51 ms·

I remember some Eurorack module used Web MIDI in it's configuration app. It wasn't a pleasant experience back then. Apple removing it is weird considering the

by ilyt 4y ago

I remember some Eurorack module used Web MIDI in it's configuration app. It wasn't a pleasant experience back then. Apple removing it is weird considering the platform prevalence with musicians...

dagmx 4y ago
I believe it was removed because of the high risk of fingerprinting and inability to safeguard it from sending malicious data to devices (some devices do firmware updates over MIDI)
- smoldesu 4y ago
  Everything that updates firmware over MIDI should have an explicit "update" mode on the hardware itself. No MIDI instruments I've ever used are writable by-default. Also, fingerprinting is easy to avoid here. Firefox leaves MIDI off entirely until you opt-in to avoid random websites picking it up. Safari could do the same, presumably.
  - jacquesm 4y ago
    Indeed, small problem: the opt-in dialog box doesn't appear, so for now no luck.
  - deleted 4y ago
    [deleted]
  - brudgers 4y ago
    I don’t doubt your experience. Firmware over midi was not uncommon for older equipment because the alternative was swapping out EPROMs if the instrument did not have an FD drive…and around Y2K, unavailability of older chips could mean replacing sockets or going without (so mostly going without).
  - dagmx 4y ago
    I forget the exact device model because it’s been a decade plus, but I definitely did have a device that was upgraded over MIDI without requiring a separate mode. That is definitely an issue with the device, but I don’t know how common or uncommon that is for much older equipment
  - ta988 4y ago
    Every MIDI device I own (all less than 10yo can take updates over MIDI) and two of them use webmidi (or a standalone program) for it.
  - SeanLuke 4y ago
    Most Waldorf synthesizers are updated just by sending MIDI sysex to them. The same goes for nearly all DSI/Sequential machines, as well as M-Audio and Novation, among many other manufacturers.
    - smoldesu 4y ago
      Sure, but if you're using your DX7 to control MIDI through Firefox I think you'd be aware of those pitfalls.
    - bzzzt 4y ago
      Those are a bit more modern devices which have enough memory they could (an probably do) use a signed firmware image so it's not possible to brick them by flashing random garbage to the eeprom.
      - deleted 4y ago
        [deleted]
      - SeanLuke 4y ago
        Waldorf's been doing this since at least the Microwave II/XT, circa 1997. Not positive they had the memory to avoid bricking at that time.
pifm_guy 4y ago
Apple has a top down mandate to make sure the web platform can't replace too many desktop apps. So far, it's working. Chromebooks have not taken over the world.
- sdfhbdf 4y ago
  Citation needed. Chromebooks seem to be working for the edu sector.
  - jeroenhd 4y ago
    Not just that, with people who have used smartphones and Chromebook all their lives now leaving college they're also slowly starting to pick up steam outside education. They're also often exceptional deals for the low end of laptops (sub 200 dollar range) because Windows and its bloat make those laptops even worse to use. I'd never recommend any laptop that cheap unless someone has no meaningful way to save up, but this segment is very much still alive. Honestly, I'm surprised the unification of smartphone and laptop hasn't reached those circles yet. A mid range phone and a cheap laptop shell that you can slide the phone into are a much better deal than a cheap laptop and a cheap phone. Samsung's DeX, for example, is fully competitive with ChromeOS and even most basic Windows use cases.
    - kristianp 4y ago
      What cheap laptop shell are you using? I've plugged my old phone into my usb-c monitor and the attached wireless mouse and keyboard just worked.
    - BuckyBeaver 4y ago
      Motorola tried this over a decade ago. The product was called the Atrix: https://www.businessinsider.com/motorola-atrix-4g-review-2011-2 https://www.businessinsider.com/motorola-atrix-4g-review-201...
      - kreddor 4y ago
        They're still kinda doing it: https://www.motorola.com/us/ready-for/p https://www.motorola.com/us/ready-for/p
jonchang 4y ago
It's because of fingerprinting. See https://webkit.org/tracking-prevention/#anti-fingerprinting https://webkit.org/tracking-prevention/#anti-fingerprinting for the official standards position.
- schemescape 4y ago
  Could it just be hidden behind a prompt to enable it on a given site? I feel like they’re just using fingerprinting as an excuse to not implement functionality that people want. Of course, I don’t really understand the problem space, so it’s likely I’m missing something.
  - throwntoday 4y ago
    > I feel like they’re just using fingerprinting as an excuse to not implement functionality that people want. Do you actually believe this? Do you not default to more practical explinations like, maybe they don't consider it worthwhile to support because of engineering cost vs people that actually use it? For example, I'd say 9/10 people I know who aren't tech literate have no idea the Health app exists on their iPhone. This includes people with Apple watches. Similarly it should be obvious that basically nobody ever knew about or used that one feature you liked.
    - schemescape 4y ago
      I think engineering/support cost might be an excellent argument against implementing MIDI support in a browser, but the claim I responded to was that MIDI support wasn't on the table due to fingerprinting concerns (which are not obviously well-founded, from my outsider's perspective). When I said "functionality that people want", I didn't mean to imply that there was a critical mass of people that made MIDI support in a browser obviously worthwhile, I just meant that some people want it and they're being told it won't happen because of fingerprinting.
    - zarzavat 4y ago
      When you make a web browser engine, you don't get to choose whether a use case is marginal or not (FWIW I use WebMIDI frequently in Chrome). You implement the standards or you perish. Nobody wants a web browser that "chooses" not to work on some % of websites. Users choose, browsers implement. They are welcome to gate this feature behind a per-site permission prompt if they think it's insecure.

by ilyt 4y ago

I remember some Eurorack module used Web MIDI in it's configuration app. It wasn't a pleasant experience back then. Apple removing it is weird considering the platform prevalence with musicians...

dagmx 4y ago

I believe it was removed because of the high risk of fingerprinting and inability to safeguard it from sending malicious data to devices (some devices do firmware updates over MIDI)

smoldesu 4y ago
Everything that updates firmware over MIDI should have an explicit "update" mode on the hardware itself. No MIDI instruments I've ever used are writable by-default. Also, fingerprinting is easy to avoid here. Firefox leaves MIDI off entirely until you opt-in to avoid random websites picking it up. Safari could do the same, presumably.
- jacquesm 4y ago
  Indeed, small problem: the opt-in dialog box doesn't appear, so for now no luck.
- deleted 4y ago
  [deleted]
- brudgers 4y ago
  I don’t doubt your experience. Firmware over midi was not uncommon for older equipment because the alternative was swapping out EPROMs if the instrument did not have an FD drive…and around Y2K, unavailability of older chips could mean replacing sockets or going without (so mostly going without).
- dagmx 4y ago
  I forget the exact device model because it’s been a decade plus, but I definitely did have a device that was upgraded over MIDI without requiring a separate mode. That is definitely an issue with the device, but I don’t know how common or uncommon that is for much older equipment
- ta988 4y ago
  Every MIDI device I own (all less than 10yo can take updates over MIDI) and two of them use webmidi (or a standalone program) for it.
- SeanLuke 4y ago
  Most Waldorf synthesizers are updated just by sending MIDI sysex to them. The same goes for nearly all DSI/Sequential machines, as well as M-Audio and Novation, among many other manufacturers.
  - smoldesu 4y ago
    Sure, but if you're using your DX7 to control MIDI through Firefox I think you'd be aware of those pitfalls.
  - bzzzt 4y ago
    Those are a bit more modern devices which have enough memory they could (an probably do) use a signed firmware image so it's not possible to brick them by flashing random garbage to the eeprom.
    - deleted 4y ago
      [deleted]
    - SeanLuke 4y ago
      Waldorf's been doing this since at least the Microwave II/XT, circa 1997. Not positive they had the memory to avoid bricking at that time.

pifm_guy 4y ago

Apple has a top down mandate to make sure the web platform can't replace too many desktop apps. So far, it's working. Chromebooks have not taken over the world.

sdfhbdf 4y ago
Citation needed. Chromebooks seem to be working for the edu sector.
- jeroenhd 4y ago
  Not just that, with people who have used smartphones and Chromebook all their lives now leaving college they're also slowly starting to pick up steam outside education. They're also often exceptional deals for the low end of laptops (sub 200 dollar range) because Windows and its bloat make those laptops even worse to use. I'd never recommend any laptop that cheap unless someone has no meaningful way to save up, but this segment is very much still alive. Honestly, I'm surprised the unification of smartphone and laptop hasn't reached those circles yet. A mid range phone and a cheap laptop shell that you can slide the phone into are a much better deal than a cheap laptop and a cheap phone. Samsung's DeX, for example, is fully competitive with ChromeOS and even most basic Windows use cases.
  - kristianp 4y ago
    What cheap laptop shell are you using? I've plugged my old phone into my usb-c monitor and the attached wireless mouse and keyboard just worked.
  - BuckyBeaver 4y ago
    Motorola tried this over a decade ago. The product was called the Atrix: https://www.businessinsider.com/motorola-atrix-4g-review-2011-2 https://www.businessinsider.com/motorola-atrix-4g-review-201...
    - kreddor 4y ago
      They're still kinda doing it: https://www.motorola.com/us/ready-for/p https://www.motorola.com/us/ready-for/p

jonchang 4y ago

It's because of fingerprinting. See https://webkit.org/tracking-prevention/#anti-fingerprinting https://webkit.org/tracking-prevention/#anti-fingerprinting for the official standards position.

schemescape 4y ago
Could it just be hidden behind a prompt to enable it on a given site? I feel like they’re just using fingerprinting as an excuse to not implement functionality that people want. Of course, I don’t really understand the problem space, so it’s likely I’m missing something.
- throwntoday 4y ago
  > I feel like they’re just using fingerprinting as an excuse to not implement functionality that people want. Do you actually believe this? Do you not default to more practical explinations like, maybe they don't consider it worthwhile to support because of engineering cost vs people that actually use it? For example, I'd say 9/10 people I know who aren't tech literate have no idea the Health app exists on their iPhone. This includes people with Apple watches. Similarly it should be obvious that basically nobody ever knew about or used that one feature you liked.
  - schemescape 4y ago
    I think engineering/support cost might be an excellent argument against implementing MIDI support in a browser, but the claim I responded to was that MIDI support wasn't on the table due to fingerprinting concerns (which are not obviously well-founded, from my outsider's perspective). When I said "functionality that people want", I didn't mean to imply that there was a critical mass of people that made MIDI support in a browser obviously worthwhile, I just meant that some people want it and they're being told it won't happen because of fingerprinting.
  - zarzavat 4y ago
    When you make a web browser engine, you don't get to choose whether a use case is marginal or not (FWIW I use WebMIDI frequently in Chrome). You implement the standards or you perish. Nobody wants a web browser that "chooses" not to work on some % of websites. Users choose, browsers implement. They are welcome to gate this feature behind a per-site permission prompt if they think it's insecure.