Am I missing something? It's my understanding that chromium based browsers also allow listening to requests same as before, they merely aren't allowed to block them anymore.
Yeah, says Forbidden in firefox or curl but loads in chromium - welcome to the open web of browser interoperability etc etc where servers now just decide your user agent or tls handshake or whatever is fishy.
It can ask user explicitly like it asks for microphone. It is not common for a website page to need access to the local network services as it is to record microphone or request location data. So it's browser fault IMO.
Browsers have weird behaviors on localhost, such as allowing webcam and microphone on HTTP and iirc, permit cross-origin resource access which is blocked on less trusted domains.
That's the point I'm questioning - I think browsers should block by default and only allow things that are specifically allowed by the CSP (or by CORS).
Not just browsers. (Other) Native apps have the same problem. For some reason we have elaborate permissions for all sorts of things but nothing remotely user friendly for various kinds of network activity.
Yes, but the site working provides absolutely no reason to actively block it. Display an 'upgrade your browser' message fine, but actively block a certain browser based on user agent string? Ridiculous.
In other words it simulates browsing the grooveshark website, instead of using their public API. I think it's this that they are upset about, but it makes little sense because if people can see something on their browser then that user should just as well be allowed to see it through a script.
What's an unauthorized device? If I fork chromium and make my own browser what makes it authorized or unauthorized? If I make a CURL request from my terminal is that authorized or unauthorized?
If FB blocked any requests from Firefox Focus they'd likely be in hot water from government agencies.
That's not a problem of browsers having a difficulty determining if they're talking to something on a local network or not, just because you're in a local network doesn't means you can't be victim of a MiTM.
Will browsers prompt (like mic and video) for permission before opening p2p traffic? I'm afraid random sites could behind my back make my machine (via nat traversal if needed) participate in illegal torrenting. It's the legal world we live in, and while I welcome the new browser abstractions, this must be behind a permission popup and provide a way to permanently disable without building a custom browser. What's the status on that?
reply