3 ms·

But do we need e.g serial port or raw USB access straight from a random website? Even WebRTC is a bit of a stretch. There is a lot of cruft in modern browsers t

But do we need e.g serial port or raw USB access straight from a random website? Even WebRTC is a bit of a stretch. There is a lot of cruft in modern browsers that does little except increase attack surface. This all just drives a need to come up with ever more tacked-on protection schemes because browsers have big targets painted on them.

shadowgovt 1y ago
How else am I going to make a game in the browser that be controlled with a controller?
- gmueckl 1y ago
  Every decent host OS already has a dedicated driver stack to provide game controller input to applications in a useful manner. Why the heck would you ship a reimplementation of that in JS in a website?
  - shadowgovt 1y ago
    So that you can take input from countrollers that haven't been invented yet and won't fit the HID model.
    - gmueckl 1y ago
      If it hasn't been invented yet, you don't need driver software for it, do you? ;) Anyway, in your scenario the controller would be essentially a one off and you'd be better off writing a native app to interface with it for the one computer this experiment will run on.
    - account42 1y ago
      If it hasn't been invented yet we don't know the implications of giving a website access to it either. And that's before realizing it's already a bad idea with existing devices because they were never designed for giving untrusted actors direct access.
      - shadowgovt 1y ago
        That's why we have a privacy and security sandbox in browsers.
- account42 1y ago
  You don't, that's the point: not everything needs to be crammed into a browser.
  - shadowgovt 1y ago
    Unlikely. The convenience incentives are far too high to leave features on the table. Not unlike the programming language or the app (growing until it half-implements LISP or half-implements an email client), the browser will grow until it half-implements an operating system. For everyone else, there's already w3m.
lukan 1y ago
WebRTC I use since many years and would miss it a lot. P2P is awesome. WebUSB I don't use or would miss it right now, but .. the main potential use case is security and it sounds somewhat reasonable "Use in multi-factor authentication WebUSB in combination with special purpose devices and public identification registries can be used as key piece in an infrastructure scale solution to digital identity on the internet." https://en.wikipedia.org/wiki/WebUSB https://en.wikipedia.org/wiki/WebUSB
com2kid 1y ago
Itch.io games and controller support. You have sites now that let you debug microcontrollers on your browser, super cool. Same thing but with firmware updates in the browser. Cross platform, replaced a mess of ugly broken vendor tools.
- progval 1y ago
  While that's pretty convenient, I'm worried about what happens when the vendor shuts down the website. "Ugly broken vendor tools" can be run forever in a VM of an old system, but a website would be gone forever unless it's purely client-side and someone archived it.
- account42 1y ago
  Just because you can do something doesn't mean you should. Your micro-controllers should use open standards for their debugging interface and not force people to use the vendor website.
hulitu 1y ago
> But do we need e.g serial port or raw USB access straight from a random website? Yes. Regards, CIA, Mossad, FSB etc.
sofixa 1y ago
> Even WebRTC is a bit of a stretch You remove that, and videoconferencing (for business or person to person) has to rely on downloading an app, meaning whoever is behind the website has to release for 10-15 OSes now. Some already do, but not everyone has that budget so now there's a massive moat around it. > But do we need e.g serial port or raw USB access straight from a random website Being able to flash an IoT (e.g. ESP32) device from the browser is useful for a lot of people. For the "normies", there was also Stadia allowing you to flash their controller to be a generic Bluetooth/usb one on a website, using that webUSB. Without it Google would have had to release an app for multiple OSes, or more likely, would have just left the devices as paperweights. Also, you can use FIDO/U2F keys directly now, which is pretty good. Browsers are the modern Excel, people complain that they do too much and you only need 20%. But it's a different 20% for everyone.
- gmueckl 1y ago
  I'll flip that around on you: why oh why do we need to browsers to carry these security holes in them? The Stadia flasher is a good example: how do I know that a website doesn't contain a device flasher that will turn one of my connected devices into a malicious actor that will attempt to take over whatever machine it's plugged into?
  - sofixa 1y ago
    You know because there is an explicit permission box that pops out and asks if you want to give this website access to a device, and asks you to select that device. Same as your camera/microphone/location.
    - gmueckl 1y ago
      But that still gives completely unvetted direct access to the device to a website! People have been pointing to Itch.io games that supposedly require direct USB access. How hard is it to hide a script in there that reprograms a controller into something malicious?
      - 1y ago
phatskat 1y ago
> But do we need e.g serial port or raw USB access straight from a random website? But do we need audio, images, Canvas, WebGL, etc? The web could just be plain text and we’d get most of the “useful” content still, add images and you get a vast majority of it. But the idea that the web is a rich environment that has all of these bells and whistles is a good thing imo. Yes there’s attack surface to consider, and it’s not negligible. However, the ability to connect so many different things opens up simple access to things that would otherwise require discrete apps and tooling. One example that kind of blew my mind is that I wanted a controller overlay for my Twitch stream. After a short bit of looking, there isn’t even a plugin needed in OBS (streaming software). Instead, you add a Web View layer and point it to GamePad Viewer[1] and you’re done. Serial and USB are possibly a boon for very specific users with very specific accessibility needs. Also, iirc some of the early iPhone jailbreaks worked via websites on a desktop with your iPhone plugged into usb. Sure these are niche, and could probably be served just as well or better with native apps, and web also makes the barrier to entry so much lower . [1]: https://gamepadviewer.com/ https://gamepadviewer.com/

shadowgovt 1y ago

How else am I going to make a game in the browser that be controlled with a controller?

gmueckl 1y ago
Every decent host OS already has a dedicated driver stack to provide game controller input to applications in a useful manner. Why the heck would you ship a reimplementation of that in JS in a website?
- shadowgovt 1y ago
  So that you can take input from countrollers that haven't been invented yet and won't fit the HID model.
  - gmueckl 1y ago
    If it hasn't been invented yet, you don't need driver software for it, do you? ;) Anyway, in your scenario the controller would be essentially a one off and you'd be better off writing a native app to interface with it for the one computer this experiment will run on.
  - account42 1y ago
    If it hasn't been invented yet we don't know the implications of giving a website access to it either. And that's before realizing it's already a bad idea with existing devices because they were never designed for giving untrusted actors direct access.
    - shadowgovt 1y ago
      That's why we have a privacy and security sandbox in browsers.
account42 1y ago
You don't, that's the point: not everything needs to be crammed into a browser.
- shadowgovt 1y ago
  Unlikely. The convenience incentives are far too high to leave features on the table. Not unlike the programming language or the app (growing until it half-implements LISP or half-implements an email client), the browser will grow until it half-implements an operating system. For everyone else, there's already w3m.

lukan 1y ago

WebRTC I use since many years and would miss it a lot. P2P is awesome. WebUSB I don't use or would miss it right now, but .. the main potential use case is security and it sounds somewhat reasonable "Use in multi-factor authentication WebUSB in combination with special purpose devices and public identification registries can be used as key piece in an infrastructure scale solution to digital identity on the internet." https://en.wikipedia.org/wiki/WebUSB https://en.wikipedia.org/wiki/WebUSB

com2kid 1y ago

Itch.io games and controller support. You have sites now that let you debug microcontrollers on your browser, super cool. Same thing but with firmware updates in the browser. Cross platform, replaced a mess of ugly broken vendor tools.

progval 1y ago
While that's pretty convenient, I'm worried about what happens when the vendor shuts down the website. "Ugly broken vendor tools" can be run forever in a VM of an old system, but a website would be gone forever unless it's purely client-side and someone archived it.
account42 1y ago
Just because you can do something doesn't mean you should. Your micro-controllers should use open standards for their debugging interface and not force people to use the vendor website.

hulitu 1y ago

> But do we need e.g serial port or raw USB access straight from a random website? Yes. Regards, CIA, Mossad, FSB etc.

sofixa 1y ago

> Even WebRTC is a bit of a stretch You remove that, and videoconferencing (for business or person to person) has to rely on downloading an app, meaning whoever is behind the website has to release for 10-15 OSes now. Some already do, but not everyone has that budget so now there's a massive moat around it. > But do we need e.g serial port or raw USB access straight from a random website Being able to flash an IoT (e.g. ESP32) device from the browser is useful for a lot of people. For the "normies", there was also Stadia allowing you to flash their controller to be a generic Bluetooth/usb one on a website, using that webUSB. Without it Google would have had to release an app for multiple OSes, or more likely, would have just left the devices as paperweights. Also, you can use FIDO/U2F keys directly now, which is pretty good. Browsers are the modern Excel, people complain that they do too much and you only need 20%. But it's a different 20% for everyone.

gmueckl 1y ago
I'll flip that around on you: why oh why do we need to browsers to carry these security holes in them? The Stadia flasher is a good example: how do I know that a website doesn't contain a device flasher that will turn one of my connected devices into a malicious actor that will attempt to take over whatever machine it's plugged into?
- sofixa 1y ago
  You know because there is an explicit permission box that pops out and asks if you want to give this website access to a device, and asks you to select that device. Same as your camera/microphone/location.
  - gmueckl 1y ago
    But that still gives completely unvetted direct access to the device to a website! People have been pointing to Itch.io games that supposedly require direct USB access. How hard is it to hide a script in there that reprograms a controller into something malicious?
    - 1y ago

phatskat 1y ago

> But do we need e.g serial port or raw USB access straight from a random website? But do we need audio, images, Canvas, WebGL, etc? The web could just be plain text and we’d get most of the “useful” content still, add images and you get a vast majority of it. But the idea that the web is a rich environment that has all of these bells and whistles is a good thing imo. Yes there’s attack surface to consider, and it’s not negligible. However, the ability to connect so many different things opens up simple access to things that would otherwise require discrete apps and tooling. One example that kind of blew my mind is that I wanted a controller overlay for my Twitch stream. After a short bit of looking, there isn’t even a plugin needed in OBS (streaming software). Instead, you add a Web View layer and point it to GamePad Viewer[1] and you’re done. Serial and USB are possibly a boon for very specific users with very specific accessibility needs. Also, iirc some of the early iPhone jailbreaks worked via websites on a desktop with your iPhone plugged into usb. Sure these are niche, and could probably be served just as well or better with native apps, and web also makes the barrier to entry so much lower . [1]: https://gamepadviewer.com/ https://gamepadviewer.com/