Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WebUSB Extension for Firefox

github.com

Post reply on HN
Print view View original

201–210 of 264 posts

Re: WebUSB Extension for Firefox

#201

Post by KomoD »

cosmic_cheese wrote: post #138
tjoff wrote: post #50

Earlier quoted context omitted.

The security implications if this goes mainstream is that you are expected to do this for all kinds of hardware. Right now that isn't the case and I can't remember last the time I had to uninstall untrustworthy native drivers. A lot to lose, very little to gain?

There's a real risk of losing the ability to control your device if the manufacturer stops hosting their propertiary WebUSB app, too. Standard USB drivers aren't going to disappear from my disk and can be reverse engineered long after its manufacturer has dropped support or gone under.

My mouse uses a WebUSB app to configure stuff. I just downloaded all the files that it uses, and now I can use it offline.

> and can be reverse engineered long after its manufacturer has dropped support or gone under

Nothing really stops you from reverse-engineering a WebUSB app either.

Re: WebUSB Extension for Firefox

#202

Post by helterskelter »

QuantumNomad_ wrote: post #107
ezst wrote: post #102

I was rather hostile towards WebUSB/Bluetooth for ideological reasons, until I came across some cool apps like a climbing board control app (Bluetooth) or a netMD (to transfer to minidisks, via USB), which I would have found overkill to install a "hard App" for. I'm glad that there's an option for Firefox at last.

Same here, was skeptical at first but then I used a web app that supports WebUSB to configure my mechanical keyboard and it lets you flash the firmware right there from the browser and that’s pretty nice and convenient. https://www.zsa.io/flash Even before WebUSB, I was using ZSA Oryx to create my keyboard layout for my first ZSA keyboard. But back then I had to download the file and then flash it using a dedicated p…

Ugh, I hate this trend. I'm using ZMK on a wireless split Corne and I have to clone the ZMK config repo, edit the config, push to GitHub, use some GH Action to compile the firmware, download it, unpack it, and then flash it. WTF happened? This is a terrible workflow, and I was not able to get this done locally after spending an entire day on it. Why can't this shit just compile on my machine? How about I edit a text file...and then compile it without all the bullshit, like installing Docker, about three or four language-specific package managers which install things not vetted by my distro's maintainers and probably run some bash scripts fetched with curl? And honestly I'm not really comfortable running firmware compiled by the Microsoft, the company known for their stellar software quality and security. Really though, I'm surprised, this was my first time being exposed to this kind of insanity. House of fucking cards.

I'm not even criticizing ZMK, btw, this is just an unbelievably obnoxious workflow. Please, nobody do this. The anger is short-circuiting my brain.

Re: WebUSB Extension for Firefox

#203

Post by bauratynov »

WebUSB as an extension is the right approach. The security concern isn't the API itself — it's the default-on expectation that Chrome created. Firefox's model of "opt-in via extension" gives power users what they need without expanding the attack surface for everyone else.

  I've used WebUSB for flashing keyboard firmware and it's genuinely better than downloading random executables from GitHub.
  The permission model is more transparent than a native app that silently gets full USB access.

Re: WebUSB Extension for Firefox

#204

Post by darkwater »

cruffle_duffle wrote: post #191
inetknght wrote: post #182

Earlier quoted context omitted.

> I would have found overkill to install a "hard App" for Hope you enjoy that same sentiment is 20 years when the website to control/manage your device doesn't exist/was bought out/whatever.

How is it any different with downloadable firmware?

That you can keep the firmware, the program to install it and a snapshot of the whole operating system in your drawer, if you want?

Re: WebUSB Extension for Firefox

#205

Post by [deleted] »

helterskelter wrote: post #202
QuantumNomad_ wrote: post #107

Earlier quoted context omitted.

Same here, was skeptical at first but then I used a web app that supports WebUSB to configure my mechanical keyboard and it lets you flash the firmware right there from the browser and that’s pretty nice and convenient. https://www.zsa.io/flash Even before WebUSB, I was using ZSA Oryx to create my keyboard layout for my first ZSA keyboard. But back then I had to download the file and then flash it using a dedicated p…

Ugh, I hate this trend. I'm using ZMK on a wireless split Corne and I have to clone the ZMK config repo, edit the config, push to GitHub, use some GH Action to compile the firmware, download it, unpack it, and then flash it. WTF happened? This is a terrible workflow, and I was not able to get this done locally after spending an entire day on it. Why can't this shit just compile on my machine? How about I edit a text…

[deleted]

Re: WebUSB Extension for Firefox

#206

Post by Griffinsauce »

traderj0e wrote: post #167
flexagoon wrote: post #148

Earlier quoted context omitted.

> not so much as a default-enabled feature. The browser opens a popup asking you if you want to grant access to a specific device for a specific website, it's not like random websites can just run adb commands on your phone

Yeah but still, I'd want that to only remotely be a thing. Like require enabling a developer setting for it.

Why? The permission dialog is crystal clear.

Re: WebUSB Extension for Firefox

#207

Post by M95D »

nezza-_- wrote: post #39

WebUSB is so great. I can ship a cross-platform application that accesses a hardware device without having to deal with all the platform specifics, and with decent sandboxing of my driver. I think one way to make it more "secure" against unwitting users would be to only support WebUSB for devices that have a WebUSB descriptor - would allow "origin" checking.

> I can ship a cross-platform application

And you can also un-ship it whenever you want, leaving users with unusable devices they paid money for.

Re: WebUSB Extension for Firefox

#208

Post by freeCandy »

helterskelter wrote: post #202
QuantumNomad_ wrote: post #107

Earlier quoted context omitted.

Same here, was skeptical at first but then I used a web app that supports WebUSB to configure my mechanical keyboard and it lets you flash the firmware right there from the browser and that’s pretty nice and convenient. https://www.zsa.io/flash Even before WebUSB, I was using ZSA Oryx to create my keyboard layout for my first ZSA keyboard. But back then I had to download the file and then flash it using a dedicated p…

Ugh, I hate this trend. I'm using ZMK on a wireless split Corne and I have to clone the ZMK config repo, edit the config, push to GitHub, use some GH Action to compile the firmware, download it, unpack it, and then flash it. WTF happened? This is a terrible workflow, and I was not able to get this done locally after spending an entire day on it. Why can't this shit just compile on my machine? How about I edit a text…

If you use nix, building locally is as easy as running a single command once it's setup with https://github.com/lilyinstarlight/zmk-nix

Re: WebUSB Extension for Firefox

#209

Post by gmac »

This is great. It makes https://printervention.app (https://news.ycombinator.com/item?id=47677885) and the soon-to-be-released https://yes-we-scan.app work on Firefox.

It would be even greater if it were possible to avoid the two-step installation. It certainly used to be possible to ship a binary inside a Firefox extension (I did that here: https://mackerron.com/zot2bib/), but I guess they may have shut that capability down for security reasons?

Re: WebUSB Extension for Firefox

#210

Post by chillfox »

deeringc wrote: post #108
chillfox wrote: post #45

Well, this seems like a terrible idea. I really don't want websites to be able to access hardware. I am already uncomfortable with the webcam access.

I see this slightly differently. Before, if I wanted to be able to do something like flash firmware onto some device I would have to download some random C++ application and install and run it on my local machine. As well as having access to all of my USB devices, it also had access to everything else on my system's user context. I didn't have a way of running that code and only giving it access to a single USB devic…

ok, let me expand on why I don't like it...

It's making a niche rarely done use case safer at the cost of making the common case (browsing the web) less safe.

And yes, I am fully aware that I can not press the button that give random sites access... But the issue is it increases the attack surface and is yet another thing that I could get tricked by on a bad day.

The OS should really be able to run code like a firmware flash utility in a sandbox that only has access to one USB device... But instead of improving the OS we keep adding features to the browser which increases the attack surface.

I have a very long list of things I am unhappy about the OS allowing just any app to do, especially app installers/uninstallers should not be a thing.

Post reply on HN