4 ms·
Kinda unfortunate that browsers don't allow general socket access. The browser could ask for permission (and possibly disable access to cookies or saved creden
by captainmuon 13y ago
Kinda unfortunate that browsers don't allow general socket access.
The browser could ask for permission (and possibly disable access to cookies or saved credentials for this tab), and it would be pretty safe. You can do that with a signed Java applet, and I believe it was possible with Flash and a couple other techniques, but they have all been killed or are on the way out.
Imagine what you could do... Bittorrent clients, something like Popcorn Time, Anonymous P2P, Anonymous instant messaging, Tor in the browser, ... or less nefariously, Mail clients, Mashups, ... all in simple HTML files, hosted anonymously on a free webhoster. You can build awesome stuff, but can't be hold accountable by your domain name, etc..
puts tinfoil hat on The paranoid part of me thinks the restriction is on purpose, to prevent this kind of app in the browser. Apple, Google & co. control the walled gardens of their App stores. They don't control the "open" web, but they have subtly pushed it in a direction where it is very powerful, but has very specific weaknesses.
- wmf 13y agoThe restriction is on purpose to prevent browsers from becoming botnets.
- psykovsky 13y agoThat's the official excuse?
- jokoon 13y ago"official" there's nothing official about the web or web browsers. mozilla or google could release a socket implementation specific to their browser without waiting for the consent of w3c or rfc or else. There's a risk for DDOS though, which have a high cost. But XSS is a risk too, so I don't see why js sockets would be so dangerous.
- psykovsky 13y agoAny software installed in a computer can turn the machine into a zombie. Why don't we lock everything down, or better yet, block the computers access to the internet, after all, no net, no DDoS...
- jokoon 13y ago> Any software installed in a computer can turn the machine into a zombie. That's not true about javascript. Also the DDoS attack risk is low, it would happens only as people would visit infected websites or with XSS attacks. You can't have a botnet with js if the browser isn't turned on on an infected webpage.
- psykovsky 13y agoSo, all said, the restriction doesn't make much sense. I knew we would agree.
- jokoon 13y agoI agree that there is a very strong risk for DDOS, but I don't see how it would make botnets possible.