[whatwg] Device Element

[Glenn Maynard]

On Sat, Jan 8, 2011 at 6:53 PM, Aryeh Gregor <Simetrical+w3c at gmail.com> wrote:
> On Sat, Jan 8, 2011 at 6:50 PM, Bjartur Thorlacius <svartman95 at gmail.com> wrote:
>> The system provides access control.
>
> I'm not sure what you're saying here.  The browser provides access
> control for web applications.  This is already true in lots of places
> -- like geolocation and network access, to name recent ones.  Even if
> all native applications can access particular hardware as far as the
> system is concerned, it certainly doesn't follow that the browser can
> expose the same privilege to web applications.

Access control is tied closely to the nearby discussion on privilege
escalation (which came out of this thread).  I do believe it's the
browser's job to decide what access a particular page gets, and to
give the user control over privilege escalation.

I hate the analogy, but the browser is to web apps what the operating
system is to native apps: from providing the APIs to let them do
things, to enforcing permissions.  The difference, of course, is that
the default trust level for remote apps is much lower than for native
apps.

Browser access control shouldn't be as complex as OS permissions, but
it does need to exist, and I do believe it'll need to be fleshed out
more thoroughly than it is currently for web apps to be a real
alternative to native for many use cases, and for others, to make them
less acutely second-class.  As I mentioned in the other thread,
privilege escalation ranges from relaxing "nuisance-preventing"
restrictions (context menu cancellation, browser fullscreen, opening
windows) to high-trust operations like broader local file access and
yes, device access.

(Not to endorse device access in general--that request for low-level
access to Bluetooth devices is, frankly, crazy--but a serial API isn't
unreasonable at all.)

The particular mechanisms to handle this should be up to the browser,
of course, but I firmly believe it's the browser's job.

-- 
Glenn Maynard