Hacker News Reader

Comment by mijoharas | Hacker News Reader

I've got two on my wishlist:

WebUSB. The only time I open chrome nowadays is to flash an ESPHome device. I'd like to drop that dependency.

I wish the extension API supported favicons in a better way. I use vimium and due to a recent change it's nice and easy to have a key binding to select bookmarks. It can't have the visual favicon which would it easier to distinguish things at a glance.

View on HN

One of the most horrible things ever invented.

But then, maybe I'm too old. Why do you need chrome when there's a stand-alone python program to build and flash esphome?

It allows using the browser as a very convenient and accessible programming platform for many types of applications, not only web-based. That's specially important for beginners, I think, as they can run (and create) all kind of projects just by opening a web page. But it is also very handy for more advanced users, as the wled project [1] shows.

And yes, there are security implications. But that's true for any other platform and as long as the users are asked for the proper permissions, I'm good with it.

[1] https://kno.wled.ge/

Python is also easy and accessible. In fact that's its whole thing.

We should not poke holes into the browser sandbox to satisfy the needs of amateur programmers.

I only use ESPHome with home assistant and the web usb device flashing is well integrated.

I did look into the standalone version, but decided it was fewer hoops to jump through to just use chrome.

The user experience _is_ good there, and I'd like it in my preferred browser.

It's nice to be able to flash something without having to give some random software access to your computer, or having to build three different versions of a device flasher for each major OS. It's boosted adoption of ESPHome devices.

Except that you are giving some random software access to your computer, and it's not even software you can decided when to install and update.

I use Linux so I do have a great deal of control over the version of Chrome I occasionally use.

The software is downloaded from a web server.

I'm not sure what you're trying to say. My point is that it's sandboxed in the browser.

You gave that software access to your computer and you don't even control when it updates.

I get that you're trying to win the argument, but you're being opaque.

Any ESP device I have isn't even connected to the Internet so I do control when it updates.

But you just did give some random software access to your computer.

When did I do that? WebUSB gives a website access to a specific USB device, not my entire computer.

Access to a programmable USB device is access to your entire computer. They can program it to emulate a mouse and accept more permissions.

I don't see how WebUSB makes that risk worse. At least I avoid making it easy and running somebody's firmware updater on my computer.

My wishlist is the opposite.

I want the browser to have less interfaces that aren't strictly needed to display self-contained websites. Using a separate program for potentially dangerous stuff like programming external devices is absolutely how things SHOULD work.

WebUSB, and a lot of other web APIs, are cancer that should not exist. No web page should ever be able to have direct access to my USB devices. You should install the app that comes on a CD with the device or from the manufacturer's website for that. Random web pages are not trustworthy enough. I can make you click a permission prompt by making you press tab,tab,tab,enter many times and then popping it up in the middle of that.

Reply on news.ycombinator.com