6 ms·

The existence of WebUSB is awful. Why anyone ever thought it was a good idea to let JavaScript touch your USB devices is beyond me.

emilfihlman 9y ago
...Wat. What you said is wrong on so many levels.
- omni 9y ago
  This comment added nothing, in the future please consider offering substantive criticisms.
Ajedi32 9y ago
It's simple: allowing sandboxed code to request limited access to a USB device is more secure than having users install native, unsandboxed code with access to everything on their PC.
- tedunangst 9y ago
  Assuming the sandbox works. If the sandbox is porous, the attack surface balloons from apps I choose to install to every link I click.
  - Ajedi32 9y ago
    Not every link you click. Only sites that you grant access to the necessary attack surface. The Web USB API can't be attacked by sites that you haven't granted access to it.
    - codedokode 9y ago
      What if that privileged website has XSS vulnerability?
      - Ajedi32 9y ago
        Then the attacker gets access to that USB device. (And only that USB device.) What if your unsandboxed native USB utility has an RCE vulnerability?
- Sir_Cmpwn 9y ago
  https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chromium https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chromium
  - Ajedi32 9y ago
    As opposed to native desktop apps, which get all the same permissions by default that a web app requires a zero-day sandbox escape vulnerability to achieve?
    - Sir_Cmpwn 9y ago
      Native desktop apps are limited in number are nowhere near the dumpster fire the web is. My desktop isn't routinely downloading and executing payloads from the web. They're clearly different.
      - Ajedi32 9y ago
        This is about the Web USB API, not the entire web in general. Are you routinely granting web pages access to your USB devices? That's not a permission that web apps get by default (unlike with native desktop apps btw). It comes down to this: if you ever found yourself in a situation where you needed to connect a USB device to a remote service, would you prefer to download that service's unsandboxed native code to your PC and execute it? Or execute some JS in the browser sandbox and grant it limited access to that one specific device?
        Sir_Cmpwn 9y ago
        >if you ever found yourself in a situation where you needed to connect a USB device to a remote service I have never found myself in that situation. That sounds like a really silly idea.
        Spivak 9y ago
        Attaching a bootable USB drive to a HTML5 based KVM? Sure it could be accomplished in other ways buy why not this way?
blitmap 9y ago
Strongly disagree here. I think WebUSB will enable a lot of cool things, though it will definitely be hard to sandbox. I want to program an Arduino from a web IDE. I want to control a 3d printer or pen plotter from a web application. I want to store things on a flash drive on my iPhone using a web-based file explorer? This last one sounds strange. On a tangent, I see application runtimes moving into the browser by default with very few performance-critical applications remaining outside that stack. Photoshop and AAA games might be exceptions. Services like databases and web browsers would not have a need to be in Chrome. (don't hurt me, I know I'm strange.. ~)
- Skunkleton 9y ago
  Why do you want to use a Web IDE? I am not trying to cause tension, I am just genuinely curious.
  - dgacmu 9y ago
    For me: teaching! Getting 400 students up and running with python is painful alone - without USB. For projects, some small fraction of those used USB, and we again had a pretty good chunk of time spent getting them all working.
    - avian 9y ago
      I would think that getting Python up and running is a valuable lesson.
- heroprotagonist 9y ago
  Considering your use cases, why not simply require an extra step in the browser to enable it instead of turning it on for all users? EG, take a few seconds to turn on a flag in configuration, or add a plugin.
  - X-Cubed 9y ago
    There is a permission prompt that appears, websites can't use the WebUSB functionality until you allow them too.
powvans 9y ago
I worked for an online retailer a long long time ago and this would have been nice to have at our packstations. The tech at each station consisted of a Linux desktop, a barcode scanner, a printer, and a scale. The commerce platform was web based and displayed the current weight on the scale on the pack page. Originally the scale was connected via serial port to the desktop. A little Perl service we called "the scale daemon" exposed the current weight on some localhost port. The backend would constantly poll that service and the web browser would poll the backend to keep the value on the page up to date. It was a nifty solution albeit a bit clumsy and it meant running an extra piece of software on 50+ machines in a warehouse. At some point our scale vendor stopped selling scales with serial connections or maybe it was that the PC vendor stopped including serial ports. It was 10+ years ago and I can't recall exactly. What I do remember is that the guy that wrote the scale daemon had moved on and I had to figure out how to make it work with USB. It was fun and probably not as hard as it seemed at the time, but wow, being able to get at that scale from inside the browser would have massively simplified things.

emilfihlman 9y ago

...Wat. What you said is wrong on so many levels.

omni 9y ago
This comment added nothing, in the future please consider offering substantive criticisms.

Ajedi32 9y ago

It's simple: allowing sandboxed code to request limited access to a USB device is more secure than having users install native, unsandboxed code with access to everything on their PC.

tedunangst 9y ago
Assuming the sandbox works. If the sandbox is porous, the attack surface balloons from apps I choose to install to every link I click.
- Ajedi32 9y ago
  Not every link you click. Only sites that you grant access to the necessary attack surface. The Web USB API can't be attacked by sites that you haven't granted access to it.
  - codedokode 9y ago
    What if that privileged website has XSS vulnerability?
    - Ajedi32 9y ago
      Then the attacker gets access to that USB device. (And only that USB device.) What if your unsandboxed native USB utility has an RCE vulnerability?
Sir_Cmpwn 9y ago
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chromium https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chromium
- Ajedi32 9y ago
  As opposed to native desktop apps, which get all the same permissions by default that a web app requires a zero-day sandbox escape vulnerability to achieve?
  - Sir_Cmpwn 9y ago
    Native desktop apps are limited in number are nowhere near the dumpster fire the web is. My desktop isn't routinely downloading and executing payloads from the web. They're clearly different.
    - Ajedi32 9y ago
      This is about the Web USB API, not the entire web in general. Are you routinely granting web pages access to your USB devices? That's not a permission that web apps get by default (unlike with native desktop apps btw). It comes down to this: if you ever found yourself in a situation where you needed to connect a USB device to a remote service, would you prefer to download that service's unsandboxed native code to your PC and execute it? Or execute some JS in the browser sandbox and grant it limited access to that one specific device?
      - Sir_Cmpwn 9y ago
        >if you ever found yourself in a situation where you needed to connect a USB device to a remote service I have never found myself in that situation. That sounds like a really silly idea.
        Spivak 9y ago
        Attaching a bootable USB drive to a HTML5 based KVM? Sure it could be accomplished in other ways buy why not this way?

blitmap 9y ago

Strongly disagree here. I think WebUSB will enable a lot of cool things, though it will definitely be hard to sandbox. I want to program an Arduino from a web IDE. I want to control a 3d printer or pen plotter from a web application. I want to store things on a flash drive on my iPhone using a web-based file explorer? This last one sounds strange. On a tangent, I see application runtimes moving into the browser by default with very few performance-critical applications remaining outside that stack. Photoshop and AAA games might be exceptions. Services like databases and web browsers would not have a need to be in Chrome. (don't hurt me, I know I'm strange.. ~)

Skunkleton 9y ago
Why do you want to use a Web IDE? I am not trying to cause tension, I am just genuinely curious.
- dgacmu 9y ago
  For me: teaching! Getting 400 students up and running with python is painful alone - without USB. For projects, some small fraction of those used USB, and we again had a pretty good chunk of time spent getting them all working.
  - avian 9y ago
    I would think that getting Python up and running is a valuable lesson.
heroprotagonist 9y ago
Considering your use cases, why not simply require an extra step in the browser to enable it instead of turning it on for all users? EG, take a few seconds to turn on a flag in configuration, or add a plugin.
- X-Cubed 9y ago
  There is a permission prompt that appears, websites can't use the WebUSB functionality until you allow them too.

powvans 9y ago

I worked for an online retailer a long long time ago and this would have been nice to have at our packstations. The tech at each station consisted of a Linux desktop, a barcode scanner, a printer, and a scale. The commerce platform was web based and displayed the current weight on the scale on the pack page. Originally the scale was connected via serial port to the desktop. A little Perl service we called "the scale daemon" exposed the current weight on some localhost port. The backend would constantly poll that service and the web browser would poll the backend to keep the value on the page up to date. It was a nifty solution albeit a bit clumsy and it meant running an extra piece of software on 50+ machines in a warehouse. At some point our scale vendor stopped selling scales with serial connections or maybe it was that the PC vendor stopped including serial ports. It was 10+ years ago and I can't recall exactly. What I do remember is that the guy that wrote the scale daemon had moved on and I had to figure out how to make it work with USB. It was fun and probably not as hard as it seemed at the time, but wow, being able to get at that scale from inside the browser would have massively simplified things.