Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WebUSB Extension for Firefox

github.com

Post reply on HN
Print view View original

111–120 of 264 posts

Re: WebUSB Extension for Firefox

#111

Post by crote »

QuantumNomad_ wrote: post #107
ezst wrote: post #102

I was rather hostile towards WebUSB/Bluetooth for ideological reasons, until I came across some cool apps like a climbing board control app (Bluetooth) or a netMD (to transfer to minidisks, via USB), which I would have found overkill to install a "hard App" for. I'm glad that there's an option for Firefox at last.

Same here, was skeptical at first but then I used a web app that supports WebUSB to configure my mechanical keyboard and it lets you flash the firmware right there from the browser and that’s pretty nice and convenient. https://www.zsa.io/flash Even before WebUSB, I was using ZSA Oryx to create my keyboard layout for my first ZSA keyboard. But back then I had to download the file and then flash it using a dedicated p…

The whole dance has been made significantly easier by the adoption of UF2 flashing by large parts of the custom keyboard hobby: the device temporarily pretends to be a USB storage device, so you can now download the file and drag&drop it to your device.

Still not quite WebUSB-easy, but a massive improvement over needing dedicated programming software!

Re: WebUSB Extension for Firefox

#112

Post by crote »

deeringc wrote: post #108
chillfox wrote: post #45

Well, this seems like a terrible idea. I really don't want websites to be able to access hardware. I am already uncomfortable with the webcam access.

I see this slightly differently. Before, if I wanted to be able to do something like flash firmware onto some device I would have to download some random C++ application and install and run it on my local machine. As well as having access to all of my USB devices, it also had access to everything else on my system's user context. I didn't have a way of running that code and only giving it access to a single USB devic…

Flashing was already solved by UF2, where the device-to-flash temporarily pretends to be a USB storage device. Giving raw USB access to to random websites for that is massively overkill.

I could understand it if you were trying to do realtime configuration of or interaction with some device like a printer or a Stream Deck, but something as trivial as firmware flashing?

Re: WebUSB Extension for Firefox

#113

Post by vishalontheline »

ezst wrote: post #102

I was rather hostile towards WebUSB/Bluetooth for ideological reasons, until I came across some cool apps like a climbing board control app (Bluetooth) or a netMD (to transfer to minidisks, via USB), which I would have found overkill to install a "hard App" for. I'm glad that there's an option for Firefox at last.

Another possible use-case: allowing your peripherals to talk to cloud gaming computers - like, a nice HOTAS setup for flight simulator on GeforceNow.

Re: WebUSB Extension for Firefox

#114

Post by michaelt »

afavour wrote: post #40
Orygin wrote: post #37

Earlier quoted context omitted.

Running directly in the browser is also not how I'd want to do USB.

When the alternative is downloading arbitrary executables I find the browser sandbox to be a reassurance.

Buddy if your "sandbox" lets code inside it replace your keyboard's firmware you don't have a sandbox.

Re: WebUSB Extension for Firefox

#115

Post by tredre3 »

crote wrote: post #111
QuantumNomad_ wrote: post #107

Earlier quoted context omitted.

Same here, was skeptical at first but then I used a web app that supports WebUSB to configure my mechanical keyboard and it lets you flash the firmware right there from the browser and that’s pretty nice and convenient. https://www.zsa.io/flash Even before WebUSB, I was using ZSA Oryx to create my keyboard layout for my first ZSA keyboard. But back then I had to download the file and then flash it using a dedicated p…

The whole dance has been made significantly easier by the adoption of UF2 flashing by large parts of the custom keyboard hobby: the device temporarily pretends to be a USB storage device, so you can now download the file and drag&drop it to your device. Still not quite WebUSB-easy, but a massive improvement over needing dedicated programming software!

Firmware updates with UF2 over the emulated mass storage aren't bad, I agree.

But config updates that way still suck. The best implementation I've seen will present you with an empty drive with a README explaining how to drop a uf2 + an editable config file that contains all options with comments.

That's definitely workable for us tech people, but it absolutely sucks for the vast majority of users (including us tech people). Just think about having to learn the syntax, or simple things like picking a color or mapping keys on a keyboard.

IMHO Mozilla should have at least adopted WebSerial. It wouldn't give the entire USB freedom, but it has fewer privacy and security concerns and devices would have make it work. But now it's too late, WebUSB has been adopted widely and Mozilla will eventually have to adopt it or perish.

Re: WebUSB Extension for Firefox

#116

Post by mlyle »

crote wrote: post #112
deeringc wrote: post #108

Earlier quoted context omitted.

I see this slightly differently. Before, if I wanted to be able to do something like flash firmware onto some device I would have to download some random C++ application and install and run it on my local machine. As well as having access to all of my USB devices, it also had access to everything else on my system's user context. I didn't have a way of running that code and only giving it access to a single USB devic…

Flashing was already solved by UF2, where the device-to-flash temporarily pretends to be a USB storage device. Giving raw USB access to to random websites for that is massively overkill. I could understand it if you were trying to do realtime configuration of or interaction with some device like a printer or a Stream Deck, but something as trivial as firmware flashing?

It's pretty common to pick a few config parameters, click, and flash a firmware that does the things you want.

Yes, you could make the configuration into a separate uf2 object that overwrites other bytes, but that's yucky.

The access is explicitly per device. Even for plain flashing, it's safer and simpler than to download and shuffle random files.

Re: WebUSB Extension for Firefox

#117

Post by tredre3 »

eikenberry wrote: post #110
Retr0id wrote: post #5

Earlier quoted context omitted.

The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.

The nice thing about USB devices is that they don't need native drivers. Hardware that requires native drivers for USB is pretty rare, at least for many common cases (keyboard, mice, controllers, joysticks, printers, dacs, headsets, cameras, ..), and are easy to avoid. What product categories exist where all entries only work (over USB) with native drivers?

> What product categories exist where all entries only work (over USB) with native drivers?

All the categories you've listed have products that require a companion application to configure things out of band, that the "universal" driver doesn't understand.

In the case of the four HID you've listed the app would be for configuring key mapping, macros, rgb, firmware updates.

Some webcams need apps to control things not exposed by the native driver (things like head tracking or more specific sensor control).

I'm not familiar with the market but I would imagine that many headsets and DACs nowadays have similar apps to tune EQs presets and the like.

Re: WebUSB Extension for Firefox

#118

Post by tredre3 »

bigfishrunning wrote: post #62
scottbez1 wrote: post #28

Earlier quoted context omitted.

How does the security of userspace drivers compare to having drivers within a sandboxed web environment with access to only the devices you’ve explicitly allowlisted?

It's about the same. People will blindly click allow on a webpage in the same way that they blindly run libusb binaries with `sudo` that they copied from some webpage. Security is possible in all of these scenarios, but always undermined by the users.

> It's about the same.

It's absolutely not the same. If I go to a WebUSB page to make my device work, it won't magically have access to all my private files and be able to upload them god knows where or to destroy them. Or access to my entire LAN. Or access to my other peripherals.

Any local driver/software will be able to. (Yes I am familiar with sandboxing technologies, they still aren't the default way to distribute apps outside of iOS/Android).

Re: WebUSB Extension for Firefox

#119

Post by angra_mainyu »

colechristensen wrote: post #97
Brian_K_White wrote: post #52

People are starting to ship even local apps only in the form of some html & js that only works on Chrome because only Chrome has webusb. Whether we like the idea of the browser having access to usb or not, I at least like even less the idea of being forced to install and use Chrome for the same reasons as the bad old days of being forced to use IE.

I still want to reinvent the web with a hypertext document reader that doesn't include the kitchen sink. I suppose with LLMs these days this is actually an achievable prototype.

nyxt? helium? midori?

There are hundreds of browsers these days, you shouldn't have a hard time finding one that fits your needs.

Re: WebUSB Extension for Firefox

#120

Post by michaelt »

eikenberry wrote: post #110
Retr0id wrote: post #5

Earlier quoted context omitted.

The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.

The nice thing about USB devices is that they don't need native drivers. Hardware that requires native drivers for USB is pretty rare, at least for many common cases (keyboard, mice, controllers, joysticks, printers, dacs, headsets, cameras, ..), and are easy to avoid. What product categories exist where all entries only work (over USB) with native drivers?

My USB wireless keyboard and mouse work just fine without vendor software, but if I ever lost the dongle and had to re-pair them with a different dongle, I'd need the vendor's software to do it.

My bluetooth headphones work just fine without vendor software, but apparently with an app I can adjust the audio to somehow make me better at playing computer games. I think it amplifies other players' footsteps or something? If I wanted that, I'd need the vendor's software to do it.

My PSU works just fine without vendor software, but includes a USB monitoring interface, which would let me see certain things like fan speeds, voltages and currents. Of course I can monitor most of those with my motherboard's existing sensors; and a dip in the 12v rail will power off the system before any monitoring could respond. But if I did want to use those features, I'd need the vendor's software to do it.

Despite my distrust for vendor software, I have even less trust for webusb. Partly that's because I'm a hater in general, but mostly it's because there are too many holes in the web browser's sandbox already - if things in the sandbox are re-flashing your keyboard firmware you've given up on sandboxing, you just haven't admitted it to yourself yet.

Post reply on HN