4 ms·

WebUSB as an extension is the right approach. The security concern isn't the API itself — it's the default-on expectation that Chrome created. Firefox's mode

WebUSB as an extension is the right approach. The security concern isn't the API itself — it's the default-on expectation that Chrome created. Firefox's model of "opt-in via extension" gives power users what they need without expanding the attack surface for everyone else. I've used WebUSB for flashing keyboard firmware and it's genuinely better than downloading random executables from GitHub. The permission model is more transparent than a native app that silently gets full USB access.

vbezhenar 6mo ago
The whole point of WebUSB is to create a tool that works with USB device, without all the risks and issues of installing external programs. If I need to install a program, browser extension, just to work with a given tool, I probably would just prefer an ordinary program without browser at all. Chrome approach is correct. It allows user to work with USB devices without exposing computer to the risks of installing a host software.
- bjord 6mo ago
  ...in your opinion. the firefox team disagrees.
  - vbezhenar 6mo ago
    They already killed Firefox. It has 2% marketshare. Next to something called "Samsung Internet" LoL. They're not in position to force technology usage.
  - paradox460 6mo ago
    They'd much rather show me full screen ads for Disney movies, install extensions advertising TV shows, or try and get me to use pocket
    - bjord 5mo ago
      sorry, what are you talking about?
      - paradox460 5mo ago
        Disney ad: on update it showed a full new tab page about turning red Installed extension: Mr robot extension Pocket: constantly tried to promote it
- StingyJelly 6mo ago
  You have to balance the this ease of use with increasing potential attack and fingerprinting surface. Correct approach is something in the middle - a separate off-by-default setting or recommended official extension.
  - vbezhenar 6mo ago
    Chrome has the option to turn off APIs by default. I do it for my installs. I think that disabling that option for everyone is not a good approach as average user will never figure out how to enable it, making that technology effectively dead, so we get back to installing host software. Sometimes security and usability contradict with each other.
    - albuic 5mo ago
      Indeed security and usability do contradict each other but in that case, I prefer Firefox approach for more security/privacy
kgwxd 6mo ago
Everything should be an extension for a browser. AI, telemetry, and other universally hated features. Let the user choose. No one has to worry if a toggle will always be respected in code, or if an update will undo it. Beholden to the same security isolations other extensions are forced to abide by. It's just the right way to do things.
Hendrikto 6mo ago
> In order to use this, you need to both install the extension in your browser and install a small program (separate from the browser) on your computer. This extra program is called the "native stub". Idk. Sure it has security advantages, but that sounds like to much of a hassle for 90% of users.

vbezhenar 6mo ago

The whole point of WebUSB is to create a tool that works with USB device, without all the risks and issues of installing external programs. If I need to install a program, browser extension, just to work with a given tool, I probably would just prefer an ordinary program without browser at all. Chrome approach is correct. It allows user to work with USB devices without exposing computer to the risks of installing a host software.

bjord 6mo ago
...in your opinion. the firefox team disagrees.
- vbezhenar 6mo ago
  They already killed Firefox. It has 2% marketshare. Next to something called "Samsung Internet" LoL. They're not in position to force technology usage.
- paradox460 6mo ago
  They'd much rather show me full screen ads for Disney movies, install extensions advertising TV shows, or try and get me to use pocket
  - bjord 5mo ago
    sorry, what are you talking about?
    - paradox460 5mo ago
      Disney ad: on update it showed a full new tab page about turning red Installed extension: Mr robot extension Pocket: constantly tried to promote it
StingyJelly 6mo ago
You have to balance the this ease of use with increasing potential attack and fingerprinting surface. Correct approach is something in the middle - a separate off-by-default setting or recommended official extension.
- vbezhenar 6mo ago
  Chrome has the option to turn off APIs by default. I do it for my installs. I think that disabling that option for everyone is not a good approach as average user will never figure out how to enable it, making that technology effectively dead, so we get back to installing host software. Sometimes security and usability contradict with each other.
  - albuic 5mo ago
    Indeed security and usability do contradict each other but in that case, I prefer Firefox approach for more security/privacy

kgwxd 6mo ago

Everything should be an extension for a browser. AI, telemetry, and other universally hated features. Let the user choose. No one has to worry if a toggle will always be respected in code, or if an update will undo it. Beholden to the same security isolations other extensions are forced to abide by. It's just the right way to do things.

Hendrikto 6mo ago

> In order to use this, you need to both install the extension in your browser and install a small program (separate from the browser) on your computer. This extra program is called the "native stub". Idk. Sure it has security advantages, but that sounds like to much of a hassle for 90% of users.