8BitDo say Ultimate Software Online is their attempt to make things easier for Linux gamers, no need to download a standalone firmware updater app now.
Ah my bad. Commenter you’re replying to is saying we never should have built this capability, and it’s a terrible idea (my own words now) to weaken boundaries to this degree, it can never be done “safely”.
But it does exist, and your own request to opt in is reasonable and would mark an improvement.
spoiler
My initial hasty comment:
What? No, it shouldn’t exist. Either I’m trippin or you missed the point of the comment you’re responding to.
“Opt-in” (your preference) can only exist if the capability exists. Comment says it shouldn’t. Commenter is correct.
Honestly, this is such a shortsighted take. Awesome, instead of a simple “Allow?” dialogue to give the sandboxed website access to one specific USB device through an (over time) more and more well-tested implementation, we have to download untrusted binaries that by default get full access to large amounts of user data.
What are you so afraid of? It’s already been live in Chromium browsers for a while, and the sky hasn’t fallen. And I’m convinced it has largely improved security for users who flash Arduino-like devices, smart home stuff, some phones and a bunch of keyboard/mouse stuff.
Yeah, Chromium’s implementation is IMO very elegant and genuinely improves security for most people. That’s why I’m a little miffed by comments that paint it as an obviously terrible feature, just like happens with the “read/write to a specific local folder” API.
These days, new browser features often aren’t in the users best interest, I understand and share the commonly discussed concerns on those. But compared to the alternatives, these specific APIs genuinely improve safety for most users AND make things more accessible for newbies and pros alike. Blocking them on principle (& without specific technical concerns) will not protect users when their remaining option gives malicious actors far more access without any exploits!
I don’t use Chromium browsers. I’m afraid of the sky falling (it is). I have been “afraid” of it for a good long while, and it is occurring.
That’s general - in this specific case, by my reckoning, it can never be safe for a website to understand, in any depth, the hardware of the machine requesting it.
Somehow, I must’ve missed all these cases where bad actors abused the WebUSB API. So what did they do? What’s the worst damage the victims have suffered?
That’s general - in this specific case, by my reckoning, it can never be safe for a website to understand, in any depth, the hardware of the machine requesting it.
You still haven’t explained: why? When the options are “website” or “untrusted binary”, the website is objectively much safer. Sure, you can sandbox untrusted binaries - but then you can just sandbox the browser.
Yes, there are security concerns, but these fears haven’t been confirmed in real life, and they don’t disappear if we ban WebUSB! Instead, people have to run untrusted code with access to far more hardware than WebUSB allows.
Sorry, when I said “sky is falling” I meant a general erosion of user security and privacy, when using our “own” devices. Things like even systemd working to accommodate OS-level age verification these days. To me, the capability of WebUSB is a bad idea, because I simply never want that path for potential data flow even available, for the things my machine is used to do.
I do see what you mean about use cases like you’re describing, though, for flashing devices, and I concede the point that flashing random binaries isn’t meaningfully better and probably is a bit worse.
I still don’t want that capability anywhere near my own machine, for all of the not-that-use-case reasons. I do see your use case, do you see my concern?
I do understand your concerns regarding safety, but not having WebUSB does not guarantee that malicious websites can’t access your USB devices. Both Firefox and Chromium already interact with your USB devices to provide features like debugging over USB, so malicious websites that exploit browser bugs are able to talk to your devices either way. And if we don’t count browser bugs, you can simply set your browser to block WebUSB by default to arrive at the same outcome.
Of course there is a chance that specific exploits could work in one case and not the other, but that’s something the real-life statistics haven’t shown to be an issue so far. Browsers are generally pretty safe these days due to multiple layers of sandboxing, so I’d be surprised to see major WebUSB-specific security exploits appearing in the future.
Edited to add:
Sorry, when I said “sky is falling” I meant a general erosion of user security and privacy, when using our “own” devices.
Same here, I hate the direction things are already clearly heading towards on mobile, and I expect desktops to get enshittified as well soon enough. But I see WebUSB as a major positive in that context (since it allows users to take control of their devices in a much easier and safer manner, & mostly guarantees backwards compatibility of such tools for many years to come). And although I’ve read comments similar to yours many times - this topic gets brought up fairly often - nobody has explained concrete technical issues that are likely to bite us.
I don’t have much else to add. You’ve clearly thought about this topic (WebUSB) more than I have, and I’ve given people grief in the past for similarly thin arguments slandering Signal over “what if” type scenarios.
In the end I am saying I wish we didn’t have things that we already have, which is ultimately pointless anyway. I wish the nature of interacting with a website was much more strictly one directional. I wish it was never considered appropriate for a remote server to learn about or interact with my own requesting hardware. There are a hundred other things I don’t want that we have, many much more impactful than this. You seem much more open-minded, and regardless clearly a lot of the rest of the world agrees with you.
Think we just disagree, but I also don’t mean to blow WebUSB out of proportion. Plenty worse things for me to get worked up about that also aren’t going anywhere.
Ah my bad. Commenter you’re replying to is saying we never should have built this capability, and it’s a terrible idea (my own words now) to weaken boundaries to this degree, it can never be done “safely”.
But it does exist, and your own request to opt in is reasonable and would mark an improvement.
spoiler
My initial hasty comment: What? No, it shouldn’t exist. Either I’m trippin or you missed the point of the comment you’re responding to.
“Opt-in” (your preference) can only exist if the capability exists. Comment says it shouldn’t. Commenter is correct.
What is it you are saying…?
Honestly, this is such a shortsighted take. Awesome, instead of a simple “Allow?” dialogue to give the sandboxed website access to one specific USB device through an (over time) more and more well-tested implementation, we have to download untrusted binaries that by default get full access to large amounts of user data.
What are you so afraid of? It’s already been live in Chromium browsers for a while, and the sky hasn’t fallen. And I’m convinced it has largely improved security for users who flash Arduino-like devices, smart home stuff, some phones and a bunch of keyboard/mouse stuff.
That is exactly how it works. You get a prompt like this you have to chose a device, and only then does a website get access to it via WebUSB.
(From the documentation: https://developer.chrome.com/docs/capabilities/usb)
You can also disable WebUSB permission requests globally in Chromium:
Yeah, Chromium’s implementation is IMO very elegant and genuinely improves security for most people. That’s why I’m a little miffed by comments that paint it as an obviously terrible feature, just like happens with the “read/write to a specific local folder” API.
These days, new browser features often aren’t in the users best interest, I understand and share the commonly discussed concerns on those. But compared to the alternatives, these specific APIs genuinely improve safety for most users AND make things more accessible for newbies and pros alike. Blocking them on principle (& without specific technical concerns) will not protect users when their remaining option gives malicious actors far more access without any exploits!
I don’t use Chromium browsers. I’m afraid of the sky falling (it is). I have been “afraid” of it for a good long while, and it is occurring.
That’s general - in this specific case, by my reckoning, it can never be safe for a website to understand, in any depth, the hardware of the machine requesting it.
Somehow, I must’ve missed all these cases where bad actors abused the WebUSB API. So what did they do? What’s the worst damage the victims have suffered?
You still haven’t explained: why? When the options are “website” or “untrusted binary”, the website is objectively much safer. Sure, you can sandbox untrusted binaries - but then you can just sandbox the browser.
Yes, there are security concerns, but these fears haven’t been confirmed in real life, and they don’t disappear if we ban WebUSB! Instead, people have to run untrusted code with access to far more hardware than WebUSB allows.
Sorry, when I said “sky is falling” I meant a general erosion of user security and privacy, when using our “own” devices. Things like even systemd working to accommodate OS-level age verification these days. To me, the capability of WebUSB is a bad idea, because I simply never want that path for potential data flow even available, for the things my machine is used to do.
I do see what you mean about use cases like you’re describing, though, for flashing devices, and I concede the point that flashing random binaries isn’t meaningfully better and probably is a bit worse.
I still don’t want that capability anywhere near my own machine, for all of the not-that-use-case reasons. I do see your use case, do you see my concern?
I do understand your concerns regarding safety, but not having WebUSB does not guarantee that malicious websites can’t access your USB devices. Both Firefox and Chromium already interact with your USB devices to provide features like debugging over USB, so malicious websites that exploit browser bugs are able to talk to your devices either way. And if we don’t count browser bugs, you can simply set your browser to block WebUSB by default to arrive at the same outcome.
Of course there is a chance that specific exploits could work in one case and not the other, but that’s something the real-life statistics haven’t shown to be an issue so far. Browsers are generally pretty safe these days due to multiple layers of sandboxing, so I’d be surprised to see major WebUSB-specific security exploits appearing in the future.
Edited to add:
Same here, I hate the direction things are already clearly heading towards on mobile, and I expect desktops to get enshittified as well soon enough. But I see WebUSB as a major positive in that context (since it allows users to take control of their devices in a much easier and safer manner, & mostly guarantees backwards compatibility of such tools for many years to come). And although I’ve read comments similar to yours many times - this topic gets brought up fairly often - nobody has explained concrete technical issues that are likely to bite us.
I don’t have much else to add. You’ve clearly thought about this topic (WebUSB) more than I have, and I’ve given people grief in the past for similarly thin arguments slandering Signal over “what if” type scenarios.
In the end I am saying I wish we didn’t have things that we already have, which is ultimately pointless anyway. I wish the nature of interacting with a website was much more strictly one directional. I wish it was never considered appropriate for a remote server to learn about or interact with my own requesting hardware. There are a hundred other things I don’t want that we have, many much more impactful than this. You seem much more open-minded, and regardless clearly a lot of the rest of the world agrees with you.
Think we just disagree, but I also don’t mean to blow WebUSB out of proportion. Plenty worse things for me to get worked up about that also aren’t going anywhere.