Re: [w3c/ServiceWorker] Preventing server-forced updates (#822)

yoshisatoyanagisawa left a comment (w3c/ServiceWorker#822)

Since we are discussing a technical specification, I believe it is more appropriate to focus on systemic solutions rather than relying on the ethics or individual efforts of service providers. From an engineering perspective, security and reliability should be guaranteed by robust mechanisms that function automatically to protect the user.

Instead of relying on users to follow manual instructions after a breach, if a server needs to explicitly remediate a compromise, we require a well-defined recovery protocol and a mechanism that prevents attackers from interfering with those fixes. Do you have proposals for such a recovery mechanism?

Furthermore, just as most people use the web without understanding TCP/IP, they should be able to rely on a secure infrastructure without being forced to make technical decisions. Expecting users to understand and manually manage every Service Worker is an unrealistic proposal that compromises the accessibility and safety of the web for the general public.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/ServiceWorker/issues/822#issuecomment-3770951326
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/ServiceWorker/issues/822/3770951326@github.com>