Yeah, I have one of their keyboards. The keyboard is advertised as a QMK based device but it doesn't work with QMK software. At minimum using their website means they get a ping whenever I'm configuring my keyboard. At worst they could be asking for all sorts of tracking information, usage details, etc. Heck, since their website can configure the keyboard's firmware they could add keystroke recording the next time and I'd never know. Now, I'm not accusing them of that or saying they would do that, but it's possible. When the site goes down one day what do I do then?

Local software will always live longer and have more respect for my privacy than web based software.

I'm thinking about throwing AI at the problem and either working to make their site work offline, making standard QMK software work with my keyboard, or replacing the firmware with more standard QMK.

I'm not a big keyboard nerd, but I had three of their keyboards, two of which were declared QMK.

As far as I remember, QMK software was extremely annoying from my own perspective, and the Keychron team was also dissatisfied with them (there was something about them being slow to add their keyboards to the app). I can say that I was able to customize my keyboards only after they released their own app.

So huge chance that your problem is caused by QMK, not Keychron.

Regarding app, i'm sure it can be made portable, maybe even via turning it into single file html.

WebUSB is indeed great, but this particular tool would not work in it, as it does something different (HID input remapping as opposed to, or maybe in addition to, reprogramming a HID device to behave differently via vendor-specific commands).

Some things could probably be pushed to the HID layer, but that would require a at least firmware redesign of the mouse, and some kinds of complex shortcuts are probably better done on the computer OS than that of the HID device, which is inevitably working with much less context.

At this point, why not have a toggle that makes the devices show up as a 10/100 USB NIC too and serve up a settings page themselves?

Do you mean adding ethernet hardware and a web server to the mouse?

Seems like that would add significant cost for something that can be done well without it.

No. You can emulate the network matters in software.

For more details, go look up the Linux USB Gadget framework. You can even play around with some of it yourself using a Pi Zero 2 W (I did, making it appear to be a USB webcam - I saw guides on how to make it be a serial port and even an ethernet adapter too)

No, you can serve IP over USB sockets just fine, no need for extra hardware.

How does that work with Firefox and Chrome's local network access (LNA) restrictions? Should a remote site be able to reconfigure your hardware? Or am I misunderstanding how this works?

I don't know much about LNA, but recently configured my new Ducky keyboard via duckyhub.io. I had to configure some udev rules[1], and use Chromium instead of Firefox, but it worked in the end.

[1] similar to this IIRC: https://github.com/Jombolio/DuckyOneX-Linux

And then after some years the website is down and you end with a brock

It's all client side -- someone (maybe me!) would spin up openkeychron from an old saved copy of the webpage and we'd be back in business in a day. Right now the keychron-hosted solution is fine -- no accounts or anything crazy -- so there's no impetus.

EDIT: turns out that my keychron, at least, is compatible with QMK/VIA and there are already open source alternatives [1] that do the job.

[1] https://usevia.app, https://remap-keys.app

Isn't all of the code in browser rather than serverside, so a simple Command + S would future proof yourself?

Web-based software is easy to extract (singlefile), preserve (webarchive), or even rebuild during its lifespan.

Desktop software is way less reliable than you think – I have a few Akai keyboards I can't configure because they don't work on my Mac already, not to mention how hard it was at least finding this executable for more than decade old keyboard.

WebUSB is deliberately unsupported on Firefox due to potential for abuse, which seems reasonable to me. Therefore, delivering updates to USB devices likes that is, in my opinion, suboptimal because it requires a specific browser feature which not everyone is willing to use.

It is also less transparent and more difficult to review than, e.g., a Python script. Which would do just the same job. While being even more portable.

I'm at least 10 times more willing to run a shady website in Chrome's sandbox and grant it USB permissions to a specific device for limited time than I am to install some random script or software running with full user privileges.

> It is also less transparent and more difficult to review than, e.g., a Python script. Which would do just the same job. While being even more portable.

Are you absolutely sure you would catch any malicious payload in some obscure single-purpose Python script?

Open source is great, but it's not a complete replacement for a narrow permission model.

> Are you absolutely sure you would catch any malicious payload in some obscure single-purpose Python script?

Of course not. But I can at least fairly easily review it. And that is the point.

A review cannot be done as easily with a minified JavaScript webpage or a WebAssembly binary that the WebUSB loader tool would use.

Also, with regards to binary Windows blobs that would require installing Windows drivers - yes, I agree that it is considerably worse than WebUSB. But we can always find something worse..

The point I am trying to make is that WebUSB, although being better than Windows binary blobs, is still less transparent, in my opinion, than e.g. a simple Python script.

Edit: To clarify: Whether the user will actually be able to find potential issues during the said review is a separate topic. But I think that the goal should be to enable users to do so. And make it as simple as possible and user-friendly as possible.

Strongly agree, its not like you're giving some website blind, lasting access to every USB device you have plugged in.

I especially prefer it when the alternative is often some random windows-only binary, probably requiring a driver to be installed at that.

Firefox now supports WebSerial though. An alternative to Via/Vial could perhaps use that, with the USB device exposing a virtual serial port.

Kinesis' keyboards with their "Clique" keyboard has a web-based configuration tool that does that. Their older "SmartSet" firmware instead exposed a virtual USB drive, with the configuration as a text file, and a firmware update could be done by dropping a new blob in there.

Unfortunately still basically chromium only, but it's a good alternative to downloaded apps yeah.