12 ms·

Using Web Bluetooth to Communicate with Bluetooth Devices

186 points by adunk 7y ago

reportgunner 7y ago
Can somebody please help me understand what is cool about this ? Seems like a web interface that can use bluetooth. Was this previously impossible or something ?
- onion2k 7y ago
  Seems like a web interface that can use bluetooth. That's precisely what it is. Accessing bluetooth devices from a progressive web app affords a lot of interesting new functionality for web app developers. Was this previously impossible or something ? Web bluetooth has been around since Chrome 42 behind a flag, but it's only recently appeared in other browsers so maybe now is the time to start taking an interest.
  - xxs 7y ago
    look even at the examples: you get endianness and protocol parsing/composition, coupled with "string" based enumerations + promises - no special error handling, etc. It feels such a mess to program with.
  - Nursie 7y ago
    > Accessing bluetooth devices from a progressive web app ... Does anyone actually use progressive web apps?
    - dspillett 7y ago
      > Does anyone actually use progressive web apps? Yes, is the correct but perhaps overly terse answer. A more useful answer depends on exactly what you mean by PWA, as there are several common interpretations of the term.
      - Nursie 7y ago
        The "Embed this on your home screen" aspect is what I was interested in, I guess. Personally I'm not really interested in routinely circumventing my mobile platform's app store, nor do I really want more clutter. Plus it seems like a lot of the sites that have the capability are just trying to push their brand in the same sort of way they did by having their own apps a few years ago - newspapers and other information sources which are just fine in the browser.
        dspillett 7y ago
        > Embed this on your home screen That you can do manually with any web page (that isn't badly designed) as it is essentially just an icon that opens the page when selected. The only real difference IIRC is that it looks like a separate app (in your task list etc.) instead of being a browser tab and having less browser chrome. Another common use for the features that come under the PWA banner are local storage and running options, which reduce transfers to/from the server(a) and allow offline working. There are a few apps I use that work this way and you don't notice that they are anything other than a simple web app until you find yourself properly disconnected for a time and they still work.
        Nursie 7y ago
        In the first instance, I don't have site bookmarks on my home screen, my browser can store those just fine. The second instance sounds like something that should be an actual app, installed from a trusted source, if it has access to storage and other device features. Particularly if it can run in the background, issue notifications etc etc.
        dspillett 7y ago
        > I don't have site bookmarks on my home screen But many people do. I have a couple of shortcuts to common pages on my phone's home screen (well, a folder there on) just as I have shortcuts to certain files that I regularly interact with on the device instead of going to the app and manually opening them from there. > sounds like something that should be an actual app, installed from a trusted source Why, when it isn't doing anything the web app can do anyway. LocalStorage isn't a PWA-only feature, nor is notifications, and both have a least some gates to access (LocalStorage should limit the amount stored, prompting the user as a soft quota is reached as well as having a hard quota, and sandbox sites from each other, notifications asking for permission before they are enabled). I assume other features like bluetooth access are similarly gated, so there is no less protection than found in app store apps. Why make me install an app on my phone as well as using the site on desktop/laptop, and make the developers write both, when the website based application can perform both roles? There are sensitive permissions that I wouldn't want to grant a PWA (access to my contacts for instance, access to other apps files) of course, not being able to be globally disabled if found to be malicious as is possible with an app-store based install makes that more dangerous. But with careful control PWAs can be very useful without being any more problematical than any other web app.
    - pauly 7y ago
      I definitely do for something I want to write myself, that behaves like an app, but has zero entry barrier. I am adding PWA best practices to everything I do now "just in case", still not quite sure if it's going anywhere, maybe it is only me. I wanted a "packing reminder" on my phone so I made https://paulypopex.gitlab.io/holiday-reminder/# https://paulypopex.gitlab.io/holiday-reminder/# and it works for me.
    - neoeldex 7y ago
      Do you use any of these in a browser: facebook, instagram, youtube, gmail, whatsapp, github, gitlab?
      - Nursie 7y ago
        On my mobile device, yes, facebook. Specifically because I won't allow fb apps to install themselves on any of my devices. On my laptop, yes I use some of the others. Mostly gmail and github, of those.
  - deleted 7y ago
    [deleted]
- The_rationalist 7y ago
  Firefox does not support web Bluetooth
  - pmlnr 7y ago
    Nothing should support web bluetooth.
  - peter_retief 7y ago
    If I remember correctly you need to enable it in the experimental flags? chrome://flags/
  - pjmlp 7y ago
    With the Chromification of the Web that slowly matters less and less, sadly.
    - sitkack 7y ago
      We are within a stone's throw away from America Online or Prodigy, but almost entirely self imposed. It is very interesting how monocultures and winner take all systemics play out.
  - greggman2 7y ago
    I wonder how it fits/doesn't fit into their WebThings initiative. https://iot.mozilla.org/ https://iot.mozilla.org/
  - reportgunner 7y ago
    I think that's a good thing.
- s_m_t 7y ago
  This is huge imo. It is exactly a web interface that can use bluetooth. One of the major problems with the BLE protocol is that there is really no standard client for a user to interact with devices. To access on the computer you'd need to download a program, on mobile you would need an app... just to have a meaningful user interface to a BLE device. Its like if you needed to download a new web browser for every website you visit, absolutely ridiculous.
  - xxs 7y ago
    > To access on the computer you'd need to download a program, on mobile you would need an app You say it like it's a bad thing. >Its like if you needed to download a new web browser for every website you visit, absolutely ridiculous. I really do hope websites do not try and enumerate Bluetooth on their right own. I know I'd never enable access to Bluetooth to a browser.
    - lapinot 7y ago
      > You say it like it's a bad thing. Actually the web is an OS: it has api for gui, for persistent data, for networking, for all kind of periphericals (gpu, gps, bluetooth) ... The problem you're raising (which i agree with) is that we already have an OS and we'd like to use that one.
    - clinta 7y ago
      Looking at the current chrome documentation it does not appear that web BLE offers the ability to enumerate. The browser pops up a dialog allowing the user to grant access to a specific device. I think this is actually superior to the security offered by mobile apps on android, which can enumerate bluetooth devices as soon as they have bluetooth permission.
  - deleted 7y ago
    [deleted]
  - reportgunner 7y ago
    > To access on the computer you'd need to download a program, on mobile you would need an app Are you suggesting that I don't need to download anything to view a website ? I beg to differ. If you check the article, namely the photo of the phone you can see there's a browser opened from localhost, so something must have been downloaded on the phone.
NKosmatos 7y ago
Another nice blog post/mini-project from Balena. Even though there are other similar solutions, the ease of use and instructions posted, make it very easy to create your own project :-)
ForHackernews 7y ago
Oh good, an exciting new attack vector!
- xxs 7y ago
  Indeed, pretty much the 'web'/html has been forced to support any possible connectivity and technology. I wonder if there would be a day where full blown out device enumeration would be provided.
- funcDropShadow 7y ago
  And a new source to improve browser fingerprinting.
- skunkpocalypse 7y ago
  ... because the attack surface is never big enough. Never.
- MrQuincle 7y ago
  Sure, but why the big difference between Wifi and Bluetooth? You can reach your Wifi devices from your browser. People do not argue that they want a separate application to do so. They use the same application to reach the internet versus the devices on their LAN.
akmarinov 7y ago
No iOS support? Dead on arrival.
- lucasverra 7y ago
  it's not even in considerations to implement in webkit
archi42 7y ago
Oh, this is neat :). I was recently thinking about how to configure something on an ESP8266 from my phone - with the ESP potentially being out of range of the WiFi; so HTTP or attaching the ESP to my MQTT server will not be a reliable option. I was afraid I had to write an Android App to connect to the device via Bluetooth, which sucks because I am neither an app nor a java dev. With the web BT functionality I can now put a simple interface somewhere on the web, open it on my device and control the ESP (I am not a web dev either, but simple JS toy stuff is easy enough). Of course this might require swapping the ESP8266 for an ESP32 if BLE is strictly necessary (the former doesn't support BLE, afaict).
- frabert 7y ago
  I don't think the ESP8266 supports any kind of Bluetooth at all
  - archi42 7y ago
    Ah, you're right, thanks - I had that mixed up anyway because until now I wasn't interested in using BT in my hobby projects at all. So that's a nice excuse to order an ESP32 or two or three.
- neoeldex 7y ago
  You could use the 'chromecast' flow. Where it creates a WiFi network the user has to connect to with another device. And then serving a webpage with configuration.
- h4waii 7y ago
  I have a few ESP8266 projects and WiFiManager [0] makes this a breeze. Configure a default AP/hotspot, Android and iOS will connect and follow their respective flows for captive-portals. This allows you to grab config from the user and save it. It's a very configurable framework. 0. https://github.com/tzapu/WiFiManager https://github.com/tzapu/WiFiManager
guzik 7y ago
We are actively using Web Bluetooth within our hardware debugging ecosystem (https://www.aidlab.com/developer/debug https://www.aidlab.com/developer/debug) for our wearable. It plays great role, as: * It's multiplatform. * You can rapidly upload the changes (it's web) * Bluetooth 4.0+ is faster than semihosting (and Bluetooth 5 even more). * You don't have to use wires. but what worries me is that there is a visible slowdown in the development of Web Bluetooth (at least when we compare it to the rapid growth in 2015-2017). Is it going to be a dead technology soon? Because it is way behind being a mature tech.
- nobodyshere 7y ago
  It is indeed very likely going to die. Webkit team isn't even considering it anymore now.
  - stabbles 7y ago
    Do you have a source for that?
    - guzik 7y ago
      I think he refers to https://webkit.org/status/#?status=not%20considering https://webkit.org/status/#?status=not%20considering
      - nobodyshere 7y ago
        Sorry for not linking it. Thank you guzik for doing what I should've done. That's the link I meant.
  - neoeldex 7y ago
    Webkit itself is very likely to die xD. Who uses safari nowadays?
    - kleptako 7y ago
      iOS users
stabbles 7y ago
I'm excited about BLE for the browser. I'm not sure what multiplatform (mobile & desktop) alternatives there are except for Qt, and even Qt has bugs and open issues you have to work around. For instance, only Qt 5.13+ has support for discovering and connecting BLE devices on Windows without pairing first -- if you are stuck on an LTS version (5.12), BLE is awkward in use.
skunkpocalypse 7y ago
What's next, "web fdisk" for repartitioning hard disks "natively" in the browser? Or "Web SSH"? What about "Web Bootloader"? Or "Web Intel Management Engine"? This thing is a Web Turkey.
filleokus 7y ago
Maybe I'm an Apple fan boy, but the list of features WebKit mark as "Not considering" [0] are indeed features I can see become awful security / usability problems. Like WebUSB, that just can't end well... [0]: https://webkit.org/status/#?status=not%20considering https://webkit.org/status/#?status=not%20considering
- archi42 7y ago
  Maybe Apple just doesn't need this for anything (yet)?
  - josteink 7y ago
    Nobody needs this. Nobody should need to enumerate low-level things like devices from a fucking web-browser. Make a real native app all the other decent people if you need this. Let the user assess the risk that way, and see how the market votes.
    - IshKebab 7y ago
      Rubbish. There are plenty of really cool use cases for this. For example combined with the physical web you can literally walk up to something, get a notification on your phone that it exists (yes there are spam concerns), tap the notification, and control it directly through your web browser. The device doesn't need internet connectivity and you didn't need to install an app. That's great for one-off things that you only interact with once.
      - jborichevskiy 7y ago
        I wonder if it can improve the setup flow for devices like wireless speakers where there's a whole guided process for powering it on, pairing it, connecting to its wifi network, changing settings, etc.
    - nexuist 7y ago
      >Make a real native app all the other decent people if you need this. Who is going to pay for this? How many ideas will die because nobody can afford to pay for 3+ native developers across Windows/Mac/Linux? How many teams will decide to axe Linux support because it's not worth it? Why develop natively when you can just hire one JS developer to write once, deploy anywhere? Native apps failed to democratize the market. We are stuck with platform-specific applications that will remain intertwined with their vendor of choice presumably forever. PWA or bust.
josteink 7y ago
How about we just provide WebDMA instead and call it a day? Clearly nobody cares about the security of the user anymore anyway.
- pjmlp 7y ago
  On the contrary, it the the web browsers trying to be native apps instead of interactive documents.
- Shoue 7y ago
  Every time someone posts Web Bluetooth someone brings up security, which is fair, but I don't think it's productive to immediately dismiss it. The Chrome developers behind the spec have thought a lot about the security implications. It's not impossible to make Web Bluetooth more secure than tricking a user into installing a malicious program, which isn't exactly a complex trick right now. This article from 2016 goes into some of the security of Web Bluetooth: https://medium.com/@jyasskin/the-web-bluetooth-security-model-666b4e7eed2 https://medium.com/@jyasskin/the-web-bluetooth-security-mode...
- sitkack 7y ago
  On the server that was heartbleed under the WebMEM spec. There needs to be a tight feedback loop between the feature people and the security people. Without it, the FP will over-run the SP. The default to ship, ship in public attitude means that all of these "features" get public exposure before the security people have looked at it deeply. Much of the worlds technical architecture needs to get inverted.
kfihihc 7y ago
If someone want to try Web Bluetooth, please look at this project[1]: a Web Command Line Interface via NUS (Nordic UART Service). [1]:https://github.com/makerdiary/web-device-cli https://github.com/makerdiary/web-device-cli
staticvar 7y ago
I'm super interested in unpacking the reasons why folks think WebUSB and Web Bluetooth "can't end well" as one user here put it. Would folks mind listing their reasons? This is assuming there is some way to install a native app with access to these APIs... But if you are in the camp of "no bluetooth ever" and "no USB ever" that would be totally interesting to know as well :).
- snagglegaggle 7y ago
  Would you download random native programs and give them hardware access? Really? The issue is exploitation of the USB devices being turned around and used to exploit the OS, or remain persistent in the device. Bluetooth has similar problems but also more.
  - staticvar 7y ago
    Aha, yes, we do end up on a lot of random websites. For argument sake, I'm going to assume your objection is not that folks visit random websites, but that there is something dangerous about how we give random websites access to Bluetooth/USB. Here are the ways in which "random websites" can gain access to USB/Bluetooth: 1) Prompt the user to download a native app. 2) Prompt the user to follow a link to an app store for their OS. 3) Prompt the user to allow the website access to the Web USB / Web Bluetooth APIs. My follow up question then is how is option #3 less good than #1 and #2, and "less good" in what ways?
    - xxs 7y ago
      >s how is option #3 less good than.. Going to the app-store allows for reading opinions (i.e. somewhat independent) compared to just clicking, go-on. It shows some download/usage statistics and the like. Also removal of the app guarantees removal, removal of web-works, etc. is significantly more cumbersome. Personally, I have very little trust in browsers (with their constant updates, sort of rushed) and have set deletion of all cookies/storage/etc. on exit - hence convenience is not there. Overall web browsers make for a poor man OS w/o any specific hardware support (unless you count virtualization to a degree) for privileged layer access.
moonbug 7y ago
Halloween has come early.
jpablo 7y ago
While Web Bluetooth seems like a good idea to us making BLE devices, the truth of the matter is that only google adopted it, and only such a small subset that you have to design your device around Web Bluetooth. I recently had to make a iOS app that embedded a webview that catches web bluetooth calls and implemented them natively, to work around the fact that Web Bluetooth doesn't work on Safari. I think that would be a maintenance nightmare going forward.
- sitkack 7y ago
  > embedded a webview that catches web bluetooth calls and implemented them natively, to work around the fact that Web Bluetooth doesn't work on Safari This just broke my mind. Could you explain how/why this infinity mirror contraption was built?
  - toast0 7y ago
    jpablo built a website that uses WebBluetooth to do something. That doesn't work on Safari, so to make it work on iOS, jpablo built an app. The app is mostly just a (safari) webview, but with hooks to satisfy the web bluetooth api, by using native code.
    - sitkack 7y ago
      The ol ReverseDoubleWat ! A native app to shim a browser feature so the web will work on mobile. Bringing the web to native mobile.
user4294 7y ago
HTTPS is good but it's not good enough for web api context because it only protects client-server communications. Prompting the user is good but it's not good enough for web api context because users can't be fully informed by a one line prompt. I was asked to help my mother in law with her PC. When I looked at the screen it was half covered by W10 notifications from web sites. I asked her, how do you use this. And she sad, I don't know how that happened and I don't know how to stop it. Of course she gave permission but she could not understand how bad web sites would abuse notifications so she couldn't make a fully informed decision . It was sad. I turned all off. Now, developers will say that it's impossible to fully inform a user but when that's the case should we really push that anyway to the user?
- skybrian 7y ago
  Hmm, at least it's easy for someone else (you) to help her fix it? This is a bit of a tangent, but as tech support workers soon learn, it's unrealistic to expect everyone in a large pool of users to be independent of tech support. We have a myth of competent independence that works for some but it's not reality. This goes double when your business includes retirees. As people age, many businesses have to figure out how to handle cognitive decline and death of their customers gracefully. (I'm thinking financial institutions in particular.) Browsers try to make the open web safe for everyone, but it seems to be based on the median user and many users are well below average.
Hitton 7y ago
Are IoT devices with Bluetooth that don't have Wi-Fi common?
- d-sc 7y ago
  Bluetooth is much simpler to implement and cheaper than WiFi.
alufers 7y ago
I have recently tried communicating via BLE on an ESP32 using the Web Bluetooth API on a hackathon. The experience was mediocre at best. Enabling an experimental flag on the desktop version of Chrome 77 was reqired, we had to use some hacks to overcome the 20 byte limit for writing into a characteristic. Additionaly after 10 hours of constantly connecting and disconnecting the device, it refused to work with any device except with one laptop. I don't know if it was caused by the web api or the ESP32 but it was quite an unpleasant superise.
- matharmin 7y ago
  I had a similar experience with ESP32 + Web Bluetooth. Ran into very weird issues, code that previously worked and then stopped working, even after restarting the device. Eventually figured out that the issue was on my laptop side (somewhere between the hardware, Ubuntu and Chrome), and it worked perfectly from my Chromebook and Android phone. For a long time I never even considered that the issue could be on the laptop, since I expected it to be the ESP32 that's buggy. What I did find is that it can give a very good UX when it's working: connect directly from the browser to the ESP32, without requiring any WiFi setup or other hack to find and pair the device.
r00fus 7y ago
Who's pushing WebBT? Facebook, Twitter? I want to understand the industry support behind this protocol/standard and the what they hope to gain from it.

186 points by adunk 7y ago

Can somebody please help me understand what is cool about this ? Seems like a web interface that can use bluetooth. Was this previously impossible or something ?

onion2k 7y ago
Seems like a web interface that can use bluetooth. That's precisely what it is. Accessing bluetooth devices from a progressive web app affords a lot of interesting new functionality for web app developers. Was this previously impossible or something ? Web bluetooth has been around since Chrome 42 behind a flag, but it's only recently appeared in other browsers so maybe now is the time to start taking an interest.
- xxs 7y ago
  look even at the examples: you get endianness and protocol parsing/composition, coupled with "string" based enumerations + promises - no special error handling, etc. It feels such a mess to program with.
- Nursie 7y ago
  > Accessing bluetooth devices from a progressive web app ... Does anyone actually use progressive web apps?
  - dspillett 7y ago
    > Does anyone actually use progressive web apps? Yes, is the correct but perhaps overly terse answer. A more useful answer depends on exactly what you mean by PWA, as there are several common interpretations of the term.
    - Nursie 7y ago
      The "Embed this on your home screen" aspect is what I was interested in, I guess. Personally I'm not really interested in routinely circumventing my mobile platform's app store, nor do I really want more clutter. Plus it seems like a lot of the sites that have the capability are just trying to push their brand in the same sort of way they did by having their own apps a few years ago - newspapers and other information sources which are just fine in the browser.
      - dspillett 7y ago
        > Embed this on your home screen That you can do manually with any web page (that isn't badly designed) as it is essentially just an icon that opens the page when selected. The only real difference IIRC is that it looks like a separate app (in your task list etc.) instead of being a browser tab and having less browser chrome. Another common use for the features that come under the PWA banner are local storage and running options, which reduce transfers to/from the server(a) and allow offline working. There are a few apps I use that work this way and you don't notice that they are anything other than a simple web app until you find yourself properly disconnected for a time and they still work.
        Nursie 7y ago
        In the first instance, I don't have site bookmarks on my home screen, my browser can store those just fine. The second instance sounds like something that should be an actual app, installed from a trusted source, if it has access to storage and other device features. Particularly if it can run in the background, issue notifications etc etc.
        dspillett 7y ago
        > I don't have site bookmarks on my home screen But many people do. I have a couple of shortcuts to common pages on my phone's home screen (well, a folder there on) just as I have shortcuts to certain files that I regularly interact with on the device instead of going to the app and manually opening them from there. > sounds like something that should be an actual app, installed from a trusted source Why, when it isn't doing anything the web app can do anyway. LocalStorage isn't a PWA-only feature, nor is notifications, and both have a least some gates to access (LocalStorage should limit the amount stored, prompting the user as a soft quota is reached as well as having a hard quota, and sandbox sites from each other, notifications asking for permission before they are enabled). I assume other features like bluetooth access are similarly gated, so there is no less protection than found in app store apps. Why make me install an app on my phone as well as using the site on desktop/laptop, and make the developers write both, when the website based application can perform both roles? There are sensitive permissions that I wouldn't want to grant a PWA (access to my contacts for instance, access to other apps files) of course, not being able to be globally disabled if found to be malicious as is possible with an app-store based install makes that more dangerous. But with careful control PWAs can be very useful without being any more problematical than any other web app.
  - pauly 7y ago
    I definitely do for something I want to write myself, that behaves like an app, but has zero entry barrier. I am adding PWA best practices to everything I do now "just in case", still not quite sure if it's going anywhere, maybe it is only me. I wanted a "packing reminder" on my phone so I made https://paulypopex.gitlab.io/holiday-reminder/# https://paulypopex.gitlab.io/holiday-reminder/# and it works for me.
  - neoeldex 7y ago
    Do you use any of these in a browser: facebook, instagram, youtube, gmail, whatsapp, github, gitlab?
    - Nursie 7y ago
      On my mobile device, yes, facebook. Specifically because I won't allow fb apps to install themselves on any of my devices. On my laptop, yes I use some of the others. Mostly gmail and github, of those.
- deleted 7y ago
  [deleted]
The_rationalist 7y ago
Firefox does not support web Bluetooth
- pmlnr 7y ago
  Nothing should support web bluetooth.
- peter_retief 7y ago
  If I remember correctly you need to enable it in the experimental flags? chrome://flags/
- pjmlp 7y ago
  With the Chromification of the Web that slowly matters less and less, sadly.
  - sitkack 7y ago
    We are within a stone's throw away from America Online or Prodigy, but almost entirely self imposed. It is very interesting how monocultures and winner take all systemics play out.
- greggman2 7y ago
  I wonder how it fits/doesn't fit into their WebThings initiative. https://iot.mozilla.org/ https://iot.mozilla.org/
- reportgunner 7y ago
  I think that's a good thing.
s_m_t 7y ago
This is huge imo. It is exactly a web interface that can use bluetooth. One of the major problems with the BLE protocol is that there is really no standard client for a user to interact with devices. To access on the computer you'd need to download a program, on mobile you would need an app... just to have a meaningful user interface to a BLE device. Its like if you needed to download a new web browser for every website you visit, absolutely ridiculous.
- xxs 7y ago
  > To access on the computer you'd need to download a program, on mobile you would need an app You say it like it's a bad thing. >Its like if you needed to download a new web browser for every website you visit, absolutely ridiculous. I really do hope websites do not try and enumerate Bluetooth on their right own. I know I'd never enable access to Bluetooth to a browser.
  - lapinot 7y ago
    > You say it like it's a bad thing. Actually the web is an OS: it has api for gui, for persistent data, for networking, for all kind of periphericals (gpu, gps, bluetooth) ... The problem you're raising (which i agree with) is that we already have an OS and we'd like to use that one.
  - clinta 7y ago
    Looking at the current chrome documentation it does not appear that web BLE offers the ability to enumerate. The browser pops up a dialog allowing the user to grant access to a specific device. I think this is actually superior to the security offered by mobile apps on android, which can enumerate bluetooth devices as soon as they have bluetooth permission.
- deleted 7y ago
  [deleted]
- reportgunner 7y ago
  > To access on the computer you'd need to download a program, on mobile you would need an app Are you suggesting that I don't need to download anything to view a website ? I beg to differ. If you check the article, namely the photo of the phone you can see there's a browser opened from localhost, so something must have been downloaded on the phone.

NKosmatos 7y ago

Another nice blog post/mini-project from Balena. Even though there are other similar solutions, the ease of use and instructions posted, make it very easy to create your own project :-)

ForHackernews 7y ago

Oh good, an exciting new attack vector!

xxs 7y ago
Indeed, pretty much the 'web'/html has been forced to support any possible connectivity and technology. I wonder if there would be a day where full blown out device enumeration would be provided.
funcDropShadow 7y ago
And a new source to improve browser fingerprinting.
skunkpocalypse 7y ago
... because the attack surface is never big enough. Never.
MrQuincle 7y ago
Sure, but why the big difference between Wifi and Bluetooth? You can reach your Wifi devices from your browser. People do not argue that they want a separate application to do so. They use the same application to reach the internet versus the devices on their LAN.

akmarinov 7y ago

No iOS support? Dead on arrival.

lucasverra 7y ago
it's not even in considerations to implement in webkit

archi42 7y ago

Oh, this is neat :). I was recently thinking about how to configure something on an ESP8266 from my phone - with the ESP potentially being out of range of the WiFi; so HTTP or attaching the ESP to my MQTT server will not be a reliable option. I was afraid I had to write an Android App to connect to the device via Bluetooth, which sucks because I am neither an app nor a java dev. With the web BT functionality I can now put a simple interface somewhere on the web, open it on my device and control the ESP (I am not a web dev either, but simple JS toy stuff is easy enough). Of course this might require swapping the ESP8266 for an ESP32 if BLE is strictly necessary (the former doesn't support BLE, afaict).

frabert 7y ago
I don't think the ESP8266 supports any kind of Bluetooth at all
- archi42 7y ago
  Ah, you're right, thanks - I had that mixed up anyway because until now I wasn't interested in using BT in my hobby projects at all. So that's a nice excuse to order an ESP32 or two or three.
neoeldex 7y ago
You could use the 'chromecast' flow. Where it creates a WiFi network the user has to connect to with another device. And then serving a webpage with configuration.
h4waii 7y ago
I have a few ESP8266 projects and WiFiManager [0] makes this a breeze. Configure a default AP/hotspot, Android and iOS will connect and follow their respective flows for captive-portals. This allows you to grab config from the user and save it. It's a very configurable framework. 0. https://github.com/tzapu/WiFiManager https://github.com/tzapu/WiFiManager

guzik 7y ago

We are actively using Web Bluetooth within our hardware debugging ecosystem (https://www.aidlab.com/developer/debug https://www.aidlab.com/developer/debug) for our wearable. It plays great role, as: * It's multiplatform. * You can rapidly upload the changes (it's web) * Bluetooth 4.0+ is faster than semihosting (and Bluetooth 5 even more). * You don't have to use wires. but what worries me is that there is a visible slowdown in the development of Web Bluetooth (at least when we compare it to the rapid growth in 2015-2017). Is it going to be a dead technology soon? Because it is way behind being a mature tech.

nobodyshere 7y ago
It is indeed very likely going to die. Webkit team isn't even considering it anymore now.
- stabbles 7y ago
  Do you have a source for that?
  - guzik 7y ago
    I think he refers to https://webkit.org/status/#?status=not%20considering https://webkit.org/status/#?status=not%20considering
    - nobodyshere 7y ago
      Sorry for not linking it. Thank you guzik for doing what I should've done. That's the link I meant.
- neoeldex 7y ago
  Webkit itself is very likely to die xD. Who uses safari nowadays?
  - kleptako 7y ago
    iOS users

stabbles 7y ago

I'm excited about BLE for the browser. I'm not sure what multiplatform (mobile & desktop) alternatives there are except for Qt, and even Qt has bugs and open issues you have to work around. For instance, only Qt 5.13+ has support for discovering and connecting BLE devices on Windows without pairing first -- if you are stuck on an LTS version (5.12), BLE is awkward in use.

skunkpocalypse 7y ago

What's next, "web fdisk" for repartitioning hard disks "natively" in the browser? Or "Web SSH"? What about "Web Bootloader"? Or "Web Intel Management Engine"? This thing is a Web Turkey.

filleokus 7y ago

Maybe I'm an Apple fan boy, but the list of features WebKit mark as "Not considering" [0] are indeed features I can see become awful security / usability problems. Like WebUSB, that just can't end well... [0]: https://webkit.org/status/#?status=not%20considering https://webkit.org/status/#?status=not%20considering

archi42 7y ago
Maybe Apple just doesn't need this for anything (yet)?
- josteink 7y ago
  Nobody needs this. Nobody should need to enumerate low-level things like devices from a fucking web-browser. Make a real native app all the other decent people if you need this. Let the user assess the risk that way, and see how the market votes.
  - IshKebab 7y ago
    Rubbish. There are plenty of really cool use cases for this. For example combined with the physical web you can literally walk up to something, get a notification on your phone that it exists (yes there are spam concerns), tap the notification, and control it directly through your web browser. The device doesn't need internet connectivity and you didn't need to install an app. That's great for one-off things that you only interact with once.
    - jborichevskiy 7y ago
      I wonder if it can improve the setup flow for devices like wireless speakers where there's a whole guided process for powering it on, pairing it, connecting to its wifi network, changing settings, etc.
  - nexuist 7y ago
    >Make a real native app all the other decent people if you need this. Who is going to pay for this? How many ideas will die because nobody can afford to pay for 3+ native developers across Windows/Mac/Linux? How many teams will decide to axe Linux support because it's not worth it? Why develop natively when you can just hire one JS developer to write once, deploy anywhere? Native apps failed to democratize the market. We are stuck with platform-specific applications that will remain intertwined with their vendor of choice presumably forever. PWA or bust.

josteink 7y ago

How about we just provide WebDMA instead and call it a day? Clearly nobody cares about the security of the user anymore anyway.

pjmlp 7y ago
On the contrary, it the the web browsers trying to be native apps instead of interactive documents.
Shoue 7y ago
Every time someone posts Web Bluetooth someone brings up security, which is fair, but I don't think it's productive to immediately dismiss it. The Chrome developers behind the spec have thought a lot about the security implications. It's not impossible to make Web Bluetooth more secure than tricking a user into installing a malicious program, which isn't exactly a complex trick right now. This article from 2016 goes into some of the security of Web Bluetooth: https://medium.com/@jyasskin/the-web-bluetooth-security-model-666b4e7eed2 https://medium.com/@jyasskin/the-web-bluetooth-security-mode...
sitkack 7y ago
On the server that was heartbleed under the WebMEM spec. There needs to be a tight feedback loop between the feature people and the security people. Without it, the FP will over-run the SP. The default to ship, ship in public attitude means that all of these "features" get public exposure before the security people have looked at it deeply. Much of the worlds technical architecture needs to get inverted.

kfihihc 7y ago

If someone want to try Web Bluetooth, please look at this project[1]: a Web Command Line Interface via NUS (Nordic UART Service). [1]:https://github.com/makerdiary/web-device-cli https://github.com/makerdiary/web-device-cli

staticvar 7y ago

I'm super interested in unpacking the reasons why folks think WebUSB and Web Bluetooth "can't end well" as one user here put it. Would folks mind listing their reasons? This is assuming there is some way to install a native app with access to these APIs... But if you are in the camp of "no bluetooth ever" and "no USB ever" that would be totally interesting to know as well :).

snagglegaggle 7y ago
Would you download random native programs and give them hardware access? Really? The issue is exploitation of the USB devices being turned around and used to exploit the OS, or remain persistent in the device. Bluetooth has similar problems but also more.
- staticvar 7y ago
  Aha, yes, we do end up on a lot of random websites. For argument sake, I'm going to assume your objection is not that folks visit random websites, but that there is something dangerous about how we give random websites access to Bluetooth/USB. Here are the ways in which "random websites" can gain access to USB/Bluetooth: 1) Prompt the user to download a native app. 2) Prompt the user to follow a link to an app store for their OS. 3) Prompt the user to allow the website access to the Web USB / Web Bluetooth APIs. My follow up question then is how is option #3 less good than #1 and #2, and "less good" in what ways?
  - xxs 7y ago
    >s how is option #3 less good than.. Going to the app-store allows for reading opinions (i.e. somewhat independent) compared to just clicking, go-on. It shows some download/usage statistics and the like. Also removal of the app guarantees removal, removal of web-works, etc. is significantly more cumbersome. Personally, I have very little trust in browsers (with their constant updates, sort of rushed) and have set deletion of all cookies/storage/etc. on exit - hence convenience is not there. Overall web browsers make for a poor man OS w/o any specific hardware support (unless you count virtualization to a degree) for privileged layer access.

moonbug 7y ago

Halloween has come early.

jpablo 7y ago

While Web Bluetooth seems like a good idea to us making BLE devices, the truth of the matter is that only google adopted it, and only such a small subset that you have to design your device around Web Bluetooth. I recently had to make a iOS app that embedded a webview that catches web bluetooth calls and implemented them natively, to work around the fact that Web Bluetooth doesn't work on Safari. I think that would be a maintenance nightmare going forward.

sitkack 7y ago
> embedded a webview that catches web bluetooth calls and implemented them natively, to work around the fact that Web Bluetooth doesn't work on Safari This just broke my mind. Could you explain how/why this infinity mirror contraption was built?
- toast0 7y ago
  jpablo built a website that uses WebBluetooth to do something. That doesn't work on Safari, so to make it work on iOS, jpablo built an app. The app is mostly just a (safari) webview, but with hooks to satisfy the web bluetooth api, by using native code.
  - sitkack 7y ago
    The ol ReverseDoubleWat ! A native app to shim a browser feature so the web will work on mobile. Bringing the web to native mobile.

user4294 7y ago

HTTPS is good but it's not good enough for web api context because it only protects client-server communications. Prompting the user is good but it's not good enough for web api context because users can't be fully informed by a one line prompt. I was asked to help my mother in law with her PC. When I looked at the screen it was half covered by W10 notifications from web sites. I asked her, how do you use this. And she sad, I don't know how that happened and I don't know how to stop it. Of course she gave permission but she could not understand how bad web sites would abuse notifications so she couldn't make a fully informed decision . It was sad. I turned all off. Now, developers will say that it's impossible to fully inform a user but when that's the case should we really push that anyway to the user?

skybrian 7y ago
Hmm, at least it's easy for someone else (you) to help her fix it? This is a bit of a tangent, but as tech support workers soon learn, it's unrealistic to expect everyone in a large pool of users to be independent of tech support. We have a myth of competent independence that works for some but it's not reality. This goes double when your business includes retirees. As people age, many businesses have to figure out how to handle cognitive decline and death of their customers gracefully. (I'm thinking financial institutions in particular.) Browsers try to make the open web safe for everyone, but it seems to be based on the median user and many users are well below average.

Hitton 7y ago

Are IoT devices with Bluetooth that don't have Wi-Fi common?

d-sc 7y ago
Bluetooth is much simpler to implement and cheaper than WiFi.

alufers 7y ago

I have recently tried communicating via BLE on an ESP32 using the Web Bluetooth API on a hackathon. The experience was mediocre at best. Enabling an experimental flag on the desktop version of Chrome 77 was reqired, we had to use some hacks to overcome the 20 byte limit for writing into a characteristic. Additionaly after 10 hours of constantly connecting and disconnecting the device, it refused to work with any device except with one laptop. I don't know if it was caused by the web api or the ESP32 but it was quite an unpleasant superise.

matharmin 7y ago
I had a similar experience with ESP32 + Web Bluetooth. Ran into very weird issues, code that previously worked and then stopped working, even after restarting the device. Eventually figured out that the issue was on my laptop side (somewhere between the hardware, Ubuntu and Chrome), and it worked perfectly from my Chromebook and Android phone. For a long time I never even considered that the issue could be on the laptop, since I expected it to be the ESP32 that's buggy. What I did find is that it can give a very good UX when it's working: connect directly from the browser to the ESP32, without requiring any WiFi setup or other hack to find and pair the device.

r00fus 7y ago

Who's pushing WebBT? Facebook, Twitter? I want to understand the industry support behind this protocol/standard and the what they hope to gain from it.