Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WebUSB Extension for Firefox

github.com

Post reply on HN
Print view View original

151–160 of 264 posts

Re: WebUSB Extension for Firefox

#151

Post by lxgr »

dylan604 wrote: post #106
concinds wrote: post #92

Earlier quoted context omitted.

I wouldn't describe it as "conservative" but as "pro-native-apps and anti-web-apps", which seems irrational in this day and age where "native apps" means platform lock-in by monopolies, less sandboxing and user-control than on the web, much more gatekeeping and control over published binaries, and these days the web app is usually a more private/secure alternative to the native app (which also bundles a marketing SDK…

I'm not saying pro-native-apps outright even if that might be what it gets boiled down as. I'm saying I do not trust anything that runs in a browser. I actively block as much nonsense as possible. I do not trust devs that write code to run in browsers. There's a lot of devs getting taken out in the blast radius, but the only way to be sure is to take off and nuke it from orbit. There are devs out there hell bent on w…

Sure, you do what works for you. But why advocate for even more limits to how other people use their computers? One person's nonsense is another person's treasured hobby.

Yes, bad actors exist, but why concede every single nice thing to them?

Re: WebUSB Extension for Firefox

#152

Post by lxgr »

skybrian wrote: post #93
lxgr wrote: post #82

Earlier quoted context omitted.

Users will unfortunately click on absolutely anything that a trusted (deservedly or otherwise) source tells them to, and you won’t be able to reliable convince them otherwise with UX alone. This includes all “developers only”, “click 5 times” etc. UX interventions. You have to decide whether the feature warrants the remaining risk after all mitigations, or at least exceeds other, simpler attack vectors. I think in th…

I suppose if it’s being actively exploited, the next step would be to make users wait a day, like the plan to change how Android side loading works.

I'd be absolutely livid if my browser asked me to wait for a day before letting me firmware flash whatever new USB gadget just arrived in the mail.

Re: WebUSB Extension for Firefox

#153

Post by saghm »

QuantumNomad_ wrote: post #107
ezst wrote: post #102

I was rather hostile towards WebUSB/Bluetooth for ideological reasons, until I came across some cool apps like a climbing board control app (Bluetooth) or a netMD (to transfer to minidisks, via USB), which I would have found overkill to install a "hard App" for. I'm glad that there's an option for Firefox at last.

Same here, was skeptical at first but then I used a web app that supports WebUSB to configure my mechanical keyboard and it lets you flash the firmware right there from the browser and that’s pretty nice and convenient. https://www.zsa.io/flash Even before WebUSB, I was using ZSA Oryx to create my keyboard layout for my first ZSA keyboard. But back then I had to download the file and then flash it using a dedicated p…

That's the exact scenario I first found it useful as well, earlier this month. It's especially nice as someone used to there not being Linux options for stuff like this.

Re: WebUSB Extension for Firefox

#154

Post by lxgr »

chillfox wrote: post #45

Well, this seems like a terrible idea. I really don't want websites to be able to access hardware. I am already uncomfortable with the webcam access.

That's fortunately easily fixed: Don't grant them access!

But please don't tell other people what they should and shouldn't do on their own hardware.

The world has enough corporate walled gardens. I even enjoy using some of them sometimes, but the world would be a strictly worse place if these were the only remaining way to use computers.

Re: WebUSB Extension for Firefox

#155

Post by lxgr »

otterley wrote: post #84
lxgr wrote: post #77

Earlier quoted context omitted.

macOS allows USB access without installing a driver, so that's probably why. The "driver" is just part of the app.

That’s how most operating systems have worked for over two decades. Most OSes support USB devices that present themselves as HID, mass storage, audio, etc. without any dedicated drivers needed. It’s only specialized devices or functionality that tends to need additional drivers.

It's not even just USB classes that the OS provides a native driver for. I believe that on both iOS and macOS (not sure about newer Windows versions), you can essentially access USB as a byte streaming device.

If your app is the only one expected to communicate with a given device, you can then just directly embed the logic speaking that protocol in it. A driver is only needed if you want to provide a shared high-level abstraction to other applications as well.

Re: WebUSB Extension for Firefox

#156

Post by skydhash »

concinds wrote: post #92
dylan604 wrote: post #78

Earlier quoted context omitted.

> I thought this was a safe space for hackers to express enthusiasm about pushing their own hardware and software further (and in this case even in a comparatively safe way). Nothing is preventing said experimentation nor discussion of it. I am merely offering my more conservative views of the situation as a contrast to the echo chamber gungho nature of the experimentation. Just because we can doesn't mean we should…

I wouldn't describe it as "conservative" but as "pro-native-apps and anti-web-apps", which seems irrational in this day and age where "native apps" means platform lock-in by monopolies, less sandboxing and user-control than on the web, much more gatekeeping and control over published binaries, and these days the web app is usually a more private/secure alternative to the native app (which also bundles a marketing SDK…

> where "native apps" means platform lock-in by monopolies, less sandboxing and user-control than on the web, much more gatekeeping and control over published binaries, and these days the web app is usually a more private/secure alternative to the native app

Please add “mobile and/or proprietary” before “native apps”. Linux and BSD on PC are still very much free. The web as a platform is just a NIH effort.

Re: WebUSB Extension for Firefox

#157

Post by dylan604 »

lxgr wrote: post #151
dylan604 wrote: post #106

Earlier quoted context omitted.

I'm not saying pro-native-apps outright even if that might be what it gets boiled down as. I'm saying I do not trust anything that runs in a browser. I actively block as much nonsense as possible. I do not trust devs that write code to run in browsers. There's a lot of devs getting taken out in the blast radius, but the only way to be sure is to take off and nuke it from orbit. There are devs out there hell bent on w…

Sure, you do what works for you. But why advocate for even more limits to how other people use their computers? One person's nonsense is another person's treasured hobby. Yes, bad actors exist, but why concede every single nice thing to them?

again, net negative is being glossed over. whatever good and nice things there might be, if it is being used more for negative purposes, you need to consider is it worth it at all or was it rushed and needing more thought before the PoC was pushed to prod

Re: WebUSB Extension for Firefox

#158

Post by Gander5739 »

ezst wrote: post #102

I was rather hostile towards WebUSB/Bluetooth for ideological reasons, until I came across some cool apps like a climbing board control app (Bluetooth) or a netMD (to transfer to minidisks, via USB), which I would have found overkill to install a "hard App" for. I'm glad that there's an option for Firefox at last.

WebUSB is the main way to flash GrapheneOS onto a phone.

Re: WebUSB Extension for Firefox

#159

Post by Gander5739 »

Retr0id wrote: post #83
embedding-shape wrote: post #81

Earlier quoted context omitted.

Is there something specific in that process that required Web USB vs just normal USB? Sounds like phone makers could have done this since forever if they wanted to, what makes WebUSB particularly useful for this?

Native android apps can talk to regular USB devices, if granted the necessary permissions. But it's exposed through a Java api (and Kotlin I suppose, these days), which is fine, but it means you need to write your client logic twice. If you target the web, you can do it once. (Yes, you could try to bulid some common interface, libusb-style, but I think you'll have a bad time with minor behavioural differences, especi…

So you can't just use fastboot in termux, with https://github.com/nohajc/termux-adb, then?

Re: WebUSB Extension for Firefox

#160

Post by troupo »

oofdere wrote: post #137
troupo wrote: post #46

Earlier quoted context omitted.

> What are the security implications this raises that downloading native programs (needed for example to flash my smartphone) doesn't raise? 1. Permission popups fatigue 2. Usually users select the apps they install, most sites are ephemeral. And yes, even with apps, especially on Android, people click through permission dialogs without looking because they are often too broad and confusing. With expected results suc…

> Permission popups fatigue Native apps also have this, and it's worse because they usually just ask for sweeping admin access on windows, unlike WebUSB which just brings up a device selection menu

> Native apps also have this, and it's worse because they usually just ask for sweeping admin access on windows

On iOS they only pop up the menu when they try to access the required functionality, and there's a limited number of things they can do.

> unlike WebUSB which just brings up a device selection menu

So the user has to contend with permissions on phones, in desktop OSes, but 26 more potential permissions [1] from a browser are fine because a) it's just a single permission window and b) the browser exists in total vacuum from all other user experiences.

[1] Counted in Chrome settings -> Site settings -> permissions. Why Chrome? Because they are the ones pushing all the hardware APIs, among others

Post reply on HN