So for the very kind of people who tend to not use Chrome because they’re privacy aware and actually tend to use Ad-Blockers, and who are very likely to be fine with standalone apps, they don’t make a standalone firmware updater app and instead make a Chrome only firmware updater.
I mean, I get it that in Linux accessing a USB-serial device from userspace can require an extra step (add user to “dialout” group), but it’s hardly something that takes more than 1 paragraph to fully explain and you can do the check for access denied in the app and only prompt the user to do it if that error occurs.
So we can now download software from our browsers, and we no longer need to use specialized downloader app? I must be really out of touch.
They probably have the hardware run in USB-Serial mode (rather than the usual USB-HID mode of controller, keyboards and mice which has no capability to upload any significant data - beyond LED status - to the device) and then just push the firmware into the Serial Device their hardware appears at in that mode.
Chrome supports letting websites remotely access Serial devices on the host PC.
Yes but only in Chromium-based browsers as only those support the direct USB connection to the device.
All of these wed based uber-projects are built on Chrome. This is bad. This gives more control to google and strengthens their strangle hold over web technologies.
Cause WebUSB still only exists on Chrome, even though Mozilla and Apple had 9 years to catch up: https://developer.mozilla.org/en-US/docs/Web/API/WebUSB_API#browser_compatibility
“to catch up”, while they deliberately choose not to implement this. they don’t just not do it, they outlined why.
their competitor has an advantage and real leverage, I’d say that’s enough reason in economics? I get why it isn’t implemented, but all that means is that chromium has the high ground when it comes to this.
It’s also bad because why the fuck should a web browser have that much access to the hardware to begin with?!
Considering they made Chrome an entire OS… It was sort of necessary for that and probably minimal to bring it to the regular desktop browser.
Otherwise it doesn’t really need to, other than simplicity for the end user. Being able to just go to the website regardless of platform and not having to install anything, or keep anything up to date, is a nice end user experience.
Considering they made Chrome an entire OS… It was sort of necessary for that and probably minimal to bring it to the regular desktop browser.
That’s both plausible and insightful on your part. Thanks!
That said, just because they could easily do it on the non-ChromeOS version of the browser doesn’t mean they should have.
it doesn’t really need to, other than simplicity for the end user
Not being a jerk, trying to be succinct, but this is you missing or disregarding a crucially important point, in a dozen words.
Also why the fuck is the OS giving the web browser the option of giving it that access to the hardware?
As long as it’s doable from userspace the OS doesn’t know what’s a browser or what is being controlled with external code. Blame the concept of ambient authority
Jesus fucking christ can’t you people ever just let something be good for once
Adding security, compatability, and vendor lock-in issues in exchange for convenience is not a good thing. Remember ActiveX and Silverlight? They forced users into uning IE. I am still finding industrial applications whos only config page is some ancient, IE only, nightmare.
Cant wait for Adobe Flash to make a comeback resulting in us being forced to use it to do something asinine like pay rent
In this case the spec is published, so it wouldn’t be a lock-in or compatibility issue if the other vendors didn’t lock themselves out.
Security, I get, but when I’ve used it to flash esp32s before the user agent pops up a box asking me which device I want to give access to before the website sees anything, so it’s not transparent and it doesn’t give it access to everything on my system.
I use Firefox all the time, but keep a Chromium on my system basically for stuff like this occasionally, and also web calls because Firefox’s implementation of the audio API doesn’t let me change microphones in the webapp, it just exposes one mic, and I’ve had issues with that before, so I join all calls in Chromium.
Maybe some of the other browsers should implement the tech needed to do this kind of thing then? Cause as far as I know, Chrome is the only browser that can give a websites access to USB.
Because it’s complex, a security problem and largely unneccessary.
They say they’re doing a webbased updater so that their software will work with all operating systems… not said is that their online updater only works with chromium based browsers… so…
https://web.8bitdo.com/browser-support
That’s actually a limitation on the Firefox side, they just flat out refuse to implement webusb. Any webapp that works with usb devices does the same thing. I’ve raged at Mozilla about this the last time they asked for my feedback and had no response.
WebUSB is absurd and shouldn’t exist. Web apps should not ever be able to work with USB devices! The core concept is wrong!
A website shouldn’t even be allowed to know if I have a USB port at all, let alone anything else about my hardware. I’m not even convinced it should be allowed to know the viewport size of the browser window! All these APIs just make the attack surface fucking gargantuan and open up infinite opportunities for browser fingerprinting. They should be Considered Harmful and abolished.
Check out webgpu
I agree. It should be an opt-in permission, per-site, with the possibility to silently auto-reject always by default. Same with all the other advanced APIs like Wifi-Geolocation and WebGL etc, as they already mostly in my browser (Librewolf). These APIs are a trojan horse for fingerprinting, and it shows. If they weren’t, they wouldn’t mind disabling them by default.
Ah my bad. Commenter you’re replying to is saying we never should have built this capability, and it’s a terrible idea (my own words now) to weaken boundaries to this degree, it can never be done “safely”.
But it does exist, and your own request to opt in is reasonable and would mark an improvement.
spoiler
My initial hasty comment: What? No, it shouldn’t exist. Either I’m trippin or you missed the point of the comment you’re responding to.
“Opt-in” (your preference) can only exist if the capability exists. Comment says it shouldn’t. Commenter is correct.
What is it you are saying…?
Honestly, this is such a shortsighted take. Awesome, instead of a simple “Allow?” dialogue to give the sandboxed website access to one specific USB device through an (over time) more and more well-tested implementation, we have to download untrusted binaries that by default get full access to large amounts of user data.
What are you so afraid of? It’s already been live in Chromium browsers for a while, and the sky hasn’t fallen. And I’m convinced it has largely improved security for users who flash Arduino-like devices, smart home stuff, some phones and a bunch of keyboard/mouse stuff.
I don’t use Chromium browsers. I’m afraid of the sky falling (it is). I have been “afraid” of it for a good long while, and it is occurring.
That’s general - in this specific case, by my reckoning, it can never be safe for a website to understand, in any depth, the hardware of the machine requesting it.
It is super helpful for flashing a pixel to GrapheneOS, especially for non technical folk
If they managed to install chrome and finding their way to grapheneos they can manage installing another program for flashing.
The convenience of webusb is pretty overrated, id rather have my browser not tell any site everything asked and more.
On the one hand I agree with the sentiment, but how else is a web based update app for a usb device supposed to work?! We can make an argument for fwupd or a custom built app but the webapp is a smaller barrier for a lot of hardware companies.
how else is a web based update app for a usb device supposed to work?!
It’s not! It’s a thing nobody in their right mind should want to do in the first place!
That question is like asking “how else is a shotgun-based dental pick supposed to work?” The things just don’t go together and you shouldn’t try to force them to!
Also, we already had an appropriate technology for this sort of thing (having a cheaply-made app that runs everywhere and doesn’t have to be pretty): it’s called “plain old fuckin’ Java.”
Yea it’s the same requirement that GrapheneOS has for their web installer. Definitely a Firefox issue.
not said is that their online updater only works with chromium based browsers
Currently, it only supports Chromium-based browsers.
Second paragraph, yo.
pft, implying I read it and not just clicked the links…
Yeah it’s probably using webusb https://caniuse.com/?search=webusb
I refused to install a Chromium based browser until recently, which was needed as a dependency for some software. At least it supports the base Chromium, which is free from all those bullshit of the other browsers its based on. I just recently updated the driver in a virtual machine with Windows 10 and their software installed. So using Chromium would be an improvement here. Still sad I have to use a different browser than Firefox, but Chromium will be just my “firmware-updater” and not my browser at all.
You could already run the firmware updater with Proton/Wine though? At least I didn’t have an issue with that, but its obviously not helpful to everyone considering the many flavours of linux. Nice that they recognize and are at least trying to address the issue though
I got it working on Wine eventually but I do recall having to hunt down instructions for the terminal so it would properly read my USB port. It was definitely confusing, and I’m glad I won’t have to remember all the steps again.
Yep that’s the downside, I know fuckall about Linux relatively speaking, so I was lucky CachyOS just ran it and my wired controller got recognized.
Good stuff 8BitDo. I’m currently a GameSir enjoyer, but this kinda stuff is why 8BitDo is still considered the gold standard for controllers.
A downloadable program would be better for if the website were to ever go offline.
Even better is a single downloadable HTML file. Downloadable programs will likely degrade over time, web APIs are highly stable and portable.
I still wish there was a “pledge” API to allow websites to disable functionality they don’t need. For example, this could be a perfect self-contained app that never needs any outside connections.
Yeah, but a website should make this compatible with all operating systems, not just Linux. BSD should profit from this as well.
I’d prefer if they’d release it as a flatpak. Making it browser based chains you to chromium browsers, since Firefox decided a while back that exposing USB devices directly to the internet was too much of a security concern. Ran into that issue with my keyboard.
Firefox supports WebSerial now: https://hacks.mozilla.org/2026/05/web-serial-support-in-firefox/
Firefox already has a website permission system, weird they don’t just let users choose if they think the risk is worth it or not.
Absolutely but at least they’re doing something for us Linux gamers.
Or, if it’s what I’m thinking of, you are not using Chrome but Firefox, and Firefox cannot use the “JavaScript USB” thing.
it’s what you’re thinking of. It doesn’t work with Firefox. Only chromium browsers.
Where’s the difference? A program still has to fetch drivers and software from somewhere.
The windows applet works just fine through Proton.
Fuckin finally, the Android app is garbage.
