7 ms·

I don't want random web sites I open (and their ads) to ask permission to scan bluetooth in my area and use usb devices connected to my computer. A website has

I don't want random web sites I open (and their ads) to ask permission to scan bluetooth in my area and use usb devices connected to my computer. A website has no business doing any of that. There is no justification for these API to exist.

fastball 6y ago
I disagree. I want that. Therefore a website does have business asking for those things.
- fennecfoxen 6y ago
  You're wrong. Therefore the developers' effort should not be wasted, and certainly not while exposing their users to privacy risks, exploits, and such other dangers as will inevitably arise when placing the capabilities to perform sensitive operations in software which also deals with untrusted input from the Internet.
  - Sayrus 6y ago
    This is definitely going to be downvoted. Isn't App store apps (Not reserved to Apple's one, this also works for Google, Microsoft and many others) untrusted code too? It runs with even more privileges than your browser's code and have access to more fingerprinting information if that's what it is going to do. As far as I see it, a PWA with these permissions has less privacy risks than a native application I can find on a store. I'd really like to understand how installing an app is not an issue but having the access from the browser is. Is it simply the permission framework that is broken and you don't trust it to not leak information when the API is disabled?
    - otterley 6y ago
      Isn't App store apps (Not reserved to Apple's one, this also works for Google, Microsoft and many others) untrusted code too? Apple puts every submitted application through an enormous battery of automated (and sometimes manual) tests and disassembly to look for malicious or non-permitted behavior before publishing apps to the App Store. They don't have that ability with random websites.
      - searchableguy 6y ago
        How did facebook, tiktok and many others get past through that lol?
        saagarjha 6y ago
        Because Apple does not enforce their rules consistently.
  - fastball 6y ago
    How can I be "wrong" about wanting these features? They're features that I want. I literally can't be wrong about that. > capabilities to perform sensitive operations in software which also deals with untrusted input from the Internet. But native apps don't deal with input coming from the internet? If that's what you think, you're... wrong.
    - close04 6y ago
      Apps go through some for of validation by the "gatekeepers", and as a user you curate them a bit, you install the trustworthy looking ones. I mean you have a greater degree of control over what apps you install and use. Now what's the level of control anyone has over a website? In your lifetime you visited many orders of magnitude more websites than apps. How do you plan on validating every link you ever click on? Every redirect? Browsers are the front line on the internet, they face the biggest threats because they can't afford to work in a walled garden with curated content. You are one minor bug away from giving access to your USB connected devices to some random website without even realizing. I don't think anyone is arguing that you are wrong about what you want. Just that what you want is wrong. Like a kid wanting more sugar, they can't spell diabetes so it can't be a problem. You're selling your privacy for trinkets and that wouldn't be anyone else's concern if there wasn't a critical mass of such users pushing everyone in the same direction. Every questionable decision made by companies was made with the (ignorant) backing of people like you who saw the shiny feature and couldn't see past that. And again, you have every right to want whatever you want no matter how smart or dumb that may be. But don't be so shocked when people call you out on it. It's only because you brought just your own personal preference into the discussion instead of the merits of giving up every shred of control over your stuff in exchange for some marbles.
      - kilburn 6y ago
        Following your analogy, we should erradicate candy from this world and never allow anyone to produce more. This way surely kids won't get candy-induced diabetes. There are perfectly valid reasons to want usb/bluetooth support for websites: fingerprint readers, smartcard readers and plenty of special-purpose hardware that would be useful to access through some web apps. Does this mean every site should have access to all your hardware? Of course not. Let's make sure you have to bless a site to allow such access, make sure that the API can only be used from https-enabled (and trusted) origins, etc.. Your position of "just no because I don't see a need for it today" is a very close-minded one...
  - deleted 6y ago
    [deleted]
- danaris 6y ago
  You (or a small minority of users) actively wanting it is not sufficient justification for creating APIs that will, with near-certainty, enable additional widespread surveillance and data gathering of the public by entities whose only interest is in profiting from that data, not better serving the public.
capableweb 6y ago
Same argument could be made for JS in general. The justification for those APIs to exist is because developers want to implement features using them, same as with JS in general too.
Alex3917 6y ago
> I don't want random web sites I open (and their ads) to ask permission to scan bluetooth in my area and use usb devices connected to my computer. Why not? It makes complete sense for something like a website that backs up the photos stored on your camera. What's even the counter argument, that if people want to back up their data they should have to pay Apple? If you've granted a website access to a restricted API, the browser can just paint a flashing red border around the website or whatever, similar to how people configure their terminals when they're SSH'd into prod.
- nemothekid 6y ago
  Because every other site will start asking you to scan Bluetooth when some ad network starts using it to fingerprint you
- mitchdoogle 6y ago
  I don't want random sites to ask to use anything on my computer. It's like a popup ad - it's annoying and blocks the site. Sure, there are legitimate use cases, but if it's anything like push notifications it will be heavily abused and far too many sites will ask for permissions.
Sayrus 6y ago
I don't want _most_ websites doing this. There are some websites (especially PWA) where they are definitely useful and can replace a heavy client. Maybe it shouldn't "asking for permission" but "giving your permission" explicitly. If you don't need such an API, you would never be bothered by it if the model is opt-in without notification/popups. I understand the problem you have with websites asking for permissions, especially push notifications permissions, as they keep showing up. And I do definitely agree that having a website that does not need any of these permissions ask for it would be even more annoying but there are definitely cases where I'm glad a website can help me out (and I don't have to download a heavy client that might or might not have tracking and analytics in it)
- ornxka 6y ago
  >There are some websites (especially PWA) where they are definitely useful and can replace a heavy client. How can this be so when the web browser itself is a heavy client?
  - Sayrus 6y ago
    You could argue that, however, I don't think it change the fact that you already have it installed. So, in my honest opinion, it is indeed replacing a second heavy client that you might have installed if you browser did not have this capability.
  - josephcsible 6y ago
    Unless you only use one such website ever, then it's a win for the browser to be the heavy client instead of having separate ones for each.
- jfkebwjsbx 6y ago
  Why would you ever want a PWA when a native version exists? And "heavy client" is a fallacy. Operating systems come with runtimes too. Very complex native app can be very small in size if it uses the native controls and APIs. They can be KB in size. Any asset is going to be bigger than the binary itself. The web-as-native apps are the ones that are huge, because they embed a behemoth (a browser) which is akin to an entire operating system.
halostatue 6y ago
I’m tired of websites asking if I want to enable push notifications from them. The answer is, and will always be, GTFO.
- Hedja 6y ago
  In most browsers, you can go into settings and default it to block without asking.
  - joking 6y ago
    most sites use a html modal to ask for the permission, and if you answer yes they make the request to the browser api which shows his own modal.

fastball 6y ago

I disagree. I want that. Therefore a website does have business asking for those things.

fennecfoxen 6y ago
You're wrong. Therefore the developers' effort should not be wasted, and certainly not while exposing their users to privacy risks, exploits, and such other dangers as will inevitably arise when placing the capabilities to perform sensitive operations in software which also deals with untrusted input from the Internet.
- Sayrus 6y ago
  This is definitely going to be downvoted. Isn't App store apps (Not reserved to Apple's one, this also works for Google, Microsoft and many others) untrusted code too? It runs with even more privileges than your browser's code and have access to more fingerprinting information if that's what it is going to do. As far as I see it, a PWA with these permissions has less privacy risks than a native application I can find on a store. I'd really like to understand how installing an app is not an issue but having the access from the browser is. Is it simply the permission framework that is broken and you don't trust it to not leak information when the API is disabled?
  - otterley 6y ago
    Isn't App store apps (Not reserved to Apple's one, this also works for Google, Microsoft and many others) untrusted code too? Apple puts every submitted application through an enormous battery of automated (and sometimes manual) tests and disassembly to look for malicious or non-permitted behavior before publishing apps to the App Store. They don't have that ability with random websites.
    - searchableguy 6y ago
      How did facebook, tiktok and many others get past through that lol?
      - saagarjha 6y ago
        Because Apple does not enforce their rules consistently.
- fastball 6y ago
  How can I be "wrong" about wanting these features? They're features that I want. I literally can't be wrong about that. > capabilities to perform sensitive operations in software which also deals with untrusted input from the Internet. But native apps don't deal with input coming from the internet? If that's what you think, you're... wrong.
  - close04 6y ago
    Apps go through some for of validation by the "gatekeepers", and as a user you curate them a bit, you install the trustworthy looking ones. I mean you have a greater degree of control over what apps you install and use. Now what's the level of control anyone has over a website? In your lifetime you visited many orders of magnitude more websites than apps. How do you plan on validating every link you ever click on? Every redirect? Browsers are the front line on the internet, they face the biggest threats because they can't afford to work in a walled garden with curated content. You are one minor bug away from giving access to your USB connected devices to some random website without even realizing. I don't think anyone is arguing that you are wrong about what you want. Just that what you want is wrong. Like a kid wanting more sugar, they can't spell diabetes so it can't be a problem. You're selling your privacy for trinkets and that wouldn't be anyone else's concern if there wasn't a critical mass of such users pushing everyone in the same direction. Every questionable decision made by companies was made with the (ignorant) backing of people like you who saw the shiny feature and couldn't see past that. And again, you have every right to want whatever you want no matter how smart or dumb that may be. But don't be so shocked when people call you out on it. It's only because you brought just your own personal preference into the discussion instead of the merits of giving up every shred of control over your stuff in exchange for some marbles.
    - kilburn 6y ago
      Following your analogy, we should erradicate candy from this world and never allow anyone to produce more. This way surely kids won't get candy-induced diabetes. There are perfectly valid reasons to want usb/bluetooth support for websites: fingerprint readers, smartcard readers and plenty of special-purpose hardware that would be useful to access through some web apps. Does this mean every site should have access to all your hardware? Of course not. Let's make sure you have to bless a site to allow such access, make sure that the API can only be used from https-enabled (and trusted) origins, etc.. Your position of "just no because I don't see a need for it today" is a very close-minded one...
- deleted 6y ago
  [deleted]
danaris 6y ago
You (or a small minority of users) actively wanting it is not sufficient justification for creating APIs that will, with near-certainty, enable additional widespread surveillance and data gathering of the public by entities whose only interest is in profiting from that data, not better serving the public.

capableweb 6y ago

Same argument could be made for JS in general. The justification for those APIs to exist is because developers want to implement features using them, same as with JS in general too.

Alex3917 6y ago

> I don't want random web sites I open (and their ads) to ask permission to scan bluetooth in my area and use usb devices connected to my computer. Why not? It makes complete sense for something like a website that backs up the photos stored on your camera. What's even the counter argument, that if people want to back up their data they should have to pay Apple? If you've granted a website access to a restricted API, the browser can just paint a flashing red border around the website or whatever, similar to how people configure their terminals when they're SSH'd into prod.

nemothekid 6y ago
Because every other site will start asking you to scan Bluetooth when some ad network starts using it to fingerprint you
mitchdoogle 6y ago
I don't want random sites to ask to use anything on my computer. It's like a popup ad - it's annoying and blocks the site. Sure, there are legitimate use cases, but if it's anything like push notifications it will be heavily abused and far too many sites will ask for permissions.

Sayrus 6y ago

I don't want _most_ websites doing this. There are some websites (especially PWA) where they are definitely useful and can replace a heavy client. Maybe it shouldn't "asking for permission" but "giving your permission" explicitly. If you don't need such an API, you would never be bothered by it if the model is opt-in without notification/popups. I understand the problem you have with websites asking for permissions, especially push notifications permissions, as they keep showing up. And I do definitely agree that having a website that does not need any of these permissions ask for it would be even more annoying but there are definitely cases where I'm glad a website can help me out (and I don't have to download a heavy client that might or might not have tracking and analytics in it)

ornxka 6y ago
>There are some websites (especially PWA) where they are definitely useful and can replace a heavy client. How can this be so when the web browser itself is a heavy client?
- Sayrus 6y ago
  You could argue that, however, I don't think it change the fact that you already have it installed. So, in my honest opinion, it is indeed replacing a second heavy client that you might have installed if you browser did not have this capability.
- josephcsible 6y ago
  Unless you only use one such website ever, then it's a win for the browser to be the heavy client instead of having separate ones for each.
jfkebwjsbx 6y ago
Why would you ever want a PWA when a native version exists? And "heavy client" is a fallacy. Operating systems come with runtimes too. Very complex native app can be very small in size if it uses the native controls and APIs. They can be KB in size. Any asset is going to be bigger than the binary itself. The web-as-native apps are the ones that are huge, because they embed a behemoth (a browser) which is akin to an entire operating system.

halostatue 6y ago

I’m tired of websites asking if I want to enable push notifications from them. The answer is, and will always be, GTFO.

Hedja 6y ago
In most browsers, you can go into settings and default it to block without asking.
- joking 6y ago
  most sites use a html modal to ask for the permission, and if you answer yes they make the request to the browser api which shows his own modal.