Hacker News Reader

Comment by Orygin | Hacker News Reader

Running directly in the browser is also not how I'd want to do USB.

When the alternative is downloading arbitrary executables I find the browser sandbox to be a reassurance.

Except the sandbox is a huge target already, and breaking it means any website can now access and mess with your usb devices. If you can develop an exploit for Chrome's WebUSB system, you potentially have millions upon millions of targets available.

Downloading an arbitrary executable can be made safe (via multiple avenues: trust, anti virus software, audits, artifact signing, reproducible builds, etc) and once the software is vetted, it exposes (or it should at least) little to no attack vector during daily use.

> trust, anti virus software, audits, artifact signing, reproducible builds, etc

My mom has six weather apps on her phone.

Buddy if your "sandbox" lets code inside it replace your keyboard's firmware you don't have a sandbox.

Programming your keyboard is actually a common case! See usevia.app

It is indeed common!

But a keyboard flashed with malicious firmware becomes an undetectable keylogger, a USB rubber ducky, and a virus-laden USB stick all in one.

The concept that someone would want to reflash their keyboard firmware, but wants a sandbox because they don't trust the firmware programmer makes no sense.

Hmm, that's probably somewhat fair. While you're using a protocol that's only intended to update the key map, it's probably not hardened against attacks.

Regardless, the real reason people use this is because it's incredibly convenient compared with using QMK and ZMK directly.

Then don't install the extension

It is enabled without extension in Chrome browsers. This is a common complain about Firefox is that they don't implement the Google draft spec.

It will probably come natively one day in Firefox, and we should push back against such attack vectors.

Of all the browser features I would consider disabling in the name of security, the ability to talk to my trackpad and printer is pretty much at the bottom of the list. I'd start with the JIT compiler, filesystem APIs, all of the video codecs, probably many of the image codecs, cookies and localstorage, webgl/webgpu, the crash collector, the auto updater...

Reply on news.ycombinator.com