5 ms·

Running directly in the browser is also not how I'd want to do USB.

by Orygin 6mo ago

afavour 6mo ago
When the alternative is downloading arbitrary executables I find the browser sandbox to be a reassurance.
- Orygin 6mo ago
  Except the sandbox is a huge target already, and breaking it means any website can now access and mess with your usb devices. If you can develop an exploit for Chrome's WebUSB system, you potentially have millions upon millions of targets available. Downloading an arbitrary executable can be made safe (via multiple avenues: trust, anti virus software, audits, artifact signing, reproducible builds, etc) and once the software is vetted, it exposes (or it should at least) little to no attack vector during daily use.
  - bastawhiz 6mo ago
    > trust, anti virus software, audits, artifact signing, reproducible builds, etc My mom has six weather apps on her phone.
- michaelt 6mo ago
  Buddy if your "sandbox" lets code inside it replace your keyboard's firmware you don't have a sandbox.
  - sagarm 6mo ago
    Programming your keyboard is actually a common case! See usevia.app
    - michaelt 6mo ago
      It is indeed common! But a keyboard flashed with malicious firmware becomes an undetectable keylogger, a USB rubber ducky, and a virus-laden USB stick all in one. The concept that someone would want to reflash their keyboard firmware, but wants a sandbox because they don't trust the firmware programmer makes no sense.
      - sagarm 6mo ago
        Hmm, that's probably somewhat fair. While you're using a protocol that's only intended to update the key map, it's probably not hardened against attacks. Regardless, the real reason people use this is because it's incredibly convenient compared with using QMK and ZMK directly.
bastawhiz 6mo ago
Then don't install the extension
- Orygin 6mo ago
  It is enabled without extension in Chrome browsers. This is a common complain about Firefox is that they don't implement the Google draft spec. It will probably come natively one day in Firefox, and we should push back against such attack vectors.
  - bastawhiz 6mo ago
    Of all the browser features I would consider disabling in the name of security, the ability to talk to my trackpad and printer is pretty much at the bottom of the list. I'd start with the JIT compiler, filesystem APIs, all of the video codecs, probably many of the image codecs, cookies and localstorage, webgl/webgpu, the crash collector, the auto updater...

Running directly in the browser is also not how I'd want to do USB.

by Orygin 6mo ago

Running directly in the browser is also not how I'd want to do USB.

afavour 6mo ago

When the alternative is downloading arbitrary executables I find the browser sandbox to be a reassurance.

Orygin 6mo ago
Except the sandbox is a huge target already, and breaking it means any website can now access and mess with your usb devices. If you can develop an exploit for Chrome's WebUSB system, you potentially have millions upon millions of targets available. Downloading an arbitrary executable can be made safe (via multiple avenues: trust, anti virus software, audits, artifact signing, reproducible builds, etc) and once the software is vetted, it exposes (or it should at least) little to no attack vector during daily use.
- bastawhiz 6mo ago
  > trust, anti virus software, audits, artifact signing, reproducible builds, etc My mom has six weather apps on her phone.
michaelt 6mo ago
Buddy if your "sandbox" lets code inside it replace your keyboard's firmware you don't have a sandbox.
- sagarm 6mo ago
  Programming your keyboard is actually a common case! See usevia.app
  - michaelt 6mo ago
    It is indeed common! But a keyboard flashed with malicious firmware becomes an undetectable keylogger, a USB rubber ducky, and a virus-laden USB stick all in one. The concept that someone would want to reflash their keyboard firmware, but wants a sandbox because they don't trust the firmware programmer makes no sense.
    - sagarm 6mo ago
      Hmm, that's probably somewhat fair. While you're using a protocol that's only intended to update the key map, it's probably not hardened against attacks. Regardless, the real reason people use this is because it's incredibly convenient compared with using QMK and ZMK directly.

bastawhiz 6mo ago

Then don't install the extension

Orygin 6mo ago
It is enabled without extension in Chrome browsers. This is a common complain about Firefox is that they don't implement the Google draft spec. It will probably come natively one day in Firefox, and we should push back against such attack vectors.
- bastawhiz 6mo ago
  Of all the browser features I would consider disabling in the name of security, the ability to talk to my trackpad and printer is pretty much at the bottom of the list. I'd start with the JIT compiler, filesystem APIs, all of the video codecs, probably many of the image codecs, cookies and localstorage, webgl/webgpu, the crash collector, the auto updater...