https://www.tenforums.com/tutorials/80233-enable-disable-goo...
I think it was something roughly like this but in terms of asking end users to use it... looked like a no go.
I wish iOS would let users write `libusb` code that worked. :(
Chrome is the new IE – doing whatever they want, and expecting every other browser vendor to enthusiastically chase them because they have the largest market share.
That sounds cool!
Chrome Experiments [1] has existed because Chrome has been at the forefront of the web for years.
Or, in the case of serial or remote debugging. Just run a terminal or gdb next to the target and connect to that instead.
Their excuse is "security". Which is funny as native apps do the exact same thing and more, often without dedicated permissions.
Mozilla also rejects most of it and joins Apple in claiming its due to security. It's speculation, but I think they really don't have the resources anymore to build such massive features and conveniently spin it into something good for the user.
Not sure I agree that makes it justified, but it does sketch me out a bit the more low level systems my browser has access to
But for now, yeah, it has the downside of being Chrome(ium) only, which makes it far less useful than it could be.
There are several specs (like USB, Bluetooth, and MIDI) which are Chrome only, and for which other browser makers have explicitly stated they don’t agree with and will not support. Further, they have said that their rejection of these specs is due to security issues (e.g. providing full access to local hardware behind a single permission prompt)
This is much a higher bar than just lack of interest or resources to getting cross-browser compatibility.
This article is a bit old, but since then the situation as become even better: - Windows 10 is being more and more popular, so WebUSB really is a "plug and play" solution on Windows now too - Windows comes with Edge that also has WebUSB support
I really with Firefox would include it too!
Super slick from a user POV, just connect the device via USB cable and hit the flash button. I admit I was a bit skeptical to all this, but having just tried it I must admit it was very, very convenient. The ESPHome instance was running as a container on my Home Assistant device, again a simple one-click install.
[1]: https://esphome.io/
[2]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Serial_...
Also cool to see a competitor to Texas Instruments. I'm in the USA and had to get TI calculators for classes.
> Firefox would include it too!
That'd be nice.
Here's more information from the author of Zadig: https://github.com/pbatard/libwdi/wiki/WCID-Devices
Hasn't Windows 10 been a thing that's come and gone now in favor of Windows 11?
Windows 11 has additionally made a lot of questionable choices that are forcing a lot of people to stay on Windows 10 involuntarily (e.g. they don't support motherboards w/out TPM's and they don't officially support CPUs that aren't relatively new; e.g. it only "supports" Intel CPUs that are 8th gen or newer regardless of cores/frequency)
https://store.steampowered.com/hwsurvey/Steam-Hardware-Softw...
I’ll leave it to others to speculate on what happens to the website in 2 years.
if you want something else to complain about, this depends on chrome-only USB support
Which is the primary reason I will never purchase another Razer product.
Because you can’t force a company to keep a website up and running. But you can keep a driver on an offline computer.
With that said, thank you for writing and sharing the article. It's interesting even with the above mentioned irritant.
For example, File System Access API was also part of WICG and similarly deemed by commenters as Chrome-only API because it implemented it first, but is now at least partially implemented in Safari 15.2. Who knows what we'll see adopted next? As long as there's a Web spec and apps using an API, browser vendors can prioritise.
The goal was to port pcsclite or scdaemon to use webusb instead of libusb.
It's been a while; I forget exactly where (very early) I left off/felt defeated. I definitely didn't consider making an additional backend for libusb!
Very cool -- I can't wait to see part 2 ;).
So far - i could only bridge USBIP communication, not much success with binding a proxied usb to a vm.
Did you see something like this?
Comlink takes care of the RPC part of any API, so you only need to choose and hook up a communication backend.
Why would anyone want to do this if it only works on one browser?
There's of course Chromium, but the code base of Chrome is so huge, I'm not even sure Chromium has been properly audited to be "clean" wrt being subservient to Mountain View.
I do understand the old dream of a "universal API", it's snake oil that has been peddled to the IT crowd since I was a teenager (looong time ago).
I also wish it could happen, but Chrome certainly isn't it.
As a matter of fact, that is exactly what Chrome uses under the hood.
Except that instead of exposing the libusb API as unchanged as possible at the JS layer, they've somehow decided - they being Google and hence smarter than everyone - to re-engineer to API to be o-so-slightly different, but not actually any better.
What a crock.
Chrome is at least as dominant as IE 5 & 6 were. The only reason that you're not hearing constant screaming about the near-monopoly (indeed, most of the screaming is abusing Apple for not just "doing what Google says" in the browser space) is because for some reason people think that the monopoly is good when an advertising company is doing it.
And as a side benefit, also makes it extremely easy to maliciously control hardware. A win for Google on two fronts here.
Connecting to a USB device requires only a single click. That just requires an attacker making the user believe what he wants, by stressing the user or by misleading or conditioning the user about what it is. It is not a more secure design than the UAC boxes in Windows Vista that users learned to "click be gone" by routine because they were annoying.
I was thrilled when I first heard about WebUSB because I had been looking for a way to configure USB device firmware using a web browser.
However, I learned that it has glaring security flaws:
* The web page bypasses the operating system's driver infrastructure, where VendorID/ProductID pair is used to look up only valid drivers. Some operating systems require USB device drivers to be signed. A web page requires only a click from the user.
* WebUSB allows web access even to devices that don't have explicit support for it. Older devices can have been designed under other pretences of security. Not all hardware engineers even know about WebUSB, so this applies to newer designs too. This is already serious, because there are devices used for 2FA that connect via USB that could be exploited this way.
* A device can not control which of its interfaces that a web page can claim or not claim.
* WebUSB contains no authentication of the web page on the device's behalf. (There was some idea that it should have, but that was removed for convenience )
Not ready for prime-time IMHO.
Getting temporary access to video is different than getting access to upload firmware that changes how the webcam works.
It is also more abstract - the browser is not going to be able to enumerate the ramifications of what they are approving. Think a script which is asking for access to a YubiKey - there’s no way the browser can enumerate the various security ramifications of doing so, and the webpage itself may do so incorrectly (this is a reason that I believe Chrome deny-lists access to FIDO keys to WebUSB).
Finally, video access is a known quantity and thus gives opportunities to surface potential abuses in certain ways, such as displaying a colored ‘recording active’ indicator across tabs when the camera is in use, or providing a way to temporarily restrict video access without needing to find the application control option.
What are some other potential uses for this down the road?
EDIT: Looks like the Popcorn Computer is still available and does roughly the same thing https://wiki.popcorncomputer.com/wiki/Original_Popcorn:Flash...
