03-01-2022 12:34 PM - edited 03-02-2022 10:15 AM
Web-based IDEs like Arduino and Github Codespaces are now commonplace. They are hobbled in Firefox due to an inability to access development boards without installing extra system software, which rather defeats the purpose of having an IDE that runs in your browser. This is not the case on Chrome, where Web USB and Web Serial can be used. (Clarification: they *could* be used on Chrome, but often are not because developers don't want to maintain two separate codebases.)
I will preempt the response I have received every previous time I brought up this topic: Web USB and Web Serial present no more of a security risk than web camera or location data, and Firefox already has a permissions system to protect those. On the other hand, the software you have to install to make Arduino IDE work in Firefox starts a webserver that shares your serial port over a websocket, just so that your browser can connect to it. It isn't clear if there are any protections at all on that websocket.
I will also note than the current prevalence of web-based development environments is in part due to Mozilla's insistence that everything should be able to run in the browser, along with projects like Firefox OS.
https://developer.mozilla.org/en-US/docs/Web/API/Web_Serial_API
07-07-2022 11:34 AM
I'm coding a project on Adafruit's circuit python platform and I have to use Chrome because Firefox doesn't support web serial. Very disappointed. The future of microcontrollers will rely on integration with web serial. If you could just take a look at what WipperSnapper is doing for AdafruitIO platform I'm sure you'd agree. Any microcontroller that has WiFi capability (including Raspberry Pi & Arduino) will need web serial in the future.
Firefox is lagging behind Chrome for web serial adoption to the point where people must now seriously consider using Chrome as their main browser of choice. Firefox users who play with microcontrollers don't want that and I'm sure Mozilla doesn't want that.
09-21-2022 07:57 AM
I agree!
Please Mozilla, add these API to Firefox 🔥🦊
09-22-2022 04:35 PM
Not a feature i would want. Also seems like api can be potentially harmful to the user. At least that seems like the current verdict. ref. https://mozilla.github.io/standards-positions/
08-10-2023 12:22 AM
I really and honestly fail to understand this position. 1. In Chrome browser pop-up is required to show and to specifically choose which devices are available to given website. 2. Before WebSerial some websites required additional app on users machine that would act as a bridge between browser and serial device. Do you deem it's safer to install some app to act as a bridge instead of using native browser APIs? Moreover app-per-vendor which might mean A LOT of apps when user uses many of such devices. I believe it can be done properly and safely (yeah, Chrome's way is a good way, but could be hidden behind about:config), but for some reason Mozilla refuses to focus on it, forcing its users to use Chrome just for the purpose of hardware interfacing.
01-06-2024 10:03 PM
Getting user to ignore a pop-up, or managing to not trigger the pop-up, is the source of all too many news articles & CVEs.
How about having the capability available, but disabled by default in the config?
04-05-2024 02:29 PM
It's no different than enabling access to the microphone/camera on a per-site basis.
A flaw would be tragic, but not impossible.
User accepts the risk/liability in the license & terms + conditions by using the software, i.e. operating system + browser combo (surely you read all of it right, including used 3rd-party libraries' terms+licenses?).
05-31-2023 09:25 AM - edited 05-31-2023 09:26 AM
I think supporting WebSerial (even if behind an about:config option to reduce attack surface for the users who don't want or need it) is required to compete in the 2023 browser market. I hate having to switch to Edge every time I need to use it.
08-10-2023 12:58 AM
Hi,
Same here, please add this feature to Firefox. I'm the CEO of Vittascience, an education company specialized in coding for schools (especially hardware such as micro:bit and arduino). Because of this limitation, we are advising our 35k monthly active users to use Chrome or Edge instead of Firefox (which they often do).
As @domints mentionned, it is not riskier than camera, microphone or location APIs, and surely much safer than the local bridge (websocket) required at the moment (we gave up on this websocket solution after 2 years of users complaining, especially about Firewall issues in schools).
If you need, I can provide you hundreds of teachers testimonies asking for this feature on Firefox. For information, Firefox usage is much higher in the teaching world than in average, so losing this user base would have very negative consequences for Mozilla.
08-14-2023 03:50 AM
Hello everybody,
I'm the project manager for Capytale, an educational service developed by the French Ministry of Education and used by over 300,000 users. More than 30% of the connections we record are on Firefox.
We plan to develop the use of hardware programming such as micro:bit and arduino and it is a pity for our users to have to change browsers every time they need to download programs via USB.
It's also very sad for the development of Firefox, which we systematically encourage students to use.
The Capytale team sincerely hopes that Firefox will soon support WebSerial.
01-06-2024 10:06 PM
How would you feel about the capability had to be enabled by a setting in about:config ? Would that be acceptable?
07-15-2024 03:01 PM
God I hope they never do. If you need that kind of access make a real native program, don't deliver it through a website.
10-10-2024 04:32 AM
How does that help with security on the end user side?
If a user is not deemed capable enough to know what a WebUSB/WebSerial permission dialog entails, most likely they are not clear what a downloaded exe/dmg can do to their machine either. And as is well known to all, whatever a malicious JS program can do using WebUSB/WebSerial/WebHID, a native program can do just as well, plus much more.
09-12-2023 08:39 PM
It should be supported, even if behind a config flag. I create dashboards for smart home using web technologies, and it's unfortunate that I have to run them in a Chrome window.
10-04-2023 04:51 PM
I'd love to be able to use Firefox daily again, there's very few reasons I use Chrome anymore. WebUSB/WebSerial support is one of those reasons. I understand those APIs present some risks, but these risks can be mitigated. If I had to toggle a setting or dig into about:config before using, I'm okay with that. I've never been prompted by a website on Chrome to enumerate USB/Serial devices when I wasn't expecting. The times that I have, it was either my own projects, an open-source tool, or on some sort of STEM platform. The last two categories is the biggest reason Mozilla needs to reconsider their stance. There are so many projects that are easier to implement in the browser. They become cross-platform easily, use a universal API that doesn't depend on installing potentially riskier third-party applications, etc. Please, Mozilla!
11-04-2023 08:44 AM
Every once in a while I give Firefox a shot again to see if it can replace Chrome as my daily driver. It gets better every time I try! But as you might have guessed already, this time the lack of support for Web Serial has become the blocker for me.
12-22-2023 03:08 PM
WebUSB has become very integral in offering cross platform, user friendly and safe interaction with USB devices.
The fact that you consistently have to point users to use a chromium based browser for that is sad and is seriously hurting Firefox adoption in hardware centric industries.
01-01-2024 07:49 PM
I work for very large semiconductor manufacturer and we have been evaluating WebUSB in general and WebSerial in particular.
Unfortunately, lack of support of WebUSB in Firefox and full support in other browsers tampers the progress of using Web-technologies for electronics engineering effectively forcing us to push back on the customers and making them to download multiple gigabytes of .NET applications and various drivers.
This is one of the reasons why people shy away from using web-technologies to build serious business applications. Everyone is using Electron to overcome stupid privacy limitations.
Market share of Firefox during last 10 years folded from 30% down to 3%. Just think about it - you have lost a third of the market! Clearly, most of what you are doing is wrong.
If Firefox wants to get back on the track it has to:
If Mozilla Foundation doesn't wake up and start making changes immediately it won't last for another 5 years.
01-06-2024 11:51 PM - edited 01-07-2024 12:06 AM
Hello
@zoonman wrote:
Stop making interface elements larger and larger, return compact themes
This information
Please don’t remove the compact density option for the Proton redesign
https://discourse.mozilla.org/t/please-dont-remove-the-compact-density-option-for-the-proton-redesig...
the optional Compact density setting will tighten up the bookmark menus that drop from the main toolbar and bookmarks toolbar (but probably not other menus).
Compact mode workaround in Firefox
https://support.mozilla.org/en-US/kb/compact-mode-workaround-firefox
(but probably not other menus).
In addition https://forums.mozfr.org/viewtopic.php?p=918460#p918460
Take a look to this code https://www.reddit.com/r/FirefoxCSS/comments/p2euaa/how_to_undo_stupid_changes_in_recent_firefox
Compact Density (not supported) without userChrome.css
What Compact Density (unsupported) can't do elsewhere
userChrome.css can do it elsewhere
What Compact Density (unsupported) can't do elsewhere
userChrome.css can do it elsewhere
What Compact Density (unsupported) can't do elsewhere
userChrome.css can do it elsewhere
01-07-2024 06:16 AM
We already have Linux for people who spends their time fixing everything.
We don't need this in the browser.
Browser should have an compact theme as it was before.
01-07-2024 08:14 AM
Of course
Compact mode workaround in Firefox
https://support.mozilla.org/en-US/kb/compact-mode-workaround-firefox
+
userChrome.css
/* Use Normal top and bottom padding for compact */
#PlacesToolbarItems .bookmark-item {
padding-top: 0px!important;
padding-bottom: 0px!important;
}
/***Tighten up drop-down/context/popup menu spacing ***/
menupopup > menuitem, menupopup > menu {
padding-block: 2px !important;
}
:root {
--arrowpanel-menuitem-padding: 2px 8px !important;
}
Also works under Linux
Other
A similar discussion here https://connect.mozilla.org/t5/ideas/advanced-firefox-themes-engine/idc-p/48455
01-07-2024 08:18 AM
I am talking about fixing this issue:
I am not looking for ugly workarounds.
01-07-2024 11:08 PM - edited 01-08-2024 12:15 AM
Hello
Another possibility, without using Compact mode workaround in Firefox
/* Use Normal top and bottom padding for compact */
#PlacesToolbarItems .bookmark-item {
padding-top: 0px!important;
padding-bottom: 0px!important;
}
/***Tighten up drop-down/context/popup menu spacing ***/
menupopup > menuitem, menupopup > menu {
padding-block: 2px !important;
}
:root {
--arrowpanel-menuitem-padding: 2px 8px !important;
}
/* ---Tabs/Tab Bar height--- */
:root {
--tab-min-height: 20px !important;
}
Add Tabs/Tab Bar heigh to userChrome.css
And, as an example, 20px is reduced, then it's up to you to decide, at your convenience
https://www.youtube.com/embed/yecDrZXjl1U
Other information
Firefox advanced customization and configuration options
https://support.mozilla.org/en-US/kb/firefox-advanced-customization-and-configuration
This also applies to Thunderbird. Please refer to Thunderbird's article
userChrome.css and .js and userContent are unsupported
https://support.mozilla.org/en-US/kb/userchromecss-js-usercontent-unsupported
Open source is cool, because it's fun!
https://www.reddit.com/r/FirefoxCSS
@zoonman wrote:
Market share of Firefox during last 10 years folded from 30% down to 3%. Just think about it - you have lost a third of the market! .
https://forums.mozillazine.org/viewtopic.php?f=48&t=3115110
I use Android on my smartphone, and Google Chrome is the default.
Android? market share worldwide
What percentage of Android users worldwide use Firefox?
Why aren't they using Firefox? Is it because Google Chrome is the default, and, well, it works, so why look elsewhere?
With the help of Responsive Design Mode
https://firefox-source-docs.mozilla.org/devtools-user/responsive_design_mode/index.html
If I modify the User-Agent? does it count in the statistics?
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Clarification
Bookmarks in Firefox
In my screenshot, you can't see the star in the address bar
It's normal, for reason, I use a userChrome.css code
#star-button-box {display:none!important;}
https://forums.mozillazine.org/viewtopic.php?f=38&t=3114663
01-08-2024 12:16 AM
Guys, could you please stay on topic of WebUSB/WebSerial? I couldn’t care less about your styling issues, yet I get lots of e-mails about it. I don’t want to unsubscribe in case something about actual topic comes.
04-18-2024 12:47 AM
i am visiting this back after almost a year in 2024 and am feeling like i should not be having any hope of this being implemented , till date keeping mozilla firefox updated yet seeing this message breaks all my optimism. In short mozilla is not giving us this have to live with two browsers (namely evil chrome browser) just for flashing my esps or tuya devices. unlike others i am not using arduino but using esp devices but with same handicap. no ability to flash / install.
If there is any experimentla or beta version or any workaround apart from having extra browsers, anybody has found out please share.
05-03-2024 02:17 AM - edited 05-03-2024 02:19 AM
Can someone please remind firefox devs this is 2024 not 2000, there are IDEs on the web esp for IOT
btw there is a 3rd party webserial extension https://github.com/kuba2k2/firefox-webserial but this is not not a native solution YMMV.
thanks
05-03-2024 02:55 PM
i really need this for things like flashing my Flipper Zero with custom firmware. frankly it's a must have in the modern day. i've been trying to get the extension Here by kuba2k2 to work, but it's having issues. Mozilla devs need to get on this, and i agree with what others have said: make it need to be enabled in about:config for security purposes just to prevent issues. this is 2 years old and needs to be acted on.
05-06-2024 01:12 AM
The ZSA Moonlander software (keyboard software for flashing etc) needs WebUSB/WebSerial support.
I find it mind boggling this isn't supported in a modern browser in 2024...!
05-06-2024 06:59 AM
Firefox will never be taken seriously without WebUSB support. It is nonsensical to refuse to support a _well established_ browser functionality that is used extensively (and without the sky falling, I might add). This remind me of when Mozilla's director opposed the development of a mobile browser - this is equally asinine.
Firefox will implement this, or it will die. It is is simple as that. More and more devices are being made without drivers relying on WebUSB instead - as it is in fact MUCH safer than installing a driver.
To not implement something because "if we make a mistake there could be security risks.." is going to keep Firefox niche - but that niche is going to shrink when the browser lack a HUGE chunk of functionality.
This is absurd and needs to change. I don't get it.
06-05-2024 11:21 AM
As a software developer I've been repping Firefox for years to everyone I know, each time having to explain what makes Firefox better than Chrome, but this issue is my biggest hangup. I can't believe that Mozilla won't even let us make our own choice on if this is "secure" or not via making it opt-in through an about:config flag or something alike. It genuinely feels like Mozilla is being more intrusive than Google when it comes to making these decisions for us, which is the opposite of their whole philosophy.
Mozilla, for the last time, listen to your community which has stood by you from the beginning, let us make this choice, and at the very least please just give us the ability to enable this "scary," "insecure," and "intrusive" feature if we so choose.
06-05-2024 03:24 PM - edited 06-05-2024 03:28 PM
i agree, it's really becoming hypocrisy at this point. i'm gonna send this thread to a support email or whatever turns out there isn't one. ask them to escalate this and give it kudos, and share with others on here, and i encourage everyone else here to do the same. at least this way we'll hopefully get a final answer soon, either it's in development, or it's off to something like brave or vivaldi for the lot of us.
06-27-2024 03:39 PM - edited 06-30-2024 08:00 PM
https://www.meta.com/help/quest/software_update/
That is 2 things I'm interested in that both need WebUSB. The latter is for Beat Saber modding on Quest VR headsets, and due to OS updates and restrictions, that WebUSB method might be the only working method currently.
I first ran into this a few weeks earlier with postmarketOS when trying to flash it to my phone. Their developers recommended me to use their WebUSB browser flasher instead when I couldn't get the binary flasher working. I didn't think this was worthwhile enough to switch browsers, so I gave Firefox's lack a pass.
07-14-2024 04:08 AM
The irony of having to use Chrome to flash GrapheneOS (a privacy-first Android ROM) via webUSB is disappointing!
07-14-2024 10:32 AM
that's sad, i'm about to be looking into changing my phone's OS or rooting it, and i'll probably find more of this.
on another note: to those in this thread with email updates enabled, there's a new FOSS browser very early in development, Ladybird, so keep an eye on it as either it'll be a great replacement for firefox in a couple years if they add web serial and web usb, or the competition will force mozilla to do something. here's hoping.
until then, mozilla needs to listen.
07-15-2024 07:42 PM
A whole new browser is a *very* ambitious task.
What about some of the existing FF forks? I wonder if LibreWolf or IceCat would consider adding opt-in support for WebUSB?
Maybe FF main would pick it up from a fork if one of those communities seemed to be doing well with it?
07-15-2024 09:59 PM
maybe, we can only hope.
07-15-2024 03:26 PM
You should keep the discussion civil, and you've only shown disrespect and lack of decency so far. I kindly ask you to stop spitting out such hateful words.
07-15-2024 02:59 PM
Absolutely do not support these. That is Chrome nonsense that no one should be using. The vulnerability footprint of browsers is enormous already, add low level protocols like that is immensely stupid. No web site should ever be able to have that kind of access to local hardware. Which is exactly why Mozilla doesn't support it currently.
07-15-2024 10:06 PM
please kindly stop taking over a thread with (presently) unexplained, and unkind accusations.
adding these protocols is a valuable tool for access to local external hardware with user's consent, and the security measures are in exactly that: the user's consent, the activation of them. any proper implementation would require human user input before webserial could be activated which is what chrome also does, and the whole feature could, and should, be locked behind an about:config flag as it's a feature many common users (seemingly such as yourself) do not need, as they have no reason nor purpose. the people here are advocating for adding it behind such a flag, for our specific use cases, as being behind an about:config flag would keep common users safe while giving us the tools we want, that firefox needs to be able to compete in terms of browser market share in the modern era.
please kindly source the reasons for your argument and explain them in the future, and explain why you are so passionate about being against this, as lack of civility nor explanation add nothing to the discussion. if you have tangible constructive concerns, please tell us so we may counter with ways to mitigate those concerns, or new things mozilla should add to ensure it's not a security risk.
08-16-2024 10:54 AM - edited 08-16-2024 11:11 AM
Consider that Web APIs which provide access to hardware devices are significantly safer in terms of security than the present alternative: instructing the user to download a random executable that likely needs to run with administrative privileges on the machine. With Web USB, Web Serial, etc. access is limited to only the devices the user specifies (+ only to that specific origin), and I certainly trust web browser vendors more to not introduce silly bugs that lead to compromise of my machine — I mean, have you seen the quality of the utilities that hardware vendors come up with?
It's a win-win for users and manufacturers: users do not need to worry about installing highly privileged, potentially buggy software on their machine and instead just use a simple webpage; manufacturers do not need to worry about platform-specific implementations of hardware APIs, maintaining the utility software, pushing updates to users, etc.
I would also like to add that devices can implement a specific descriptor that defines the origins that the device trusts to access it. Why not begin with an implementation which allows only a device's trusted origins to access it, and hide a "show all devices" option behind about:config? This would eliminate a big chunk of risk.