Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> Firefox could allow websites to open sockets and toss arbitrary packets around, and choose not to.

There are very good security and privacy reasons that all browsers (not just Firefox) work extremely hard to prevent this from being possible.



So treat socket access as one does Microphone and Web Cam access.


The problem with that is that regular people (not super-techies) have a much better chance of understanding the implications of agreeing to microphone and webcam use than something called "socket access" - or any other more friendly term that tries to explain what's going on, because it's such a long way away from the level of abstraction that they are likely to understand.


"Allow this Website unrestricted access to the internet?"

Seems no more or less confusing or understandable than allowing access to microphone or camera.


I mean, I could honestly see a ton of confusion along the lines of “isn’t this website already on the internet? what??”


Also not knowing if disabling it will break the page, something even technically inclined people can't know ahead of time. It's not like push notifications where you would have to try hard to build pages that could break without the feature enabled. I could easily see people abusing this to serve pages over alternate protocols and making people expect to need to click "allow."


It's implied it will break or limit the page; just as denying access to microphone and video has that implication.


No it isn't? Unless you're doing something with the microphone or video there's no implication there.


Sure there is. If it needs hardware access for a function then without it that function breaks.


It's no more confusing than the warning provided for self signed certificates.


That requires people to know what "access to the internet" means.

A sizable portion of internet users think that the internet is what you get when you click the Facebook icon on your phone.

But they do at least understand what a microphone and webcam are for.


So make the default negative and appealing, and the positive option scary and diminished.

As Firefox does with self signed certificates and similar.


And your internal network.


Right - the original reason for same origin policies in browsers was to prevent scripts from stealing data from private corporate intranets.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: