Also helps to cut down on your number of cables once you see you have 5 USB-B cables when at most you need 1. I ziplock bagged all of my cables and cut them down to one of each type. These days I throw out the included cable with devices immediately rather than throwing it in with all the others. Thankfully a lot of new devices don't include cables now so the wastage is cut down.
I think it's more the size of the data rather than digital vs analog. you could have digital data stored on punch cards or say a large array of dip switches and it would last ages, but the storage density is terrible. Meanwhile disks and ssds store massive amounts of data on a very tiny space but it's prone to corruption over time.
Punch cards that are laser cut from metal would probably outlast stone tablets.
There’s also one specifically for God - 祂, and one for animal - 牠, the first one you can see frequently in Chinese bibles or churches, the latter is rarely used.
This is what China has done. Aside from drug crimes it doesn't seem like they punish any harsher than the rest of the world, they just have an incredibly good ability to follow up. If you smash the window of a store, they will find you and you'll have to pay for it. Just the knowledge that there is an almost 100% chance of having to pay to restore anything you break seems all that's needed to stop the destruction of public spaces.
On the less extreme end, Europe also has much higher rates of catching criminals and punishes then less. I understand the US is really the outlier.
I read an interesting article that laid out how that's ultimately rooted in what level of government pays for what. It's easier for local politicians to call for harsher punishment because prisons are run by state or federal but police is funded locally.
It simultaneously is and isn't. It's overfunded on things that don't matter for the problem at hand - traffic enforcement using full fledged officers in expensive vehicles, militarized SWAT teams, regulations requiring huge officer presence at all events, etc. But it's underfunded on what would change things for the better - foot patrols, investigation, etc.
This is why you can get pulled over for a broken taillight in the US and have 3 police cars behind you complete with a K9 unit, but if that same car gets stolen, you'll probably get asked to make a report and never hear a peep from the police again.
Look at officers per 100k: https://en.wikipedia.org/wiki/List_of_countries_and_dependen...
France has 422, Germany 349, Italy 456, US 242. There are countries that are super safe like Japan and Singapore with only 255 and 174 but I think it's safe to say that the US probably is better compared to France here. China also has only 258 but I think they make up for it through surveillance which isn't welcome in the US.
The US also doesn't train police officers well compared to most European countries. In the US it takes just a few months to become a police officer. In Germany it takes years.
The thing there that the West has not been able to accept to achieve this is the surveillance state. Just look at Flock.
I'm not sure anyone has really cracked how to get it done without that part, though certainly tweaking the spending from prisons to police would help a lot. The trouble in the US at least is people (rightly) don't trust police, and don't want to give them more power, so it also needs to be paired with reform on that front for the population to accept it.
Because cameras alone do nothing useful, and there's precious little evidence these are being used to help address petty vandalism.
The UK already went down this road years ago - cameras everywhere, public restrooms nowhere, prompt and automatic ticketing for parking violations but precious little in the way of assistance from humans should you need it. The shut-in dotage of a former empire too afraid to leave its house.
It is pretty much how China has handled it. It seems like it does actually work if your goal is to fully eliminate drug issues, but it's unacceptably harsh for most countries to palate.
A quick check suggests the penalty for possession is 3 years in prison, not life. No idea if that is a maximum sentence.
From what I can find, it looks like China does a lot of what the US does, including DARE style education, and that there is still (by Chinese accounts) quite a lot of illegal drug use.
I would think that since China is very nationalist and still fairly collectivist/anti-individualist, and has a grim history of drugs being used as a tool of foreign imperialism (the opium wars), drug use is much further out of the social "Overton window". I think that's a better explanation for apparently lower drug use than harsh punishments, because other states also have those (notably the US!)
It's not new capabilities, it's new levels of access. Reverse engineering this stuff used to be a very tedious process which required a lot of specialised skill. Which is why most devices haven't been reverse engineered or hacked despite being full of low hanging fruit.
This is why most of the browsers rejected these specs. They are super useful, but the security risks are incredible. Most USB devices were not designed to hold up to being exposed to the internet.
I kinda remember that the counterargument Google used is that only devices with a special attribute would ever be available through WebHID, ensuring that such older devices would never be exposed.
Cue my surprise when it turns out you can use WebHID to program a Minidisc / Net-MD device [1], so.. they never did implement that filter, apparently. I mean, certainly it is useful, but ... What The F., Google?
The user has to first specifically pick the device from the list and grant the website access. If a user is confused by a permissions prompt and has no idea what is going on, the default path is to reject the permission.
In the real world the default action for a user when presented with a permissions popup is to accept it because they get asked 20 times a day, have no idea what the implications of it are and just want to get on with their day.
So software designers need to avoid asking the users to approve potentially highly dangerous things.
This is untrue. Chrome's "acceptance rates" for proceeding through its bad SSL cert warnings used to be pretty high, but with a redesign they basically flipped the numbers so most people didn't proceed to connect to the site. Similarly with cookie banners, where making it more difficult to say no (by e.g. moving a decline button to a second interaction layer) meaningfully raises acceptance rates; if users were just blindly accepting everything, then there'd be no reason to make it harder to say no. Apple's App Tracking Transparency (ATT) prompt has users overwhelmingly answering no even years after introduction (though of course opt-in is increasing). A study on permission prompts in Android found that the main factor in first-use denial rates was whether users thought the app needed the permission it was requesting or not, showing some actual comprehension of what they're being asked. Another found higher denial rates if the frequency of the prompt was on every access instead of once, rather than apathetic blanket acceptance.
Design prompts for potentially dangerous actions so refusal is easy and what's being asked is legible, and people will refuse plenty.
I think Safari does this with popups & downloads. Tiny little icons that barely appear [to change]. Can annoy me when I miss them but sometimes I figure maybe it’s for The Greater Good.
You realize that most of the time that you are giving access to an older HID device, you are giving the website permission to convert that device into a persistent backdoor forever? No matter if you later close the browser or revoke the permission -- the damage has already been done? Most devices predating WebHID and the like have almost no protection (why would they?), and you can corrupt or even entirely replace the firmware quite easily. heck, NetMD is one example (the browser can overwrite its firmware with no trouble!), as are the devices listed in TFA .
It is basically the same reason most desktops do not give the logged in user access to /dev/hidraw*, even though it makes a shitton of sense and would simplify many things greatly.
This is one of the few areas where I think Mozilla did the right thing without question.
WebUSB has been live in Chrome for 9 years and nothing happened. Compare to all the features that result in people getting hacked every day. Your threat model is ridiculous.
Look, I find it funny that I find myself arguing on the other side of the discussion that I'm frequently on, but here is where I draw the line, and I think what is ridiculous is to think otherwise.
How many hoops Google asks you to go to install an Android app ? (Androids amounts to basically the most sandboxed environment one can have today; malware installed there can practically do _nothing_) MANY. Centralized register of apps and remote blacklisting, a lot of permission prompts, password check, and they are even literally pushing to even have a physical 24h cool-off period if you skip the centralized register.
How many hoops does Google ask you to go an allow a random website unfettered access to destroy your hardware? One. Permission. Prompt. In a bubble prompt, that barely registers above noise compared to other permission prompts browsers ask.
Of course these are two ridiculous extremes, but they exemplify the point. There is a reason a browser won't allow a random website to write over random sectors of your hard disk just because you said "accept" to a bubble-style permission prompt about wanting to "save files to your hard disk". The line has to be drawn somewhere, and allowing what basically amounts to raw access to IO ports just after a single permission prompt listing the device name is where I draw it. Any user, even knowledgeable ones, is simply going to be _incapable_ of truly understanding the risks behind allowing this access.
I would be much more in favor of allowing random IPC to services in your local computer (after a permission prompt) than this., something that is equally useful if not more than allow raw access to HID.
Devices need to be hidden behind drivers that multiplex and control access to the device at the OS level. A bus that was never meant to be exposed to user-level access should not be exposed to random programs much less websites. This is not security, this is "mistake prevention" level, in the same way operating systems disallow a random user-level program from overwriting the hard disk.
And do not read this as "devices should sign their firmwares and what not". That is (for me) definitely the wrong take but literally the only take that is left on the table due to Google's stupid behavior.
> How many hoops Google asks you to go to install an Android app ? (Androids amounts to basically the most sandboxed environment one can have today; malware installed there can practically do _nothing_) MANY. Centralized register of apps and remote blacklisting, a lot of permission prompts, password check, and they are even literally pushing to even have a physical 24h cool-off period if you skip the centralized register.
I 'member (and miss) the old Android days before everything became the locked down hellscape Android is these days. And I also member why it became that way, there was a loooot of bad actors exploiting that open model.
For operating systems it's similar. DOS/Windows up to and through ME didn't have the concept of different user levels, the file system didn't allow for it, and if you had physical access to the machine it was trivial to corrupt and subvert it. Only with Windows XP, Microsoft switched the consumer OS to NT and its multi-user model.
And so it will be for WebUSB et al. First it will be a pretty open and unrestricted world, and only if there turns out to be a significant problem, security will (need to) be tightened.
WebHID being used to access a microphone is risky though. Microphones are already often exposed to web browsers, so asking for microphone access wouldn't be out of the ordinary.
Maybe MD drives aren't really at risk, but things like HID peripherals definitely are.
Note that when you say “rejected”, Mozilla’s position has actually shifted a bit. At the end of 2022, it shipped MIDI in the form of an extension that it will prompt to install for the purpose, with more detailed information and a couple of other details that make it less unsafe. After a few years of that, consensus has grown that this seems to be working acceptably, and that the technique may be considered for other risky areas. They haven’t said anything about USB publicly, to my knowledge, which is definitely way more dangerous than MIDI (even SysEx), but I have heard one rumour (of dubious provenance) that they may cautiously proceed with USB and such too some time soon. Though this sort of thing definitely weighs against that, showing that maybe they were right the first time.
I'm hopeful that in the future we can end planned obsolescence from devices that require companion apps which eventually get shut down. Just vibe reverse engineering replacements.
we could have ended planned obsolescence decades ago if we put strong policies in place. I would really like a systemic solution instead of every-man-for-himself vibe coding. I've been following the "stop killing games" movement for that reason. fingers crossed.
reply