4 ms·

So you don’t trust the vendor. Maybe using their hardware isn’t a good idea in the first place. I think browsers are the bigger target and they provide the muc

• lukan 2y ago
  "Using an internet tool to access local resources is using the wrong tool for the job." Browser technology stopped being internet tech only quite a while ago. It might not have been the best idea, but that's where we are. So my first choice would nowdays also be webusb if possible.
  • croes 2y ago
    > Browser technology stopped being internet tech only quite a while ago. That was already a bad idea. > It might not have been the best idea, but that's where we are. You aren’t forced to use it for local resources.
    • lukan 2y ago
      No I am not forced to use it, but since the web is my usual tech stack, I likely will just use that, if I ever have to connect to a USB device.
      • croes 2y ago
        If you write code ok, but what about third party apps. Supply chain attacks are quite common.
• kccqzy 2y ago
  Maybe I'll believe you when desktop operating systems have a mature and easy-to-use sandbox for local apps. Any random local app by default having access to ~/.ssh/id_rsa no attack required is a much bigger threat for me to worry about than thinking a web app might attack my browser to steal data belonging to a different origin.
  • jimmaswell 2y ago
    Run it as another user or put it in a less privileged cgroup. Problem solved.
    • kccqzy 2y ago
      That's what I currently do but it's not easy to do at all. For one, there's no simple and built-in way to copy my desktop user settings to the new user. For two, when you switch to a new user, you can't simultaneously do things as the original user in the same desktop session.
  • croes 2y ago
    What about supply chain attacks? Do you know if your trusted web app fell for one?
    • kccqzy 2y ago
      That's irrelevant. Both local apps and web apps are subject to supply chain attacks. The difference is that a local app that has had a supply chain attack carried out can read my documents, my private keys, my photos, etc; a web app that has similarly malicious code cannot do any of that. The browser protects me because it has a sandbox. I also do not understand why you refer to "trusted web app" whereas in my comment above I have stated that I need a sandbox to run the code; I clearly don't trust it enough. The whole point is that the browser allows me to run untrusted code safely. And supply chain attack is one of the main reasons why I don't trust it enough.
      • croes 2y ago
        Web apps have a magnitude more dependencies than desktop apps. A lot bigger attack vector. >I also do not understand why you refer to "trusted web app" whereas in my comment above I have stated that I need a sandbox to run the code Because you referred to apps stealing code from a different origin. I talk about the app you use to access the usb device per web usb. Previously it was about a malicious app attacking per browser exploit. This tine the app is allowed to access the data but because of the supply chain attacks your data gets stolen.