As much as I understand the ease of deployment this brings people, it puts a massive amount of code between the device and the user. Will webusb software written today work in 5, 10, 15 years? Personally, I think webusb is a giant contraption.
WebUSB Extension for Firefox
61–70 of 264 posts
Re: WebUSB Extension for Firefox
#62Earlier quoted context omitted.
You can have userspace drivers for usb devices in Linux
How does the security of userspace drivers compare to having drivers within a sandboxed web environment with access to only the devices you’ve explicitly allowlisted?
It's about the same. People will blindly click allow on a webpage in the same way that they blindly run libusb binaries with `sudo` that they copied from some webpage. Security is possible in all of these scenarios, but always undermined by the users.
Re: WebUSB Extension for Firefox
#63Earlier quoted context omitted.
The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.
The security implications if this goes mainstream is that you are expected to do this for all kinds of hardware. Right now that isn't the case and I can't remember last the time I had to uninstall untrustworthy native drivers. A lot to lose, very little to gain?
So what is an example use case where you'd prefer to do X without using this particular tech?
Re: WebUSB Extension for Firefox
#64Earlier quoted context omitted.
The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.
The security implications if this goes mainstream is that you are expected to do this for all kinds of hardware. Right now that isn't the case and I can't remember last the time I had to uninstall untrustworthy native drivers. A lot to lose, very little to gain?
I felt that way too, but having used it a few devices as an end user I enjoy being able to close the browser and have the whole stack disappear. Instead of having to install a creepy Logitech tool to pair a mouse with a receiver, as soon as that task is done, goodbye Logitech. I guess a real concern is manufacturers stop offering native drivers, but for the majority of hardware the PnP or the Linux kernel just handle it.
Re: WebUSB Extension for Firefox
#65So we can’t trust simple things like back-button hijacking, so let’s open up access to all attached hardware. Sounds stupid.
Re: WebUSB Extension for Firefox
#66I really don't understand the use case. Why would I want hardware that I own to be managed by a web app that could disappear?
Re: WebUSB Extension for Firefox
#67Earlier quoted context omitted.
This is not just an isolated incident, it's the whole trend of limiting capabilities in the name of security and that's what I was referring to. However in this particular case, even the security argument doesn't hold, either I: a) know that I want to use USB - in that case I'll switch browsers or download a native binary (even more unsafe), it's not that I'd decide that I no longer want to flash my smartphone b) I d…
So instead of using trusted vendors or requiring tools with auditable code, we just allow everyone to be able to access the user’s devices?
What a concept. We could call it "Personal Computing."
Re: WebUSB Extension for Firefox
#68I recently flashed GrapheneOS on a Pixel for a friend. I was very surprised that you can do this entire process from the browser using WebUSB - the only downside being that it required me to launch Chromium.
Web USB and Web Bluetooth are amazing. I've used the former for the excellent Web MiniDisc [1], and the latter to flash custom firmware [2] on cheap Xiaomi Bluetooth LE thermometer/hygrometer devices that Home Assistant can pick up. Truly opening new possibilities, since I wouldn't have been comfortable running some sketchy script or local binary. [1] https://web.minidisc.wiki/ [2] https://github.com/pvvx/ATC_MiTherm…
> Web USB and Web Bluetooth are amazing.
Comments like this scare me. Things look amazing when people with benevolent intentions are making interesting things, but as soon as someone with malevolent intentions does something that becomes the reason we can't have nice things people will start asking if this is something we should have actually done.
I just have no faith in humanity, and do not understand why we think this is a good idea to give a browser this much access to local system resources.
Re: WebUSB Extension for Firefox
#69As much as I understand the ease of deployment this brings people, it puts a massive amount of code between the device and the user. Will webusb software written today work in 5, 10, 15 years? Personally, I think webusb is a giant contraption.
In 5, 10, and 15 years LLMs will make maintaining the massive amount of code trivial.
Re: WebUSB Extension for Firefox
#70I recently flashed GrapheneOS on a Pixel for a friend. I was very surprised that you can do this entire process from the browser using WebUSB - the only downside being that it required me to launch Chromium.
I've used Firefox successfully twice. I have nextdns on my router, not sure if that helped.