IMO it’s fine since you need to explicitly grant permission for the site to use it, and also explicitly choose a device to allow it to communicate with. You can also configure your browser to always reject requests to use the API, if you never want to use it.
WebSerial is useful for the developer as they can build their webapp once and it’ll work consistently across platforms, and it’s useful for the user since the same interface will work across all OSes.
I prefer it over the other common approach for communicating with serial devices, which is often to only make a Windows app and to have some convoluted setup process involving sketchy-looking drivers, which then breaks when you have different devices that require different versions of the flashing software or drivers.
as someone who did an ESP based project for end users, this is really useful to let users flash new stuff on their device without needing some convoluted toolchain on your computer
it was really really useful to tell people “go to xyz and select the option you want, follow the on screen instructions and you’re done. sorry, chrome only”
these technologies are both really cool and really scary at the same time.
IMO it’s fine since you need to explicitly grant permission for the site to use it, and also explicitly choose a device to allow it to communicate with. You can also configure your browser to always reject requests to use the API, if you never want to use it.
WebSerial is useful for the developer as they can build their webapp once and it’ll work consistently across platforms, and it’s useful for the user since the same interface will work across all OSes.
I prefer it over the other common approach for communicating with serial devices, which is often to only make a Windows app and to have some convoluted setup process involving sketchy-looking drivers, which then breaks when you have different devices that require different versions of the flashing software or drivers.
i agree with you, but the exploits are gonna be wild.
Chrome’s had it for five years, and I don’t recall any Webserial-specific vulnerabilities in it (but I could be wrong!)
i’d bet on webusb being compromised first, when/if that takes off for more mundane tasks.
This has always felt like something that doesn’t belong in a web browser to me.
as someone who did an ESP based project for end users, this is really useful to let users flash new stuff on their device without needing some convoluted toolchain on your computer
it was really really useful to tell people “go to xyz and select the option you want, follow the on screen instructions and you’re done. sorry, chrome only”
Just last week my mobile died. I was able to get a new one and flash GrapheneOS while traveling, using my partners phone. That was totally awesome.
Since they are adding Ai to the browser, it seems the quality and security standards are reduced.