<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>jesprenj</author><text>What I very dislike about current browser automation tools is that they all use TCP for connecting the browser with the manager program. This means that, unlike for UNIX domain sockets, filesystem permissions (user&amp;#x2F;group restrictions) cannot be used to protect the TCP socket, which opens the browser automation ecosystem to many attacks where 127.0.0.1 cannot be trusted (untrusted users on a shared host).&lt;p&gt;I have yet to see a browser automation tool that does not use localhost bound TCP sockets. Apart from that, most tools do not offer strong authentication -- a browser is spawned and it listens on a socket and when the controlling application connects to the browser management socket, no authentication is required by default, which creates hidden vulnerabilites.&lt;p&gt;While browser sessions may only be controlled by knowing their random UUIDs, creating new sessions is usually possible to anyone on 127.0.0.1.&lt;p&gt;I don&amp;#x27;t know really, it&amp;#x27;s quite possible I&amp;#x27;m just spreading lies here, please correct me and expand on this topic a bit.</text><parent_chain></parent_chain></comment><story><title>Puppeteer Support for Firefox</title><url>https://hacks.mozilla.org/2024/08/puppeteer-support-for-firefox/</url></story>
<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>yoavm</author><text>I know this isn&amp;#x27;t what the WebDriver BiDi protocol is for, but I feel like it&amp;#x27;s 90% there to being a protocol through which you can create browsers, with swappable engines. Gecko has gone a long way since Servo, and it&amp;#x27;s actually quite performant these days. The sad thing is that it&amp;#x27;s so much easier to create a Chromium-based browser than it is to create a Gecko based one. But with APIs for navigating, intercepting requests, reading the console, executing JS - why not just embed the thing, remove all the browser chrome around it, and let us create customized browsers?</text><parent_chain></parent_chain></comment><story><title>Puppeteer Support for Firefox</title><url>https://hacks.mozilla.org/2024/08/puppeteer-support-for-firefox/</url></story>