search

WICG / webusb

Connecting hardware to the web.
https://wicg.github.io/webusb/
Other
1.3k stars 127 forks source link

Obtaining permissions for a new device #105

Closed triblondon closed 6 years ago

triblondon commented 6 years ago

As part of the latest round of TAG review, our biggest concern is that it is non-obvious from the spec how one goes about obtaining permission to access a new device and in what circumstances a page is entitled to do so. Quoting @dbaron from our review issue:

We're having trouble finding the parts of the spec that explain which websites have the ability to have access to which devices. I was under the impression that there was both a CORS-like model where the device has data that says which origin is allowed to access it, and a chooser model where the user could choose to let a site access a USB device despite the lack of such permission on the device (and maybe the lack of anything WebUSB-specific on the device).

A good starting point might be a high-level walkthrough of a typical 'cold start' usage scenario, involving any and all relevant permissions grants. This will help those who do not already deeply understand USB and the way you have designed the permissions model. We're curious about the interaction of the general usb permission, and the more granular permissions that appear to be granted on a per-device basis. The walkthrough would help with this too.

We would ideally encourage this content to be in a standalone explainer.

reillyeon commented 6 years ago

Recommended page load behavior and the cold-start scenario are covered in Example 1 in §5. Device Enumeration. I'm having trouble reconciling the TAG's earlier recommendation to add examples to the spec with its current preference for a standalone explainer. Should the existing content be duplicated? Are in-spec examples now discouraged?

triblondon commented 6 years ago

Both in-spec examples AND stand-alone explainers are very much encouraged. The TAG is in favour of anything that makes specs more accessible to developers.

That example is pretty good, sorry we missed that. In the review issue we have the feedback that the CORS like model has been removed, which explains our misunderstanding.

We'd be delighted to see some more developer accessible info upfront, but I think this specific issue is no longer a problem.