<story><title>Apple declined to implement 16 Web APIs in Safari due to privacy concerns</title><url>https://www.zdnet.com/article/apple-declined-to-implement-16-web-apis-in-safari-due-to-privacy-concerns/</url></story><parent_chain><item><author>jamesgeck0</author><text>&amp;gt; Web MIDI API - Allows websites to enumerate, manipulate and access MIDI devices.&lt;p&gt;This API is actually a bit horrifying from a security perspective. In addition to allowing you to use MIDI keyboards as input devices on websites, it also allows websites to send binary firmware updates to MIDI devices. The reason is that it&amp;#x27;s common to use custom firmware to backup&amp;#x2F;restore settings and enable neat effects and functionality on MIDI devices.&lt;p&gt;Mozilla&amp;#x27;s engineers have reasonably pointed out that an attacker utilizing Web MIDI could use MIDI devices as a stepping stone to launch an attack against the user&amp;#x27;s PC outside of the web sandbox. One such attack might be by reprogramming the device to appear as a standard USB computer keyboard and &amp;quot;typing&amp;quot; commands to the host.&lt;p&gt;At least one well known manufacturer has vouched for the technical safety of their musical instruments, noting that they&amp;#x27;re physically designed in such a way that the MIDI firmware can&amp;#x27;t alter USB firmware. But there&amp;#x27;s no way to know that every MIDI device has been similarly well designed.&lt;p&gt;As neat as Web MIDI is, I think Mozilla and Apple probably made the right security call here.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;mozilla&amp;#x2F;standards-positions&amp;#x2F;issues&amp;#x2F;58&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;mozilla&amp;#x2F;standards-positions&amp;#x2F;issues&amp;#x2F;58&lt;/a&gt;</text></item></parent_chain><comment><author>henriquez</author><text>Fun fact: for quite a long time Chrome skipped over the user permission step in the Web MIDI spec, always allowing access and silently giving ad networks a list of connected USB MIDI devices with no user consent:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.obsessivefacts.com&amp;#x2F;blog&amp;#x2F;2018-10-20-chrome-allows-enumeration-of-usb-devices.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.obsessivefacts.com&amp;#x2F;blog&amp;#x2F;2018-10-20-chrome-allows...&lt;/a&gt;&lt;p&gt;Here&amp;#x27;s what appeared on porn site xhamster.com once newer versions of Chromium got around to implementing the permission check (SFW-ish):&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.obsessivefacts.com&amp;#x2F;images&amp;#x2F;blog&amp;#x2F;2020-04-04-the-javascript-black-hole&amp;#x2F;xhamster-cropped.png&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.obsessivefacts.com&amp;#x2F;images&amp;#x2F;blog&amp;#x2F;2020-04-04-the-ja...&lt;/a&gt;</text></comment>
<story><title>Apple declined to implement 16 Web APIs in Safari due to privacy concerns</title><url>https://www.zdnet.com/article/apple-declined-to-implement-16-web-apis-in-safari-due-to-privacy-concerns/</url></story><parent_chain><item><author>jamesgeck0</author><text>&amp;gt; Web MIDI API - Allows websites to enumerate, manipulate and access MIDI devices.&lt;p&gt;This API is actually a bit horrifying from a security perspective. In addition to allowing you to use MIDI keyboards as input devices on websites, it also allows websites to send binary firmware updates to MIDI devices. The reason is that it&amp;#x27;s common to use custom firmware to backup&amp;#x2F;restore settings and enable neat effects and functionality on MIDI devices.&lt;p&gt;Mozilla&amp;#x27;s engineers have reasonably pointed out that an attacker utilizing Web MIDI could use MIDI devices as a stepping stone to launch an attack against the user&amp;#x27;s PC outside of the web sandbox. One such attack might be by reprogramming the device to appear as a standard USB computer keyboard and &amp;quot;typing&amp;quot; commands to the host.&lt;p&gt;At least one well known manufacturer has vouched for the technical safety of their musical instruments, noting that they&amp;#x27;re physically designed in such a way that the MIDI firmware can&amp;#x27;t alter USB firmware. But there&amp;#x27;s no way to know that every MIDI device has been similarly well designed.&lt;p&gt;As neat as Web MIDI is, I think Mozilla and Apple probably made the right security call here.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;mozilla&amp;#x2F;standards-positions&amp;#x2F;issues&amp;#x2F;58&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;mozilla&amp;#x2F;standards-positions&amp;#x2F;issues&amp;#x2F;58&lt;/a&gt;</text></item></parent_chain><comment><author>BiteCode_dev</author><text>Besides, I know they want to turn the browser into an os, but it&amp;#x27;s not one.&lt;p&gt;It&amp;#x27;s sandboxed from the os and limited to some use cases, which is the point. I don&amp;#x27;t want something capable of hot loading code from any web site to have the capabilities of my OS.</text></comment>