Hacker News Reader

Comment by lukan | Hacker News Reader

"You could take about 90% of that out and into dedicated tools "

But then you would loose plattform independency, the main selling point of this atrocity.

Having all those APIs in a sandbox that mostly just work on billion devices is pretty powerful and a potential succesor to HTML would have to beat that, to be adopted.

The best thing to happen, that I can see, is that a sane subset crystalizes, that people start to use dominantly, with the rest becoming legacy, only maintained to have it still working.

But I do dream of a fresh rewrite of the web since university (and the web was way slimmer back then), but I got a bit more pragmatic and I think I understood now the massive problem of solving trusted human communication better. It ain't easy in the real world.

View on HN

But do we need e.g serial port or raw USB access straight from a random website? Even WebRTC is a bit of a stretch. There is a lot of cruft in modern browsers that does little except increase attack surface.

This all just drives a need to come up with ever more tacked-on protection schemes because browsers have big targets painted on them.

How else am I going to make a game in the browser that be controlled with a controller?

Every decent host OS already has a dedicated driver stack to provide game controller input to applications in a useful manner. Why the heck would you ship a reimplementation of that in JS in a website?

So that you can take input from countrollers that haven't been invented yet and won't fit the HID model.

If it hasn't been invented yet, you don't need driver software for it, do you? ;)

Anyway, in your scenario the controller would be essentially a one off and you'd be better off writing a native app to interface with it for the one computer this experiment will run on.

If it hasn't been invented yet we don't know the implications of giving a website access to it either.

And that's before realizing it's already a bad idea with existing devices because they were never designed for giving untrusted actors direct access.

That's why we have a privacy and security sandbox in browsers.

You don't, that's the point: not everything needs to be crammed into a browser.

Unlikely. The convenience incentives are far too high to leave features on the table.

Not unlike the programming language or the app (growing until it half-implements LISP or half-implements an email client), the browser will grow until it half-implements an operating system.

For everyone else, there's already w3m.

WebRTC I use since many years and would miss it a lot. P2P is awesome.

WebUSB I don't use or would miss it right now, but .. the main potential use case is security and it sounds somewhat reasonable

"Use in multi-factor authentication

WebUSB in combination with special purpose devices and public identification registries can be used as key piece in an infrastructure scale solution to digital identity on the internet."

https://en.wikipedia.org/wiki/WebUSB

Itch.io games and controller support.

You have sites now that let you debug microcontrollers on your browser, super cool.

Same thing but with firmware updates in the browser. Cross platform, replaced a mess of ugly broken vendor tools.

While that's pretty convenient, I'm worried about what happens when the vendor shuts down the website. "Ugly broken vendor tools" can be run forever in a VM of an old system, but a website would be gone forever unless it's purely client-side and someone archived it.

Just because you can do something doesn't mean you should.

Your micro-controllers should use open standards for their debugging interface and not force people to use the vendor website.

> But do we need e.g serial port or raw USB access straight from a random website?

Yes. Regards, CIA, Mossad, FSB etc.

> Even WebRTC is a bit of a stretch

You remove that, and videoconferencing (for business or person to person) has to rely on downloading an app, meaning whoever is behind the website has to release for 10-15 OSes now. Some already do, but not everyone has that budget so now there's a massive moat around it.

> But do we need e.g serial port or raw USB access straight from a random website

Being able to flash an IoT (e.g. ESP32) device from the browser is useful for a lot of people. For the "normies", there was also Stadia allowing you to flash their controller to be a generic Bluetooth/usb one on a website, using that webUSB. Without it Google would have had to release an app for multiple OSes, or more likely, would have just left the devices as paperweights. Also, you can use FIDO/U2F keys directly now, which is pretty good.

Browsers are the modern Excel, people complain that they do too much and you only need 20%. But it's a different 20% for everyone.

I'll flip that around on you: why oh why do we need to browsers to carry these security holes in them? The Stadia flasher is a good example: how do I know that a website doesn't contain a device flasher that will turn one of my connected devices into a malicious actor that will attempt to take over whatever machine it's plugged into?

You know because there is an explicit permission box that pops out and asks if you want to give this website access to a device, and asks you to select that device.

Same as your camera/microphone/location.

But that still gives completely unvetted direct access to the device to a website! People have been pointing to Itch.io games that supposedly require direct USB access. How hard is it to hide a script in there that reprograms a controller into something malicious?

If you download a executable from a website and run it .. pretty much the same thing?

If you give USB access, it is not really a website anymore, rather a app delivered through the web. I don't see a fundamental difference in trust.

I rather am able to verify the web based version easier and I certainly won't give access to a random website, just like I don't download random exes from websites.

Performance is lower, yes and well ... like I said, it is all a big mess. Just look at the global namespace in js. I still use it because of that power feature called plattform independence. What I release, people can (mostly) just use. I (mostly) don't care which OS the user has.

A fule thst lands on my hard drive is aztomatically scanned for malware. That same kindof protection isn't in place against malicious scripts downloaded by my broswer via an opaque HTTPS connection and run in process.

And we all know that non-technical users never just click Yes to make the annoying popup go away.

> But do we need e.g serial port or raw USB access straight from a random website?

But do we need audio, images, Canvas, WebGL, etc? The web could just be plain text and we’d get most of the “useful” content still, add images and you get a vast majority of it.

But the idea that the web is a rich environment that has all of these bells and whistles is a good thing imo. Yes there’s attack surface to consider, and it’s not negligible. However, the ability to connect so many different things opens up simple access to things that would otherwise require discrete apps and tooling.

One example that kind of blew my mind is that I wanted a controller overlay for my Twitch stream. After a short bit of looking, there isn’t even a plugin needed in OBS (streaming software). Instead, you add a Web View layer and point it to GamePad Viewer[1] and you’re done.

Serial and USB are possibly a boon for very specific users with very specific accessibility needs. Also, iirc some of the early iPhone jailbreaks worked via websites on a desktop with your iPhone plugged into usb. Sure these are niche, and could probably be served just as well or better with native apps, and web also makes the barrier to entry so much lower .

[1]: https://gamepadviewer.com/

> Having all those APIs in a sandbox that mostly just work on billion devices is pretty powerful and a potential succesor to HTML would have to beat that, to be adopted.

I think the giant major downside, is that they've written a rootkit that runs on everything, and to try to make up for that they want to make it so only sites they allow can run.

It's not really very powerful at all if nobody can use it, at that point you are better off just not bothering with it at all.

The Internet may remain, but the Web may really be dead.

"It's not really very powerful at all if nobody can use it"

But people do use it, like the both of us right now?

People also use maps, do online banking, play games, start complex interactive learning environments, collaborate in real time on documents etc.

All of that works right now.

> to try to make up for that they want to make it so only sites they allow can run

What do you mean, you can run whatever you want on localhost, and it's quite easy to host whatever you want for whoever you want too. Maybe the biggest modern added barrier to entry is that having TLS is strongly encouraged/even needed for some things, but this is an easily solved problem.

The blog post and several anecdotes in the comments prove otherwise

Not sure if it counts but I've been enjoying librewolf. I believe just a stripped down firefox.

Reply on news.ycombinator.com