Fully support Web USB and Web Serial

[ali1234]

Web-based IDEs like Arduino and Github Codespaces are now commonplace. They are hobbled in Firefox due to an inability to access development boards without installing extra system software, which rather defeats the purpose of having an IDE that runs in your browser. This is not the case on Chrome, where Web USB and Web Serial can be used. (Clarification: they *could* be used on Chrome, but often are not because developers don't want to maintain two separate codebases.)

I will preempt the response I have received every previous time I brought up this topic: Web USB and Web Serial present no more of a security risk than web camera or location data, and Firefox already has a permissions system to protect those. On the other hand, the software you have to install to make Arduino IDE work in Firefox starts a webserver that shares your serial port over a websocket, just so that your browser can connect to it. It isn't clear if there are any protections at all on that websocket.

I will also note than the current prevalence of web-based development environments is in part due to Mozilla's insistence that everything should be able to run in the browser, along with projects like Firefox OS.

https://developer.mozilla.org/en-US/docs/Web/API/Web_Serial_API

https://developer.mozilla.org/en-US/docs/Web/API/USB

[djdevon3]

I'm coding a project on Adafruit's circuit python platform and I have to use Chrome because Firefox doesn't support web serial. Very disappointed. The future of microcontrollers will rely on integration with web serial. If you could just take a look at what WipperSnapper is doing for AdafruitIO platform I'm sure you'd agree. Any microcontroller that has WiFi capability (including Raspberry Pi & Arduino) will need web serial in the future.

Firefox is lagging behind Chrome for web serial adoption to the point where people must now seriously consider using Chrome as their main browser of choice. Firefox users who play with microcontrollers don't want that and I'm sure Mozilla doesn't want that.

[LeoBriand]

I agree!

Please Mozilla, add these API to Firefox 🔥🦊

[Anonymous]

Not a feature i would want. Also seems like api can be potentially harmful to the user. At least that seems like the current verdict. ref. https://mozilla.github.io/standards-positions/

[domints]

I really and honestly fail to understand this position. 1. In Chrome browser pop-up is required to show and to specifically choose which devices are available to given website. 2. Before WebSerial some websites required additional app on users machine that would act as a bridge between browser and serial device. Do you deem it's safer to install some app to act as a bridge instead of using native browser APIs? Moreover app-per-vendor which might mean A LOT of apps when user uses many of such devices. I believe it can be done properly and safely (yeah, Chrome's way is a good way, but could be hidden behind about:config), but for some reason Mozilla refuses to focus on it, forcing its users to use Chrome just for the purpose of hardware interfacing.

[PseudoNym2112]

Getting user to ignore a pop-up, or managing to not trigger the pop-up, is the source of all too many news articles & CVEs.

How about having the capability available, but disabled by default in the config?

[Tyeth]

It's no different than enabling access to the microphone/camera on a per-site basis.

A flaw would be tragic, but not impossible.

User accepts the risk/liability in the license & terms + conditions by using the software, i.e. operating system + browser combo (surely you read all of it right, including used 3rd-party libraries' terms+licenses?).

[klikini]

I think supporting WebSerial (even if behind an about:config option to reduce attack surface for the users who don't want or need it) is required to compete in the 2023 browser market. I hate having to switch to Edge every time I need to use it.

[LeoBriand]

Hi,

Same here, please add this feature to Firefox. I'm the CEO of Vittascience, an education company specialized in coding for schools (especially hardware such as micro:bit and arduino). Because of this limitation, we are advising our 35k monthly active users to use Chrome or Edge instead of Firefox (which they often do).

As @domints mentionned, it is not riskier than camera, microphone or location APIs, and surely much safer than the local bridge (websocket) required at the moment (we gave up on this websocket solution after 2 years of users complaining, especially about Firewall issues in schools).

If you need, I can provide you hundreds of teachers testimonies asking for this feature on Firefox. For information, Firefox usage is much higher in the teaching world than in average, so losing this user base would have very negative consequences for Mozilla.

[nicolaspoulain]

Hello everybody,

I'm the project manager for Capytale, an educational service developed by the French Ministry of Education and used by over 300,000 users. More than 30% of the connections we record are on Firefox.

We plan to develop the use of hardware programming such as micro:bit and arduino and it is a pity for our users to have to change browsers every time they need to download programs via USB.
It's also very sad for the development of Firefox, which we systematically encourage students to use.

The Capytale team sincerely hopes that Firefox will soon support WebSerial.

[PseudoNym2112]

How would you feel about the capability had to be enabled by a setting in about:config ? Would that be acceptable?

[KellyClowers]

God I hope they never do. If you need that kind of access make a real native program, don't deliver it through a website.

[SuibianP]

How does that help with security on the end user side?

If a user is not deemed capable enough to know what a WebUSB/WebSerial permission dialog entails, most likely they are not clear what a downloaded exe/dmg can do to their machine either. And as is well known to all, whatever a malicious JS program can do using WebUSB/WebSerial/WebHID, a native program can do just as well, plus much more.

[lumi]

It should be supported, even if behind a config flag. I create dashboards for smart home using web technologies, and it's unfortunate that I have to run them in a Chrome window.

[z4xh]

I'd love to be able to use Firefox daily again, there's very few reasons I use Chrome anymore. WebUSB/WebSerial support is one of those reasons. I understand those APIs present some risks, but these risks can be mitigated. If I had to toggle a setting or dig into about:config before using, I'm okay with that. I've never been prompted by a website on Chrome to enumerate USB/Serial devices when I wasn't expecting. The times that I have, it was either my own projects, an open-source tool, or on some sort of STEM platform. The last two categories is the biggest reason Mozilla needs to reconsider their stance. There are so many projects that are easier to implement in the browser. They become cross-platform easily, use a universal API that doesn't depend on installing potentially riskier third-party applications, etc. Please, Mozilla!

[wimpy]

Every once in a while I give Firefox a shot again to see if it can replace Chrome as my daily driver. It gets better every time I try! But as you might have guessed already, this time the lack of support for Web Serial has become the blocker for me.

[timonsku]

WebUSB has become very integral in offering cross platform, user friendly and safe interaction with USB devices.
The fact that you consistently have to point users to use a chromium based browser for that is sad and is seriously hurting Firefox adoption in hardware centric industries.

[zoonman]

I work for very large semiconductor manufacturer and we have been evaluating WebUSB in general and WebSerial in particular.

Unfortunately, lack of support of WebUSB in Firefox and full support in other browsers tampers the progress of using Web-technologies for electronics engineering effectively forcing us to push back on the customers and making them to download multiple gigabytes of .NET applications and various drivers. 

This is one of the reasons why people shy away from using web-technologies to build serious business applications. Everyone is using Electron to overcome stupid privacy limitations.

Market share of Firefox during last 10 years folded from 30% down to 3%. Just think about it - you have lost a third of the market! Clearly, most of what you are doing is wrong.

If Firefox wants to get back on the track it has to:

1. Focus on the customer needs, make experience seamless
2. Support all modern web-standards, even if they are considered unsafe or violate privacy
3. Invest into real innovations like WebUSB, develop multipeer WebRTC, VR, AR experiences
4. Use AI to improve navigation, rank results from the history, fix search and performance there (oh, it is still can't find a web-site if there was something in the title or in url)
5. Stop making interface elements larger and larger, return compact themes
6. Introduce security profiles for privacy freaks, where they can turn off whatever they like but make sure that everything works by default.
7. Stop funding BS like writing classes or advocacy. Focus on Firefox and MDN. This is your bread and butter.

If Mozilla Foundation doesn't wake up and start making changes immediately it won't last for another 5 years.

[Agentvirtuel]

Hello

---

@zoonman wrote:
Stop making interface elements larger and larger, return compact themes

---

This information

Please don’t remove the compact density option for the Proton redesign
https://discourse.mozilla.org/t/please-dont-remove-the-compact-density-option-for-the-proton-redesig...

---

the optional Compact density setting will tighten up the bookmark menus that drop from the main toolbar and bookmarks toolbar (but probably not other menus).

---

Compact mode workaround in Firefox
https://support.mozilla.org/en-US/kb/compact-mode-workaround-firefox

---

(but probably not other menus).

---

In addition https://forums.mozfr.org/viewtopic.php?p=918460#p918460

Take a look to this code https://www.reddit.com/r/FirefoxCSS/comments/p2euaa/how_to_undo_stupid_changes_in_recent_firefox

Compact Density (not supported) without userChrome.css

What Compact Density (unsupported) can't do elsewhere

userChrome.css can do it elsewhere

What Compact Density (unsupported) can't do elsewhere

userChrome.css can do it elsewhere

What Compact Density (unsupported) can't do elsewhere

userChrome.css can do it elsewhere

https://www.userchrome.org

[zoonman]

We already have Linux for people who spends their time fixing everything.

We don't need this in the browser.

Browser should have an compact theme as it was before.

[Agentvirtuel]

Of course

Compact mode workaround in Firefox
https://support.mozilla.org/en-US/kb/compact-mode-workaround-firefox
+
userChrome.css

/* Use Normal top and bottom padding for compact */
#PlacesToolbarItems .bookmark-item {
padding-top: 0px!important;
padding-bottom: 0px!important;
}

/***Tighten up drop-down/context/popup menu spacing ***/

menupopup > menuitem, menupopup > menu {
padding-block: 2px !important;
}
:root {
--arrowpanel-menuitem-padding: 2px 8px !important;
}

Also works under Linux

Other
A similar discussion here https://connect.mozilla.org/t5/ideas/advanced-firefox-themes-engine/idc-p/48455

[zoonman]

 I am talking about fixing this issue:

 I am not looking for ugly workarounds.

[Agentvirtuel]

Hello

Another possibility, without using Compact mode workaround in Firefox

/* Use Normal top and bottom padding for compact */
#PlacesToolbarItems .bookmark-item {
padding-top: 0px!important;
padding-bottom: 0px!important;
}

/***Tighten up drop-down/context/popup menu spacing ***/

menupopup > menuitem, menupopup > menu {
padding-block: 2px !important;
}
:root {
--arrowpanel-menuitem-padding: 2px 8px !important;
}

/* ---Tabs/Tab Bar height--- */
:root {
 --tab-min-height: 20px !important;
}

Add Tabs/Tab Bar heigh to userChrome.css
And, as an example, 20px is reduced, then it's up to you to decide, at your convenience

https://www.youtube.com/embed/yecDrZXjl1U

Other information
Firefox advanced customization and configuration options
https://support.mozilla.org/en-US/kb/firefox-advanced-customization-and-configuration
This also applies to Thunderbird. Please refer to Thunderbird's article
userChrome.css and .js and userContent are unsupported
https://support.mozilla.org/en-US/kb/userchromecss-js-usercontent-unsupported

Open source is cool, because it's fun!
https://www.reddit.com/r/FirefoxCSS

---

@zoonman wrote:
Market share of Firefox during last 10 years folded from 30% down to 3%. Just think about it - you have lost a third of the market! .

https://forums.mozillazine.org/viewtopic.php?f=48&t=3115110

I use Android on my smartphone, and Google Chrome is the default.
Android? market share worldwide

What percentage of Android users worldwide use Firefox?
Why aren't they using Firefox? Is it because Google Chrome is the default, and, well, it works, so why look elsewhere?

With the help of Responsive Design Mode
https://firefox-source-docs.mozilla.org/devtools-user/responsive_design_mode/index.html
If I modify the User-Agent? does it count in the statistics?

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

https://ipleak.net

Clarification
Bookmarks in Firefox
In my screenshot, you can't see the star in the address bar
It's normal, for reason, I use a userChrome.css code
#star-button-box {display:none!important;}
https://forums.mozillazine.org/viewtopic.php?f=38&t=3114663

[domints]

Guys, could you please stay on topic of WebUSB/WebSerial? I couldn’t care less about your styling issues, yet I get lots of e-mails about it. I don’t want to unsubscribe in case something about actual topic comes.

[k2here]

i am visiting this back after almost a year in 2024 and am feeling like i should not be having any hope of this being implemented , till date keeping mozilla firefox updated yet seeing this message breaks all my optimism. In short mozilla is not giving us this have to live with two browsers (namely evil chrome browser) just for flashing my esps or tuya devices. unlike others i am not using arduino but using esp devices but with same handicap. no ability to flash / install.

If there is any experimentla or beta version or any workaround apart from having extra browsers, anybody has found out please share.

[xmris]

Can someone please remind firefox devs this is 2024 not 2000, there are IDEs on the web esp for IOT

btw there is a 3rd party webserial extension https://github.com/kuba2k2/firefox-webserial but this is not not a native solution YMMV.

thanks

[Nebula-System]

i really need this for things like flashing my Flipper Zero with custom firmware. frankly it's a must have in the modern day. i've been trying to get the extension Here by kuba2k2 to work, but it's having issues. Mozilla devs need to get on this, and i agree with what others have said: make it need to be enabled in about:config for security purposes just to prevent issues. this is 2 years old and needs to be acted on.

[ThijsFTW]

The ZSA Moonlander software (keyboard software for flashing etc) needs WebUSB/WebSerial support.

I find it mind boggling this isn't supported in a modern browser in 2024...!

[BouncingBanana]

Firefox will never be taken seriously without WebUSB support. It is nonsensical to refuse to support a _well established_ browser functionality that is used extensively (and without the sky falling, I might add). This remind me of when Mozilla's director opposed the development of a mobile browser - this is equally asinine.

Firefox will implement this, or it will die. It is is simple as that. More and more devices are being made without drivers relying on WebUSB instead - as it is in fact MUCH safer than installing a driver.

To not implement something because "if we make a mistake there could be security risks.." is going to keep Firefox niche - but that niche is going to shrink when the browser lack a HUGE chunk of functionality.

This is absurd and needs to change. I don't get it.

[eli_liam]

As a software developer I've been repping Firefox for years to everyone I know, each time having to explain what makes Firefox better than Chrome, but this issue is my biggest hangup. I can't believe that Mozilla won't even let us make our own choice on if this is "secure" or not via making it opt-in through an about:config flag or something alike. It genuinely feels like Mozilla is being more intrusive than Google when it comes to making these decisions for us, which is the opposite of their whole philosophy.

Mozilla, for the last time, listen to your community which has stood by you from the beginning, let us make this choice, and at the very least please just give us the ability to enable this "scary," "insecure," and "intrusive" feature if we so choose.

[Nebula-System]

i agree, it's really becoming hypocrisy at this point. i'm gonna send this thread to a support email or whatever turns out there isn't one. ask them to escalate this and give it kudos, and share with others on here, and i encourage everyone else here to do the same. at least this way we'll hopefully get a final answer soon, either it's in development, or it's off to something like brave or vivaldi for the lot of us.

[Espionage724]

https://www.roadtovr.com/meta-is-reportedly-working-on-a-tool-to-let-you-force-quest-os-updates-via-...

https://www.meta.com/help/quest/software_update/

https://mbf.bsquest.xyz

That is 2 things I'm interested in that both need WebUSB. The latter is for Beat Saber modding on Quest VR headsets, and due to OS updates and restrictions, that WebUSB method might be the only working method currently.

I first ran into this a few weeks earlier with postmarketOS when trying to flash it to my phone. Their developers recommended me to use their WebUSB browser flasher instead when I couldn't get the binary flasher working. I didn't think this was worthwhile enough to switch browsers, so I gave Firefox's lack a pass.

[Espionage724]

Another: An Attack Shark R6 mouse has a WebUSB configuration interface: https://cn.attackshark.pro/WebDriven/index.html#/project/items

Loaded fine in MS Edge on Windows, and they also have a standalone win32 app for the mouse settings too.

[KERR]

The irony of having to use Chrome to flash GrapheneOS (a privacy-first Android ROM) via webUSB is disappointing!

[Nebula-System]

that's sad, i'm about to be looking into changing my phone's OS or rooting it, and i'll probably find more of this.

on another note: to those in this thread with email updates enabled, there's a new FOSS browser very early in development, Ladybird, so keep an eye on it as either it'll be a great replacement for firefox in a couple years if they add web serial and web usb, or the competition will force mozilla to do something. here's hoping.

until then, mozilla needs to listen.

[PseudoNym2112]

A whole new browser is a *very* ambitious task.

What about some of the existing FF forks? I wonder if LibreWolf or IceCat would consider adding opt-in support for WebUSB?

Maybe FF main would pick it up from a fork if one of those communities seemed to be doing well with it?

[Nebula-System]

maybe, we can only hope.

[domints]

You should keep the discussion civil, and you've only shown disrespect and lack of decency so far. I kindly ask you to stop spitting out such hateful words.

[KellyClowers]

Absolutely do not support these. That is Chrome nonsense that no one should be using. The vulnerability footprint of browsers is enormous already, add low level protocols like that is immensely stupid. No web site should ever be able to have that kind of access to local hardware. Which is exactly why Mozilla doesn't support it currently. 

[Nebula-System]

please kindly stop taking over a thread with (presently) unexplained, and unkind accusations.

adding these protocols is a valuable tool for access to local external hardware with user's consent, and the security measures are in exactly that: the user's consent, the activation of them. any proper implementation would require human user input before webserial could be activated which is what chrome also does, and the whole feature could, and should, be locked behind an about:config flag as it's a feature many common users (seemingly such as yourself) do not need, as they have no reason nor purpose. the people here are advocating for adding it behind such a flag, for our specific use cases, as being behind an about:config flag would keep common users safe while giving us the tools we want, that firefox needs to be able to compete in terms of browser market share in the modern era.

please kindly source the reasons for your argument and explain them in the future, and explain why you are so passionate about being against this, as lack of civility nor explanation add nothing to the discussion. if you have tangible constructive concerns, please tell us so we may counter with ways to mitigate those concerns, or new things mozilla should add to ensure it's not a security risk.