Hacker News new | ask | show | jobs
by Animats 4107 days ago
Right. A USB device can't do anything unless the OS lets it.

We went through this with "autorun" on CDs and DVDs. For years, Windows would run anything that looked executable if you put it in the obvious place. That didn't end well. Those defaults were finally changed.

What's needed is to turn off automatic hot plugging for USB devices. The era when you can plug in a USB device and have it go live without user interaction is over. We're going to need clear OS dialogs - "The USB device you just plugged in claims to be a keyboard - did you just plug in a keyboard?" You should't be able to boot from a USB device without doing something to enter a maintenance mode.

There's nothing special about USB Type C here. It's just that the asymmetry of USB is being dealt with.

Asymmetrical USB has created an amusing hierarchy. Desktop computers were masters. Phones were slaves. Then came tablets. Are they masters or slaves?
2 comments
bentcorner 4107 days ago
> The USB device you just plugged in claims to be a keyboard - did you just plug in a keyboard?

The problem with that is that you inevitably run into this dialog with nothing else attached to the machine. How are you going to confirm the dialog?

Better to focus on isolating the keyboard driver from the rest of the OS, so the only thing it should be able to do is read in input from the keyboard and report it back to the OS.

link
masklinn 4107 days ago
> The problem with that is that you inevitably run into this dialog with nothing else attached to the machine. How are you going to confirm the dialog?

That's only a serious issue for a keyboard, and for this specific situation the keyboard could be segregated (globally inactive) and require a specific sequence of action to be activated.

> Better to focus on isolating the keyboard driver from the rest of the OS, so the only thing it should be able to do is read in input from the keyboard and report it back to the OS.

The virtual keyboard can send whatever keypresses (and thus indirectly commands) it wants to the system.

link
masklinn 4107 days ago
> We're going to need clear OS dialogs - "The USB device you just plugged in claims to be a keyboard - did you just plug in a keyboard?"

Of course there is the chicken-and-egg issue of allowing the first keyboard you plug into a machine which does not have any built-in input device.

link
Mindless2112 4106 days ago
"The USB device you plugged in claims to be a keyboard -- type the following randomly generated number to confirm."
link