7 ms·

Best use of WebUSB so far! It's so good that even /r/minidisc no longer bother using old software to enjoy this format, they keep recommending this. This is an

Best use of WebUSB so far! It's so good that even /r/minidisc no longer bother using old software to enjoy this format, they keep recommending this. This is an excellent work

whywhywhywhy 5y ago
I know a lot of people dislike webusb and webbt but honestly the potential for sustainable devices is huge. No more devices turning into landfill fodder once their iOS and Android apps stop being updated.
- Erwin 5y ago
  Back when I used Netscape on DEC ULtrix, connected from a Windows X client some 20+ years ago, I sure would not have believed that one day device drivers would be written in scripting language and run in my browser.
- bayindirh 5y ago
  > I know a lot of people dislike webusb and webbt... The problem with these technologies are not their utility, but their potential for being abused. Who on this blue dot ever uses battery percentage meter as another input for browser fingerprinting. That's insane.
  - moron4hire 5y ago
    I use the battery API for it's intended purpose. I make apps that run in fullscreen, immersive modes, targeting battery operated devices, with built-in teleconferencing. Users need to know if their battery is about to run out so they don't just lose their meeting session with no warning. I've gotten really tired of this browser fingerprinting FUD. Removing features like WebUSB, WebBluetooth, etc, is not going to make users less fingerprintable. You're 100% fingerprintable from just your browsing activity. Preventing fingerprinting is not just "hard", it's impossible. But we still get people complaining about it enough that browser vendors implement these security theater mitigations like when Google unilaterally decided WebAudio needed to be hobbled. Are users any less fingerprintable because WebAudio now requires a user activation to run, and timing information needed to have artificial noise added? No, users are still 100% fingerprintable. But now we have to jump through hoops to get it to work, the API as a whole is unusable for timing-critical applications, and old demos and apps are broken. I'd be fine with a permissions prompt. We have the web app manifest format. Let's use it. It's not like the app stores are doing anywhere near a good job at preventing abuse, anyway. But no, is so often not even an option. That is what is insane.
    - bayindirh 5y ago
      > I'm so sick of this browser fingerprinting FUD. I'm sick of fingerprinting itself actually. Coming the office and seeing the ads of stuff my family browsed at home is really getting old now. > Removing features like WebUSB, WebBluetooth, etc, is not going to make users less fingerprintable. No, but I think it'll reduce attack surface considerably for boty wired and wireless devices. Just being able to abuse webbt to listen my wireless keyboard or abuse my information stored on an external drive via webusb or just being able to poke around via an untrusted medium by design is perfectly safe as blindly poking a positive coefficient nuclear reactor (we know how well it went in Chernobyl). > Are users any less fingerprintable because WebAudio now requires a user activation to run? No, users are still 100% fingerprintable. Again, microphone access? I think there's a lot of insanity going on the web right now. Exclusion of extremely cool technologies because of a real and big potential for abuse is probably the leading one. Edit: I also use technologies for their intended purposes, but not everyone is doing that, AFAWCS
      - moron4hire 5y ago
        Why is "the potential for abuse" always brought up when it's Web apps that people are talking about, but almost anything else in the world, "potential for abuse" is considered a fallacious argument employed disingenously by people with hidden agendas? Crypto-*: it might be used by criminals! Anonymous content sharing: it might be used be poedophiles! Free speech: it might be used by yucky people! UBI: it might be used as an excuse to not work! Consumer-grade GPUs: they might be used by cryptominers trying to burn the world! Paternalism and prior-restraint are anti-democratic. Other people using a tool for bad purposes should have no bearing on my usage.
        bayindirh 5y ago
        I understand you, but web technologies are different, because, web technologies are literally the other way around. In the examples I've given, most of the daily, normal users are in the receiving end of the abuse. Let's dig deeper, with your examples: Crypto: If you're a normal user, you can be private. If you're criminal, you'll get to cover some of your tracks. The other effects are secondary and indirect. Anonymous content sharing: If you're a normal user, you can share stuff. I personally share stuff this way in HN. It keeps my cloud accounts tidy. It can be used for other nefarious purposes, but it's effects are again secondary. Free Speech: It shall also be used by yucky people, so we can improve our civilization, systems and ourselves further. It causes a lot of pain I know, but alas, humans probably need it sometimes to evolve. We're lazy otherwise. UBI: I think it's a neat idea. I can't think any bad examples, sorry. Consumer Grade GPUs: I don't think using a country's worth of energy to speculate on something's value is hardly efficient, so I'll pass. However, again its effects are secondary. In all your examples, the receiving party is narrow. The receiving party's number grows because of secondary effect. However, web technologies bring everything to your home, including exploits and abuse. It's a big can of worms for 1-click and 0-click exploits. "Oh, the web browser was not on the foreground, how my data is exfiltrated?" yeah, webusb/webbt/webaudio. Crypto cannot directly harm you, neither GPUs. But I can get into your home and violate your with every privacy right with a couple of little, neat technologies. Maybe you're right. We shall let these technologies loose and allow everyone to snoop into everyone's devices. That'd be equal and democratic. Maybe exploited people will like it and allow more of it. Like the most recent Facebook breach... While we're at it, I really like the glow of Cherenkov Radiation. I'd like to build a small, fish-tank sized reactor with lead-glass sides. I won't use the material for any other reasons. If only they let me...
tambourine_man 5y ago
I feel like we need to separate the JavaScript based open platform from the actual web. I love the idea of accessing USB devices from JavaScript but I don't want my browser anywhere near them. Both are great ideas and share technologies, but can (and should) be separate products.
- Jonnax 5y ago
  They don't need to be separate. It's just that Apple and Mozilla are not the majority steerers of the development of the Web. Chrome have stated that they won't do anything to prevent fingerprinting for example.
  - tambourine_man 5y ago
    It’s not malice that I want to avoid, it’s carelessness. Bugs. My browser need not access to my files. Even the camera is a bit of a stretch.
atat7024 5y ago
I've gotta disagree =] Flashing a Pixel phone with GrapheneOS.org with nothing but a single page webapp is absolutely magical.

Best use of WebUSB so far! It's so good that even /r/minidisc no longer bother using old software to enjoy this format, they keep recommending this. This is an excellent work

whywhywhywhy 5y ago

I know a lot of people dislike webusb and webbt but honestly the potential for sustainable devices is huge. No more devices turning into landfill fodder once their iOS and Android apps stop being updated.

Erwin 5y ago
Back when I used Netscape on DEC ULtrix, connected from a Windows X client some 20+ years ago, I sure would not have believed that one day device drivers would be written in scripting language and run in my browser.
bayindirh 5y ago
> I know a lot of people dislike webusb and webbt... The problem with these technologies are not their utility, but their potential for being abused. Who on this blue dot ever uses battery percentage meter as another input for browser fingerprinting. That's insane.
- moron4hire 5y ago
  I use the battery API for it's intended purpose. I make apps that run in fullscreen, immersive modes, targeting battery operated devices, with built-in teleconferencing. Users need to know if their battery is about to run out so they don't just lose their meeting session with no warning. I've gotten really tired of this browser fingerprinting FUD. Removing features like WebUSB, WebBluetooth, etc, is not going to make users less fingerprintable. You're 100% fingerprintable from just your browsing activity. Preventing fingerprinting is not just "hard", it's impossible. But we still get people complaining about it enough that browser vendors implement these security theater mitigations like when Google unilaterally decided WebAudio needed to be hobbled. Are users any less fingerprintable because WebAudio now requires a user activation to run, and timing information needed to have artificial noise added? No, users are still 100% fingerprintable. But now we have to jump through hoops to get it to work, the API as a whole is unusable for timing-critical applications, and old demos and apps are broken. I'd be fine with a permissions prompt. We have the web app manifest format. Let's use it. It's not like the app stores are doing anywhere near a good job at preventing abuse, anyway. But no, is so often not even an option. That is what is insane.
  - bayindirh 5y ago
    > I'm so sick of this browser fingerprinting FUD. I'm sick of fingerprinting itself actually. Coming the office and seeing the ads of stuff my family browsed at home is really getting old now. > Removing features like WebUSB, WebBluetooth, etc, is not going to make users less fingerprintable. No, but I think it'll reduce attack surface considerably for boty wired and wireless devices. Just being able to abuse webbt to listen my wireless keyboard or abuse my information stored on an external drive via webusb or just being able to poke around via an untrusted medium by design is perfectly safe as blindly poking a positive coefficient nuclear reactor (we know how well it went in Chernobyl). > Are users any less fingerprintable because WebAudio now requires a user activation to run? No, users are still 100% fingerprintable. Again, microphone access? I think there's a lot of insanity going on the web right now. Exclusion of extremely cool technologies because of a real and big potential for abuse is probably the leading one. Edit: I also use technologies for their intended purposes, but not everyone is doing that, AFAWCS
    - moron4hire 5y ago
      Why is "the potential for abuse" always brought up when it's Web apps that people are talking about, but almost anything else in the world, "potential for abuse" is considered a fallacious argument employed disingenously by people with hidden agendas? Crypto-*: it might be used by criminals! Anonymous content sharing: it might be used be poedophiles! Free speech: it might be used by yucky people! UBI: it might be used as an excuse to not work! Consumer-grade GPUs: they might be used by cryptominers trying to burn the world! Paternalism and prior-restraint are anti-democratic. Other people using a tool for bad purposes should have no bearing on my usage.
      - bayindirh 5y ago
        I understand you, but web technologies are different, because, web technologies are literally the other way around. In the examples I've given, most of the daily, normal users are in the receiving end of the abuse. Let's dig deeper, with your examples: Crypto: If you're a normal user, you can be private. If you're criminal, you'll get to cover some of your tracks. The other effects are secondary and indirect. Anonymous content sharing: If you're a normal user, you can share stuff. I personally share stuff this way in HN. It keeps my cloud accounts tidy. It can be used for other nefarious purposes, but it's effects are again secondary. Free Speech: It shall also be used by yucky people, so we can improve our civilization, systems and ourselves further. It causes a lot of pain I know, but alas, humans probably need it sometimes to evolve. We're lazy otherwise. UBI: I think it's a neat idea. I can't think any bad examples, sorry. Consumer Grade GPUs: I don't think using a country's worth of energy to speculate on something's value is hardly efficient, so I'll pass. However, again its effects are secondary. In all your examples, the receiving party is narrow. The receiving party's number grows because of secondary effect. However, web technologies bring everything to your home, including exploits and abuse. It's a big can of worms for 1-click and 0-click exploits. "Oh, the web browser was not on the foreground, how my data is exfiltrated?" yeah, webusb/webbt/webaudio. Crypto cannot directly harm you, neither GPUs. But I can get into your home and violate your with every privacy right with a couple of little, neat technologies. Maybe you're right. We shall let these technologies loose and allow everyone to snoop into everyone's devices. That'd be equal and democratic. Maybe exploited people will like it and allow more of it. Like the most recent Facebook breach... While we're at it, I really like the glow of Cherenkov Radiation. I'd like to build a small, fish-tank sized reactor with lead-glass sides. I won't use the material for any other reasons. If only they let me...

tambourine_man 5y ago

I feel like we need to separate the JavaScript based open platform from the actual web. I love the idea of accessing USB devices from JavaScript but I don't want my browser anywhere near them. Both are great ideas and share technologies, but can (and should) be separate products.

Jonnax 5y ago
They don't need to be separate. It's just that Apple and Mozilla are not the majority steerers of the development of the Web. Chrome have stated that they won't do anything to prevent fingerprinting for example.
- tambourine_man 5y ago
  It’s not malice that I want to avoid, it’s carelessness. Bugs. My browser need not access to my files. Even the camera is a bit of a stretch.

atat7024 5y ago

I've gotta disagree =] Flashing a Pixel phone with GrapheneOS.org with nothing but a single page webapp is absolutely magical.