[dead]
Show HN: OpenBLE, Swagger for Bluetooth
31–40 of 45 posts
Re: Show HN: OpenBLE, Swagger for Bluetooth
#32I really wish WebBluetooth (and WebUSB, etc) was more widely supported. It really opens the door for so many cool applications.
Unfortunately it also opens up the door for so many new exploits. A lot of hardware has very minimal protection against attacks, because the general idea is that anyone able to run software on a machine could also just trivially physically attack the device itself. The result is that you can often update device firmware over Bluetooth or USB. Allowing random websites to suddenly have unlimited access to poorly-secure…
> you get basically identical popups for a website wanting to send you notification
Last I saw, that's not really true - you get asked for BT access in general, but then you have to directly select the device you want the site to connect to once scanning happens (site can specify basic filters to limit devices shown, but little else). Sites can't see what devices are available until you actively select the device from the browser UI, and can't just show you a 'click to give full access to BT with everything'.
Re: Show HN: OpenBLE, Swagger for Bluetooth
#33As another commenter mentioned, it's common practice to shove all your device's functionality into one characteristic to reduce service discovery time (and, in some cases, memory footprint in firmware). With that in mind, can OpenBLE be used to describe the structure of the bytes being read, written, and indicated by the characteristics? OpenAPI is useful because it not only generates a frontend for testing an API, i…
> I'd advise against hanging your hat on Web Bluetooth. Bluetooth is already rife with security problems, and exposing direct control of it to a browser is asking for zero-day nightmares.
Which is why (quoting OP) Mozilla has 'shunned' it. Apple too perhaps (though the reasoning isn't open afaik, and Safari omits more or adopts more slowly in general than can be ascribed to security/privacy concerns).
Re: Show HN: OpenBLE, Swagger for Bluetooth
#34Seems to be unsupported on any iPhone browsers - I’m assuming it’s WebKit constraint?
The only mainstream browser that supports Web Bluetooth is Chrome. Maybe Apple told Google "no, don't implement that." There are good reasons for that. Web Bluetooth's usefulness is dubious, and the potential for exploits is massive.
> Web Bluetooth's usefulness is dubious,
It is very useful, I use it often. I can't think what security exploits there could be given that the user has to select the device and until they do the API can't access any devices or even scan for them.
Re: Show HN: OpenBLE, Swagger for Bluetooth
#35There's a lot of FUD about Web Bluetooth in here. The problem with that is Web Bluetooth isn't theoretical. It has been enabled by default since 2017. Where is the flood of predicted exploits? The fears are way overblown.
Re: Show HN: OpenBLE, Swagger for Bluetooth
#36Cool! I have an interesting project but it’s still waiting for Security Level 3 support in Web Bluetooth. Also Peripheral mode would be nice.
Re: Show HN: OpenBLE, Swagger for Bluetooth
#37I really wish WebBluetooth (and WebUSB, etc) was more widely supported. It really opens the door for so many cool applications.
Unfortunately it also opens up the door for so many new exploits. A lot of hardware has very minimal protection against attacks, because the general idea is that anyone able to run software on a machine could also just trivially physically attack the device itself. The result is that you can often update device firmware over Bluetooth or USB. Allowing random websites to suddenly have unlimited access to poorly-secure…
> Unfortunately it also opens up the door for so many new exploits.
Put the door behind a permission the user has to explicitly activate, and if you are still concerned, add more friction to the process, or in this case, argue for a better permission system, but please do not argue for "infinite friction" (a.k.a prohibiting, banning, censoring)
If you still think we should not do this because users won't care and will accept any permission anyway, then you are arguing against the freedom of users to have control of their devices and run whatever algorithm they want on them
Re: Show HN: OpenBLE, Swagger for Bluetooth
#38Earlier quoted context omitted.
I'll bite. What other format would you have chosen that's widely supported, easy to read and type by hand, and supports deeply nested data structures?
JSON5
YAML5: https://github.com/quasilyte/yaml5
YAML-LD w/ convenience.jsonld or dollar-convenience.jsonld: https://json-ld.github.io/yaml-ld/spec/
Re: Show HN: OpenBLE, Swagger for Bluetooth
#39Seems to be unsupported on any iPhone browsers - I’m assuming it’s WebKit constraint?
The only mainstream browser that supports Web Bluetooth is Chrome. Maybe Apple told Google "no, don't implement that." There are good reasons for that. Web Bluetooth's usefulness is dubious, and the potential for exploits is massive.
> Web Bluetooth's usefulness is dubious
The previous commenter seems to have found a use :)
Re: Show HN: OpenBLE, Swagger for Bluetooth
#40As another commenter mentioned, it's common practice to shove all your device's functionality into one characteristic to reduce service discovery time (and, in some cases, memory footprint in firmware). With that in mind, can OpenBLE be used to describe the structure of the bytes being read, written, and indicated by the characteristics? OpenAPI is useful because it not only generates a frontend for testing an API, i…
Hey, thanks for checking out my project. So the spec is independent of Web Bluetooth; like Swagger is to Swagger UI. I considered electron but it needs installation and wouldn't run on mobiles. Perhaps Web Bluetooth is not ready for devices, but is perfect for dev tools like this one.
As of today it can generate an Arduino GATT server; I'm working to support more platforms, Zephyr, iOS etc.