21–30 of 264 posts
Earlier quoted context omitted.
The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.
you do know microsoft OS 2.0 descriptors are a thing, right? or that you can force the unknown device to use WinUSB but really most devices you want to interface to via webusb are CDC and DFU so.. problem solved?
Earlier quoted context omitted.
you do know microsoft OS 2.0 descriptors are a thing, right? or that you can force the unknown device to use WinUSB but really most devices you want to interface to via webusb are CDC and DFU so.. problem solved?
I'm unfamiliar with the Windows platform but that sounds like something that still requires executing code locally.
Anyway OS 2.0 descriptors are a custom USB descriptor that basically tells the device to use WinUSB as the driver. The burden then is in the application that will have to implement the read/writes to the endpoints instead of using higher level functions provided by the custom driver.
If you ever developed software with libUSB, using WinUSB on the windows side makes things super easy for cross platform development, and you don't have to go through all the pain to have a signed driver. Win-win in my book.
Earlier quoted context omitted.
you do know microsoft OS 2.0 descriptors are a thing, right? or that you can force the unknown device to use WinUSB but really most devices you want to interface to via webusb are CDC and DFU so.. problem solved?
.. or HID ( https://usevia.app/ , for programmable keyboards)
Earlier quoted context omitted.
And I'll just fire up a chrome instance which I specifically keep for when my daily driver firefox decides to spazz out and not implement basics in 2026 :'(
How do you make sure that technically illiterate people don't just click away the requestDevice() popup? IMHO a browser offering device level USB access is a security nightmare and there is no way this can ever be made safe and convenient at the same time.
Earlier quoted context omitted.
And I'll just fire up a chrome instance which I specifically keep for when my daily driver firefox decides to spazz out and not implement basics in 2026 :'(
How do you make sure that technically illiterate people don't just click away the requestDevice() popup? IMHO a browser offering device level USB access is a security nightmare and there is no way this can ever be made safe and convenient at the same time.
I recently flashed GrapheneOS on a Pixel for a friend. I was very surprised that you can do this entire process from the browser using WebUSB - the only downside being that it required me to launch Chromium.
Earlier quoted context omitted.
How do you make sure that technically illiterate people don't just click away the requestDevice() popup? IMHO a browser offering device level USB access is a security nightmare and there is no way this can ever be made safe and convenient at the same time.
Isn't that the same excuse Gooogle is using to lrevent folks from installing what they want on Android phones?
Earlier quoted context omitted.
The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.
You can have userspace drivers for usb devices in Linux
Earlier quoted context omitted.
The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.
On macOS, I think I've installed device drivers exactly once in the last decade, and they were for a weird printer.