Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WebUSB Extension for Firefox

github.com

Post reply on HN
Print view View original

161–170 of 264 posts

Re: WebUSB Extension for Firefox

#161

Post by troupo »

strbean wrote: post #122
troupo wrote: post #43

Earlier quoted context omitted.

> their silly role in the security theater of “but what if our users are dumb” It's not security theater. If you go to Chromium settings -> Site settings -> permissions, and expand "additional permissions", you will see a total of 26 different permissions , each gated by the same generic "you want to use this" popup. Permission popup fatigue is quite real, and not a security theater. And that's on top of the usual qu…

They should just add a "Security Console", with black background and green text, and a simple shell interface for enabling/disabling flags that gate whether these requests are automatically denied or create a permissions popup. Anything dangerous starts disable by default. Short of crippling capabilities to save dumb users, the best we can do is make the process scary enough that Grandma won't do it without calling h…

Yup, I would agree to an about:config

Re: WebUSB Extension for Firefox

#162

Post by dylan604 »

lxgr wrote: post #142
dwaite wrote: post #136

Earlier quoted context omitted.

Sure, but some people are concerned about any website being one confirmation prompt away from being able to have full access to hardware in the user's physical environment, and being able to permanently change the behavior of that hardware. A hacker may think such things are convenient for them, but an end user does not know the ramification of a random website (WebUSB IIRC still does not have origin restrictions) ge…

What physical access and what permanent behavior changes in particular are you concerned about? Most common "dangerous" USB device classes are explicitly excluded in Web USB. I've heard about rogue keyboard firmware, but that requires having a programmable/updatable firmware keyboard in the first place. And that closes the loop of my argument: People that want to update the firmware in their keyboard will do so, whet…

The most important USB thing I have are storage devices. Keyboards/mice/etc are much less of a concern. If something rogue happens to a drive, that's a "major problem in Australia. Please help us stop it" situation.

Re: WebUSB Extension for Firefox

#163

Post by goodmythical »

hollerith wrote: post #140
angra_mainyu wrote: post #119

Earlier quoted context omitted.

nyxt? helium? midori? There are hundreds of browsers these days, you shouldn't have a hard time finding one that fits your needs.

No offense, but you don't get it.

w3m, lynks, elinks? falkon?

I'm not sure what you mean given that JS and CSS account for at least half of the kitchen sink.

Hell, wasn't there someone that implemented an entire OS stack in CSS?

Re: WebUSB Extension for Firefox

#165

Post by lxgr »

dylan604 wrote: post #157
lxgr wrote: post #151

Earlier quoted context omitted.

Sure, you do what works for you. But why advocate for even more limits to how other people use their computers? One person's nonsense is another person's treasured hobby. Yes, bad actors exist, but why concede every single nice thing to them?

again, net negative is being glossed over. whatever good and nice things there might be, if it is being used more for negative purposes, you need to consider is it worth it at all or was it rushed and needing more thought before the PoC was pushed to prod

How can you tell that the negatives were glossed over? Just by WebUSB's eventual launch? Have you considered that different people might have different value preferences than you?

Re: WebUSB Extension for Firefox

#166

Post by lxgr »

dylan604 wrote: post #162
lxgr wrote: post #142

Earlier quoted context omitted.

What physical access and what permanent behavior changes in particular are you concerned about? Most common "dangerous" USB device classes are explicitly excluded in Web USB. I've heard about rogue keyboard firmware, but that requires having a programmable/updatable firmware keyboard in the first place. And that closes the loop of my argument: People that want to update the firmware in their keyboard will do so, whet…

The most important USB thing I have are storage devices. Keyboards/mice/etc are much less of a concern. If something rogue happens to a drive, that's a "major problem in Australia. Please help us stop it" situation.

That would indeed be horrible, which is why storage devices are explicitly excluded from WebUSB.

Re: WebUSB Extension for Firefox

#167

Post by traderj0e »

flexagoon wrote: post #148
traderj0e wrote: post #123

Earlier quoted context omitted.

It's fine as an extension, not so much as a default-enabled feature. We got the best outcome here. Edit: Wait, no we didn't. Chrome added WebUSB support after all. Wtf I'm disabling that

> not so much as a default-enabled feature. The browser opens a popup asking you if you want to grant access to a specific device for a specific website, it's not like random websites can just run adb commands on your phone

Yeah but still, I'd want that to only remotely be a thing. Like require enabling a developer setting for it.

Re: WebUSB Extension for Firefox

#168

Post by colechristensen »

goodmythical wrote: post #163
hollerith wrote: post #140

Earlier quoted context omitted.

No offense, but you don't get it.

w3m, lynks, elinks? falkon? I'm not sure what you mean given that JS and CSS account for at least half of the kitchen sink. Hell, wasn't there someone that implemented an entire OS stack in CSS?

My point is a new standard, document format, and browser that doesn't have the capabilities which limits publishers to ... not what we have now.

The existence of elinks which is marginally useful on the modern web doesn't make the cut nor do tools to un-shitify the existing web.

Re: WebUSB Extension for Firefox

#169

Post by jasomill »

ezst wrote: post #102

I was rather hostile towards WebUSB/Bluetooth for ideological reasons, until I came across some cool apps like a climbing board control app (Bluetooth) or a netMD (to transfer to minidisks, via USB), which I would have found overkill to install a "hard App" for. I'm glad that there's an option for Firefox at last.

This, more than ideology or security, is one of the main reasons I don't want WebUSB: fear that many hardware vendors will only support updates and configuration through a web app, that isn't guaranteed to remain online forever, may not be available to download and run locally, and may require installing otherwise undesirable firmware updates to maintain compatibility with available versions of the web app.

I have many expensive USB devices (cameras, musical instruments, audio and MIDI interfaces, a spectrometer) that are still useful despite being over a decade old; most will remain useful until the hardware fails. It'd be a shame if they required a long-lost web app to configure or control.

Re: WebUSB Extension for Firefox

#170

Post by monocasa »

catfood wrote: post #99
Zopieux wrote: post #38

And Web Serial reached mainline Firefox last week. I hope Mozilla can eventually stop playing their silly role in the security theater of “but what if our users are dumb” and actually deliver those "power-user" features that would allow me to uninstall Chrome for good. Oh, and also, --app= flag please.

>And Web Serial reached mainline Firefox last week. That's good news. I wish FF wasn't so conservative... they're missing a lot of cool APIs. Sometimes I wonder who they think their audience is. I suppose they would know better than I would.

I think they see privacy as one of their primary valueadds, and are concerned about the privacy implications with exposing a (PAN) network to the internet that probably wasn't designed to be exposed to such an adversarial environment.
Post reply on HN