Conversation

so, a lot of people I know have a severely negative view of WebUSB. that view is, mostly, justified. I think it is only more interesting then that I see the GrapheneOS flashing tool--yes, flashing stuff via the browser--as net beneficial

Quote Tweet

GrapheneOS

@GrapheneOS

Jan 24, 2021

An experimental version of our web-based installer for GrapheneOS is now available: grapheneos.org/install/web This can be used from browsers with WebUSB support. Most Chromium-based browsers are supported including Chrome, Edge and Brave. No need to run any additional software.

Show this thread

144

Catherine

@whitequark

Jan 24, 2021

it's beneficial because flashing is hard and most people rightfully don't want learn how fastboot, adb, etc work, and seek out convenience. they'll find it either with the first party, GrapheneOS, or a potentially malicious or negligent third party. here, WebUSB is harm reduction

Catherine

@whitequark

Jan 24, 2021

I'm not sure if WebUSB could have been designed in a way that makes harm negligible. I know that it could have been designed to minimize potential harm, and it clearly wasn't (Chrome just lets you do ~anything to ~any device), and I find that unfortunate.

Replying to

Chrome has a long history of adding API's with vast attack surfaces. Remember NaCl?

Replying to

and

As far as I know, WebUSB originated at Mozilla, as did WebGL to a lesser extent. They don't implement WebUSB in Firefox, but it was their idea, and their initial work on the spec. NaCl evolved to PNaCl and then that effort got directed into the collaborative WebAssembly work.

Replying to

and

Mozilla didn't implement webusb, as far as I can tell, because the obvious glaring security issues weren't resolved (and possibly couldn't be)

Replying to

and

WebAssembly had a very different evolutionary path and while some of it may have been influenced by NaCl, it was mostly in direct opposition to NaCl.

Replying to

and

asm.js, sure, not WebAssembly. PNaCl is also the relevant technology, not the legacy NaCl. WebAssembly vs. PNaCl is largely the same issue as IndexedDB vs WebSQL. PNaCl was too tied to a specific implementation (LLVM) similarly to WebSQL being too tied to one (SQLite).

Replying to

and

I don't really see WebAssembly as Mozilla getting their way. Their way was JavaScript (via asm.js) and they ended up accepting it wasn't satisfactory. WebAssembly is only missing the ability to directly access APIs like the DOM instead of needing JavaScript as an intermediary.

7:59 PM · Jan 24, 2021Twitter Web App

Replying to

and

It's what Google wanted and created without the LLVM heritage. Sure, it was a collaboration between them, but it looks more like Mozilla and Google collaborating to reimplement Google's approach together to me. PNaCl let you avoid JS FFI via Pepper but I think wasm will get that.