> To my understanding their browser isolation text just renders to canvas on their edge servers (don’t quote me on this). Does canvas provide any accessibility at all and is actually a bigger problem with the creation of that standard / element in HTML5 with text generation? It’s an image block that allows text generation with almost no accessibility in mind? That’s not really Cloudflare’s fault to be honest.

The standard workaround is to create a parallel DOM that's invisible, e.g. covered up by the canvas. To be clear, this parallel DOM should be based on the accessibility tree of the remote browser, not based on the original DOM, as that would undermine the whole point of the exercise. This work-around may not be perfect, but Cloudflare hasn't implemented even this.

> But this post feels like an open letter to some bigger issue when it seems like it’s a very niche and non-common security tool.

It seems to me, from Cloudflare's original pre-announcement of this technology [1], that they intend for it to be widely adopted. Here's the money quote:

> Operating costs translate directly to customer costs. The S2 system was designed to make deployment to an entire enterprise and not just targeted users (aka: vaccinating half the class) both feasible and attractive for customers.

[1]: https://blog.cloudflare.com/cloudflare-and-remote-browser-is...