Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: DualShock calibration in the browser using WebHID

blog.the.al

Post reply on HN
Print view View original

61–70 of 82 posts

Re: Show HN: DualShock calibration in the browser using WebHID

#61

Post by hnburnsy »

sotix wrote: post #30

> It is available only for Google Chrome, Chromium or compatiable browsers (e.g. Edge) because it uses WebHID, a javascript extension that can be used to send commands to a HID device. I didn’t know about WebHID, but it’s interesting Firefox doesn’t support it. According to Mozilla’s position[0]: > This API, like WebUSB, provides access to generic devices. Though this API is limited to human interface devices (HID),…

Or WebKit, per Apple...

>Here are some examples of features we have decided to not yet implement due to fingerprinting, security, and other concerns, and where we do not yet see a path to resolving those concerns:

    Web Bluetooth
    Web MIDI API
    Magnetometer API
    Web NFC API
    Device Memory API
    Network Information API
    Battery Status API
    Web Bluetooth Scanning
    Ambient Light Sensor
    HDCP Policy Check extension for EME
    Proximity Sensor
    WebHID
    Serial API
    Web USB
    Geolocation Sensor (background geolocation)
    User Idle Detection

Re: Show HN: DualShock calibration in the browser using WebHID

#62

Post by hnburnsy »

steelbrain wrote: post #55

Chrome is doing amazing work with these WebAPIs. Here's a quick list of things enabled by Chrome being open-minded and allowing WebHID and WebUSB APIs to exist: - Turn your Stadia controllers into bluetooth controllers: https://stadia.google.com/controller/index_en_GB.html - Android Flash Tool: https://flash.android.com/welcome - fastboot.js - FastBoot API but entirely though the web: https://kdrag0n.github.io/fastbo…

Are these really the job of your browser?

Re: Show HN: DualShock calibration in the browser using WebHID

#63

Post by xcdzvyn »

hnburnsy wrote: post #60

JFC, is there any host functionality that Chrome will not try and implement in the browser. No wonder it is so bloated and leaks your fingerprint in a million different ways. Apple says they will not implement WebHID and 15 other "features" in WebKit... >Here are some examples of features we have decided to not yet implement due to fingerprinting, security, and other concerns, and where we do not yet see a path to re…

I completely understand the desire to not implement such things, but I also understand why they exist.

Unfortunately, perhaps due to a mixture of elitism, protectionism, and market dominance, writing cross-platform software in any capacity, let alone cross platform software that requires low-level hardware access, Bluetooth, video, geolocation, etc., is far harder than it deserves to be, and using the web as an abstraction layer makes these things a million times easier.

edit: It's also far easier to distribute this stuff. I just want my video game controller working in slightly better order - I don't want to have to install some bluetooth library and then choose between an x86 Mac, ARM Mac, x86 Windows, x64 Windows, AppImage, deb, flatpak, .tar.gz, snap, my package manager (if it's even there), try install it, shit, it doesn't run on my distro, patch it, use it once, then uninstall it.

Re: Show HN: DualShock calibration in the browser using WebHID

#64

Post by John_Cena »

aidenn0 wrote: post #44
evilhackerdude wrote: post #22

Earlier quoted context omitted.

i fixed a busted analog stick by opening it up and cleaning the sensor thanks to some youtube video.

I have revived my CH Mach III twice now with DeoxIT on the potentiometers. I've owned that stick for over 30 years at this point. P.S. I wish someone made a modern joystick with a similar feel, but more than two buttons.

The CH Mach III looks tight! I was messing around with a DOS game Sword of the Samurai and was wondering what types of sticks were being used by enthusiasts at the time since that game supported a joystick.

What kind of things were you playing with that when you purchased it new? I'm in this industry in no small part to watching my brother play Descent with a joystick in the 90s. I think his was made by the same company - F-16 Flightstick. I remember it having suction cups on the bottom though

Re: Show HN: DualShock calibration in the browser using WebHID

#65

Post by AgentME »

hnburnsy wrote: post #62
steelbrain wrote: post #55

Chrome is doing amazing work with these WebAPIs. Here's a quick list of things enabled by Chrome being open-minded and allowing WebHID and WebUSB APIs to exist: - Turn your Stadia controllers into bluetooth controllers: https://stadia.google.com/controller/index_en_GB.html - Android Flash Tool: https://flash.android.com/welcome - fastboot.js - FastBoot API but entirely though the web: https://kdrag0n.github.io/fastbo…

Are these really the job of your browser?

The browser is a great for distribution (apps are just URLs) and security (web pages need to ask permission before accessing anything on your computer outside of their domain).

More people should question the common belief that desktop OSes (without enforced app sandboxing) do a proper job at being a platform for utilities like OP's. When you download and run an .exe on a normal Windows pc, you're giving it read and write access to everything on your user account. It's bad that you're required to put so much trust in developers to run programs on typical desktop systems; this either ends up causing people to be extremely picky about what they run or to give out trust too freely and get bitten by malware often. Platforms like the browser which sandbox (web) apps and enforce a granular permission system are terrific.

Re: Show HN: DualShock calibration in the browser using WebHID

#66

Post by password4321 »

steelbrain wrote: post #55

Chrome is doing amazing work with these WebAPIs. Here's a quick list of things enabled by Chrome being open-minded and allowing WebHID and WebUSB APIs to exist: - Turn your Stadia controllers into bluetooth controllers: https://stadia.google.com/controller/index_en_GB.html - Android Flash Tool: https://flash.android.com/welcome - fastboot.js - FastBoot API but entirely though the web: https://kdrag0n.github.io/fastbo…

Reprogram a $30 ham radio:

https://news.ycombinator.com/item?id=39850972

Re: Show HN: DualShock calibration in the browser using WebHID

#67

Post by modeless »

colordrops wrote: post #37
sotix wrote: post #30

> It is available only for Google Chrome, Chromium or compatiable browsers (e.g. Edge) because it uses WebHID, a javascript extension that can be used to send commands to a HID device. I didn’t know about WebHID, but it’s interesting Firefox doesn’t support it. According to Mozilla’s position[0]: > This API, like WebUSB, provides access to generic devices. Though this API is limited to human interface devices (HID),…

What is the chrome team's threat model for this? Why are they ok with it?

They are OK with it because it's behind an explicit permission dialog and the user has to specifically choose a single device to grant access. I doubt there's been a single instance of a real world attack using this API. It's been enabled by default in Chrome for years, so it's not like there hasn't been an opportunity. This is just concern trolling by people who dislike the modern web for other reasons.

Re: Show HN: DualShock calibration in the browser using WebHID

#68

Post by 0cf8612b2e1e »

modeless wrote: post #67
colordrops wrote: post #37

Earlier quoted context omitted.

What is the chrome team's threat model for this? Why are they ok with it?

They are OK with it because it's behind an explicit permission dialog and the user has to specifically choose a single device to grant access. I doubt there's been a single instance of a real world attack using this API. It's been enabled by default in Chrome for years, so it's not like there hasn't been an opportunity. This is just concern trolling by people who dislike the modern web for other reasons.

Well, it did break the security of YubiKeys

https://www.pcmag.com/news/google-chrome-feature-pokes-secur...

Re: Show HN: DualShock calibration in the browser using WebHID

#69

Post by modeless »

0cf8612b2e1e wrote: post #68
modeless wrote: post #67

Earlier quoted context omitted.

They are OK with it because it's behind an explicit permission dialog and the user has to specifically choose a single device to grant access. I doubt there's been a single instance of a real world attack using this API. It's been enabled by default in Chrome for years, so it's not like there hasn't been an opportunity. This is just concern trolling by people who dislike the modern web for other reasons.

Well, it did break the security of YubiKeys https://www.pcmag.com/news/google-chrome-feature-pokes-secur...

That's research, never used in a real world attack. It's long since patched, and also that's not the WebHID API.

Re: Show HN: DualShock calibration in the browser using WebHID

#70

Post by 0cf8612b2e1e »

modeless wrote: post #69
0cf8612b2e1e wrote: post #68

Earlier quoted context omitted.

Well, it did break the security of YubiKeys https://www.pcmag.com/news/google-chrome-feature-pokes-secur...

That's research, never used in a real world attack. It's long since patched, and also that's not the WebHID API.

Moving goal posts. I guess all of this xz stuff is overblown because we do not have a documented case where it was used? Just research about something that might happen does not count, I guess.

Here is a WebHID attack in Chrome with a 9.8 severity (https://www.cve.news/cve-2023-1529/)

Post reply on HN