WebUSB is deliberately unsupported on Firefox due to potential for abuse, which seems reasonable to me. Therefore, delivering updates to USB devices likes that is, in my opinion, suboptimal because it requires a specific browser feature which not everyone is willing to use.
It is also less transparent and more difficult to review than, e.g., a Python script. Which would do just the same job. While being even more portable.
I'm at least 10 times more willing to run a shady website in Chrome's sandbox and grant it USB permissions to a specific device for limited time than I am to install some random script or software running with full user privileges.
> It is also less transparent and more difficult to review than, e.g., a Python script. Which would do just the same job. While being even more portable.
Are you absolutely sure you would catch any malicious payload in some obscure single-purpose Python script?
Open source is great, but it's not a complete replacement for a narrow permission model.
> Are you absolutely sure you would catch any malicious payload in some obscure single-purpose Python script?
Of course not. But I can at least fairly easily review it. And that is the point.
A review cannot be done as easily with a minified JavaScript webpage or a WebAssembly binary that the WebUSB loader tool would use.
Also, with regards to binary Windows blobs that would require installing Windows drivers - yes, I agree that it is considerably worse than WebUSB. But we can always find something worse..
The point I am trying to make is that WebUSB, although being better than Windows binary blobs, is still less transparent, in my opinion, than e.g. a simple Python script.
Edit: To clarify: Whether the user will actually be able to find potential issues during the said review is a separate topic. But I think that the goal should be to enable users to do so. And make it as simple as possible and user-friendly as possible.
Firefox now supports WebSerial though. An alternative to Via/Vial could perhaps use that, with the USB device exposing a virtual serial port.
Kinesis' keyboards with their "Clique" keyboard has a web-based configuration tool that does that. Their older "SmartSet" firmware instead exposed a virtual USB drive, with the configuration as a text file, and a firmware update could be done by dropping a new blob in there.
It is also less transparent and more difficult to review than, e.g., a Python script. Which would do just the same job. While being even more portable.