4 ms·

How can you build applications on the web that use Bluetooth or USB devices without these APIs? Here there is a lot of hate for web based applications but I th

by taf2 8y ago

How can you build applications on the web that use Bluetooth or USB devices without these APIs? Here there is a lot of hate for web based applications but I think this is because the web unlike native apps has a huge amount of transparency that means we can have solid debate about the approaches and solutions taken. In your closed source native app who knows what you chose for security, tracking and anything else about your app is not transparent. I always prefer web based applications over native. Native means I have far less trust in the application. Is it even using tls for network requests? So many things we can’t see in a native app.

michaelt 8y ago
How can you build applications on the web that use Bluetooth or USB devices without these APIs? Same way you use mice, keyboards, sound cards, printers, webcams and so on: a generic, secure interface supported by all device makers, OSes and browsers. The whole benefit of web apps is they demand less trust because they're better sandboxed. Poking holes in the sandbox (like WebUSB) makes web apps worse, not better.
- kilburn 8y ago
  Yeah, and if the powers that be (browser vendors) don't implement the generic interface you need (e.g.: signature tablets, cash drawers, NFC readers, memory card readers, etc.) then you: a) Don't do it and pivot your company to doing something else. b) Implement your own solution with companion native apps that build this missing bridge. Out of public scrutiny and with many times less resources, but hey: the browser is secure! ;)
baybal2 8y ago
>How can you build applications on the web that use Bluetooth or USB devices without these APIs? You simply don't
- seba_dos1 8y ago
  This shouldn't be downvoted. Web platform isn't a place for device usage like that, that's a Pandora's box.
angersock 8y ago
Web assembly trashes that idea of transparency. Also, maybe bluetooth and USB devices don't need to be on the net.
- acdha 8y ago
  > Web assembly trashes that idea of transparency Only if you believe minified JS is significantly easier to audit, which seems rather unlikely. In both cases, the thing which works is securing the capability rather than the code. Having generic USB support is risky but e.g. having mediated access to cameras and microphones has been fine.
  - angersock 8y ago
    We couldn't even trust JS devs with high-performance timers and SharedArrayBuffers without enabling attacks like Spectre and Meltdown. I find it highly unlikely we are going to be able to trust "mediated" access.
userbinator 8y ago
I always prefer web based applications over native. Native means I have far less trust in the application. Really? Web applications can essentially change at the whim of the owner or server(s) hosting them, every time you refresh the page. You have far more control and "transparency" over when a native application changes. Is it even using tls for network requests? So many things we can’t see in a native app. You're just not looking hard enough. ;-) As all the vulnerabilities discovered and exploited in closed-source software shows, along with those in open-source which have been there for many years without being discovered, whether the source is open or closed is nearly irrelevant. To quote the mentality of those who see beyond that debate, "Source code? We don't need no stinkin' source code!"
kilburn 8y ago
> How can you build applications on the web that use Bluetooth or USB devices without these APIs? Unfortunately, the only viable alternative right now is to install a companion native application. That companion app launches an (https/ws) server that talks to the device and exposes some api for your site to use through javascript. It is a disgusting can of worms, but if you squash them all you get a working system at the end.

by taf2 8y ago

michaelt 8y ago

How can you build applications on the web that use Bluetooth or USB devices without these APIs? Same way you use mice, keyboards, sound cards, printers, webcams and so on: a generic, secure interface supported by all device makers, OSes and browsers. The whole benefit of web apps is they demand less trust because they're better sandboxed. Poking holes in the sandbox (like WebUSB) makes web apps worse, not better.

kilburn 8y ago
Yeah, and if the powers that be (browser vendors) don't implement the generic interface you need (e.g.: signature tablets, cash drawers, NFC readers, memory card readers, etc.) then you: a) Don't do it and pivot your company to doing something else. b) Implement your own solution with companion native apps that build this missing bridge. Out of public scrutiny and with many times less resources, but hey: the browser is secure! ;)

baybal2 8y ago

>How can you build applications on the web that use Bluetooth or USB devices without these APIs? You simply don't

seba_dos1 8y ago
This shouldn't be downvoted. Web platform isn't a place for device usage like that, that's a Pandora's box.

angersock 8y ago

Web assembly trashes that idea of transparency. Also, maybe bluetooth and USB devices don't need to be on the net.

acdha 8y ago
> Web assembly trashes that idea of transparency Only if you believe minified JS is significantly easier to audit, which seems rather unlikely. In both cases, the thing which works is securing the capability rather than the code. Having generic USB support is risky but e.g. having mediated access to cameras and microphones has been fine.
- angersock 8y ago
  We couldn't even trust JS devs with high-performance timers and SharedArrayBuffers without enabling attacks like Spectre and Meltdown. I find it highly unlikely we are going to be able to trust "mediated" access.

userbinator 8y ago

I always prefer web based applications over native. Native means I have far less trust in the application. Really? Web applications can essentially change at the whim of the owner or server(s) hosting them, every time you refresh the page. You have far more control and "transparency" over when a native application changes. Is it even using tls for network requests? So many things we can’t see in a native app. You're just not looking hard enough. ;-) As all the vulnerabilities discovered and exploited in closed-source software shows, along with those in open-source which have been there for many years without being discovered, whether the source is open or closed is nearly irrelevant. To quote the mentality of those who see beyond that debate, "Source code? We don't need no stinkin' source code!"

kilburn 8y ago

> How can you build applications on the web that use Bluetooth or USB devices without these APIs? Unfortunately, the only viable alternative right now is to install a companion native application. That companion app launches an (https/ws) server that talks to the device and exposes some api for your site to use through javascript. It is a disgusting can of worms, but if you squash them all you get a working system at the end.