4 ms·
> Even WebRTC is a bit of a stretch You remove that, and videoconferencing (for business or person to person) has to rely on downloading an app, meaning whoeve
by sofixa 1y ago
> Even WebRTC is a bit of a stretch
You remove that, and videoconferencing (for business or person to person) has to rely on downloading an app, meaning whoever is behind the website has to release for 10-15 OSes now. Some already do, but not everyone has that budget so now there's a massive moat around it.
> But do we need e.g serial port or raw USB access straight from a random website
Being able to flash an IoT (e.g. ESP32) device from the browser is useful for a lot of people. For the "normies", there was also Stadia allowing you to flash their controller to be a generic Bluetooth/usb one on a website, using that webUSB. Without it Google would have had to release an app for multiple OSes, or more likely, would have just left the devices as paperweights. Also, you can use FIDO/U2F keys directly now, which is pretty good.
Browsers are the modern Excel, people complain that they do too much and you only need 20%. But it's a different 20% for everyone.
- gmueckl 1y agoI'll flip that around on you: why oh why do we need to browsers to carry these security holes in them? The Stadia flasher is a good example: how do I know that a website doesn't contain a device flasher that will turn one of my connected devices into a malicious actor that will attempt to take over whatever machine it's plugged into?
- sofixa 1y agoYou know because there is an explicit permission box that pops out and asks if you want to give this website access to a device, and asks you to select that device. Same as your camera/microphone/location.
- gmueckl 1y agoBut that still gives completely unvetted direct access to the device to a website! People have been pointing to Itch.io games that supposedly require direct USB access. How hard is it to hide a script in there that reprograms a controller into something malicious?
- lukan 1y agoIf you download a executable from a website and run it .. pretty much the same thing? If you give USB access, it is not really a website anymore, rather a app delivered through the web. I don't see a fundamental difference in trust. I rather am able to verify the web based version easier and I certainly won't give access to a random website, just like I don't download random exes from websites. Performance is lower, yes and well ... like I said, it is all a big mess. Just look at the global namespace in js. I still use it because of that power feature called plattform independence. What I release, people can (mostly) just use. I (mostly) don't care which OS the user has.
- gmueckl 1y agoA fule thst lands on my hard drive is aztomatically scanned for malware. That same kindof protection isn't in place against malicious scripts downloaded by my broswer via an opaque HTTPS connection and run in process.
- account42 1y agoAnd we all know that non-technical users never just click Yes to make the annoying popup go away.