3 ms·

I think they're right to be wary, but then again, Chrome shipped this in 2021. It's not widely used, but it seems like there should be some real-world experienc

I think they're right to be wary, but then again, Chrome shipped this in 2021. It's not widely used, but it seems like there should be some real-world experience to go on? Are Chrome's safely precautions inadequate? Is it being abused? In the end, though, it's not that big a deal. It's easy for technically minded people to have more than one browser installed. You can use Firefox and start Chrome for any websites that need this niche feature. I wrote a tool that uses WebSerial. It's a little annoying to ask people to switch browsers to use my tool, but it's doable. (Or perhaps use this extension, if you trust it.) In practice, nobody is using my tool much anyway, including me.

troupo 3y ago
> I think they're right to be wary, but then again, Chrome shipped this in 2021. Just because Chrome shipped something: - doesn't make it a standard - doesn't make it secure Can't say for WebSerial, but when Mozilla shipped WebMIDI they immediately discovered that it was used for fingerprinting (https://twitter.com/denschub/status/1582730985778556931 https://twitter.com/denschub/status/1582730985778556931), and Chrome was silently letting sites enumerate MIDI devices on a user's computer (https://twitter.com/denschub/status/1582730988118867968 https://twitter.com/denschub/status/1582730988118867968)
- skybrian 3y ago
  No, of course not, but I think we should be curious about it. For example, what have security researchers discovered about WebSerial as implemented in Chrome?
  - troupo 3y ago
    You don't even have to discover anything. The spec itself lists unmitigated issues that are the same for other hardware APIs too: https://wicg.github.io/serial/#security https://wicg.github.io/serial/#security