4 ms·

We already have authorisation popup boxes for websites that want to use stuff like webcams, it doesn't seem unreasonable for them to just give a popup authorisa

We already have authorisation popup boxes for websites that want to use stuff like webcams, it doesn't seem unreasonable for them to just give a popup authorisation for web serial with a warning that it could set your printer on fire.

madeofpalk 2y ago
You can read through the conversations to understand more of the context https://github.com/mozilla/standards-positions/issues/100#issuecomment-411931908 https://github.com/mozilla/standards-positions/issues/100#is... https://github.com/mozilla/standards-positions/issues/95#issuecomment-403139745 https://github.com/mozilla/standards-positions/issues/95#iss... https://github.com/mozilla/standards-positions/issues/336 https://github.com/mozilla/standards-positions/issues/336 The main struggle is around giving informed consent that explains the risks. Understandably, browsers don't want to ship a "Set my printer on fire" button. The web is held to a higher standard because it's so much more hostile than the native app environments, with arbitary code being executed, without permission, from unknown and untrustable origins.
WorldMaker 2y ago
Mozilla has a lot of metrics of things like webcam permissions and quite a lot of data on how often that goes wrong in practice (websites that get more permissions than users meant to give them; websites that abuse permissions after they've been granted them; etc). If Mozilla thought a permissions flow was all that was needed to make Webserial safe, they would have suggested it. I'm sure they have plenty of empirical data to give them enough reasons why they suggested that a permissions flow wouldn't be enough to keep this safe.
troupo 2y ago
> doesn't seem unreasonable for them to just give a popup authorisation for web serial Just a pop up for camera Just a popup for microphone Just a popup for location Just a popup for notifications Just a popup for Web Serial Just a popup for Web USB Just a popup for Web MIDI Just a popup for Web HID Just a popup for Web Bluetooth Just a popup for File System Access Just a popup for Network Information Just a popup for Web NFC Just a popup for ...
- IshKebab 2y ago
  I don't really see any issue with that. What's the specific problem? I mean that's how Android and iOS work and it seems to work quite well in practice.
  - troupo 2y ago
    > I don't really see any issue with that. You don't see an issue with a barrage of prompts that users have been conditioned to blindly accept? > I mean that's how Android and iOS work and it seems to work quite well in practice. It doesn't work that well in practice. This is an older study, but the results in section 7 remain as relevant: https://cups.cs.cmu.edu/soups/2012/proceedings/a3_Felt.pdf https://cups.cs.cmu.edu/soups/2012/proceedings/a3_Felt.pdf
    - IshKebab 2y ago
      > You don't see an issue with a barrage of prompts that users have been conditioned to blindly accept? No, for two reasons: 1. This isn't like "are you sure you wish to run this program that you just downloaded?" where you pretty much have zero reason to ever say no. If a torrent site asks for USB access I'm going to say no. If a firmware update site asks, I'll say yes. It's easily actionable. 2. No sites ask for all of those permissions. At most they ask for one or two.
      - troupo 2y ago
        > . If a torrent site asks for USB access I'm going to say no You keep pretending that only torrent sites (or scammy sites) will be asking for this. Here's an ad network on a legitimate site asking for access to MIDI:https://x.com/denschub/status/1582730985778556931 https://x.com/denschub/status/1582730985778556931 > No sites ask for all of those permissions. You don't have to ask for all permissions. There are so many permissions that you only need a subset
        madeofpalk 2y ago
j45 2y ago
A web cam doesn't seem like a universal interface to plug in anything through.

madeofpalk 2y ago

You can read through the conversations to understand more of the context https://github.com/mozilla/standards-positions/issues/100#issuecomment-411931908 https://github.com/mozilla/standards-positions/issues/100#is... https://github.com/mozilla/standards-positions/issues/95#issuecomment-403139745 https://github.com/mozilla/standards-positions/issues/95#iss... https://github.com/mozilla/standards-positions/issues/336 https://github.com/mozilla/standards-positions/issues/336 The main struggle is around giving informed consent that explains the risks. Understandably, browsers don't want to ship a "Set my printer on fire" button. The web is held to a higher standard because it's so much more hostile than the native app environments, with arbitary code being executed, without permission, from unknown and untrustable origins.

WorldMaker 2y ago

Mozilla has a lot of metrics of things like webcam permissions and quite a lot of data on how often that goes wrong in practice (websites that get more permissions than users meant to give them; websites that abuse permissions after they've been granted them; etc). If Mozilla thought a permissions flow was all that was needed to make Webserial safe, they would have suggested it. I'm sure they have plenty of empirical data to give them enough reasons why they suggested that a permissions flow wouldn't be enough to keep this safe.

troupo 2y ago

> doesn't seem unreasonable for them to just give a popup authorisation for web serial Just a pop up for camera Just a popup for microphone Just a popup for location Just a popup for notifications Just a popup for Web Serial Just a popup for Web USB Just a popup for Web MIDI Just a popup for Web HID Just a popup for Web Bluetooth Just a popup for File System Access Just a popup for Network Information Just a popup for Web NFC Just a popup for ...

IshKebab 2y ago
I don't really see any issue with that. What's the specific problem? I mean that's how Android and iOS work and it seems to work quite well in practice.
- troupo 2y ago
  > I don't really see any issue with that. You don't see an issue with a barrage of prompts that users have been conditioned to blindly accept? > I mean that's how Android and iOS work and it seems to work quite well in practice. It doesn't work that well in practice. This is an older study, but the results in section 7 remain as relevant: https://cups.cs.cmu.edu/soups/2012/proceedings/a3_Felt.pdf https://cups.cs.cmu.edu/soups/2012/proceedings/a3_Felt.pdf
  - IshKebab 2y ago
    > You don't see an issue with a barrage of prompts that users have been conditioned to blindly accept? No, for two reasons: 1. This isn't like "are you sure you wish to run this program that you just downloaded?" where you pretty much have zero reason to ever say no. If a torrent site asks for USB access I'm going to say no. If a firmware update site asks, I'll say yes. It's easily actionable. 2. No sites ask for all of those permissions. At most they ask for one or two.
    - troupo 2y ago
      > . If a torrent site asks for USB access I'm going to say no You keep pretending that only torrent sites (or scammy sites) will be asking for this. Here's an ad network on a legitimate site asking for access to MIDI:https://x.com/denschub/status/1582730985778556931 https://x.com/denschub/status/1582730985778556931 > No sites ask for all of those permissions. You don't have to ask for all permissions. There are so many permissions that you only need a subset
      - madeofpalk 2y ago

j45 2y ago

A web cam doesn't seem like a universal interface to plug in anything through.