w3c / strategy

team-strat, on GitHub, working in public. Current state: DRAFT
151 stars 45 forks source link

W3C's ambiguous strategy for internet freedom and security #260

Open ghost opened 3 years ago

ghost commented 3 years ago

For decades, W3C's vision of internet appears to be really ambiguous: people can do any kind of mischiefs or propaganda into web browsers, such as diffusing misinformations, political or religious dogmas or even pornography, but web users, as for them, are not even allowed to programmatically interact with their own local computer and local resources, from within the web browser, because web technologies are sandboxed and do not have access to the local environment, even if in some situations the user would want to grant the browser access to it, in the case of trusted services that could be installed, digitally signed, with clear and transparent permissions and in the context of a well defined local security model for browser/computer user interactions.

W3C's mantra seems to be: "in the name of security, freedom is in the cloud, not in your computer". But in the name of "security and freedom in the cloud", the W3C factually instaured over the years the worst possible technical privation of freedom both for web users and web developers, directly into our computers, by unconditionally preventing access to the local machine from the browser, which in turn created the most insecure situation for web users, pushing or even forcing them to upload all their documents and information into the cloud, that is, the most unsafe possible situation for web users' data.

In order to gain true freedom and security on the internet, web developers and users urgently need the possibility to grant fine-grained permissions to web applications, allowing to bypass the browser sandbox, such as running local programs or scripts, accessing local resources, etc, and should be able to use browser technologies in a way that is unbranded and do not impose the browser manufacturers' UI.

According to permissions granted by users, developers should thus be able to build, directly within the web browsers, frameless UI applications indistinguishable from native applications and interacting with local resources beyond the sandbox security system, which is obviously needed for browsing the internet safely but which also should be able to be bypassed when the user needs or wants to.

To this end, we would need a "frameless media feature" allowing developers to totally customize the application window as well as the window controls in HTML/CSS, and also a security model such as "trusted desktop activity" which would allow applications to be granted access to local resources and programs on the local computer.

ANoobyBird commented 2 years ago

Agreed, and cannot agree more.