[dead]
WebUSB Extension for Firefox
31–40 of 264 posts
Re: WebUSB Extension for Firefox
#32Earlier quoted context omitted.
They can click everything away, so maybe educate them or buy an ios device for your relatives instead of breaking computing for everyone else.
Fair, but remember that we are the Maybe an about:config switch to enable it would be enough to stop casuals from pwning their peripherals.
I’d be ok with an about:config switch, but given that many people will install anything, paste arbitrary text into terminals, and share their password/pin code with complete strangers for almost no reason, I think we need to stop making our tools less powerful in pursuit of an impossible goal.
Re: WebUSB Extension for Firefox
#33No thanks. I'll accept it in my browser when they fix the security implications this raises, and when the Spec is no longer in draft.
What are the security implications this raises that downloading native programs (needed for example to flash my smartphone) doesn't raise?
None. People will follow any instruction presented to them when they think it will get them something they want. Mozilla’s stance here is infuriating.
Re: WebUSB Extension for Firefox
#34Earlier quoted context omitted.
How do you make sure that technically illiterate people don't just click away the requestDevice() popup? IMHO a browser offering device level USB access is a security nightmare and there is no way this can ever be made safe and convenient at the same time.
You simply don't. This quest of saving idiots from themselves is not gaining anyone anything and meanwhile other people get more and more useless restrictions.
Or you can just not give a loaded shotgun to every browser user on the off chance they need to interact with 1 (one) usb device per year.
Re: WebUSB Extension for Firefox
#35I recently flashed GrapheneOS on a Pixel for a friend. I was very surprised that you can do this entire process from the browser using WebUSB - the only downside being that it required me to launch Chromium.
Web USB and Web Bluetooth are amazing. I've used the former for the excellent Web MiniDisc [1], and the latter to flash custom firmware [2] on cheap Xiaomi Bluetooth LE thermometer/hygrometer devices that Home Assistant can pick up.
Truly opening new possibilities, since I wouldn't have been comfortable running some sketchy script or local binary.
[1] https://web.minidisc.wiki/ [2] https://github.com/pvvx/ATC_MiThermometer
Re: WebUSB Extension for Firefox
#36Earlier quoted context omitted.
How do you make sure that technically illiterate people don't just click away the requestDevice() popup? IMHO a browser offering device level USB access is a security nightmare and there is no way this can ever be made safe and convenient at the same time.
They can click everything away, so maybe educate them or buy an ios device for your relatives instead of breaking computing for everyone else.
> breaking computing for everyone else
How is not implementing a Draft spec, which may compromise security badly, breaking computing?
Overreacting much?
Re: WebUSB Extension for Firefox
#37Looks to be a great proof of concept. No, running a standalone executable alongside the browser is not the way you'd want to do WebUSB. But it's great to see someone working on it.
Running directly in the browser is also not how I'd want to do USB.
Re: WebUSB Extension for Firefox
#38And Web Serial reached mainline Firefox last week.
I hope Mozilla can eventually stop playing their silly role in the security theater of “but what if our users are dumb” and actually deliver those "power-user" features that would allow me to uninstall Chrome for good. Oh, and also, --app= flag please.
Re: WebUSB Extension for Firefox
#39WebUSB is so great.
I can ship a cross-platform application that accesses a hardware device without having to deal with all the platform specifics, and with decent sandboxing of my driver.
I think one way to make it more "secure" against unwitting users would be to only support WebUSB for devices that have a WebUSB descriptor - would allow "origin" checking.
Re: WebUSB Extension for Firefox
#40Looks to be a great proof of concept. No, running a standalone executable alongside the browser is not the way you'd want to do WebUSB. But it's great to see someone working on it.
Running directly in the browser is also not how I'd want to do USB.
When the alternative is downloading arbitrary executables I find the browser sandbox to be a reassurance.