Security concerns about web-printing

[reillyeon]

It seems like core to your concerns here is the idea that this API allows a site to scan the local network or send arbitrary network traffic. That isn't the intent at all. If there's a particular section of the explainer which gives this impression please let us know.

There are two UX options in https://github.com/WICG/web-printing#suggested-options, the first option would grant access to information about all configured printers, similar to how getUserMedia() grants access to information about all connected cameras, while the second option would require the user to choose which printer to grant access to, similar to how more modern APIs like Web Serial work. In neither case would the site be given the broad ability to scan the network for arbitrary devices. Access would be mediated by the underlying operating system's printing API, which provides information about printers the user has set up and nothing else.

The https://github.com/WICG/web-printing#main-motivating-use-case-remote-printing section explains the problem with the current print dialogs in the context of a particular category of web apps that do server-side generation of documents for printing.