On: Researcher banned on Valve's bug bounty program publishes second Steam 0-day

[umvi]

> They do not need access to your browser's cookies or history, or documents folder, for example

Well, some do... like Doki Doki Literature Club

[extrapickles → umvi]

I would think it would work in practice closer to mobile apps, where their access requirements are explicitly stated upfront (eg: needs access to documents folder).

[jbverschoor → extrapickles]

Yes please. Still most apps don’t need access to the documents directory or the camera.

They want to “open a file” which’s means file open dialog

Or: upload your profile picture, which’s means a one time upload of a file. Right now you give access to the camera and it can be used for anything