3 ms·

I don't think these features are bad, they are useful in some ways. Why we need USB on the browser? Think about updating the firmware of a device, you just go t

I don't think these features are bad, they are useful in some ways. Why we need USB on the browser? Think about updating the firmware of a device, you just go to the webpage, connect the device to the USB and update it, without having to download and install a tool to flash it, for an operation that you need to do just one time. This is only one example of many that we can make, another could be IDEs in the browser to program boards like Arduino, without installing software on the PC. Battery status? It could be useful to know if the PC is connected to a power source and the level of the battery, even for a stupid scenario like watching a video, when I'm low on battery I usually reduce the resolution of a YouTube video because reproducing a 4k60p video uses a lot of resources, and drains the battery quickly. It would be useful if the webapp could just do that automatically, maybe on YouTube an option like reduce resolution when low on battery. Or for games, or whatever uses a lot of resources. Think about it: the only reason because Electron apps exist (and we waste 200Mb of disk for each one of them) is only because browsers don't have APIs to access the filesystem! To me is a waste, the browser should give each application (let's stop calling them sites, they are no longer that) the APIs and permissions to access hardware, just like on mobile devices you have a dialog that says "this app would like to access the internal storage, consent or deny?". Where is the problem? The user should give the privilege (only one time) and you finally can do basically 99% of work in the browser (and maybe the browser introduces also API to run the application in a window), you no longer need Electron just to do these kind of things, is still more secure than Electron because the code is sandboxed by the browser, and you don't have to worry about packaging your software for different operating systems.

vbezhenar 6y ago
Another use-case for USB is to access crypto tokens. There are USB devices which store private key and allow to perform crypto operations. It's much safer than storing private key in file system. Using those keys in website is a useful feature.
- goalieca 6y ago
  Ditto for smart cards. I've seen a lot of activex apps over the years do this.
saagarjha 6y ago
> I don't think these features are bad, they are useful in some ways. That’s the whole point: they look like APIs that might be useful for something but then they invariably become used for fingerprinting or an attack surface and we find out that nobody was actually using it at all, even though we came up with a couple of legitimate-sounding use cases for it. > the code is sandboxed by the browser What’s the point of a sandbox if you keep poking holes in it by adding new APIs?
- dmix 6y ago
  aka the road to hell is paved with good intentions
gruez 6y ago
>Battery status? It could be useful to know if the PC is connected to a power source and the level of the battery [...] But when was it ever implemented in the wild? This applies to most of these "features". There's a bunch of theoretical use cases, but there's pretty much 0 use for it in reality, and even if there's significant use, it's used more for fingerprinting.
- MayeulC 6y ago
  IIRC, that feature might have been introduced by Mozilla for FirefoxOS? A lot of sensor APIs were. The idea isn't bad, but it should probably be guarded behind some permissions...
derefr 6y ago
> Battery status? It could be useful to know if the PC is connected to a power source and the level of the battery, even for a stupid scenario like watching a video, when I'm low on battery I usually reduce the resolution of a YouTube video because reproducing a 4k60p video uses a lot of resources, and drains the battery quickly. It would be useful if the webapp could just do that automatically, maybe on YouTube an option like reduce resolution when low on battery. Or for games, or whatever uses a lot of resources. I don't think it's a wrong API, but it certainly is a backward one. I don't want a website to collect low-level information from my computer's ACPI sensors, and then build its own policy on top. (Will I, the user, get any control over that policy? Probably not.) Instead, I want my OS to implement an energy policy (and a control panel for that policy) and then to maybe expose the information about the current energy policy to websites. E.g., I'd be fine with iOS telling websites that I currently have Low Power mode enabled. If I don't have it enabled, then I don't care if the website thinks 10% is an emergency—I left it disabled for a reason. (And, contrariwise, if I turned on Low Power mode at 100% battery, then I'd like the website to cooperate.) For a similar idea, I don't want websites to try figuring out that my IP translates to a cellular data connection. But I do want the state of my OS's "Metered Data mode" setting to be passed on to websites, so that they can help me to use less data, when I've decided I want to do so.
jschwartzi 6y ago
> Why we need USB on the browser? Think about updating the firmware of a device, you just go to the webpage, connect the device to the USB and update it, without having to download and install a tool to flash it, for an operation that you need to do just one time. This is only one example of many that we can make, another could be IDEs in the browser to program boards like Arduino, without installing software on the PC. This is a great idea! Now I not only have to be careful what drivers I install, I also have to be careful which websites I visit or they'll drive-by brick my development tools. Thanks! It really should not be easy to update firmware on a device. It should be hard enough that it establishes obvious user intent. And I don't want to use a browser to do this. They're unstable enough without adding in soft real-time requirements. Firefox crashes on me about once per day. Doing it while I'm updating a $3000 JTAG adapter would be an absolute disaster.

vbezhenar 6y ago

Another use-case for USB is to access crypto tokens. There are USB devices which store private key and allow to perform crypto operations. It's much safer than storing private key in file system. Using those keys in website is a useful feature.

goalieca 6y ago
Ditto for smart cards. I've seen a lot of activex apps over the years do this.

saagarjha 6y ago

> I don't think these features are bad, they are useful in some ways. That’s the whole point: they look like APIs that might be useful for something but then they invariably become used for fingerprinting or an attack surface and we find out that nobody was actually using it at all, even though we came up with a couple of legitimate-sounding use cases for it. > the code is sandboxed by the browser What’s the point of a sandbox if you keep poking holes in it by adding new APIs?

dmix 6y ago
aka the road to hell is paved with good intentions

gruez 6y ago

>Battery status? It could be useful to know if the PC is connected to a power source and the level of the battery [...] But when was it ever implemented in the wild? This applies to most of these "features". There's a bunch of theoretical use cases, but there's pretty much 0 use for it in reality, and even if there's significant use, it's used more for fingerprinting.

MayeulC 6y ago
IIRC, that feature might have been introduced by Mozilla for FirefoxOS? A lot of sensor APIs were. The idea isn't bad, but it should probably be guarded behind some permissions...

derefr 6y ago

> Battery status? It could be useful to know if the PC is connected to a power source and the level of the battery, even for a stupid scenario like watching a video, when I'm low on battery I usually reduce the resolution of a YouTube video because reproducing a 4k60p video uses a lot of resources, and drains the battery quickly. It would be useful if the webapp could just do that automatically, maybe on YouTube an option like reduce resolution when low on battery. Or for games, or whatever uses a lot of resources. I don't think it's a wrong API, but it certainly is a backward one. I don't want a website to collect low-level information from my computer's ACPI sensors, and then build its own policy on top. (Will I, the user, get any control over that policy? Probably not.) Instead, I want my OS to implement an energy policy (and a control panel for that policy) and then to maybe expose the information about the current energy policy to websites. E.g., I'd be fine with iOS telling websites that I currently have Low Power mode enabled. If I don't have it enabled, then I don't care if the website thinks 10% is an emergency—I left it disabled for a reason. (And, contrariwise, if I turned on Low Power mode at 100% battery, then I'd like the website to cooperate.) For a similar idea, I don't want websites to try figuring out that my IP translates to a cellular data connection. But I do want the state of my OS's "Metered Data mode" setting to be passed on to websites, so that they can help me to use less data, when I've decided I want to do so.

jschwartzi 6y ago

> Why we need USB on the browser? Think about updating the firmware of a device, you just go to the webpage, connect the device to the USB and update it, without having to download and install a tool to flash it, for an operation that you need to do just one time. This is only one example of many that we can make, another could be IDEs in the browser to program boards like Arduino, without installing software on the PC. This is a great idea! Now I not only have to be careful what drivers I install, I also have to be careful which websites I visit or they'll drive-by brick my development tools. Thanks! It really should not be easy to update firmware on a device. It should be hard enough that it establishes obvious user intent. And I don't want to use a browser to do this. They're unstable enough without adding in soft real-time requirements. Firefox crashes on me about once per day. Doing it while I'm updating a $3000 JTAG adapter would be an absolute disaster.