Well, this seems like a terrible idea. I really don't want websites to be able to access hardware. I am already uncomfortable with the webcam access.

▲

deeringc 4 hours ago | parent | next [-]

I see this slightly differently. Before, if I wanted to be able to do something like flash firmware onto some device I would have to download some random C++ application and install and run it on my local machine. As well as having access to all of my USB devices, it also had access to everything else on my system's user context. I didn't have a way of running that code and only giving it access to a single USB device and nothing else. Now, I can avoid installing anything at all. I visit the project page and opt-in to some flashing flow that's running in a sandboxed env. When the app requests it, the browser asks me for permission and I get to choose exactly which USB device I want to give it access too. That's picking exactly the minimum "outside" access I want to give it, nothing more. It doesnt get to read/write other USB devices I didnt choose. I doesnt get to read/write to my filesystem. It doesnt get to call system APIs. It doesnt get to set itself to start at startup. It doesnt get to install an auto-updater. For me, this is a better security posture than installing random win32 apps.

▲

crote 4 hours ago | parent [-]

Flashing was already solved by UF2, where the device-to-flash temporarily pretends to be a USB storage device. Giving raw USB access to to random websites for that is massively overkill.

I could understand it if you were trying to do realtime configuration of or interaction with some device like a printer or a Stream Deck, but something as trivial as firmware flashing?

	▲	mlyle 4 hours ago \| parent \| next [-]
		It's pretty common to pick a few config parameters, click, and flash a firmware that does the things you want. Yes, you could make the configuration into a separate uf2 object that overwrites other bytes, but that's yucky. The access is explicitly per device. Even for plain flashing, it's safer and simpler than to download and shuffle random files.
	▲	oofdere 3 hours ago \| parent \| prev [-]
		trivial for you maybe but many people don't know how and where to find the right firmware for their specific device, and can be in environments where the UF2 volume isn't as obvious (e.g. using a phone)

▲

Brian_K_White 9 hours ago | parent | prev | next [-]

Whether we like it or not, the distinction between an app and a web page has already eroded, and is, and only will be, eroding more.

Even for local apps it's starting to become common to ship the app in an interpreted language where the interpreter is a browser instead of say python & qt.

	▲	traderj0e 3 hours ago \| parent [-]
		They're converging towards the middle, which is good, but it's not going to be the same thing. Apps use web tech for convenience and native APIs for things you can't do in web. You're expected to trust apps and extensions more than websites.

▲

lxgr 3 hours ago | parent | prev | next [-]

That's fortunately easily fixed: Don't grant them access!

But please don't tell other people what they should and shouldn't do on their own hardware.

The world has enough corporate walled gardens. I even enjoy using some of them sometimes, but the world would be a strictly worse place if these were the only remaining way to use computers.

▲

goodmythical 2 hours ago | parent | prev | next [-]

It's already got access to CPU and RAM...how else do you think it works?

▲

q3k 9 hours ago | parent | prev [-]

Then don't select the device and don't press the 'allow' button when prompted.