COcollimarco·Aug 14, 2026Submission
How much time do you spend collecting invoices from websites? WICG proposal
1 points · Open discussionWICG
proposals
Web Development2021–2026
WICG / proposals
proposals
A home for well-formed proposed incubations for the web platform. All proposals welcome.
12Distinct people
14Mentions
0Explicit recommenders
303GitHub stars
What to know before exploring
What it is
A home for well-formed proposed incubations for the web platform. All proposals welcome.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year14 dated mentions
Observed mentions: 2021-02-03 20:35:47 UTC to 2026-08-14 09:05:42 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 2 | 2 | 0 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 6 | 4 | 2 |
What Hacker News says
14 sourcesProposals Repo, a place for ideas to start their incubation journey
3 points · Open discussionYay, I'd love to have your help!
1) Anyone can join the W3C group; you don't need to be a formal member of W3C!
2) What's dumb about the proposal itself? How could it better achieve its goals?
3) You can see some dialogue at https://github.com/WICG/proposals/issues/261 - what resonates and doesn't in the feedback and critique?
In A new bill in New York would require disclaimers on AI-generated news contentWICG Proposal – AI Content Disclosure
1 points · Open discussionAI Content Disclosure for HTML
1 points · Open discussionYay! Next up, <usermedia>, which is even more vital a permission to be able to flip on and off!! https://github.com/WICG/PEPC/blob/main/usermedia_element.md https://groups.google.com/a/chromium.org/g/blink-dev/c/jQgYo...
As noted in the intent to ship for both, these are a very specific narrow cases chipped off a bunch broader attempt to offer declarative ways to handle permissions in general, a <permission> element.
Intent-to-ship for geolocation:
https://groups.google.com/a/chromium.org/g/blink-dev/c/GL0Bk...
Earlier Page-Embedded Permissions Control (PEPC) proposal: https://github.com/WICG/proposals/issues/113 https://github.com/andypaicu/PEPC/blob/main/explainer.md
The root problem is that permissions right now are super hard to adjust for users (and the way they are exposed to the page is not very good at dealing with users turning p
Read the rest
ermissions on and off either). It's imo very good that we are finally leaving this awful tarpit of design, & moving towards permissions being more fluid. I get that other browsers wanted to be conservative & not do a generic <permission> element, but given how big an improvement this feels like, I sort of wish it'd gotten the pass.
WICG Proposal for Browser AI API for Utilizing On-Device Models
1 points · Open discussionA coding world with more standardization will be better world.
I met this week "Standardized Interface for SQL Database Drivers" https://github.com/halvardssm/stdext/pull/6 by example then https://github.com/WICG/proposals/issues too.
Huge work to get everybody on the same page (About my previous example, it's not well engaged by example https://github.com/nodejs/node/issues/55419), but when done and right done, it's a huge win for developers.
PHP PSR, RFC & co are the way.
In OpenFeature – a vendor-agnostic, community-driven API for feature flaggingI'd like to use Argon2 for web stuff but Web Crypto doesn't support it yet (https://github.com/WICG/proposals/issues/59) and the WASM flavor creates problems with bundling and testing. Stuck with PBKDF2 for now...
In Bcrypt at 25The problem is certificates and WAN access, and lack of MDNS on Android. There's basically no way to do anything that doesn't involve some manual setup, aside from developing a new purpose built app, and maintaining it in addition to the product, probably on two platforms.
If Mozilla still had FlyWeb things could be plug and play.
I have a set of proposals here to bring some of that back: https://github.com/WICG/proposals/issues/43
And some are considering the Tox protocol, but in general, we have not solved the most basic issue of self hosting. How do I connect to my device in a way that just works, LAN or WAN, without manually serting up the client or registering for a service?
In Start Self HostingYes, it is 100% time fot that.
Mozilla FlyWeb was close, but didn't handle remote access. It could have been extended to, but they dropped it.
I wrote a proposal here for how this could be done with Bluetooth-like pairing, using URLs that embed a certificate hash, a random sequence as an extra security layer, and a lookup URL that one can ask where to find the host for a service, for access over the WAN.
By using a URL instead of normal non-HTTP DNS, the lookup URL can be another web service self hosted using the same TLD, or a Data URI if one is hosting from a static IP.
No part of the URL besides the key is used to determine the origin for CORS and local storage, so you can change discovery methods and the random string freely.
Initial connection is by directly sending a link, or by LAN discovery.
Unless discovery is enabled and you ar
Read the rest
e on the same network, it should be impossible to connect without already knowing the URL, so even if your home automation hub is very badly coded, they can't even start hacking it till they find your URL, which can't be found just by sniffing(Because of that random string).
Clients track the "last seen" address of servers, so even if lookup goes down, access still works until your home IP changes.
When nodes connect over LAN, the server sends it's "Find me on the WAN at" IP. So even with no discovery server at all and no static IP, it creates a very convincing illusion of "just working" 99% of the time.
Which means that if you buy a device that uses a cloud lookup service, and they drop that service, your device will still be remote accessible, most of the time. Which might be good enough, or at least good enough to get by until you can find a more permanent solution.
Proposal:
https://github.com/WICG/proposals/issues/43
And a partial implementation of a very close version(Lookups always use OpenDHT in this), plus a notetaking app based on it.
https://github.com/EternityForest/hardlinep2p
I really think this is one of those critical missing technologies that would really enable a lot of amazing things.
I just finished writing a long proposal: https://github.com/WICG/proposals/issues/43
PKI is fairly awful and bad for internal anything, unless you have a full IT team and infrastructure.
A much simpler solution would be URLs with embedded public keys, with an optional discover and pair mechanism.
Browsers already have managed profiles. Just set them up with a trusted set of "paired" servers and labels, push the configs with ansible(It's just like an old school hosts file!), and don't let them pair with anything new.
If you have a small company of people you trust(probably a bad plan!), or are a home user, just use discovery. No more downloading an app to set up a smart device.
The protocol as I sketched it out(and actually prototyped a version of) provides some extra layers of security, you can't connect unless you already know the URL,
Read the rest
or discovery is on and you see it on the same LAN.
We could finally stop talking to our routers and printers via plaintext on the LAN and encrypt everywhere.
We already use exactly this kind of scheme to secure our keyboards and mice, with discovery in open air not even requiring being on the same LAN.
We type our sensitive info into Google docs shared with an "anyone with this URL" feature.
It seems we already trust opaque random URLs and pairing quite a bit. So why not trust them more than the terrible plaintext LAN services we use now?
Attempt to standardize the JavaScript API to encode/decode CBOR
1 points · Open discussionProposal for an App History API
67 points · Open discussion