Re: [w3ctag/design-reviews] Serial API (#431)

Chromium implements a block list mechanism for USB serial devices as a defense-in-depth measure. There are currently no entries.

During the development of the WebUSB specification the feedback from Mozillians (not an official Mozilla position) was similar to @tomayac's concerns as the original design required devices to opt in to connections from web content. There are open questions about how registries such as these should be managed to balance the risks against user choice. I don't have a good answer and I think we will need to wait and see how the ecosystem evolves. As mentioned in the "[Security considerations](https://wicg.github.io/serial/#security)" section there is a class of devices which are intentionally insecure which we would never include in the block list.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/431#issuecomment-775617108