As someone who builds an open source remote browser myself, this is a non trivial task.
but anyone who wants to attempt to bring accessibility to a pixels only or drawing instructions only remote isolated browser security model is welcome to fork my repository and add that kind of stuff.
I appreciate the importance of accessibility but the tone of that article strikes me as strident and demanding, acknowledging only the situation feelings and difficulty of accessibility users, but not of the developers, nor of the other user groups.
Technically the issue is a trade-off between security and inspectability. the most secure remote browser technology simply sends pixels or in the case of S2 and cloudflare drawing instructions from the remote browser to the local client where the viewport is then presented so there is no HTML JavaScript or css sent to the client... which is the basis of that whole remote browser isolation security model. In order to make that accessible, without having the benefit of the HTML CSS and JavaScript on the client, it's not trivial. The more you expose that information from which you can bring accessibility to the client the greater the attack surface from a security point of view. So it's a trade off.
but anyone who wants to attempt to bring accessibility to a pixels only or drawing instructions only remote isolated browser security model is welcome to fork my repository and add that kind of stuff.
I appreciate the importance of accessibility but the tone of that article strikes me as strident and demanding, acknowledging only the situation feelings and difficulty of accessibility users, but not of the developers, nor of the other user groups.
Technically the issue is a trade-off between security and inspectability. the most secure remote browser technology simply sends pixels or in the case of S2 and cloudflare drawing instructions from the remote browser to the local client where the viewport is then presented so there is no HTML JavaScript or css sent to the client... which is the basis of that whole remote browser isolation security model. In order to make that accessible, without having the benefit of the HTML CSS and JavaScript on the client, it's not trivial. The more you expose that information from which you can bring accessibility to the client the greater the attack surface from a security point of view. So it's a trade off.