Chrome 61 to Include WebUSB
-
@scottalanmiller said in Chrome 61 to Include WebUSB:
@dafyre said in Chrome 61 to Include WebUSB:
@scottalanmiller said in Chrome 61 to Include WebUSB:
@dafyre said in Chrome 61 to Include WebUSB:
@scottalanmiller said in Chrome 61 to Include WebUSB:
@dafyre said in Chrome 61 to Include WebUSB:
The OS has interfaces for Cameras and storage, and wireless adapters that connect via USB... Why something like this?
Because how else do you write modern web apps but manage to interact with USB peripherals? NTG needed this in 1999 when we were making apps that we had to work around not being able to do this.
Why would you possibly need a WebApp to directly interact with a USB device on a client machine?
What is a specific use case for this?
Well, what is the use of any USB peripheral if you don't want your apps to be able to interact with them?
No, I want the app to use my USB only when I tell it to, not just because a web page calls an API... You see no way this can go wrong?
Those two are one and the same. You are thinking of apps as being different from web pages. They are not. Modern apps are built on web tech most of the time. So to have access to the USB ever you need this technology. You can't have the app have USB access when you tell it to if it doesn't have any ability to access it.
I just will need to know more about the specifics of it before I can decide if it's a good thing.
I simply see no reason to give Your web app (as an example) direct access to all of my USB devices.
-
@dafyre said in Chrome 61 to Include WebUSB:
I simply see no reason to give Your web app (as an example) direct access to all of my USB devices.
Read: You see no good reason to have USB ports.
What good are USB ports that the computer cannot use?
-
Example, MY web app needed access to the ports in order to use a bar code scanner as an input device or to use a scale as an input device. The work around for this 18 years ago was to build a legacy app just to handle those devices and then would act as a web browser containing the otherwise modern app within it. Basically we had to build our own WebUSB and WebRS232 framework to work around deficiencies in the technologies of the time. Incredibly cumbersome and problematic - hard for customers to use, expensive to produce.
-
@scottalanmiller said in Chrome 61 to Include WebUSB:
@dafyre said in Chrome 61 to Include WebUSB:
I simply see no reason to give Your web app (as an example) direct access to all of my USB devices.
Read: You see no good reason to have USB ports.
What good are USB ports that the computer cannot use?
How do we go from Web Apps dont' need direct access to my USB to no my computer has no reason to have USB?
Does this WebUSB system go "Hey, which USB device to I need to access right now?" when the API is called?
I don't want a web site to just randomly pick a USB device from my computer and try to write a file to it. That obviously won't go over well if it tries to store a 5GB ISO image on my keyboard.
-
@dafyre said in Chrome 61 to Include WebUSB:
How do we go from Web Apps dont' need direct access to my USB to no my computer has no reason to have USB?
Web apps are just modern apps. Apps are what use peripherals. If apps shouldn't have access to peripherals, what is their purpose? They are useless.
-
@dafyre said in Chrome 61 to Include WebUSB:
I don't want a web site to just randomly pick a USB device from my computer and try to write a file to it. That obviously won't go over well if it tries to store a 5GB ISO image on my keyboard.
Why are you okay with legacy apps doing this but not modern ones? I don't follow any logic here. If you are okay with apps accessing USB, then you are okay with it. If you aren't, why are they there?
You've not answered my original question... if you don't want apps having access to USB, why do you want USB at all? How can it be used?
-
@scottalanmiller said in Chrome 61 to Include WebUSB:
Why are you okay with legacy apps doing this but not modern ones? I don't follow any logic here. If you are okay with apps accessing USB, then you are okay with it. If you aren't, why are they there?
Let's pick a legacy app, say... Office 2003. If I need to save new data, it pops up and asks me where do I want to save it? I'm okay with his because I know where I am telling the system to save the data. If I am modifying a file, I make my changes and hit save, that's okay too, because I am the one that opened the file to start with. I get to pick where my data is saved.
The same for a "modern" application, such as Office 2016. It is fine, it is expected.If
www.samsitwebsite.nettries to access my USB Devic, I should get some kind of alert or warning (like a save dialog box or something)We all know that no website (or API) has been hacked or tricked into doing something it wasn't supposed to do.
-
@dafyre said in Chrome 61 to Include WebUSB:
Let's pick a legacy app, say... Office 2003. If I need to save new data, it pops up and asks me where do I want to save it? I'm okay with his because I know where I am telling the system to save the data.
And if Office 2003 is written in JavaScript and run in a browser, you'd stop being okay with this same chain of events?
-
@scottalanmiller said in Chrome 61 to Include WebUSB:
If you are okay with apps accessing USB, then you are okay with it. If you aren't, why are they there?
The way this WebUSB description is written makes it sound like it's not going to just provide access to a USB device to any web site that makes use of the API without any kind of warning or dialog box or anything telling me that the USB device is being used.
-
@dafyre said in Chrome 61 to Include WebUSB:
The same for a "modern" application, such as Office 2016. It is fine, it is expected.
Office 2016 is not fully modernized yet and is still run in a legacy mode with legacy helpers like I described.
Why are you okay if they use legacy code to do this but not if modern code does the same task? Why do you care about the code type, rather than the results.
-
@scottalanmiller said in Chrome 61 to Include WebUSB:
@dafyre said in Chrome 61 to Include WebUSB:
Let's pick a legacy app, say... Office 2003. If I need to save new data, it pops up and asks me where do I want to save it? I'm okay with his because I know where I am telling the system to save the data.
And if Office 2003 is written in JavaScript and run in a browser, you'd stop being okay with this same chain of events?
Absolutely . Because I get a popup about where the data is going. (See my latest comment)
-
@dafyre said in Chrome 61 to Include WebUSB:
We all know that no website (or API) has been hacked or tricked into doing something it wasn't supposed to do.
What does this have to do with the price of eggs? We are talking about app capabilities. All apps, modern or legacy can be hacked just the same.
-
@dafyre said in Chrome 61 to Include WebUSB:
@scottalanmiller said in Chrome 61 to Include WebUSB:
@dafyre said in Chrome 61 to Include WebUSB:
Let's pick a legacy app, say... Office 2003. If I need to save new data, it pops up and asks me where do I want to save it? I'm okay with his because I know where I am telling the system to save the data.
And if Office 2003 is written in JavaScript and run in a browser, you'd stop being okay with this same chain of events?
Absolutely . Because I get a popup about where the data is going. (See my latest comment)
And you think this is different? Why?
-
@dafyre said in Chrome 61 to Include WebUSB:
@scottalanmiller said in Chrome 61 to Include WebUSB:
If you are okay with apps accessing USB, then you are okay with it. If you aren't, why are they there?
The way this WebUSB description is written makes it sound like it's not going to just provide access to a USB device to any web site that makes use of the API without any kind of warning or dialog box or anything telling me that the USB device is being used.
Same as with legacy apps. Office 2003 could always do this and did. Just because you feel that it always asked you for permission, it didn't. That's a false impression.
-
@scottalanmiller said in Chrome 61 to Include WebUSB:
@dafyre said in Chrome 61 to Include WebUSB:
@scottalanmiller said in Chrome 61 to Include WebUSB:
@dafyre said in Chrome 61 to Include WebUSB:
Let's pick a legacy app, say... Office 2003. If I need to save new data, it pops up and asks me where do I want to save it? I'm okay with his because I know where I am telling the system to save the data.
And if Office 2003 is written in JavaScript and run in a browser, you'd stop being okay with this same chain of events?
Absolutely . Because I get a popup about where the data is going. (See my latest comment)
And you think this is different? Why?
With any application that is going to access my device, I get some kind of indicator (File Save Dialog, or a progress window, you get the idea). I'm perfectly fine with this as long as there is such an indicator (I see no mention of any type of indicator for this).
-
@dafyre said in Chrome 61 to Include WebUSB:
@scottalanmiller said in Chrome 61 to Include WebUSB:
@dafyre said in Chrome 61 to Include WebUSB:
Let's pick a legacy app, say... Office 2003. If I need to save new data, it pops up and asks me where do I want to save it? I'm okay with his because I know where I am telling the system to save the data.
And if Office 2003 is written in JavaScript and run in a browser, you'd stop being okay with this same chain of events?
Absolutely . Because I get a popup about where the data is going. (See my latest comment)
Just like how it is described in the WebUSB papers?
https://developers.google.com/web/updates/2016/03/access-usb-devices-on-the-web
-
@dafyre said in Chrome 61 to Include WebUSB:
@scottalanmiller said in Chrome 61 to Include WebUSB:
@dafyre said in Chrome 61 to Include WebUSB:
@scottalanmiller said in Chrome 61 to Include WebUSB:
@dafyre said in Chrome 61 to Include WebUSB:
Let's pick a legacy app, say... Office 2003. If I need to save new data, it pops up and asks me where do I want to save it? I'm okay with his because I know where I am telling the system to save the data.
And if Office 2003 is written in JavaScript and run in a browser, you'd stop being okay with this same chain of events?
Absolutely . Because I get a popup about where the data is going. (See my latest comment)
And you think this is different? Why?
With any application that is going to access my device, I get some kind of indicator (File Save Dialog, or a progress window, you get the idea). I'm perfectly fine with this as long as there is such an indicator (I see no mention of any type of indicator for this).
No, you don't. Some choose to do this, it is 100% voluntary by the app. There is no enforcement of this, unlike WebUSB. So, in reality, WebUSB is the only one you'd be okay with and what you've had all along is actually what is violating your usage rules, you just haven't been aware because most apps either hide this from you or behave.
-
@scottalanmiller said in Chrome 61 to Include WebUSB:
@dafyre said in Chrome 61 to Include WebUSB:
@scottalanmiller said in Chrome 61 to Include WebUSB:
@dafyre said in Chrome 61 to Include WebUSB:
Let's pick a legacy app, say... Office 2003. If I need to save new data, it pops up and asks me where do I want to save it? I'm okay with his because I know where I am telling the system to save the data.
And if Office 2003 is written in JavaScript and run in a browser, you'd stop being okay with this same chain of events?
Absolutely . Because I get a popup about where the data is going. (See my latest comment)
Just like how it is described in the WebUSB papers?
https://developers.google.com/web/updates/2016/03/access-usb-devices-on-the-web
If you knew about this site, that could have avoided three whole pages of back and forth, lol. Thank you.
-
Here is how it works...
- Legacy Apps run on the OS and have USB access, period. They are not gated from access and can do anything that they want.
- Modern Apps using WebUSB need to pop up to ask permission for access.
All apps need peripheral access to work fully. Really, the two should be treated equally. But given deficiencies in legacy apps around security, WebUSB addresses that.
-
@dafyre said in Chrome 61 to Include WebUSB:
@scottalanmiller said in Chrome 61 to Include WebUSB:
@dafyre said in Chrome 61 to Include WebUSB:
@scottalanmiller said in Chrome 61 to Include WebUSB:
@dafyre said in Chrome 61 to Include WebUSB:
Let's pick a legacy app, say... Office 2003. If I need to save new data, it pops up and asks me where do I want to save it? I'm okay with his because I know where I am telling the system to save the data.
And if Office 2003 is written in JavaScript and run in a browser, you'd stop being okay with this same chain of events?
Absolutely . Because I get a popup about where the data is going. (See my latest comment)
Just like how it is described in the WebUSB papers?
https://developers.google.com/web/updates/2016/03/access-usb-devices-on-the-web
If you knew about this site, that could have avoided three whole pages of back and forth, lol. Thank you.
I didn't, but it was obvious that it had to exist. You have to admit, thinking that all web sites suddenly had peripheral access without any security, totally different than anything that web protocols have ever done, was not even remotely in the realm of reason to assume, even if some paper made it sound that way. I posted that the moment that I found it. But it is just what you had to know going in.
Also, much of this discussion is other things... like explaining why apps would use USB, how USB has no function if apps can't use it and how legacy apps have not had the imagined security in the past.
