-Origin. From the POV of API integrations it's basically annoyance. It doesn't prevent or discourage using an endpoint from scripts and applications except browsers, which voluntarily handle it and also don't give the end-user any control over it. > You do realize it prevented countless script injection attacks from affecting users? I do. We're talking about making software as secure as web browsers. I can begrudgingly accept that the World Wide Web is what it is because it is World Wide, but I don't want any of this bullshit to spill over to general-purpose personal computers. It's bad enough that we increasingly do most of our computing in the browsers. > Also seems like your idea of integration is using someone else's server without permission. Not server but software, and the very phrasing of it is... I don't know where to even begin addressing it. I am not and am never gonna ask permission to use software for whatever purpose I want. That's, like, the basic philosophy of computing. Integrations - voluntary or not - are basically an extension of that. Adversarial interoperability is a sad necessity today, but we're not even talking about that - we're talking transplanting "browser security" like CORS to places and use cases where it would be mostly annoying, leaving users at the mercy of the software provider to kindly relax the security flag a bit.

botanical76 2y ago

Android has very good reason to have such strict process isolation. For example, that third party calculator app I downloaded shouldn't be able to interface with my bank app. That said, I do feel it (Google) has used security as an excuse to build a walled garden. How would you do Android differently?