4 ms·

Why is it important that a website should have access to my serial ports?

beeboobaa3 2y ago
It doesn't have access to your "serial ports". It has access to a consent dialog in which you can choose one port to give the website access to, so it can e.g. flash IoT devices for you. Take a look at e.g. https://esphome.io/index.html https://esphome.io/index.html Or just RTFA: https://github.com/kuba2k2/firefox-webserial?tab=readme-ov-file#usage https://github.com/kuba2k2/firefox-webserial?tab=readme-ov-f...
- troupo 2y ago
  And how many consent dialogs will you be willing to call an acceptable number?
  - cillian64 2y ago
    If that’s the argument against, it could just be denied by default and require the user to go into settings to allow. The annoyance isn’t too bad given webserial is probably only used on occasion, and it means no concerns about consent spam or fingerprinting.
    - troupo 2y ago
      Why do people willingly ignore all the other APIs that require a consent dialog. And what happens when users are presented with a barrage of them.
      - gregmac 2y ago
        Users aren't presented with a "barrage" of consent dialogs. There's not even that many of them, and being able to access a serial port is a niche case where it does make sense -- just like accessing a web cam or microphone. It's certainly less annoying than the one for allowing push notifications. Unless, of course, the site is malicious/spammy. It's possible to do all kinds of annoying things, from triggering consent dialogs, to opening new windows, to playing sounds.. and you can even do them in a loop. Adding (or not) a consent dialog for webserial doesn't change that.
        troupo 2y ago
        > Users aren't presented with a "barrage" of consent dialogs. There's not even that many of them, and being able to access a serial port is a niche case It's amazing that you write this and then immediately find the (almost) right answer: > Unless, of course, the site is malicious/spammy. It's possible to do all kinds of annoying things, from triggering consent dialogs... And then immediately dismiss that as if that wasn't a valid concern: > Adding (or not) a consent dialog for webserial doesn't change that. Yes, yes it changes that. It increases the number of consent dialogs in a system that already has a few of those, and where users are already trained to click "yes" to thousands of annoying popups. Oh, and these are not just empty words. Recently Mozilla relented and implemented WebMIDI. Guess what: https://x.com/denschub/status/1582730985778556931 https://x.com/denschub/status/1582730985778556931 It didn't even require a malicious/spammy site. Just regular ad networks.
        sfink 2y ago
        > Users aren't presented with a "barrage" of consent dialogs. There's not even that many of them And that is the result of a lot of hard work and pushing back on... well, on things like this. There are already enough that many people have been trained to click Accept without reading. Any new source of consent dialogs must be scrutinized very closely. > being able to access a serial port is a niche case where it does make sense -- just like accessing a web cam or microphone. If you agree to webcam access, then the site can see and record you visually. If you agree to microphone access, then the website can hear and record you aurally. If you agree to serial access, then your "TSMX9200b7 Larangipone GmbH" can... er... do something? Maybe it can turn on a blinky light. Maybe it can capture audio through an embedded IoT microphone (or speaker that shares wires with something else). Maybe it can use the debug interface on something you didn't realize had a debug interface to reprogram the device to emulate a keyboard or ethernet device and hack your system. Are you going to whitelist devices owned by big companies with lawyers and screw over experimenters? Blacklist devices so the well-behaved hackers won't hack you? I wish we lived in a world where we could just add consent dialogs or config settings to allow things like this. Instead, we live in a world where if something like this is enabled, you'll get phishing emails with support tips for fixing your browser issues (or slowness) by going to about:config and twiddling some setting that is meaningless to the 1% of recipients who matter.
      - beeboobaa3 2y ago
        Stop making up problems that don't exist.
  - IshKebab 2y ago
    I would say the same number that you get from downloading and running a program that can do exactly the same thing (and worse!). So 1. Maybe 2 at most.
    - troupo 2y ago
      https://news.ycombinator.com/item?id=40248040 https://news.ycombinator.com/item?id=40248040
  - beeboobaa3 2y ago
    One for every action that needs consent. What kind of question is that?
    - troupo 2y ago
      See this discussion: https://news.ycombinator.com/item?id=40248040 https://news.ycombinator.com/item?id=40248040
vbezhenar 2y ago
Because device vendor can provide you tools for your device that'll work in browser, protected by browser sandbox, cross-platform and always up to date. Rather than requiring you to install some crappy executables with instructions how to disable Windows protection to be able to install unsigned drivers.
- graemep 2y ago
  That sounds like a problem with Windows that should be fixed in Windows. Adding a browser API for such narrow user cases is unnecessary. Even better Windows drivers should be signed as they are supposed to be,
- ale42 2y ago
  Why install drivers? Webserial is about serial ports. If you need a driver to actually see your serial port, you need to install it anyway to use webserial.
- ale42 2y ago
  Tools that unlike local apps will go offline when the vendors' web site will go offline at some point. And then the user will have a stupid brick instead of a device. I understand the convenience of using a web-based application, but it has numerous disadvantages that should also be taken in account.
  - zamadatix 2y ago
    A browser based application doesn't need to rely on the vendor's website being up any more than an executable based application needs to. It's definitely an option in each case but one does not imply the other. Distribution access becomes a pain point but in either case the answer is to find archived versions.
    - ale42 2y ago
      Sure, but I can easily put an installer on a NAS (or on whatever media I use for long-term storage) and keep it there. Properly archiving a website and making sure it works offline is another story: sometimes it is relatively simple, sometimes there are requests on backend servers and you'd have to reimplement whatever the backend is doing, and it can get a real pain to do.
beefnugs 2y ago
I just ran into this recently: provisioning some older HSMs require creating an executable sent to customers. Windows defender now blocks these by default just because they have some kind of encryption going on in them. Mozilla is correct, this is very dangerous to just freely allow access. But some people really need it. And IOT and firmware stuff really needs it to exist somehow. I dont know why active purposeful allow button isn't good enough however
- josephcsible 2y ago
  Why can't the executable be compiled on the customer's computer? And just "some kind of encryption" isn't enough to look like a virus. Is it doing something evil like encrypting its own code?
  - tmottabr 2y ago
    not at all.. At least in windows, anything that is not signed with a code signing certificate that is known and that have good reputation will be blocked by windows and\or anti-virus. There are some small devs that i have seen needing to get a new cert, for whatever reason, and got new versions of their software start being blocked for a few weeks until the new cert got known.

It doesn't have access to your "serial ports". It has access to a consent dialog in which you can choose one port to give the website access to, so it can e.g. flash IoT devices for you. Take a look at e.g. https://esphome.io/index.html https://esphome.io/index.html Or just RTFA: https://github.com/kuba2k2/firefox-webserial?tab=readme-ov-file#usage https://github.com/kuba2k2/firefox-webserial?tab=readme-ov-f...

troupo 2y ago
And how many consent dialogs will you be willing to call an acceptable number?
- cillian64 2y ago
  If that’s the argument against, it could just be denied by default and require the user to go into settings to allow. The annoyance isn’t too bad given webserial is probably only used on occasion, and it means no concerns about consent spam or fingerprinting.
  - troupo 2y ago
    Why do people willingly ignore all the other APIs that require a consent dialog. And what happens when users are presented with a barrage of them.
    - gregmac 2y ago
      Users aren't presented with a "barrage" of consent dialogs. There's not even that many of them, and being able to access a serial port is a niche case where it does make sense -- just like accessing a web cam or microphone. It's certainly less annoying than the one for allowing push notifications. Unless, of course, the site is malicious/spammy. It's possible to do all kinds of annoying things, from triggering consent dialogs, to opening new windows, to playing sounds.. and you can even do them in a loop. Adding (or not) a consent dialog for webserial doesn't change that.
      - troupo 2y ago
        > Users aren't presented with a "barrage" of consent dialogs. There's not even that many of them, and being able to access a serial port is a niche case It's amazing that you write this and then immediately find the (almost) right answer: > Unless, of course, the site is malicious/spammy. It's possible to do all kinds of annoying things, from triggering consent dialogs... And then immediately dismiss that as if that wasn't a valid concern: > Adding (or not) a consent dialog for webserial doesn't change that. Yes, yes it changes that. It increases the number of consent dialogs in a system that already has a few of those, and where users are already trained to click "yes" to thousands of annoying popups. Oh, and these are not just empty words. Recently Mozilla relented and implemented WebMIDI. Guess what: https://x.com/denschub/status/1582730985778556931 https://x.com/denschub/status/1582730985778556931 It didn't even require a malicious/spammy site. Just regular ad networks.
      - sfink 2y ago
        > Users aren't presented with a "barrage" of consent dialogs. There's not even that many of them And that is the result of a lot of hard work and pushing back on... well, on things like this. There are already enough that many people have been trained to click Accept without reading. Any new source of consent dialogs must be scrutinized very closely. > being able to access a serial port is a niche case where it does make sense -- just like accessing a web cam or microphone. If you agree to webcam access, then the site can see and record you visually. If you agree to microphone access, then the website can hear and record you aurally. If you agree to serial access, then your "TSMX9200b7 Larangipone GmbH" can... er... do something? Maybe it can turn on a blinky light. Maybe it can capture audio through an embedded IoT microphone (or speaker that shares wires with something else). Maybe it can use the debug interface on something you didn't realize had a debug interface to reprogram the device to emulate a keyboard or ethernet device and hack your system. Are you going to whitelist devices owned by big companies with lawyers and screw over experimenters? Blacklist devices so the well-behaved hackers won't hack you? I wish we lived in a world where we could just add consent dialogs or config settings to allow things like this. Instead, we live in a world where if something like this is enabled, you'll get phishing emails with support tips for fixing your browser issues (or slowness) by going to about:config and twiddling some setting that is meaningless to the 1% of recipients who matter.
    - beeboobaa3 2y ago
      Stop making up problems that don't exist.
- IshKebab 2y ago
  I would say the same number that you get from downloading and running a program that can do exactly the same thing (and worse!). So 1. Maybe 2 at most.
  - troupo 2y ago
    https://news.ycombinator.com/item?id=40248040 https://news.ycombinator.com/item?id=40248040
- beeboobaa3 2y ago
  One for every action that needs consent. What kind of question is that?
  - troupo 2y ago
    See this discussion: https://news.ycombinator.com/item?id=40248040 https://news.ycombinator.com/item?id=40248040

vbezhenar 2y ago

Because device vendor can provide you tools for your device that'll work in browser, protected by browser sandbox, cross-platform and always up to date. Rather than requiring you to install some crappy executables with instructions how to disable Windows protection to be able to install unsigned drivers.

graemep 2y ago
That sounds like a problem with Windows that should be fixed in Windows. Adding a browser API for such narrow user cases is unnecessary. Even better Windows drivers should be signed as they are supposed to be,
ale42 2y ago
Why install drivers? Webserial is about serial ports. If you need a driver to actually see your serial port, you need to install it anyway to use webserial.
ale42 2y ago
Tools that unlike local apps will go offline when the vendors' web site will go offline at some point. And then the user will have a stupid brick instead of a device. I understand the convenience of using a web-based application, but it has numerous disadvantages that should also be taken in account.
- zamadatix 2y ago
  A browser based application doesn't need to rely on the vendor's website being up any more than an executable based application needs to. It's definitely an option in each case but one does not imply the other. Distribution access becomes a pain point but in either case the answer is to find archived versions.
  - ale42 2y ago
    Sure, but I can easily put an installer on a NAS (or on whatever media I use for long-term storage) and keep it there. Properly archiving a website and making sure it works offline is another story: sometimes it is relatively simple, sometimes there are requests on backend servers and you'd have to reimplement whatever the backend is doing, and it can get a real pain to do.

beefnugs 2y ago

I just ran into this recently: provisioning some older HSMs require creating an executable sent to customers. Windows defender now blocks these by default just because they have some kind of encryption going on in them. Mozilla is correct, this is very dangerous to just freely allow access. But some people really need it. And IOT and firmware stuff really needs it to exist somehow. I dont know why active purposeful allow button isn't good enough however

josephcsible 2y ago
Why can't the executable be compiled on the customer's computer? And just "some kind of encryption" isn't enough to look like a virus. Is it doing something evil like encrypting its own code?
- tmottabr 2y ago
  not at all.. At least in windows, anything that is not signed with a code signing certificate that is known and that have good reputation will be blocked by windows and\or anti-virus. There are some small devs that i have seen needing to get a new cert, for whatever reason, and got new versions of their software start being blocked for a few weeks until the new cert got known.