8BitDo say Ultimate Software Online is their attempt to make things easier for Linux gamers, no need to download a standalone firmware updater app now.
They say they’re doing a webbased updater so that their software will work with all operating systems… not said is that their online updater only works with chromium based browsers… so…
That’s actually a limitation on the Firefox side, they just flat out refuse to implement webusb. Any webapp that works with usb devices does the same thing. I’ve raged at Mozilla about this the last time they asked for my feedback and had no response.
WebUSB is absurd and shouldn’t exist. Web apps should not ever be able to work with USB devices! The core concept is wrong!
A website shouldn’t even be allowed to know if I have a USB port at all, let alone anything else about my hardware. I’m not even convinced it should be allowed to know the viewport size of the browser window! All these APIs just make the attack surface fucking gargantuan and open up infinite opportunities for browser fingerprinting. They should be Considered Harmful and abolished.
I agree. It should be an opt-in permission, per-site, with the possibility to silently auto-reject always by default. Same with all the other advanced APIs like Wifi-Geolocation and WebGL etc, as they already mostly in my browser (Librewolf). These APIs are a trojan horse for fingerprinting, and it shows. If they weren’t, they wouldn’t mind disabling them by default.
Ah my bad. Commenter you’re replying to is saying we never should have built this capability, and it’s a terrible idea (my own words now) to weaken boundaries to this degree, it can never be done “safely”.
But it does exist, and your own request to opt in is reasonable and would mark an improvement.
spoiler
My initial hasty comment:
What? No, it shouldn’t exist. Either I’m trippin or you missed the point of the comment you’re responding to.
“Opt-in” (your preference) can only exist if the capability exists. Comment says it shouldn’t. Commenter is correct.
Honestly, this is such a shortsighted take. Awesome, instead of a simple “Allow?” dialogue to give the sandboxed website access to one specific USB device through an (over time) more and more well-tested implementation, we have to download untrusted binaries that by default get full access to large amounts of user data.
What are you so afraid of? It’s already been live in Chromium browsers for a while, and the sky hasn’t fallen. And I’m convinced it has largely improved security for users who flash Arduino-like devices, smart home stuff, some phones and a bunch of keyboard/mouse stuff.
Yeah, Chromium’s implementation is IMO very elegant and genuinely improves security for most people. That’s why I’m a little miffed by comments that paint it as an obviously terrible feature, just like happens with the “read/write to a specific local folder” API.
These days, new browser features often aren’t in the users best interest, I understand and share the commonly discussed concerns on those. But compared to the alternatives, these specific APIs genuinely improve safety for most users AND make things more accessible for newbies and pros alike. Blocking them on principle (& without specific technical concerns) will not protect users when their remaining option gives malicious actors far more access without any exploits!
I don’t use Chromium browsers. I’m afraid of the sky falling (it is). I have been “afraid” of it for a good long while, and it is occurring.
That’s general - in this specific case, by my reckoning, it can never be safe for a website to understand, in any depth, the hardware of the machine requesting it.
Somehow, I must’ve missed all these cases where bad actors abused the WebUSB API. So what did they do? What’s the worst damage the victims have suffered?
That’s general - in this specific case, by my reckoning, it can never be safe for a website to understand, in any depth, the hardware of the machine requesting it.
You still haven’t explained: why? When the options are “website” or “untrusted binary”, the website is objectively much safer. Sure, you can sandbox untrusted binaries - but then you can just sandbox the browser.
Yes, there are security concerns, but these fears haven’t been confirmed in real life, and they don’t disappear if we ban WebUSB! Instead, people have to run untrusted code with access to far more hardware than WebUSB allows.
Sorry, when I said “sky is falling” I meant a general erosion of user security and privacy, when using our “own” devices. Things like even systemd working to accommodate OS-level age verification these days. To me, the capability of WebUSB is a bad idea, because I simply never want that path for potential data flow even available, for the things my machine is used to do.
I do see what you mean about use cases like you’re describing, though, for flashing devices, and I concede the point that flashing random binaries isn’t meaningfully better and probably is a bit worse.
I still don’t want that capability anywhere near my own machine, for all of the not-that-use-case reasons. I do see your use case, do you see my concern?
until google, microsoft, and all the big companies decide everything should be hosted and owned by them. having a browser do everything you can do locally is the first step to locking down the OS so everything can be subscription based. these giants love being able to use standards as a way to kill competition.
On the one hand I agree with the sentiment, but how else is a web based update app for a usb device supposed to work?! We can make an argument for fwupd or a custom built app but the webapp is a smaller barrier for a lot of hardware companies.
how else is a web based update app for a usb device supposed to work?!
It’s not! It’s a thing nobody in their right mind should want to do in the first place!
That question is like asking “how else is a shotgun-based dental pick supposed to work?” The things just don’t go together and you shouldn’t try to force them to!
Also, we already had an appropriate technology for this sort of thing (having a cheaply-made app that runs everywhere and doesn’t have to be pretty): it’s called “plain old fuckin’ Java.”
I refused to install a Chromium based browser until recently, which was needed as a dependency for some software. At least it supports the base Chromium, which is free from all those bullshit of the other browsers its based on. I just recently updated the driver in a virtual machine with Windows 10 and their software installed. So using Chromium would be an improvement here. Still sad I have to use a different browser than Firefox, but Chromium will be just my “firmware-updater” and not my browser at all.
They say they’re doing a webbased updater so that their software will work with all operating systems… not said is that their online updater only works with chromium based browsers… so…
https://web.8bitdo.com/browser-support
That’s actually a limitation on the Firefox side, they just flat out refuse to implement webusb. Any webapp that works with usb devices does the same thing. I’ve raged at Mozilla about this the last time they asked for my feedback and had no response.
WebUSB is absurd and shouldn’t exist. Web apps should not ever be able to work with USB devices! The core concept is wrong!
A website shouldn’t even be allowed to know if I have a USB port at all, let alone anything else about my hardware. I’m not even convinced it should be allowed to know the viewport size of the browser window! All these APIs just make the attack surface fucking gargantuan and open up infinite opportunities for browser fingerprinting. They should be Considered Harmful and abolished.
I agree. It should be an opt-in permission, per-site, with the possibility to silently auto-reject always by default. Same with all the other advanced APIs like Wifi-Geolocation and WebGL etc, as they already mostly in my browser (Librewolf). These APIs are a trojan horse for fingerprinting, and it shows. If they weren’t, they wouldn’t mind disabling them by default.
Ah my bad. Commenter you’re replying to is saying we never should have built this capability, and it’s a terrible idea (my own words now) to weaken boundaries to this degree, it can never be done “safely”.
But it does exist, and your own request to opt in is reasonable and would mark an improvement.
spoiler
My initial hasty comment: What? No, it shouldn’t exist. Either I’m trippin or you missed the point of the comment you’re responding to.
“Opt-in” (your preference) can only exist if the capability exists. Comment says it shouldn’t. Commenter is correct.
What is it you are saying…?
Honestly, this is such a shortsighted take. Awesome, instead of a simple “Allow?” dialogue to give the sandboxed website access to one specific USB device through an (over time) more and more well-tested implementation, we have to download untrusted binaries that by default get full access to large amounts of user data.
What are you so afraid of? It’s already been live in Chromium browsers for a while, and the sky hasn’t fallen. And I’m convinced it has largely improved security for users who flash Arduino-like devices, smart home stuff, some phones and a bunch of keyboard/mouse stuff.
That is exactly how it works. You get a prompt like this you have to chose a device, and only then does a website get access to it via WebUSB.
(From the documentation: https://developer.chrome.com/docs/capabilities/usb)
You can also disable WebUSB permission requests globally in Chromium:
Yeah, Chromium’s implementation is IMO very elegant and genuinely improves security for most people. That’s why I’m a little miffed by comments that paint it as an obviously terrible feature, just like happens with the “read/write to a specific local folder” API.
These days, new browser features often aren’t in the users best interest, I understand and share the commonly discussed concerns on those. But compared to the alternatives, these specific APIs genuinely improve safety for most users AND make things more accessible for newbies and pros alike. Blocking them on principle (& without specific technical concerns) will not protect users when their remaining option gives malicious actors far more access without any exploits!
I don’t use Chromium browsers. I’m afraid of the sky falling (it is). I have been “afraid” of it for a good long while, and it is occurring.
That’s general - in this specific case, by my reckoning, it can never be safe for a website to understand, in any depth, the hardware of the machine requesting it.
Somehow, I must’ve missed all these cases where bad actors abused the WebUSB API. So what did they do? What’s the worst damage the victims have suffered?
You still haven’t explained: why? When the options are “website” or “untrusted binary”, the website is objectively much safer. Sure, you can sandbox untrusted binaries - but then you can just sandbox the browser.
Yes, there are security concerns, but these fears haven’t been confirmed in real life, and they don’t disappear if we ban WebUSB! Instead, people have to run untrusted code with access to far more hardware than WebUSB allows.
Sorry, when I said “sky is falling” I meant a general erosion of user security and privacy, when using our “own” devices. Things like even systemd working to accommodate OS-level age verification these days. To me, the capability of WebUSB is a bad idea, because I simply never want that path for potential data flow even available, for the things my machine is used to do.
I do see what you mean about use cases like you’re describing, though, for flashing devices, and I concede the point that flashing random binaries isn’t meaningfully better and probably is a bit worse.
I still don’t want that capability anywhere near my own machine, for all of the not-that-use-case reasons. I do see your use case, do you see my concern?
It is super helpful for flashing a pixel to GrapheneOS, especially for non technical folk
If they managed to install chrome and finding their way to grapheneos they can manage installing another program for flashing.
The convenience of webusb is pretty overrated, id rather have my browser not tell any site everything asked and more.
You don’t have to use it.
until google, microsoft, and all the big companies decide everything should be hosted and owned by them. having a browser do everything you can do locally is the first step to locking down the OS so everything can be subscription based. these giants love being able to use standards as a way to kill competition.
Check out webgpu
On the one hand I agree with the sentiment, but how else is a web based update app for a usb device supposed to work?! We can make an argument for fwupd or a custom built app but the webapp is a smaller barrier for a lot of hardware companies.
It’s not! It’s a thing nobody in their right mind should want to do in the first place!
That question is like asking “how else is a shotgun-based dental pick supposed to work?” The things just don’t go together and you shouldn’t try to force them to!
Also, we already had an appropriate technology for this sort of thing (having a cheaply-made app that runs everywhere and doesn’t have to be pretty): it’s called “plain old fuckin’ Java.”
Yea it’s the same requirement that GrapheneOS has for their web installer. Definitely a Firefox issue.
Yeah it’s probably using webusb https://caniuse.com/?search=webusb
Second paragraph, yo.
pft, implying I read it and not just clicked the links…
I refused to install a Chromium based browser until recently, which was needed as a dependency for some software. At least it supports the base Chromium, which is free from all those bullshit of the other browsers its based on. I just recently updated the driver in a virtual machine with Windows 10 and their software installed. So using Chromium would be an improvement here. Still sad I have to use a different browser than Firefox, but Chromium will be just my “firmware-updater” and not my browser at all.