8BitDo say Ultimate Software Online is their attempt to make things easier for Linux gamers, no need to download a standalone firmware updater app now.
WebUSB is absurd and shouldn’t exist. Web apps should not ever be able to work with USB devices! The core concept is wrong!
A website shouldn’t even be allowed to know if I have a USB port at all, let alone anything else about my hardware. I’m not even convinced it should be allowed to know the viewport size of the browser window! All these APIs just make the attack surface fucking gargantuan and open up infinite opportunities for browser fingerprinting. They should be Considered Harmful and abolished.
I agree. It should be an opt-in permission, per-site, with the possibility to silently auto-reject always by default. Same with all the other advanced APIs like Wifi-Geolocation and WebGL etc, as they already mostly in my browser (Librewolf). These APIs are a trojan horse for fingerprinting, and it shows. If they weren’t, they wouldn’t mind disabling them by default.
Ah my bad. Commenter you’re replying to is saying we never should have built this capability, and it’s a terrible idea (my own words now) to weaken boundaries to this degree, it can never be done “safely”.
But it does exist, and your own request to opt in is reasonable and would mark an improvement.
spoiler
My initial hasty comment:
What? No, it shouldn’t exist. Either I’m trippin or you missed the point of the comment you’re responding to.
“Opt-in” (your preference) can only exist if the capability exists. Comment says it shouldn’t. Commenter is correct.
Honestly, this is such a shortsighted take. Awesome, instead of a simple “Allow?” dialogue to give the sandboxed website access to one specific USB device through an (over time) more and more well-tested implementation, we have to download untrusted binaries that by default get full access to large amounts of user data.
What are you so afraid of? It’s already been live in Chromium browsers for a while, and the sky hasn’t fallen. And I’m convinced it has largely improved security for users who flash Arduino-like devices, smart home stuff, some phones and a bunch of keyboard/mouse stuff.
I don’t use Chromium browsers. I’m afraid of the sky falling (it is). I have been “afraid” of it for a good long while, and it is occurring.
That’s general - in this specific case, by my reckoning, it can never be safe for a website to understand, in any depth, the hardware of the machine requesting it.
On the one hand I agree with the sentiment, but how else is a web based update app for a usb device supposed to work?! We can make an argument for fwupd or a custom built app but the webapp is a smaller barrier for a lot of hardware companies.
how else is a web based update app for a usb device supposed to work?!
It’s not! It’s a thing nobody in their right mind should want to do in the first place!
That question is like asking “how else is a shotgun-based dental pick supposed to work?” The things just don’t go together and you shouldn’t try to force them to!
Also, we already had an appropriate technology for this sort of thing (having a cheaply-made app that runs everywhere and doesn’t have to be pretty): it’s called “plain old fuckin’ Java.”
WebUSB is absurd and shouldn’t exist. Web apps should not ever be able to work with USB devices! The core concept is wrong!
A website shouldn’t even be allowed to know if I have a USB port at all, let alone anything else about my hardware. I’m not even convinced it should be allowed to know the viewport size of the browser window! All these APIs just make the attack surface fucking gargantuan and open up infinite opportunities for browser fingerprinting. They should be Considered Harmful and abolished.
Check out webgpu
I agree. It should be an opt-in permission, per-site, with the possibility to silently auto-reject always by default. Same with all the other advanced APIs like Wifi-Geolocation and WebGL etc, as they already mostly in my browser (Librewolf). These APIs are a trojan horse for fingerprinting, and it shows. If they weren’t, they wouldn’t mind disabling them by default.
Ah my bad. Commenter you’re replying to is saying we never should have built this capability, and it’s a terrible idea (my own words now) to weaken boundaries to this degree, it can never be done “safely”.
But it does exist, and your own request to opt in is reasonable and would mark an improvement.
spoiler
My initial hasty comment: What? No, it shouldn’t exist. Either I’m trippin or you missed the point of the comment you’re responding to.
“Opt-in” (your preference) can only exist if the capability exists. Comment says it shouldn’t. Commenter is correct.
What is it you are saying…?
Honestly, this is such a shortsighted take. Awesome, instead of a simple “Allow?” dialogue to give the sandboxed website access to one specific USB device through an (over time) more and more well-tested implementation, we have to download untrusted binaries that by default get full access to large amounts of user data.
What are you so afraid of? It’s already been live in Chromium browsers for a while, and the sky hasn’t fallen. And I’m convinced it has largely improved security for users who flash Arduino-like devices, smart home stuff, some phones and a bunch of keyboard/mouse stuff.
I don’t use Chromium browsers. I’m afraid of the sky falling (it is). I have been “afraid” of it for a good long while, and it is occurring.
That’s general - in this specific case, by my reckoning, it can never be safe for a website to understand, in any depth, the hardware of the machine requesting it.
It is super helpful for flashing a pixel to GrapheneOS, especially for non technical folk
If they managed to install chrome and finding their way to grapheneos they can manage installing another program for flashing.
The convenience of webusb is pretty overrated, id rather have my browser not tell any site everything asked and more.
On the one hand I agree with the sentiment, but how else is a web based update app for a usb device supposed to work?! We can make an argument for fwupd or a custom built app but the webapp is a smaller barrier for a lot of hardware companies.
It’s not! It’s a thing nobody in their right mind should want to do in the first place!
That question is like asking “how else is a shotgun-based dental pick supposed to work?” The things just don’t go together and you shouldn’t try to force them to!
Also, we already had an appropriate technology for this sort of thing (having a cheaply-made app that runs everywhere and doesn’t have to be pretty): it’s called “plain old fuckin’ Java.”