41–50 of 264 posts
No thanks. I'll accept it in my browser when they fix the security implications this raises, and when the Spec is no longer in draft.
And I'll just fire up a chrome instance which I specifically keep for when my daily driver firefox decides to spazz out and not implement basics in 2026 :'(
No thanks. I'll accept it in my browser when they fix the security implications this raises, and when the Spec is no longer in draft.
The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.
And Web Serial reached mainline Firefox last week. I hope Mozilla can eventually stop playing their silly role in the security theater of “but what if our users are dumb” and actually deliver those "power-user" features that would allow me to uninstall Chrome for good. Oh, and also, --app= flag please.
It's not security theater. If you go to Chromium settings -> Site settings -> permissions, and expand "additional permissions", you will see a total of 26 different permissions, each gated by the same generic "you want to use this" popup.
Permission popup fatigue is quite real, and not a security theater. And that's on top of the usual questions of implementation complexity etc.
No thanks. I'll accept it in my browser when they fix the security implications this raises, and when the Spec is no longer in draft.
What are the security implications this raises that downloading native programs (needed for example to flash my smartphone) doesn't raise?
1. Permission popups fatigue
2. Usually users select the apps they install, most sites are ephemeral. And yes, even with apps, especially on Android, people click through permission dialogs without looking because they are often too broad and confusing. With expected results such as exfiltrating user data.
Earlier quoted context omitted.
They can click everything away, so maybe educate them or buy an ios device for your relatives instead of breaking computing for everyone else.
> breaking computing for everyone else How is not implementing a Draft spec, which may compromise security badly, breaking computing? Overreacting much?
However in this particular case, even the security argument doesn't hold, either I:
a) know that I want to use USB - in that case I'll switch browsers or download a native binary (even more unsafe), it's not that I'd decide that I no longer want to flash my smartphone
b) I don't understand what's happening but I follow arbitrary instructions anyway - WebUSB changes nothing.
Earlier quoted context omitted.
How do you make sure that technically illiterate people don't just click away the requestDevice() popup? IMHO a browser offering device level USB access is a security nightmare and there is no way this can ever be made safe and convenient at the same time.
They can click everything away, so maybe educate them or buy an ios device for your relatives instead of breaking computing for everyone else.
So maybe don't populate the browser with dozens of features requiring permission popups?
Well, this seems like a terrible idea. I really don't want websites to be able to access hardware. I am already uncomfortable with the webcam access.
No thanks. I'll accept it in my browser when they fix the security implications this raises, and when the Spec is no longer in draft.
The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.
Right now that isn't the case and I can't remember last the time I had to uninstall untrustworthy native drivers.
A lot to lose, very little to gain?