Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WebUSB Extension for Firefox

github.com

Post reply on HN
Print view View original

81–90 of 264 posts

Re: WebUSB Extension for Firefox

#81

Post by embedding-shape »

infogulch wrote: post #26
sva_ wrote: post #13

I recently flashed GrapheneOS on a Pixel for a friend. I was very surprised that you can do this entire process from the browser using WebUSB - the only downside being that it required me to launch Chromium.

You can flash GrapheneOS on a Pixel from another pixel , no pc required at all. I've done it several times, this is what sold me on the utility of WebUSB. You can use GOS' own distribution of chromium, Vanadium, if you have a GOS device and you want to avoid Chrome.

Is there something specific in that process that required WebUSB vs just normal USB? Sounds like phone makers could have done this since forever if they wanted to, what makes WebUSB particularly useful for this?

Re: WebUSB Extension for Firefox

#82

Post by lxgr »

suryajena wrote: post #75
dylan604 wrote: post #68

Earlier quoted context omitted.

> Web USB and Web Bluetooth are amazing. Comments like this scare me. Things look amazing when people with benevolent intentions are making interesting things, but as soon as someone with malevolent intentions does something that becomes the reason we can't have nice things people will start asking if this is something we should have actually done. I just have no faith in humanity, and do not understand why we think…

What if we implement them but hide them deep in the settings or as experimental feature inside the hidden developer menu, behind multiple warning messages and password prompts? Only the very determined developers and advanced users would be able to unlock them. Then it's safe enough?

Users will unfortunately click on absolutely anything that a trusted (deservedly or otherwise) source tells them to, and you won’t be able to reliable convince them otherwise with UX alone. This includes all “developers only”, “click 5 times” etc. UX interventions.

You have to decide whether the feature warrants the remaining risk after all mitigations, or at least exceeds other, simpler attack vectors.

I think in this case it does, but it’s not an easy decision and I can understand most opposing positions as well.

Re: WebUSB Extension for Firefox

#83

Post by Retr0id »

embedding-shape wrote: post #81
infogulch wrote: post #26

Earlier quoted context omitted.

You can flash GrapheneOS on a Pixel from another pixel , no pc required at all. I've done it several times, this is what sold me on the utility of WebUSB. You can use GOS' own distribution of chromium, Vanadium, if you have a GOS device and you want to avoid Chrome.

Is there something specific in that process that required Web USB vs just normal USB? Sounds like phone makers could have done this since forever if they wanted to, what makes WebUSB particularly useful for this?

Native android apps can talk to regular USB devices, if granted the necessary permissions. But it's exposed through a Java api (and Kotlin I suppose, these days), which is fine, but it means you need to write your client logic twice. If you target the web, you can do it once.

(Yes, you could try to bulid some common interface, libusb-style, but I think you'll have a bad time with minor behavioural differences, especially around permissions. libusb itself does ostensibly support Android but there are several caveats: https://github.com/libusb/libusb/wiki/Android#does-libusb-su... )

Re: WebUSB Extension for Firefox

#84

Post by otterley »

lxgr wrote: post #77
rafram wrote: post #18

Earlier quoted context omitted.

On macOS, I think I've installed device drivers exactly once in the last decade, and they were for a weird printer.

macOS allows USB access without installing a driver, so that's probably why. The "driver" is just part of the app.

That’s how most operating systems have worked for over two decades. Most OSes support USB devices that present themselves as HID, mass storage, audio, etc. without any dedicated drivers needed. It’s only specialized devices or functionality that tends to need additional drivers.

Re: WebUSB Extension for Firefox

#85

Post by [deleted] »

charcircuit wrote: post #69
MisterTea wrote: post #61

As much as I understand the ease of deployment this brings people, it puts a massive amount of code between the device and the user. Will webusb software written today work in 5, 10, 15 years? Personally, I think webusb is a giant contraption.

In 5, 10, and 15 years LLMs will make maintaining the massive amount of code trivial.

[deleted]

Re: WebUSB Extension for Firefox

#86

Post by [deleted] »

tjoff wrote: post #50
Retr0id wrote: post #5

Earlier quoted context omitted.

The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.

The security implications if this goes mainstream is that you are expected to do this for all kinds of hardware. Right now that isn't the case and I can't remember last the time I had to uninstall untrustworthy native drivers. A lot to lose, very little to gain?

[deleted]

Re: WebUSB Extension for Firefox

#87

Post by xeonmc »

mschuster91 wrote: post #55
1313ed01 wrote: post #17

Earlier quoted context omitted.

Sounds like something that could have a standalone usb-driver-container or special chromium fork for the 0.00001% of users that need it instead of bloating every browser with yet another niche API and the inevitable security holes it will bring.

People are already doing that in the experimental embedded world, and let me tell you, it's pain . True and utter pain. You're going to fight different versions of libusb's userland being installed, Windows/macOS/Linux kernel occupying the device with a default driver ( cough rtl_sdr) and a whole lot of other messes. Or some things aren't even available made using libusb. Think control applications for RGB lights in…

Let me guess, Razer which is known for auto-downloading kernel rootkits as soon you plug in your mouse? They’re basically the Riot Games of gaming peripherals.

Re: WebUSB Extension for Firefox

#88

Post by Shalomboy »

dylan604 wrote: post #68
lxgr wrote: post #35

Earlier quoted context omitted.

Web USB and Web Bluetooth are amazing. I've used the former for the excellent Web MiniDisc [1], and the latter to flash custom firmware [2] on cheap Xiaomi Bluetooth LE thermometer/hygrometer devices that Home Assistant can pick up. Truly opening new possibilities, since I wouldn't have been comfortable running some sketchy script or local binary. [1] https://web.minidisc.wiki/ [2] https://github.com/pvvx/ATC_MiTherm…

> Web USB and Web Bluetooth are amazing. Comments like this scare me. Things look amazing when people with benevolent intentions are making interesting things, but as soon as someone with malevolent intentions does something that becomes the reason we can't have nice things people will start asking if this is something we should have actually done. I just have no faith in humanity, and do not understand why we think…

There isn't much to fear here. Web Bluetooth has been around nearly ten years now and nothing monumental has sprung forth from it. It is wonderfully convenient to have at your fingertips, especially in the ChromeOS world, but it's not gonna turn everyone's devices into Flipper Zero targets.

Re: WebUSB Extension for Firefox

#89

Post by leptons »

dylan604 wrote: post #68
lxgr wrote: post #35

Earlier quoted context omitted.

Web USB and Web Bluetooth are amazing. I've used the former for the excellent Web MiniDisc [1], and the latter to flash custom firmware [2] on cheap Xiaomi Bluetooth LE thermometer/hygrometer devices that Home Assistant can pick up. Truly opening new possibilities, since I wouldn't have been comfortable running some sketchy script or local binary. [1] https://web.minidisc.wiki/ [2] https://github.com/pvvx/ATC_MiTherm…

> Web USB and Web Bluetooth are amazing. Comments like this scare me. Things look amazing when people with benevolent intentions are making interesting things, but as soon as someone with malevolent intentions does something that becomes the reason we can't have nice things people will start asking if this is something we should have actually done. I just have no faith in humanity, and do not understand why we think…

You can press a simple button on a webpage and it will install malware on your iPhone. Plenty of exploits have been out there for a long time.

Should we disallow clicking on anything on a webpage too?

WebUSB is no more risky than any other tech. You have to explicitly opt-in to use WebUSB on any site requesting access to it. And I'm sorry if someone's grandfather trusts a malicious website and gets hacked, but that isn't a reason to prevent the rest of us from using tech that enables functionality on non-malicious websites that serves a useful purpose.

Re: WebUSB Extension for Firefox

#90

Post by leptons »

dylan604 wrote: post #78
lxgr wrote: post #72

Earlier quoted context omitted.

> Comments like this scare me. Sorry to hear that. I thought this was a safe space for hackers to express enthusiasm about pushing their own hardware and software further (and in this case even in a comparatively safe way). > I just have no faith in humanity, and do not understand why we think this is a good idea to give a browser this much access to local system resources. The browser already has all that access, it…

> I thought this was a safe space for hackers to express enthusiasm about pushing their own hardware and software further (and in this case even in a comparatively safe way). Nothing is preventing said experimentation nor discussion of it. I am merely offering my more conservative views of the situation as a contrast to the echo chamber gungho nature of the experimentation. Just because we can doesn't mean we should…

>Sadly, someone else will and weaponize it in an uncontrollable manner.

Except it isn't "uncontrollable". You have to explicitly allow every single website to use WebUSB. Without that explicit allowance, the website can't access anything.

Plenty of things can be weaponized, even household utensils. Should we ban all forks?

The sky is not falling, and WebUSB is not going to cause it to fall.

Post reply on HN