For PC gaming news and discussion. PCGamingWiki
Rules:
They say they're doing a webbased updater so that their software will work with all operating systems.... not said is that their online updater only works with chromium based browsers.... so...
https://web.8bitdo.com/browser-support
That's actually a limitation on the Firefox side, they just flat out refuse to implement webusb. Any webapp that works with usb devices does the same thing. I've raged at Mozilla about this the last time they asked for my feedback and had no response.
WebUSB is absurd and shouldn't exist. Web apps should not ever be able to work with USB devices! The core concept is wrong!
A website shouldn't even be allowed to know if I have a USB port at all, let alone anything else about my hardware. I'm not even convinced it should be allowed to know the viewport size of the browser window! All these APIs just make the attack surface fucking gargantuan and open up infinite opportunities for browser fingerprinting. They should be Considered Harmful and abolished.
It is super helpful for flashing a pixel to GrapheneOS, especially for non technical folk
If they managed to install chrome and finding their way to grapheneos they can manage installing another program for flashing.
The convenience of webusb is pretty overrated, id rather have my browser not tell any site everything asked and more.
I agree. It should be an opt-in permission, per-site, with the possibility to silently auto-reject always by default. Same with all the other advanced APIs like Wifi-Geolocation and WebGL etc, as they already mostly in my browser (Librewolf). These APIs are a trojan horse for fingerprinting, and it shows. If they weren't, they wouldn't mind disabling them by default.
Ah my bad. Commenter you're replying to is saying we never should have built this capability, and it's a terrible idea (my own words now) to weaken boundaries to this degree, it can never be done "safely".
But it does exist, and your own request to opt in is reasonable and would mark an improvement.
spoiler
My initial hasty comment:
What? No, it shouldn't exist. Either I'm trippin or you missed the point of the comment you're responding to.
"Opt-in" (your preference) can only exist if the capability exists. Comment says it shouldn't. Commenter is correct.
What is it you are saying...?
Honestly, this is such a shortsighted take. Awesome, instead of a simple "Allow?" dialogue to give the sandboxed website access to one specific USB device through an (over time) more and more well-tested implementation, we have to download untrusted binaries that by default get full access to large amounts of user data.
What are you so afraid of? It's already been live in Chromium browsers for a while, and the sky hasn't fallen. And I'm convinced it has largely improved security for users who flash Arduino-like devices, smart home stuff, some phones and a bunch of keyboard/mouse stuff.
give the sandboxed website access to one specific USB device
That is exactly how it works. You get a prompt like this you have to chose a device, and only then does a website get access to it via WebUSB.
,
(From the documentation: https://developer.chrome.com/docs/capabilities/usb)
You can also disable WebUSB permission requests globally in Chromium: 
I don't use Chromium browsers. I'm afraid of the sky falling (it is). I have been "afraid" of it for a good long while, and it is occurring.
That's general - in this specific case, by my reckoning, it can never be safe for a website to understand, in any depth, the hardware of the machine requesting it.
On the one hand I agree with the sentiment, but how else is a web based update app for a usb device supposed to work?! We can make an argument for fwupd or a custom built app but the webapp is a smaller barrier for a lot of hardware companies.
how else is a web based update app for a usb device supposed to work?!
It's not! It's a thing nobody in their right mind should want to do in the first place!
That question is like asking "how else is a shotgun-based dental pick supposed to work?" The things just don't go together and you shouldn't try to force them to!
Also, we already had an appropriate technology for this sort of thing (having a cheaply-made app that runs everywhere and doesn't have to be pretty): it's called "plain old fuckin' Java."
Yea it's the same requirement that GrapheneOS has for their web installer. Definitely a Firefox issue.
not said is that their online updater only works with chromium based browsers
Currently, it only supports Chromium-based browsers.
Second paragraph, yo.
pft, implying I read it and not just clicked the links....
All of these wed based uber-projects are built on Chrome. This is bad. This gives more control to google and strengthens their strangle hold over web technologies.
It's also bad because why the fuck should a web browser have that much access to the hardware to begin with?!
Considering they made Chrome an entire OS... It was sort of necessary for that and probably minimal to bring it to the regular desktop browser.
Otherwise it doesn't really need to, other than simplicity for the end user. Being able to just go to the website regardless of platform and not having to install anything, or keep anything up to date, is a nice end user experience.
Considering they made Chrome an entire OS… It was sort of necessary for that and probably minimal to bring it to the regular desktop browser.
That's both plausible and insightful on your part. Thanks!
That said, just because they could easily do it on the non-ChromeOS version of the browser doesn't mean they should have.
Also why the fuck is the OS giving the web browser the option of giving it that access to the hardware?
As long as it's doable from userspace the OS doesn't know what's a browser or what is being controlled with external code. Blame the concept of ambient authority
Cause WebUSB still only exists on Chrome, even though Mozilla and Apple had 9 years to catch up: https://developer.mozilla.org/en-US/docs/Web/API/WebUSB_API#browser_compatibility
Maybe some of the other browsers should implement the tech needed to do this kind of thing then? Cause as far as I know, Chrome is the only browser that can give a websites access to USB.
Good stuff 8BitDo. I'm currently a GameSir enjoyer, but this kinda stuff is why 8BitDo is still considered the gold standard for controllers.
A downloadable program would be better for if the website were to ever go offline.
Yeah, but a website should make this compatible with all operating systems, not just Linux. BSD should profit from this as well.
I'd prefer if they'd release it as a flatpak. Making it browser based chains you to chromium browsers, since Firefox decided a while back that exposing USB devices directly to the internet was too much of a security concern. Ran into that issue with my keyboard.
Firefox already has a website permission system, weird they don't just let users choose if they think the risk is worth it or not.
Absolutely but at least they're doing something for us Linux gamers.
Or, if it's what I'm thinking of, you are not using Chrome but Firefox, and Firefox cannot use the "JavaScript USB" thing.
it's what you're thinking of. It doesn't work with Firefox. Only chromium browsers.
So for the very kind of people who tend to not use Chrome because they're privacy aware and actually tend to use Ad-Blockers, and who are very likely to be fine with standalone apps, they don't make a standalone firmware updater app and instead make a Chrome only firmware updater.
I mean, I get it that in Linux accessing a USB-serial device from userspace can require an extra step (add user to "dialout" group), but it's hardly something that takes more than 1 paragraph to fully explain and you can do the check for access denied in the app and only prompt the user to do it if that error occurs.
Believe it or not, people use Linux for more than just privacy reasons.
Installed the 8bitdo windows software using Lutris on Bazzite and it worked just fine for me.
Working your way around stupid obstacles is the Linux way...
You don't need exactly Google's Chrome though. ungoogled-chromium works as well and it doesn't send a bit to any of Big Tech's servers.
I have it installed and I have already bookmarked 10+ different flashers and updaters I've needed so far. And I genuinely think it's better than 10+ poorly made Electron apps I'd have to install instead.
Though I wouldn't daily drive a browser that allows websites to screw my USB devices.
You could already run the firmware updater with Proton/Wine though? At least I didn't have an issue with that, but its obviously not helpful to everyone considering the many flavours of linux. Nice that they recognize and are at least trying to address the issue though
I got it working on Wine eventually but I do recall having to hunt down instructions for the terminal so it would properly read my USB port. It was definitely confusing, and I'm glad I won't have to remember all the steps again.
Where's the difference? A program still has to fetch drivers and software from somewhere.