Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WebUSB Extension for Firefox

github.com

Post reply on HN
Print view View original

141–150 of 264 posts

Re: WebUSB Extension for Firefox

#141

Post by dwaite »

concinds wrote: post #92
dylan604 wrote: post #78

Earlier quoted context omitted.

> I thought this was a safe space for hackers to express enthusiasm about pushing their own hardware and software further (and in this case even in a comparatively safe way). Nothing is preventing said experimentation nor discussion of it. I am merely offering my more conservative views of the situation as a contrast to the echo chamber gungho nature of the experimentation. Just because we can doesn't mean we should…

I wouldn't describe it as "conservative" but as "pro-native-apps and anti-web-apps", which seems irrational in this day and age where "native apps" means platform lock-in by monopolies, less sandboxing and user-control than on the web, much more gatekeeping and control over published binaries, and these days the web app is usually a more private/secure alternative to the native app (which also bundles a marketing SDK…

The web and native app platforms have very different security models.

Nobody is vetting websites for you. There is no guarantee the same company operates a website today that did yesterday. There is no obvious distribution or regulatory authority instituting penalties for illegal actions (and often is no legal presence in a country when illegal actions take place).

That means for the web, every consent prompt has a large, sometimes even unbounded amount of harm behind it if the user picks incorrectly, and browsers have limited capacity to help them pick correctly outside of reactive block lists once substantial harm has been done and recognized.

This is why, for example, the major browsers have all moved to restricting web extensions behind their own review processes/stores, and put restrictions that make unaudited web extensions difficult to install outside of development workflows. The risk is just too great.

Chrome pushed many of these API early in the Chromebook product cycle, because their idea was that you would only build apps using web technologies. I somewhat doubt they would have pushed for WebUSB themselves if Chromebook started in its current state, where it primarily runs android apps and is about to transition to be android-based.

Re: WebUSB Extension for Firefox

#142

Post by lxgr »

dwaite wrote: post #136
lxgr wrote: post #72

Earlier quoted context omitted.

> Comments like this scare me. Sorry to hear that. I thought this was a safe space for hackers to express enthusiasm about pushing their own hardware and software further (and in this case even in a comparatively safe way). > I just have no faith in humanity, and do not understand why we think this is a good idea to give a browser this much access to local system resources. The browser already has all that access, it…

Sure, but some people are concerned about any website being one confirmation prompt away from being able to have full access to hardware in the user's physical environment, and being able to permanently change the behavior of that hardware. A hacker may think such things are convenient for them, but an end user does not know the ramification of a random website (WebUSB IIRC still does not have origin restrictions) ge…

What physical access and what permanent behavior changes in particular are you concerned about? Most common "dangerous" USB device classes are explicitly excluded in Web USB.

I've heard about rogue keyboard firmware, but that requires having a programmable/updatable firmware keyboard in the first place. And that closes the loop of my argument: People that want to update the firmware in their keyboard will do so, whether it's in the browser or by installing a potentially shady and not at all sandboxed third party application.

At least in the browser, permissions are time limited and scoped to explicitly granted devices.

> WebUSB IIRC still does not have origin restrictions

How would you even enforce these on the open web?

Re: WebUSB Extension for Firefox

#143

Post by michaelt »

sagarm wrote: post #128
michaelt wrote: post #114

Earlier quoted context omitted.

Buddy if your "sandbox" lets code inside it replace your keyboard's firmware you don't have a sandbox.

Programming your keyboard is actually a common case! See usevia.app

It is indeed common!

But a keyboard flashed with malicious firmware becomes an undetectable keylogger, a USB rubber ducky, and a virus-laden USB stick all in one.

The concept that someone would want to reflash their keyboard firmware, but wants a sandbox because they don't trust the firmware programmer makes no sense.

Re: WebUSB Extension for Firefox

#144

Post by lxgr »

dylan604 wrote: post #78
lxgr wrote: post #72

Earlier quoted context omitted.

> Comments like this scare me. Sorry to hear that. I thought this was a safe space for hackers to express enthusiasm about pushing their own hardware and software further (and in this case even in a comparatively safe way). > I just have no faith in humanity, and do not understand why we think this is a good idea to give a browser this much access to local system resources. The browser already has all that access, it…

> I thought this was a safe space for hackers to express enthusiasm about pushing their own hardware and software further (and in this case even in a comparatively safe way). Nothing is preventing said experimentation nor discussion of it. I am merely offering my more conservative views of the situation as a contrast to the echo chamber gungho nature of the experimentation. Just because we can doesn't mean we should…

> those creating the something "cool" simply because they would never fathom using the "cool" for "uncool" purposes

I can definitely imagine a ton of things going wrong with Web USB, and I think the spec authors did a pretty good job at bolting everything down that can be, while still shipping something actually capable at providing USB access.

And that's my point: Sure, fewer capabilities are always safer than more capabilities. But some capabilities are nice and arguably worth the risk, especially if the obvious alternative (blindly installing native applications) isn't much safer.

Re: WebUSB Extension for Firefox

#145

Post by colechristensen »

cosmic_cheese wrote: post #135
colechristensen wrote: post #97

Earlier quoted context omitted.

I still want to reinvent the web with a hypertext document reader that doesn't include the kitchen sink. I suppose with LLMs these days this is actually an achievable prototype.

Conversely, a web app platform that includes all the primitives that are needed to build a decent web app (as opposed to bring your own everything/building castles from grains of sand model) would be nice. It doesn't necessarily have to be a browser, though.

We had those (Flash, Shockwave, Java Applets, etc.), the browser won.

Nobody is going to win over browsers with an opinionated batteries included application framework.

Re: WebUSB Extension for Firefox

#146

Post by lxgr »

dwaite wrote: post #141
concinds wrote: post #92

Earlier quoted context omitted.

I wouldn't describe it as "conservative" but as "pro-native-apps and anti-web-apps", which seems irrational in this day and age where "native apps" means platform lock-in by monopolies, less sandboxing and user-control than on the web, much more gatekeeping and control over published binaries, and these days the web app is usually a more private/secure alternative to the native app (which also bundles a marketing SDK…

The web and native app platforms have very different security models. Nobody is vetting websites for you. There is no guarantee the same company operates a website today that did yesterday. There is no obvious distribution or regulatory authority instituting penalties for illegal actions (and often is no legal presence in a country when illegal actions take place). That means for the web, every consent prompt has a l…

> The web and native app platforms have very different security models.

Yes, and as a result, the web is much more sandboxed than native app stores (which are mostly based on the illusion that vetting apps can somehow achieve better security than minimizing what resources apps can access in the first place and making access more fine grained).

This is exactly why I'd rather run e.g. shady USB aftermarket firmware flashing apps in my browser (where I know they can at most compromise the device I'm flashing) than as a native app (where USB access is the default and requires zero permissions to be approved).

> This is why, for example, the major browsers have all moved to restricting web extensions behind their own review processes/stores, and put restrictions that make unaudited web extensions difficult to install outside of development workflows. The risk is just too great.

Web extensions very often have access to your complete browsing data, including all cookies. That's orders of magnitude more risky than access to an explicitly selected USB device, in my view.

> I somewhat doubt they would have pushed for WebUSB themselves if Chromebook started in its current state, where it primarily runs android apps and is about to transition to be android-based.

Android has an USB API as well, and if Google only wanted "apps" to have USB access, nothing was stopping them from making Web USB "Chrome App Store" only.

Re: WebUSB Extension for Firefox

#148

Post by flexagoon »

traderj0e wrote: post #123
ezst wrote: post #102

I was rather hostile towards WebUSB/Bluetooth for ideological reasons, until I came across some cool apps like a climbing board control app (Bluetooth) or a netMD (to transfer to minidisks, via USB), which I would have found overkill to install a "hard App" for. I'm glad that there's an option for Firefox at last.

It's fine as an extension, not so much as a default-enabled feature. We got the best outcome here. Edit: Wait, no we didn't. Chrome added WebUSB support after all. Wtf I'm disabling that

> not so much as a default-enabled feature.

The browser opens a popup asking you if you want to grant access to a specific device for a specific website, it's not like random websites can just run adb commands on your phone

Re: WebUSB Extension for Firefox

#149

Post by cosmic_cheese »

colechristensen wrote: post #145
cosmic_cheese wrote: post #135

Earlier quoted context omitted.

Conversely, a web app platform that includes all the primitives that are needed to build a decent web app (as opposed to bring your own everything/building castles from grains of sand model) would be nice. It doesn't necessarily have to be a browser, though.

We had those (Flash, Shockwave, Java Applets, etc.), the browser won. Nobody is going to win over browsers with an opinionated batteries included application framework.

Those all had major issues. All of them were constrained to a browser environment, the first two were proprietary and full of security holes, and all of them had a reputation for causing browser or even full OS crashes.

I wouldn't say that any of them were particularly "batteries included", either. Flash was probably closest but still left a lot of legwork to the developer.

Re: WebUSB Extension for Firefox

#150

Post by lxgr »

embedding-shape wrote: post #81
infogulch wrote: post #26

Earlier quoted context omitted.

You can flash GrapheneOS on a Pixel from another pixel , no pc required at all. I've done it several times, this is what sold me on the utility of WebUSB. You can use GOS' own distribution of chromium, Vanadium, if you have a GOS device and you want to avoid Chrome.

Is there something specific in that process that required Web USB vs just normal USB? Sounds like phone makers could have done this since forever if they wanted to, what makes WebUSB particularly useful for this?

Cross-platform compatibility comes to mind. WebUSB is available on macOS, Windows, and Android; a native Android app would pose a bootstrapping problem for a probably not insubstantial fraction of all potential users.
Post reply on HN