9 ms·
Doesn't most software just register a protocol handler with the OS? Then a website can hand the browser a zoommtg:// link, which the browser opens with zoom ?
by michaelt 1y ago
Doesn't most software just register a protocol handler with the OS? Then a website can hand the browser a zoommtg:// link, which the browser opens with zoom ?
Things like Jupyter Notebooks will presumably be unaffected by this, as they're not doing any cross-origin requests.
And likewise, when a command line tool wants you to log in with oauth2 and returns you to a localhost URL, it's a simple redirect not a cross-origin request, so should likewise be allowed?
- ronsor 1y agoThat works if you want to launch an application from a website, but it doesn't work if you want to actively communicate with an application from a website.
- fn-mote 1y agoThis needs more detail to make it clear what you are wishing for that will not happen. It seems like you're thinking of a specific application, or at least use-case. Can you elaborate? Once you're launching an application, it seems like the application can negotiate with the external site directly if it wants.
- xp84 1y ago#1 use case would be a password manager. It would be best if the browser plugin part can ping say, the 1password native app, which runs locally on your pc, and say "Yo I need a password for google.com" - then the native app springs into action, prompts for biometrics, locates the password or offers the user to choose, then returns it directly to the browser for filling. Sure you can make a fully cloud-reliant PW manager, which has to have your key stored in the browser and fetch your vault from the server, but a lot of us like having that information never have to leave our computers.
- spiffyk 1y agoBrowser extensions play by very different rules than websites already. The proposal is for the latter and I doubt it is going to affect the former, other than MAYBE an extra permanent permission.
- cAtte_ 1y agoyou missed the point. password managers are one of the many use cases for this feature; that they just so happen to be mostly implemented as extensions does not mean that the feature is only useful for extensions
- minitech 1y agoExtensions can already use a better mechanism for this (https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/runtime/sendNativeMessage https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...) than starting a local web server.
- kuschku 1y agoA common use case, whether for 3D printers, switches, routers, or NAS devices is that you've got a centrally hosted management UI that then sends requests directly to your local devices. This allows you to use a single centrally hosted website as user interface, without the control traffic leaving your network. e.g. Plex uses this.
- michaelt 1y agoI don't think this proposal will stop you visiting the management UI for devices like switches and NASes on the local network. You'll be able to visit http://192.168.0.1 http://192.168.0.1 and it'll work just fine? This is just about blocking cross-origin requests from other websites. I probably don't want every ad network iframe being able to talk to my router's admin UI.
- kuschku 1y agoThat's not what I'm talking about. A common example is this: 1. I visit ui.manufacturer.tld 2. I click "add device" and enter 192.168.0.230, repeating this for my other local devices. 3. The website ui.manufacturer.tld now shows me a dashboard with aggregate metrics from all my switches and routers, which it collects by fetch(...) ing data from all of them. The manufacturers site is just a static page. It stores the list of devices and credentials to connect to them in localStorage. None of the data ever leaves my network, but I can just bookmark ui.manufacturer.tld and control all of my devices at once. This is a relatively neat approach providing the same comfort as cloud control, without the privacy nightmare.