Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WebUSB Extension for Firefox

github.com

Post reply on HN
Print view View original

181–190 of 264 posts

Re: WebUSB Extension for Firefox

#181

Post by ocdtrekkie »

surajrmal wrote: post #173
ezst wrote: post #102

I was rather hostile towards WebUSB/Bluetooth for ideological reasons, until I came across some cool apps like a climbing board control app (Bluetooth) or a netMD (to transfer to minidisks, via USB), which I would have found overkill to install a "hard App" for. I'm glad that there's an option for Firefox at last.

There is a host of software that only runs on Windows which can now run on any os with webusb. It's a glorious improvement

It just can't run on any device with a security policy in place.

Re: WebUSB Extension for Firefox

#182

Post by inetknght »

ezst wrote: post #102

I was rather hostile towards WebUSB/Bluetooth for ideological reasons, until I came across some cool apps like a climbing board control app (Bluetooth) or a netMD (to transfer to minidisks, via USB), which I would have found overkill to install a "hard App" for. I'm glad that there's an option for Firefox at last.

> I would have found overkill to install a "hard App" for

Hope you enjoy that same sentiment is 20 years when the website to control/manage your device doesn't exist/was bought out/whatever.

Re: WebUSB Extension for Firefox

#183

Post by spankalee »

colechristensen wrote: post #168
goodmythical wrote: post #163

Earlier quoted context omitted.

w3m, lynks, elinks? falkon? I'm not sure what you mean given that JS and CSS account for at least half of the kitchen sink. Hell, wasn't there someone that implemented an entire OS stack in CSS?

My point is a new standard, document format, and browser that doesn't have the capabilities which limits publishers to ... not what we have now. The existence of elinks which is marginally useful on the modern web doesn't make the cut nor do tools to un-shitify the existing web.

What's the difference between that and a subset of what we have now, without, say WebUSB?

Re: WebUSB Extension for Firefox

#184

Post by Rohansi »

ninkendo wrote: post #178
uyzstvqs wrote: post #171

WebUSB has been used by projects like GrapheneOS, ESPHome, and Meshtastic. Google has used WebUSB to let users convert Stadia controllers to regular bluetooth input devices. Some manufacturers of keyboards use WebUSB for their configuration utilities. It's an incredibly useful API, and it's secure. You have to explicitly pick a device to give access to. Mozilla's attitude in refusing to natively implement it seems ne…

Honestly, an extension seems like the perfect solution for this. Wanting a website to access your USB stack directly (or Bluetooth, which has a similar standard) is such an extremely niche use case that it’s probably better for it to be available only as an opt-in extension. They can still standardize it, but… let me just not have it by default please. On iOS, there’s a “Bluetooth browser” app which is basically a si…

> Wanting a website to access your USB stack directly (or Bluetooth, which has a similar standard) is such an extremely niche use case that it’s probably better for it to be available only as an opt-in extension.

It doesn't give direct access. You go through the browser which restricts what you can use it to touch (eg. can't access USB drives). The user also needs to choose which USB device to allow access to before you can do anything.

> More of the enormous bloated JS web API specs should be implemented as browser plugins.

Then you'll get one of two outcomes: 1. Users install extensions without caring about what they do. I don't see why we should train people to install more extensions when there are already a lot of malicious extensions! 2. Hardware manufacturers decide to not adopt these standards and continue shipping executables for everything, which are not sandboxed at all and don't support all platforms

Re: WebUSB Extension for Firefox

#185

Post by colechristensen »

spankalee wrote: post #183
colechristensen wrote: post #168

Earlier quoted context omitted.

My point is a new standard, document format, and browser that doesn't have the capabilities which limits publishers to ... not what we have now. The existence of elinks which is marginally useful on the modern web doesn't make the cut nor do tools to un-shitify the existing web.

What's the difference between that and a subset of what we have now, without, say WebUSB?

I'm talking about no javascript, no additional requests besides the bare document, no sending any information back home. Dynamic behavior only by a simple declarative language.

Re: WebUSB Extension for Firefox

#186

Post by thayne »

crtasm wrote: post #175
QuantumNomad_ wrote: post #107

Earlier quoted context omitted.

Same here, was skeptical at first but then I used a web app that supports WebUSB to configure my mechanical keyboard and it lets you flash the firmware right there from the browser and that’s pretty nice and convenient. https://www.zsa.io/flash Even before WebUSB, I was using ZSA Oryx to create my keyboard layout for my first ZSA keyboard. But back then I had to download the file and then flash it using a dedicated p…

is anyone making backups of these webapps? my keyboard uses one for everything, I've been meaning to learn how to host a local copy for when the website inevitably gets shut down

Oryx is proprietary, but vial[1] is open source and has similar functionality. It still uses web technology though, so you either need a chromium based browser, or electron to use it (or maybe Firefox with this extension).

https://get.vial.today/

Re: WebUSB Extension for Firefox

#187

Post by bigfishrunning »

tredre3 wrote: post #118
bigfishrunning wrote: post #62

Earlier quoted context omitted.

It's about the same. People will blindly click allow on a webpage in the same way that they blindly run libusb binaries with `sudo` that they copied from some webpage. Security is possible in all of these scenarios, but always undermined by the users.

> It's about the same. It's absolutely not the same. If I go to a WebUSB page to make my device work, it won't magically have access to all my private files and be able to upload them god knows where or to destroy them. Or access to my entire LAN. Or access to my other peripherals. Any local driver/software will be able to. (Yes I am familiar with sandboxing technologies, they still aren't the default way to distribu…

Yeah, but if you request webUSB access maliciously to some random device, an unsavvy user is likely to click ok without thinking about it. Its still very much a viable attack vector.

Re: WebUSB Extension for Firefox

#188

Post by b1temy »

zb3 wrote: post #7
Orygin wrote: post #2

No thanks. I'll accept it in my browser when they fix the security implications this raises, and when the Spec is no longer in draft.

What are the security implications this raises that downloading native programs (needed for example to flash my smartphone) doesn't raise?

> What are the security implications this raises

It increases attack surface area on the browser. Even if you do need to "accept" a connection for a device, this isn't foolproof. I imagine adding WebUSB is a non-insignificant amount of code, who's to say there isn't a bug/exploit introduced there somewhere, or a bypass for accepting device connections?

This would still be better than downloading random native programs since it's under the browser's sandbox, but not everyone would _ever_ need to do something that requires WebUSB/USB, so this is just adding attack surface area for a feature only a small percentage of people would ever use.

The solution is to use a smaller separate _trusted_ native program instead of bloating the web with everything just for convenience. But I understand that most are proprietary.

I say all this, but a part of me does think it's pretty cool I can distribute a web-app to people and communicate via WebUSB without having the user go through the process of downloading a native app. I felt the same way when I made a page on my website using WebBluetooth to connect to my fitness watch and make a graph of my heart rate solely with HTML and Javascript (and no Electron).

I'm just not too happy about the implications. Or maybe I'm just a cynic, and this is all fine.

Re: WebUSB Extension for Firefox

#189

Post by DANmode »

Gander5739 wrote: post #158
ezst wrote: post #102

I was rather hostile towards WebUSB/Bluetooth for ideological reasons, until I came across some cool apps like a climbing board control app (Bluetooth) or a netMD (to transfer to minidisks, via USB), which I would have found overkill to install a "hard App" for. I'm glad that there's an option for Firefox at last.

WebUSB is the main way to flash GrapheneOS onto a phone.

You can even do it from another Graphene phone!

One that’s been using Attestation, for bonus points.

Re: WebUSB Extension for Firefox

#190

Post by DANmode »

dylan604 wrote: post #78
lxgr wrote: post #72

Earlier quoted context omitted.

> Comments like this scare me. Sorry to hear that. I thought this was a safe space for hackers to express enthusiasm about pushing their own hardware and software further (and in this case even in a comparatively safe way). > I just have no faith in humanity, and do not understand why we think this is a good idea to give a browser this much access to local system resources. The browser already has all that access, it…

> I thought this was a safe space for hackers to express enthusiasm about pushing their own hardware and software further (and in this case even in a comparatively safe way). Nothing is preventing said experimentation nor discussion of it. I am merely offering my more conservative views of the situation as a contrast to the echo chamber gungho nature of the experimentation. Just because we can doesn't mean we should…

Honest question, dude:

have you used the thing in the wild?

Much like the Location API, it’s explicitly opt-in, and isolated.

How is it going to be weaponized?

That’s what to talk about here. I’d love to take part.

Post reply on HN