{"action":"created","issue":{"url":"https://api.github.com/repos/WICG/webusb/issues/52","repository_url":"https://api.github.com/repos/WICG/webusb","labels_url":"https://api.github.com/repos/WICG/webusb/issues/52/labels{/name}","comments_url":"https://api.github.com/repos/WICG/webusb/issues/52/comments","events_url":"https://api.github.com/repos/WICG/webusb/issues/52/events","html_url":"https://github.com/WICG/webusb/issues/52","id":147596804,"number":52,"title":"Maybe just emulate HTTP server via USB CDC NCM virtual network interface?","user":{"login":"jaseg","id":136313,"avatar_url":"https://avatars.githubusercontent.com/u/136313?v=3","gravatar_id":"","url":"https://api.github.com/users/jaseg","html_url":"https://github.com/jaseg","followers_url":"https://api.github.com/users/jaseg/followers","following_url":"https://api.github.com/users/jaseg/following{/other_user}","gists_url":"https://api.github.com/users/jaseg/gists{/gist_id}","starred_url":"https://api.github.com/users/jaseg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jaseg/subscriptions","organizations_url":"https://api.github.com/users/jaseg/orgs","repos_url":"https://api.github.com/users/jaseg/repos","events_url":"https://api.github.com/users/jaseg/events{/privacy}","received_events_url":"https://api.github.com/users/jaseg/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2016-04-12T00:32:20Z","updated_at":"2016-04-14T23:12:09Z","closed_at":null,"body":"Thinking about #50 I got the following idea:\r\n\r\nIn the end, what you want to do is let a webapp communicate with a USB-connected device running a cooperating firmware. You might be able to achieve this by doing the following:\r\n * Have the device enumerate as an USB CDC NCM (network) device in addition to its usual interfaces. (AFAIK Android adb uses something like this)\r\n * Have the device provide DHCP on a company-owned, not globally routed network range on that interface, but do not annouce DNS or a default route.\r\n * Emulate an HTTP server listening on this virtual network port on the device that sends the appropriate headers to allow access from vendor website despite Same-Origin-Policy.\r\n\r\nThis requires a bit of code on the firmware side of things, but that's mostly a barebones stripped-down IP/DHCP/TCP/HTTP stack. The advantage of this would be that it is fully compatible with existing systems, since USB network drivers (hopefully) are already installed on any system and browsers are already good at talking to \"network\" devices.\r\n\r\nThis solution would IMO be cleaner than what is currently proposed as it does not require new client-side code and the attack surface is clearly limited on the embedded HTTP thingamabob which could conceivably be secured. There still remains a lot of potential for ownage, but I guess that's what you get for plugging the internet into your things."},"comment":{"url":"https://api.github.com/repos/WICG/webusb/issues/comments/210198891","html_url":"https://github.com/WICG/webusb/issues/52#issuecomment-210198891","issue_url":"https://api.github.com/repos/WICG/webusb/issues/52","id":210198891,"user":{"login":"cwilso","id":507001,"avatar_url":"https://avatars.githubusercontent.com/u/507001?v=3","gravatar_id":"","url":"https://api.github.com/users/cwilso","html_url":"https://github.com/cwilso","followers_url":"https://api.github.com/users/cwilso/followers","following_url":"https://api.github.com/users/cwilso/following{/other_user}","gists_url":"https://api.github.com/users/cwilso/gists{/gist_id}","starred_url":"https://api.github.com/users/cwilso/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cwilso/subscriptions","organizations_url":"https://api.github.com/users/cwilso/orgs","repos_url":"https://api.github.com/users/cwilso/repos","events_url":"https://api.github.com/users/cwilso/events{/privacy}","received_events_url":"https://api.github.com/users/cwilso/received_events","type":"User","site_admin":false},"created_at":"2016-04-14T23:12:09Z","updated_at":"2016-04-14T23:12:09Z","body":"@datenwolf Again: you are working within a repo that is stated to work under a code of conduct.  You can oppose this all you want, but if you wish to participate in this group's work, you must respect that CoC.  To summarize, this code of conduct says \"treat each other with respect,\" which I don't think is a high price to pay.  We are not attempting to mute your points; quite the contrary, we welcome multiple viewpoints.  However, \"freely speaking your mind\" does not need to entail being disrespectful (in fact, it lessens your impact when you are); please try to not be insulting, or your comments will be deleted (and unfortunately, then your input will lost.)  This is your second warning."}}