[davsti4]

From: https://developer.mozilla.org/en-US/docs/Web/API/WebUSB_API "WebUSB provides a way for these non-standardized USB device services to be exposed to the web. This means that hardware manufacturers will be able to provide a way for their device to be accessed from the web, without having to provide their own API."

That doesn't sound secure at all!

[monocasa]

Which is why Firefox doesn't support it either.

[leptons]

Firefox's non-reasons are just as lame as Apple's non-reasons. These APIs aren't security risks, the user has to explicitly opt-in on every website that requests USB access, just like every other privacy-risky API that a website requests, like microphone and camera access. WebUSB is no different.

The only thing that has changed since camera and microphone access was allowed is that Apple now considers web apps to cut into their app store business, so they are unwilling to let any new APIs get approved that would make a web app as capable as a native app. This includes WebBluetooth and other APIs.

Apple is also getting sued by the DOJ for exactly this type of shady business practice.

And I don't really think what Firefox says is relevant, they are so cash-strapped I would not doubt that Apple pays them to have a negative opinion about new web APIs just so people like you can say "Firefox doesn't want it either".

The truth is there is no good reason to block WebUSB and WebBluetooth from becoming standards.

[Gigachad]

The user gets spammed with a million permissions popups a day and has no idea what they are actually accepting or what the risks are. The same looking permissions popup usually means something incredibly trivial like notifications or camera, while the webusb spec is exposing you to potentially high risks of damage to hardware or data theft.

[leptons]

>The user gets spammed with a million permissions popups a day and has no idea what they are actually accepting or what the risks are.

"A million" is quite the hyperbole. So let's just not do anything anymore because it might cause a permission popup? Or because some idiot might trust a scam website? That's your argument? Sorry, it's not a good argument.

>while the webusb spec is exposing you to potentially high risks of damage to hardware or data theft.

Please explain a realistic scenario where a website >that someone trusts< is going to "damage hardware or cause data theft".

I'll wait.

I don't care about someone's stupid grandfather that is going to find a way to get hacked one way or another - he's not a good reason to hold the rest of us back.

[Gigachad]

That’s the source of the issue. Apple sells products that are safe for someone’s stupid grandfather. WebUSB is not safe for people who don’t understand the implications. Which is most people.

The rest can choose a different browser.

[Rohansi]

> WebUSB is not safe for people who don’t understand the implications. Which is most people.

Why? What is the worst that could happen? The user needs to choose which device(s) to allow access to and browsers do not allow access to all of them.

[leptons]

>Apple sells products that are safe for someone’s stupid grandfather.

Then then they should be selling it in "grandfather mode". The rest of the non-stupid people that have iPhones (there are non-stupid people with iPhones, aren't there?) should be able to do what they want with their devices. But they can't because Apple puts profit over progress.

>The rest can choose a different browser.

Except on iOS you can't choose a different browser. Apple has blocked all other browsers on their mobile platform, so if you try to install Chrome, you're really just getting a Safari webview with a wrapper around it. It's just another example of abusive business tactics that the DOJ is suing Apple for.

[leptons]

That's nonsense. You have to opt-in on any website that is requesting USB access, just like every other useful but potentially privacy-risky browser API.

Plenty of sites ask for camera access, and that is typically a USB device. Plenty of sites ask for microphone accesss, which can be a USB device. And even if those aren't always USB devices, they are still very much a privacy risk that browsers all allow. USB access is no different, a website can't just do whatever it wants, you have to give it permission to use it first. And it doesn't have to be all-or-nothing either, it could be implemented to allow the browser to access only specific USB devices.

Apple is holding back progress in favor of profit. They profit when developers are forced to create a native app where Apple can extract 30% of revenue through the app.

[Gigachad]

It's not about if the camera is a USB device or not, it's about what the capabilities being exposed is. Web browsers aren't just handing over the webcam as an arbitrary USB device, they are presenting a media stream from them. Which means they can't for example send arbitrary commands, flash firmware, or do any of the infinite things a USB device might present.

[leptons]

I don't care?

I'm not giving any old website access to all of my USB devices. I'd expect to give a website I trust access to a specific USB device. I'm not sure why you think this has to be a willy-nilly free-access-to-everything feature.

Yes, I want to give access to site XYZ to a product purchased from site XYZ to do amazing things over WebUSB.

If that isn't the current spec, then change the spec so it's good.

But Apple just doesn't give a single shit to propose any changes because doing so would hurt their precious app store just a little bit.

[bcjdjsndon]

Sounds like it's time for you to learn a proper programming language, little boy.

[leptons]

You're a shitty troll. Not engaging with your level of shithead.