Well if most of steam doesn't already, could it use webkit or something like that. There are plenty of ways to throw webkit into a GL context and you pretty much get all of the latest features of a web browser for zero effort.
I think it does use WebKit, just an old version. And I think it is not zero effort to get all the features. Maybe Steam should switch to Blink (Google and Operas WebKit fork). I don't know how well Apple's WebKit is (or will be) supported under Linux. Also the TLS support depends on the used NSS library (under Linux, under Windows it uses a different TLS library, IIRC). I think Blink is switching to OpenSSL.
While I wasn't making the case for Webkit and really just using that as a good example, it is very well supported under Linux and is already used in Garrysmod with the pretty cool library called Awesonium which I have used before. It is also supported in QT and python. And yes, its very much zero effort to include a web control into a GL context, because I have done it before and its literally just sending input to a library and displaying the images back.
Unless valve wants to roll their own solution in which case no one can gauge at how much effort it will take.
Steam is using WebKit. I just meant that more and more WebKit users are switching to Blink (Chromium) and I fear that thus WebKit support for Linux will not be as good in the future. Qt already announced the switch to Blink/Chromium.
Well I'm all for Blink (I did a little research and its a fork?). As long as you can get all the platforms supported I see no issue with it. Anything from Valve?
Closing as steam switched to libcef quite a while ago.
Nothing extracted yet.
TLS support in the in-game browser is currently sub-par. https://www.howsmyssl.com/ currently criticizes these things:
Version
Your client is using TLS 1.0, which is very old, possibly susceptible to the BEAST attack, and doesn't have the best cipher suites available on it. Additions like AES-GCM, and SHA256 to replace MD5-SHA-1 are unavailable to a TLS 1.0 client as well as many more modern cipher suites.
TLS Compression
Your TLS client supports compressing the settings that encrypt your connection. This is really not good. It makes your TLS connections susceptible to the CRIME attack and your encrypted data could be leaked!
Insecure Cipher Suites
Your client supports cipher suites that are known to be insecure:
SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA: This cipher was meant to die with SSL 3.0 and is of unknown safety.
TLS_DHE_DSS_WITH_RC4_128_SHA: This cipher uses keys smaller than 128 bits in its encryption.