direct-sockets

From "Chrome 130: Direct Sockets API" (2024-09) https://news.ycombinator.com/item?id=41418718 : > I can understand FF's position on Direct Sockets [...] Without support for Direct Sockets in Firefox, developers have JSONP, HTTP, WebSockets, and WebRTC. > Typically today, a user must agree to install a package that uses L3 sockets before they're using sockets other than DNS, HTTP, and mDNS. HTTP Signed Exchanges is one way to sign webapps. But HTTP Signed Exchanges is cancelled, so arbitrary code with sockets if one ad network? ... > Mozilla's position is that Direct Sockets would be unsafe and inconsiderate given existing cross-origin expectations FWIU: https://github.com/mozilla/standards-positions/issues/431 > Direct Sockets API > Permissions Policy: https://wicg.github.io/direct-sockets/#permissions-policy > docs/explainer.md >> Secu

This slowly alters the essence of The Internet, due to the permissionless nature of running any self-organising system like Bittorrent and Bitcoin. This is NOT in Android, just isolated Web Apps at desktops at this stage[0]. The "direct socket access" creep moves forward again. First, IoT without any security standards. Now Web Apps. With direct socket access to TCP/UDP you can build anything! You loose the constraint of JS servers, costly WebRTC server hosting, and lack of listen sockets feature in WebRTC DataChannel. <self promotion>NAT puncturing is already solved in our lab, even for mobile 4G/5G. This might bring back the cyberpunk dreams of Peer2Peer... In our lab we bought 40+ SIM cards for the big EU 4G/5G networks and got the carrier-grade NAT puncturing working[1]. Demo blends 4G/5G puncturing, TikTok-style streaming, and Bittor

When reading https://github.com/WICG/direct-sockets/blob/main/docs%2Fexpl..., it's noted this is part of the "isolated web apps" proposal: https://github.com/WICG/isolated-web-apps/blob/main/README.m... , which is important context because the obvious reaction to this is the security nightmare

Mozilla's position is that Direct Sockets would be unsafe and inconsiderate given existing cross-origin expectations FWIU: https://github.com/mozilla/standards-positions/issues/431 Direct Sockets API > Permissions Policy: https://wicg.github.io/direct-sockets/#permissions-policy docs/explainer.md >> Security Considerations : https://github.com/WICG/direct-sockets/blob/main/docs/explai...

Could be cool to see an implementation using Chrome's experimental Direct Sockets API [0]. The API requires using a form of new web packaging known as Isolated Web Apps which have a strict CSP [1] though, so it might not be possible to use it for this since I'd assume it's dynamically executing a lot of code. [0]: https://github.com/WICG/direct-sockets/blob/main/docs/explai... [1]: https://github.com/WICG/isolated-web-apps/blob/main/README.m...

We switched the url from https://github.com/WICG/direct-sockets, to the post it points to which seems to have the most information. There's also an explanation at https://discourse.wicg.io/t/filling-the-remaining-gap-betwee....