Post #2563487

2026-05-09 03:07 UTC

@owen@mastodon.transneptune.net I would rather understand the tradeoffs and rationale as well, while sometimes business interests put their fingers on the scale to accumulate power, there is often a real problem behind these kinds of security practice, and sometimes its hard to see the underlying problem because its masked by the restrictions preventing it from being a popular avenue of attack.

Replies (1)

@raven667@hachyderm.io 2026-05-09 03:29

@owen@mastodon.transneptune.net I'm not sure I understand all of it but at first guess those APIs are ones that aren't considered safe against MITM attacks, if the connection isn't encrypted then any device on the local segment or network between client and server can takeover the connection and inject malicious data into it, the gamepad support is probably not hardened against attack, its not considered a security boundary, so they don't let the browser open it up for attack. There may be a bit of "better safe than sorry" thinking too, even if the computer owner attests that they accept the risk, if anything goes wrong the browser maker might still be afraid of catching liability. I dunno, but having some documented thinking could help have a productive discussion about it

Open ##2563488