4 ms·

Web USB and Web Bluetooth are amazing. I've used the former for the excellent Web MiniDisc [1], and the latter to flash custom firmware [2] on cheap Xiaomi Blue

• dylan604 6mo ago
  > Web USB and Web Bluetooth are amazing. Comments like this scare me. Things look amazing when people with benevolent intentions are making interesting things, but as soon as someone with malevolent intentions does something that becomes the reason we can't have nice things people will start asking if this is something we should have actually done. I just have no faith in humanity, and do not understand why we think this is a good idea to give a browser this much access to local system resources.
  • lxgr 6mo ago
    > Comments like this scare me. Sorry to hear that. I thought this was a safe space for hackers to express enthusiasm about pushing their own hardware and software further (and in this case even in a comparatively safe way). > I just have no faith in humanity, and do not understand why we think this is a good idea to give a browser this much access to local system resources. The browser already has all that access, it's just further granting it to web apps, and on a page-by-page, device-by-device, explicitly user opt-in basis at that. And as I've mentioned, the alternative here is to install a potentially untrusted native application that gets the same access and so much more. If that's what the Github page tells users to do, many of them will just do it without thinking twice. Is that better?
    • dylan604 6mo ago
      > I thought this was a safe space for hackers to express enthusiasm about pushing their own hardware and software further (and in this case even in a comparatively safe way). Nothing is preventing said experimentation nor discussion of it. I am merely offering my more conservative views of the situation as a contrast to the echo chamber gungho nature of the experimentation. Just because we can doesn't mean we should is often left out of the conversation. At some point, the net negative that comes from the use of something "cool" is never contemplated by those creating the something "cool" simply because they would never fathom using the "cool" for "uncool" purposes. Sadly, someone else will and weaponize it in an uncontrollable manner. If the creators can't think of how it can happen, it is vital that those not so involved in the creation speak up when there are potential issues.
      • leptons 6mo ago
        >Sadly, someone else will and weaponize it in an uncontrollable manner. Except it isn't "uncontrollable". You have to explicitly allow every single website to use WebUSB. Without that explicit allowance, the website can't access anything. Plenty of things can be weaponized, even household utensils. Should we ban all forks? The sky is not falling, and WebUSB is not going to cause it to fall.
        • bcjdjsndon 6mo ago
          > The sky is not falling, and WebUSB is not going to cause it to fall. You could always write a native app. It's always been possible that way.
          • leptons 6mo ago
            Sorry, no, I am not supporting Windows, MacOS, iOS, Android or multiple other platforms when I could just target one single platform - the web browser.
            • bcjdjsndon 6mo ago
              > the web browser Which one? Your page looks the same on all major browsers does it? Didn't think so.
              • bcjdjsndon 6mo ago
                And you have one page for both mobie and desktop?
      • concinds 6mo ago
        I wouldn't describe it as "conservative" but as "pro-native-apps and anti-web-apps", which seems irrational in this day and age where "native apps" means platform lock-in by monopolies, less sandboxing and user-control than on the web, much more gatekeeping and control over published binaries, and these days the web app is usually a more private/secure alternative to the native app (which also bundles a marketing SDK, now, and fingerprints you invisibly via iCloud Keychain, tracks you with various identifiers, and more). If native platforms removed USB or Bluetooth, the "control over my own hardware" crowd would flip a table. I just wish they also understood the benefits of the web compared to native. The Chrome/Project Fugu team's dream of making the web platform as powerful as native platforms is the correct one from a user freedom standpoint, or at bare minimum a "user choice" standpoint.
    • dwaite 6mo ago
      Sure, but some people are concerned about any website being one confirmation prompt away from being able to have full access to hardware in the user's physical environment, and being able to permanently change the behavior of that hardware. A hacker may think such things are convenient for them, but an end user does not know the ramification of a random website (WebUSB IIRC still does not have origin restrictions) getting hardware access - nor can we categorize the risk in order to protect them.
      • lxgr 6mo ago
        What physical access and what permanent behavior changes in particular are you concerned about? Most common "dangerous" USB device classes are explicitly excluded in Web USB. I've heard about rogue keyboard firmware, but that requires having a programmable/updatable firmware keyboard in the first place. And that closes the loop of my argument: People that want to update the firmware in their keyboard will do so, whether it's in the browser or by installing a potentially shady and not at all sandboxed third party application. At least in the browser, permissions are time limited and scoped to explicitly granted devices. > WebUSB IIRC still does not have origin restrictions How would you even enforce these on the open web?
        • dylan604 6mo ago
          The most important USB thing I have are storage devices. Keyboards/mice/etc are much less of a concern. If something rogue happens to a drive, that's a "major problem in Australia. Please help us stop it" situation.
          • lxgr 6mo ago
            That would indeed be horrible, which is why storage devices are explicitly excluded from WebUSB.
            • dylan604 6mo ago
              It's a good thing that history has shown us that things have never happened that were designed not to happen. Sure, my tinfoil hat is securely fashioned, but I've been around long enough to see things get subverted even if it's not until long after release.
  • suryajena 6mo ago
    What if we implement them but hide them deep in the settings or as experimental feature inside the hidden developer menu, behind multiple warning messages and password prompts? Only the very determined developers and advanced users would be able to unlock them. Then it's safe enough?
    • lxgr 6mo ago
      Users will unfortunately click on absolutely anything that a trusted (deservedly or otherwise) source tells them to, and you won’t be able to reliable convince them otherwise with UX alone. This includes all “developers only”, “click 5 times” etc. UX interventions. You have to decide whether the feature warrants the remaining risk after all mitigations, or at least exceeds other, simpler attack vectors. I think in this case it does, but it’s not an easy decision and I can understand most opposing positions as well.
      • skybrian 6mo ago
        I suppose if it’s being actively exploited, the next step would be to make users wait a day, like the plan to change how Android side loading works.
        • lxgr 6mo ago
          I'd be absolutely livid if my browser asked me to wait for a day before letting me firmware flash whatever new USB gadget just arrived in the mail.
  • Shalomboy 6mo ago
    There isn't much to fear here. Web Bluetooth has been around nearly ten years now and nothing monumental has sprung forth from it. It is wonderfully convenient to have at your fingertips, especially in the ChromeOS world, but it's not gonna turn everyone's devices into Flipper Zero targets.
  • leptons 6mo ago
    You can press a simple button on a webpage and it will install malware on your iPhone. Plenty of exploits have been out there for a long time. Should we disallow clicking on anything on a webpage too? WebUSB is no more risky than any other tech. You have to explicitly opt-in to use WebUSB on any site requesting access to it. And I'm sorry if someone's grandfather trusts a malicious website and gets hacked, but that isn't a reason to prevent the rest of us from using tech that enables functionality on non-malicious websites that serves a useful purpose.
  • cruffle_duffle 6mo ago
    “ I just have no faith in humanity, and do not understand why we think this is a good idea to give a browser this much access to local system resources” As opposed to dodgy windows-only installable software from some weird site to flash devices instead? I’ll take my chances with webusb, thanks.
    • paradox460 6mo ago
      I love that, in order to reprogram my very expensive model locomotive, I not only have to buy a special device (ESU LokProgrammer) but I can also only use said programmer with windows. Yeah I could have used some other decoder, but they all have limited functionality compared to Lol sound There's no real reason a future iteration of the LokProgrammer couldn't run a simple webserver, or connect to Web USB. This also all applies to most PLC programmers. Proprietary crap you have to run on Windows, just to build ladder logic