WebUSB Extension for Firefox • Hacker News Board

Re: WebUSB Extension for Firefox

#101

Post by bastawhiz » Mon, Apr 20, 2026, 6:36 PM UTC

Orygin wrote: post #76

afavour wrote: post #40

Earlier quoted context omitted.

When the alternative is downloading arbitrary executables I find the browser sandbox to be a reassurance.

Except the sandbox is a huge target already, and breaking it means any website can now access and mess with your usb devices. If you can develop an exploit for Chrome's WebUSB system, you potentially have millions upon millions of targets available. Downloading an arbitrary executable can be made safe (via multiple avenues: trust, anti virus software, audits, artifact signing, reproducible builds, etc) and once the s…

> trust, anti virus software, audits, artifact signing, reproducible builds, etc

My mom has six weather apps on her phone.

Re: WebUSB Extension for Firefox

#102

Post by ezst » Mon, Apr 20, 2026, 6:56 PM UTC

I was rather hostile towards WebUSB/Bluetooth for ideological reasons, until I came across some cool apps like a climbing board control app (Bluetooth) or a netMD (to transfer to minidisks, via USB), which I would have found overkill to install a "hard App" for. I'm glad that there's an option for Firefox at last.

Re: WebUSB Extension for Firefox

#103

Post by ezst » Mon, Apr 20, 2026, 6:59 PM UTC

charcircuit wrote: post #69

MisterTea wrote: post #61

As much as I understand the ease of deployment this brings people, it puts a massive amount of code between the device and the user. Will webusb software written today work in 5, 10, 15 years? Personally, I think webusb is a giant contraption.

In 5, 10, and 15 years LLMs will make maintaining the massive amount of code trivial.

If history is a lesson (of going from lower level to higher level programming languages), the exact opposite will happen: there'll just be so much stuff out there that any eventual gain in efficiency will be dwarfed in the grand scheme of things.

Re: WebUSB Extension for Firefox

#104

Post by sturbes » Mon, Apr 20, 2026, 6:59 PM UTC

BBC Microbit kids hardware platform uses WebUSB. It’s a game changer for introducing hardware to students. Just works. Makecode.microbit.org is the web IDE. Reference URLs for the code make sharing and debugging easy.

Re: WebUSB Extension for Firefox

#105

Post by ACCount37 » Mon, Apr 20, 2026, 6:59 PM UTC

lxgr wrote: post #74

nezza-_- wrote: post #39

WebUSB is so great. I can ship a cross-platform application that accesses a hardware device without having to deal with all the platform specifics, and with decent sandboxing of my driver. I think one way to make it more "secure" against unwitting users would be to only support WebUSB for devices that have a WebUSB descriptor - would allow "origin" checking.

Let's please not (or at most, add a scary warning for non-tagged devices), as this would break the use case for at least all retrocomputing.

Aren't most retrocomputing USB devices running open source firmware? Adding a descriptor "WebUSB supported" is a few commits and a firmware update away.

Re: WebUSB Extension for Firefox

#106

Post by dylan604 » Mon, Apr 20, 2026, 7:06 PM UTC

concinds wrote: post #92

dylan604 wrote: post #78

Earlier quoted context omitted.

> I thought this was a safe space for hackers to express enthusiasm about pushing their own hardware and software further (and in this case even in a comparatively safe way). Nothing is preventing said experimentation nor discussion of it. I am merely offering my more conservative views of the situation as a contrast to the echo chamber gungho nature of the experimentation. Just because we can doesn't mean we should…

I wouldn't describe it as "conservative" but as "pro-native-apps and anti-web-apps", which seems irrational in this day and age where "native apps" means platform lock-in by monopolies, less sandboxing and user-control than on the web, much more gatekeeping and control over published binaries, and these days the web app is usually a more private/secure alternative to the native app (which also bundles a marketing SDK…

I'm not saying pro-native-apps outright even if that might be what it gets boiled down as. I'm saying I do not trust anything that runs in a browser. I actively block as much nonsense as possible. I do not trust devs that write code to run in browsers. There's a lot of devs getting taken out in the blast radius, but the only way to be sure is to take off and nuke it from orbit. There are devs out there hell bent on writing malicious code. I am willing to take a stand and refuse to use things when the net result is negative. I do not use social media. I do not shop at Walmart. These are the decisions I'm willing to live with even if it makes life slightly less "easy" because I've made a moral decision to not open myself up to nonsense just to later ask "what happened...".

Re: WebUSB Extension for Firefox

#107

Post by QuantumNomad_ » Mon, Apr 20, 2026, 7:15 PM UTC

ezst wrote: post #102

I was rather hostile towards WebUSB/Bluetooth for ideological reasons, until I came across some cool apps like a climbing board control app (Bluetooth) or a netMD (to transfer to minidisks, via USB), which I would have found overkill to install a "hard App" for. I'm glad that there's an option for Firefox at last.

Same here, was skeptical at first but then I used a web app that supports WebUSB to configure my mechanical keyboard and it lets you flash the firmware right there from the browser and that’s pretty nice and convenient.

https://www.zsa.io/flash

Even before WebUSB, I was using ZSA Oryx to create my keyboard layout for my first ZSA keyboard. But back then I had to download the file and then flash it using a dedicated program on the computer. Now with WebUSB I could both create the layout for my new ZSA keyboard there, and flash it from there without any additional software other than a Chromium based desktop web browser.

Re: WebUSB Extension for Firefox

#108

Post by deeringc » Mon, Apr 20, 2026, 7:21 PM UTC

chillfox wrote: post #45

Well, this seems like a terrible idea. I really don't want websites to be able to access hardware. I am already uncomfortable with the webcam access.

I see this slightly differently. Before, if I wanted to be able to do something like flash firmware onto some device I would have to download some random C++ application and install and run it on my local machine. As well as having access to all of my USB devices, it also had access to everything else on my system's user context. I didn't have a way of running that code and only giving it access to a single USB device and nothing else. Now, I can avoid installing anything at all. I visit the project page and opt-in to some flashing flow that's running in a sandboxed env. When the app requests it, the browser asks me for permission and I get to choose exactly which USB device I want to give it access too. That's picking exactly the minimum "outside" access I want to give it, nothing more. It doesnt get to read/write other USB devices I didnt choose. I doesnt get to read/write to my filesystem. It doesnt get to call system APIs. It doesnt get to set itself to start at startup. It doesnt get to install an auto-updater. For me, this is a better security posture than installing random win32 apps.

Re: WebUSB Extension for Firefox

#109

Post by aitchnyu » Mon, Apr 20, 2026, 7:24 PM UTC

coupdejarnac wrote: post #58

Having WebUSB and WebBle everywhere would allow me to ship my IoT application via web only. That would be a win for my productivity, no more messing about with app store shenanigans.

Just heard of this. Still wondering if my fantasy CCTV DVR can serve a web app to my phone and stream the feed.

Hard to google, use "Web Bluetooth API" instead of webble

Re: WebUSB Extension for Firefox

#110

Post by eikenberry » Mon, Apr 20, 2026, 7:24 PM UTC

Retr0id wrote: post #5

Orygin wrote: post #2

No thanks. I'll accept it in my browser when they fix the security implications this raises, and when the Spec is no longer in draft.

The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.

The nice thing about USB devices is that they don't need native drivers. Hardware that requires native drivers for USB is pretty rare, at least for many common cases (keyboard, mice, controllers, joysticks, printers, dacs, headsets, cameras, ..), and are easy to avoid.

What product categories exist where all entries only work (over USB) with native drivers?