undefined | Better HN

0 pointsJimDabell2mo ago0 comments

> The spec is still in draft because Apple refuses to let it move forward

This is untrue. Web standards need two independent implementations. Google can’t convince any other rendering engine besides their own to implement it.

It doesn't take a single no from Apple to veto it; it takes a single yes from anybody outside of Blink to move it forward. Nobody is doing that.

Here is what Mozilla have to say about WebUSB:

> Because many USB devices are not designed to handle potentially-malicious interactions over the USB protocols and because those devices can have significant effects on the computer they're connected to, we believe that the security risks of exposing USB devices to the Web are too broad to risk exposing users to them or to explain properly to end users to obtain meaningful informed consent. It also poses risks that sites could use USB device identity or data stored on USB devices as tracking identifiers.

— https://mozilla.github.io/standards-positions/#webusb

Until Google can convince anybody outside of Blink to implement it, it is not a standard it’s a Blink-only API.

0 comments

5 comments · 1 top-level

leptons2mo ago· 4 in thread

Apple has provided no alternative, and no suggestions for how to improve the draft. They are not helping advance the draft only for selfish reasons.

They also won't allow any other browser on iOS for the same selfish reasons.

Apple continues to use abusive business tactics, and it's why they are being sued by the DOJ in an antitrust lawsuit. Them not implementing and not even suggesting changes to WebUSB and WebBluetooth are just further examples of it.

https://www.justice.gov/archives/opa/media/1344546/dl?inline

So the alternative is installing questionable drivers from questionable websites that give an attacker full-access to the entire computer. This is far less good for security, and is unfortunately the norm right now.

>we believe that the security risks of exposing USB devices to the Web are too broad to risk exposing users to them or to explain properly to end users to obtain meaningful informed consent.

So is every other browser API that's currently implemented that requires explicit approval from a user. It's nonsense to single out WebUSB specifically.

> It also poses risks that sites could use USB device identity or data stored on USB devices as tracking identifiers.

Bullshit. You have to explicitly allow WebUSB to interact with any website that requests it. It does NOT allow arbitrary tracking, and this sentence proves that whatever Mozilla writes about it is disingenuous, trying to incite hysteria about an API.

bcjdjsndon2mo ago

> So the alternative is installing questionable drivers from questionable websites that give an attacker full-access to the entire computer. This is far less good for security, and is unfortunately the norm right now

WebUSB isn't a driver, it relies on underlying usb drivers. What is the need here for a webpage that also needs to access specific hardware not exposed generically?

leptons2mo ago

>WebUSB isn't a driver, it relies on underlying usb drivers.

I never said WebUSB "was a driver". But it does not rely on specific usb device drivers being installed for specific devices.

>What is the need here for a webpage that also needs to access specific hardware not exposed generically?

There are already plenty. You don't need to ask me because you'll likely just shit on what I write, so here's a list compiled by someone else:

https://github.com/webusb/awesome

That just scratches the surface.

I'm more interested in WebBluetooth, which Apple is also blocking from standardization. I manufacture a bluetooth enabled device that I'd like to have a simple web application to interface with, rather than needing to pay Apple for the privledge to develop an app for their app store, where they can then extort me for $$$ for any sales made through the app.

It's no different for WebUSB, it has many, many uses, but Apple is choosing profit over progress.

1 more reply

JimDabellOP2mo ago

You’re avoiding my point. What you said:

> The spec is still in draft because Apple refuses to let it move forward

…is simply untrue. Apple cannot stop it from being a standard by refusing to implement it. As long as anybody else is willing to produce a second implementation it can be a standard.

The thing that is preventing it from being a standard is that nobody is willing to do this.

If Apple did not even exist then WebUSB would be no closer at all to being a standard.

leptons2mo ago

I didn't avoid anything. My first sentence spelled it out:

"Apple has provided no alternative, and no suggestions for how to improve the draft. They are not helping advance the draft only for selfish reasons."

They prefer to let the spec die, instead of proposing anything that would help it move forward because they are using abusive business tactics to stifle innovation for their own greedy purposes.

They simply do not want the web to compete with their app store. It is that simple.

j / k navigate · click thread line to collapse

0 comments

5 comments · 1 top-level

leptons2mo ago· 4 in thread

Apple has provided no alternative, and no suggestions for how to improve the draft. They are not helping advance the draft only for selfish reasons.

They also won't allow any other browser on iOS for the same selfish reasons.

https://www.justice.gov/archives/opa/media/1344546/dl?inline

>we believe that the security risks of exposing USB devices to the Web are too broad to risk exposing users to them or to explain properly to end users to obtain meaningful informed consent.

So is every other browser API that's currently implemented that requires explicit approval from a user. It's nonsense to single out WebUSB specifically.

> It also poses risks that sites could use USB device identity or data stored on USB devices as tracking identifiers.

bcjdjsndon2mo ago

WebUSB isn't a driver, it relies on underlying usb drivers. What is the need here for a webpage that also needs to access specific hardware not exposed generically?

leptons2mo ago

>WebUSB isn't a driver, it relies on underlying usb drivers.

I never said WebUSB "was a driver". But it does not rely on specific usb device drivers being installed for specific devices.

>What is the need here for a webpage that also needs to access specific hardware not exposed generically?

There are already plenty. You don't need to ask me because you'll likely just shit on what I write, so here's a list compiled by someone else:

https://github.com/webusb/awesome

That just scratches the surface.

It's no different for WebUSB, it has many, many uses, but Apple is choosing profit over progress.

1 more reply

JimDabellOP2mo ago

You’re avoiding my point. What you said:

> The spec is still in draft because Apple refuses to let it move forward

…is simply untrue. Apple cannot stop it from being a standard by refusing to implement it. As long as anybody else is willing to produce a second implementation it can be a standard.

The thing that is preventing it from being a standard is that nobody is willing to do this.

If Apple did not even exist then WebUSB would be no closer at all to being a standard.

leptons2mo ago

I didn't avoid anything. My first sentence spelled it out:

"Apple has provided no alternative, and no suggestions for how to improve the draft. They are not helping advance the draft only for selfish reasons."

They prefer to let the spec die, instead of proposing anything that would help it move forward because they are using abusive business tactics to stifle innovation for their own greedy purposes.

They simply do not want the web to compete with their app store. It is that simple.

j / k navigate · click thread line to collapse