Just wanted to address this part, too:
"
Removing the API also strengthens the operating system's security and privacy."
That sounds a little unfair. Manifest Version 3 already did much to limit the capabilities of extensions, and Input.ime purposefully never worked in password fields. The initial activation also isn't easy, making it more of a power-user feature (which is who I've developed products for). Once you've activated it, deactivation can be done by pressing Ctrl + Spacebar, with ChromeOS telling users whether or not this third-party IME is still registering their keystrokes.
Removing the ChromeOS IMEs also doesn't prevent attacks via the Android Runtime, which can still install (touch-only) Input method editors that read everything you type on ChromeOS tablets. Being that this is an expected use-case for applications on all platforms, I don't see why custom keyboards are a problem on ChromeOS.
You recently added support for ChromeOS IMEs in the Crostini container, moving us to further optimize our application for that. Did the team just realize that Lacros would make further advancements harder? Will Lacros kill the other system-based ChromeOS APIs (such as the wallpaper and new file-handling apis)? If not, couldn't this api be allowed to target ash-chrome, too?
On Tuesday, July 18, 2023 at 12:07:06 AM UTC-4 Darren Shen wrote: