3 ms·

Been a Safari user since the original Beta. Getting more and more disappointed every year as their decisions on what web technologies to implement and which to

Been a Safari user since the original Beta. Getting more and more disappointed every year as their decisions on what web technologies to implement and which to not are just blatantly obvious more about building a moat between the web and the App Store than anything else. In my day job we've been building physical devices and rather than building say an iOS app and an Android app that would have to be updated and cost a huge amount of money we went the webUSB/webBT route (hang on hear me out) which is actually an amazing technology, allowing us to do things like transfer data to the device all through the browser, we even plan to open the API so users can build upon it. Complete breath of fresh air compared to having to write custom apps for each platform and I'm happy we're able to do things that if our company goes under our devices wont become paperweights because the tech is all open and runs in the browser. Of course this all falls apart as soon as you hit iOS, so eventually we'll have to hire in an iOS developer to write some wrapper for the website and connective tissue between the missing APIs. Apple's sandboxing and permission models are so aggressive that them pretending for a second that they can't implement webUSB and webBT without good security is absurd, it's simply to ensure only Apps can do "grown up" things like connectivity and full hardware acceleration. Becomes even more absurd when every modern app on their store demands my contacts to even use the app, where was your care for my security when designing and normalizing that permission flow. [1] [1]: https://news.ycombinator.com/item?id=27939815 https://news.ycombinator.com/item?id=27939815

mikl 5y ago
Thanks to all the creepy adtech and malware on the net, webUSB/webBT would be a terrible thing to add to the browser. I understand that it would enable many good things, but the world’s just too full of assholes to trust random web applications with such power. The amount of security exploits and spyware they would enable is just too great. Putting them behind additional permission-prompts is not a solution. The amount of such prompts is already too high, and too many users can be tricked into saying yes.
- whywhywhywhy 5y ago
  There isn't a "Yes allow" prompt, it pops up a list and you have to select something specific. Do you have an example of how these technologies have been used for ad tracking? I hear this as justification for Apples actions a lot but haven't seen it myself anywhere.
  - mikl 5y ago
    > There isn't a "Yes allow" prompt, it pops up a list and you have to select something specific. And once hackers figure out a device they can use for attacks, they’ll tell the user some nonsense reason why they need to allow access and then pop a dialog for that device and hey presto you have a massive security mess. I don’t know any concrete exploits, but the theoretical application is not complicated. Any information you can access about the user’s system (like what USB or Bluetooth devices are visible) will be used for fingerprinting purposes, just like they’re already using screen resolution, fonts, canvas tricks, etc.

mikl 5y ago

Thanks to all the creepy adtech and malware on the net, webUSB/webBT would be a terrible thing to add to the browser. I understand that it would enable many good things, but the world’s just too full of assholes to trust random web applications with such power. The amount of security exploits and spyware they would enable is just too great. Putting them behind additional permission-prompts is not a solution. The amount of such prompts is already too high, and too many users can be tricked into saying yes.

whywhywhywhy 5y ago
There isn't a "Yes allow" prompt, it pops up a list and you have to select something specific. Do you have an example of how these technologies have been used for ad tracking? I hear this as justification for Apples actions a lot but haven't seen it myself anywhere.
- mikl 5y ago
  > There isn't a "Yes allow" prompt, it pops up a list and you have to select something specific. And once hackers figure out a device they can use for attacks, they’ll tell the user some nonsense reason why they need to allow access and then pop a dialog for that device and hey presto you have a massive security mess. I don’t know any concrete exploits, but the theoretical application is not complicated. Any information you can access about the user’s system (like what USB or Bluetooth devices are visible) will be used for fingerprinting purposes, just like they’re already using screen resolution, fonts, canvas tricks, etc.