5 ms·

It doesn't have access to your "serial ports". It has access to a consent dialog in which you can choose one port to give the website access to, so it can e.g.

It doesn't have access to your "serial ports". It has access to a consent dialog in which you can choose one port to give the website access to, so it can e.g. flash IoT devices for you. Take a look at e.g. https://esphome.io/index.html https://esphome.io/index.html Or just RTFA: https://github.com/kuba2k2/firefox-webserial?tab=readme-ov-file#usage https://github.com/kuba2k2/firefox-webserial?tab=readme-ov-f...

troupo 2y ago
And how many consent dialogs will you be willing to call an acceptable number?
- cillian64 2y ago
  If that’s the argument against, it could just be denied by default and require the user to go into settings to allow. The annoyance isn’t too bad given webserial is probably only used on occasion, and it means no concerns about consent spam or fingerprinting.
  - troupo 2y ago
    Why do people willingly ignore all the other APIs that require a consent dialog. And what happens when users are presented with a barrage of them.
    - gregmac 2y ago
      Users aren't presented with a "barrage" of consent dialogs. There's not even that many of them, and being able to access a serial port is a niche case where it does make sense -- just like accessing a web cam or microphone. It's certainly less annoying than the one for allowing push notifications. Unless, of course, the site is malicious/spammy. It's possible to do all kinds of annoying things, from triggering consent dialogs, to opening new windows, to playing sounds.. and you can even do them in a loop. Adding (or not) a consent dialog for webserial doesn't change that.
      - troupo 2y ago
        > Users aren't presented with a "barrage" of consent dialogs. There's not even that many of them, and being able to access a serial port is a niche case It's amazing that you write this and then immediately find the (almost) right answer: > Unless, of course, the site is malicious/spammy. It's possible to do all kinds of annoying things, from triggering consent dialogs... And then immediately dismiss that as if that wasn't a valid concern: > Adding (or not) a consent dialog for webserial doesn't change that. Yes, yes it changes that. It increases the number of consent dialogs in a system that already has a few of those, and where users are already trained to click "yes" to thousands of annoying popups. Oh, and these are not just empty words. Recently Mozilla relented and implemented WebMIDI. Guess what: https://x.com/denschub/status/1582730985778556931 https://x.com/denschub/status/1582730985778556931 It didn't even require a malicious/spammy site. Just regular ad networks.
      - sfink 2y ago
        > Users aren't presented with a "barrage" of consent dialogs. There's not even that many of them And that is the result of a lot of hard work and pushing back on... well, on things like this. There are already enough that many people have been trained to click Accept without reading. Any new source of consent dialogs must be scrutinized very closely. > being able to access a serial port is a niche case where it does make sense -- just like accessing a web cam or microphone. If you agree to webcam access, then the site can see and record you visually. If you agree to microphone access, then the website can hear and record you aurally. If you agree to serial access, then your "TSMX9200b7 Larangipone GmbH" can... er... do something? Maybe it can turn on a blinky light. Maybe it can capture audio through an embedded IoT microphone (or speaker that shares wires with something else). Maybe it can use the debug interface on something you didn't realize had a debug interface to reprogram the device to emulate a keyboard or ethernet device and hack your system. Are you going to whitelist devices owned by big companies with lawyers and screw over experimenters? Blacklist devices so the well-behaved hackers won't hack you? I wish we lived in a world where we could just add consent dialogs or config settings to allow things like this. Instead, we live in a world where if something like this is enabled, you'll get phishing emails with support tips for fixing your browser issues (or slowness) by going to about:config and twiddling some setting that is meaningless to the 1% of recipients who matter.
    - beeboobaa3 2y ago
      Stop making up problems that don't exist.
- IshKebab 2y ago
  I would say the same number that you get from downloading and running a program that can do exactly the same thing (and worse!). So 1. Maybe 2 at most.
  - troupo 2y ago
    https://news.ycombinator.com/item?id=40248040 https://news.ycombinator.com/item?id=40248040
- beeboobaa3 2y ago
  One for every action that needs consent. What kind of question is that?
  - troupo 2y ago
    See this discussion: https://news.ycombinator.com/item?id=40248040 https://news.ycombinator.com/item?id=40248040

troupo 2y ago

And how many consent dialogs will you be willing to call an acceptable number?

cillian64 2y ago
If that’s the argument against, it could just be denied by default and require the user to go into settings to allow. The annoyance isn’t too bad given webserial is probably only used on occasion, and it means no concerns about consent spam or fingerprinting.
- troupo 2y ago
  Why do people willingly ignore all the other APIs that require a consent dialog. And what happens when users are presented with a barrage of them.
  - gregmac 2y ago
    Users aren't presented with a "barrage" of consent dialogs. There's not even that many of them, and being able to access a serial port is a niche case where it does make sense -- just like accessing a web cam or microphone. It's certainly less annoying than the one for allowing push notifications. Unless, of course, the site is malicious/spammy. It's possible to do all kinds of annoying things, from triggering consent dialogs, to opening new windows, to playing sounds.. and you can even do them in a loop. Adding (or not) a consent dialog for webserial doesn't change that.
    - troupo 2y ago
      > Users aren't presented with a "barrage" of consent dialogs. There's not even that many of them, and being able to access a serial port is a niche case It's amazing that you write this and then immediately find the (almost) right answer: > Unless, of course, the site is malicious/spammy. It's possible to do all kinds of annoying things, from triggering consent dialogs... And then immediately dismiss that as if that wasn't a valid concern: > Adding (or not) a consent dialog for webserial doesn't change that. Yes, yes it changes that. It increases the number of consent dialogs in a system that already has a few of those, and where users are already trained to click "yes" to thousands of annoying popups. Oh, and these are not just empty words. Recently Mozilla relented and implemented WebMIDI. Guess what: https://x.com/denschub/status/1582730985778556931 https://x.com/denschub/status/1582730985778556931 It didn't even require a malicious/spammy site. Just regular ad networks.
    - sfink 2y ago
      > Users aren't presented with a "barrage" of consent dialogs. There's not even that many of them And that is the result of a lot of hard work and pushing back on... well, on things like this. There are already enough that many people have been trained to click Accept without reading. Any new source of consent dialogs must be scrutinized very closely. > being able to access a serial port is a niche case where it does make sense -- just like accessing a web cam or microphone. If you agree to webcam access, then the site can see and record you visually. If you agree to microphone access, then the website can hear and record you aurally. If you agree to serial access, then your "TSMX9200b7 Larangipone GmbH" can... er... do something? Maybe it can turn on a blinky light. Maybe it can capture audio through an embedded IoT microphone (or speaker that shares wires with something else). Maybe it can use the debug interface on something you didn't realize had a debug interface to reprogram the device to emulate a keyboard or ethernet device and hack your system. Are you going to whitelist devices owned by big companies with lawyers and screw over experimenters? Blacklist devices so the well-behaved hackers won't hack you? I wish we lived in a world where we could just add consent dialogs or config settings to allow things like this. Instead, we live in a world where if something like this is enabled, you'll get phishing emails with support tips for fixing your browser issues (or slowness) by going to about:config and twiddling some setting that is meaningless to the 1% of recipients who matter.
  - beeboobaa3 2y ago
    Stop making up problems that don't exist.
IshKebab 2y ago
I would say the same number that you get from downloading and running a program that can do exactly the same thing (and worse!). So 1. Maybe 2 at most.
- troupo 2y ago
  https://news.ycombinator.com/item?id=40248040 https://news.ycombinator.com/item?id=40248040
beeboobaa3 2y ago
One for every action that needs consent. What kind of question is that?
- troupo 2y ago
  See this discussion: https://news.ycombinator.com/item?id=40248040 https://news.ycombinator.com/item?id=40248040