Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: DualShock calibration in the browser using WebHID

blog.the.al

Post reply on HN
Print view View original

71–80 of 82 posts

Re: Show HN: DualShock calibration in the browser using WebHID

#71

Post by modeless »

0cf8612b2e1e wrote: post #70
modeless wrote: post #69

Earlier quoted context omitted.

That's research, never used in a real world attack. It's long since patched, and also that's not the WebHID API.

Moving goal posts. I guess all of this xz stuff is overblown because we do not have a documented case where it was used? Just research about something that might happen does not count, I guess. Here is a WebHID attack in Chrome with a 9.8 severity ( https://www.cve.news/cve-2023-1529/ )

I moved nothing. You didn't read my original comment that clearly specified "real world attack". Your second link doesn't qualify either. Besides, if you can connect a malicious USB device to the user's computer you've already won. There are a million ways to exploit that which have nothing to do with Chrome.

The xz thing was a big deal precisely because it was a real world attack. It wasn't something created by researchers as a proof of concept and disclosed to vendors. It was discovered in the wild, luckily before it caused any damage, but it was absolutely a real world attack.

Re: Show HN: DualShock calibration in the browser using WebHID

#72

Post by aidenn0 »

John_Cena wrote: post #64
aidenn0 wrote: post #44

Earlier quoted context omitted.

I have revived my CH Mach III twice now with DeoxIT on the potentiometers. I've owned that stick for over 30 years at this point. P.S. I wish someone made a modern joystick with a similar feel, but more than two buttons.

The CH Mach III looks tight! I was messing around with a DOS game Sword of the Samurai and was wondering what types of sticks were being used by enthusiasts at the time since that game supported a joystick. What kind of things were you playing with that when you purchased it new? I'm in this industry in no small part to watching my brother play Descent with a joystick in the 90s. I think his was made by the same comp…

New would have been Chuck Yeager's Advanced Flight Trainer various EPYX sports games (e.g. Winter Games & California Games) A bit later would be Wing Commander and Traffic Department 2192. Even later (besides several Wing Commander sequels and spinoffs) Tyrian, One Must Fall 2097, and Duke Nukem 3D (keyboard & joystick instead of keyboard & mouse).

Re: Show HN: DualShock calibration in the browser using WebHID

#74

Post by troupo »

jauntywundrkind wrote: post #29
troupo wrote: post #14

Earlier quoted context omitted.

You could acquaint yourself with the timeline of WebHID. Google presented a "spec" that wasn't even a spec. They were asked to create a better spec. Instead they just shipped WebHID, and several months later dumped several hundred pages of specifications saying "there". Whatever your position on hardware standards are, this is not how standards are presented. Edit: the status of WebHID is literally "not a W3C Standar…

WebHID is work done under Web Platform Incubator Community Group, wicg. http://wicg.io There's tons of work done with this group, and it is very much a genuine, multi-party attempt to standardize out specs. I have a hard time believing this is an innocent mistake you've made, portraying such a stark "Google couldn't care less" dark-world fantasy. Over something very normal very boring and very commonly done by everyo…

> I have a hard time believing this is an innocent mistake you've made, portraying such a stark "Google couldn't care less" dark-world fantasy.

This is literally the timeline: https://github.com/mozilla/standards-positions/issues/459

Re: Show HN: DualShock calibration in the browser using WebHID

#75

Post by troupo »

moron4hire wrote: post #28
troupo wrote: post #14

Earlier quoted context omitted.

You could acquaint yourself with the timeline of WebHID. Google presented a "spec" that wasn't even a spec. They were asked to create a better spec. Instead they just shipped WebHID, and several months later dumped several hundred pages of specifications saying "there". Whatever your position on hardware standards are, this is not how standards are presented. Edit: the status of WebHID is literally "not a W3C Standar…

That's literally the W3C standards process!!! W3C standard are supposed to start with a single vendor implementation, then a draft spec, then collaboration and multiple implementation from other vendors, and THEN a final W3C Standard Specification. The very reason why this spec is not on the standard track is because Mozilla refuses to implement it in Firefox.

Yes, your supposed to have an implementation, but your not supposed to release it into the wild without a working spec and without working it the potential issues.

Re: Show HN: DualShock calibration in the browser using WebHID

#76

Post by troupo »

pseudosavant wrote: post #27
troupo wrote: post #14

Earlier quoted context omitted.

You could acquaint yourself with the timeline of WebHID. Google presented a "spec" that wasn't even a spec. They were asked to create a better spec. Instead they just shipped WebHID, and several months later dumped several hundred pages of specifications saying "there". Whatever your position on hardware standards are, this is not how standards are presented. Edit: the status of WebHID is literally "not a W3C Standar…

There is probably a point of view in here where Google is being stupid, lazily pushing like WebHID without any kind of standards support - like they've done countless times before. But Mozilla is also being stupid about clutching impractically tight to their ideals in a way that harms their users. Mozilla has done it many times in the past when they tried to only support open-source codecs or refused to implement the…

> But Mozilla is also being stupid about clutching impractically tight to their ideals in a way that harms their users.

Time and again their concerns have been shown to be true.

Re: Show HN: DualShock calibration in the browser using WebHID

#77

Post by troupo »

jorvi wrote: post #34
troupo wrote: post #18

Earlier quoted context omitted.

There's nothing "die hard" about wanting to create a proper standard (and being aware of the trade offs) instead of just implementing whatever Google deigns worthy of throwing up. Now Firefox cannot even implement the "proper HID" because Google has already shipped their version

I mean, its a pretty binary choice. You'd rather have these repairmen (who are laymen at tech) suffer a really crappy workflow just to have a more "pure" solution in an ephemeral point in the future.

No, the choice is always more nuanced than that.

However, if you believe that the choice is binary, how's this for a measure: world's largest advertising and tracking company with the world's most dominant browser should not be able to just shove whatever it wants into the browser with full disregard for any and all concerns.

Re: Show HN: DualShock calibration in the browser using WebHID

#78

Post by hnburnsy »

AgentME wrote: post #65
hnburnsy wrote: post #62

Earlier quoted context omitted.

Are these really the job of your browser?

The browser is a great for distribution (apps are just URLs) and security (web pages need to ask permission before accessing anything on your computer outside of their domain). More people should question the common belief that desktop OSes (without enforced app sandboxing) do a proper job at being a platform for utilities like OP's. When you download and run an .exe on a normal Windows pc, you're giving it read and…

With all the APIs available to the browser at what point do I have the same worry that an .exe brings?

Re: Show HN: DualShock calibration in the browser using WebHID

#79

Post by aidenn0 »

ultimatt42 wrote: post #46
aidenn0 wrote: post #42

Does this mean that a malicious website could intentionally miscalibrate any HID devices connected, or does it ask for permissions?

The site has to request permission to access a device, then the user has to select the device from a permission dialog to grant access.

Good; that's way better than being able to reflash your PS4 controllers with a drive-by.

Re: Show HN: DualShock calibration in the browser using WebHID

#80

Post by AgentME »

hnburnsy wrote: post #78
AgentME wrote: post #65

Earlier quoted context omitted.

The browser is a great for distribution (apps are just URLs) and security (web pages need to ask permission before accessing anything on your computer outside of their domain). More people should question the common belief that desktop OSes (without enforced app sandboxing) do a proper job at being a platform for utilities like OP's. When you download and run an .exe on a normal Windows pc, you're giving it read and…

With all the APIs available to the browser at what point do I have the same worry that an .exe brings?

Web pages can't do anything that affects the rest of your system without going through a permission dialog, and the permissions are always very granular. A page can't trigger a yes/no permission dialog to get access to all of your files; it can only trigger a file-picker that gives it access to whatever the user picks in it. An .exe doesn't need to go through any permission dialog to upload/wipe/infect any file in your home directory.
Post reply on HN