Fully support Web USB and Web Serial

[ali1234]

Web-based IDEs like Arduino and Github Codespaces are now commonplace. They are hobbled in Firefox due to an inability to access development boards without installing extra system software, which rather defeats the purpose of having an IDE that runs in your browser. This is not the case on Chrome, where Web USB and Web Serial can be used. (Clarification: they *could* be used on Chrome, but often are not because developers don't want to maintain two separate codebases.)

I will preempt the response I have received every previous time I brought up this topic: Web USB and Web Serial present no more of a security risk than web camera or location data, and Firefox already has a permissions system to protect those. On the other hand, the software you have to install to make Arduino IDE work in Firefox starts a webserver that shares your serial port over a websocket, just so that your browser can connect to it. It isn't clear if there are any protections at all on that websocket.

I will also note than the current prevalence of web-based development environments is in part due to Mozilla's insistence that everything should be able to run in the browser, along with projects like Firefox OS.

https://developer.mozilla.org/en-US/docs/Web/API/Web_Serial_API

https://developer.mozilla.org/en-US/docs/Web/API/USB

[nayz]

Please consider adding native support for this. Hate having to switch to Chrome, just to use a web installer.

[z4xh]

https://nvd.nist.gov/vuln/detail/CVE-2024-9680

Animations were a security problem, should they have been removed? No, they were patched like any reasonable solution to a security problem. Could the same be done for Web Serial? Absolutely!

[zoonman]

I hate to say this but over course of recent years every change that Firefox team brings is sort of questionable.

Chrome and Safari provide better support of web-standards, work faster and become more and more usable. TBH, I use Safari more and more. Also, it renders fonts a little bit nicer.

Instagram reels section just hangs in Firefox.

Mozilla developed a super-fancy Rust but can't use it to make the browser secure.

There are real problems but developers add a weather widget to a new tab.

Dear developers, if you don't get focus back onto your customer's demands you will lose Firefox.

[Nebula-System]

at the end of the day it really is just simply this ^^^

they aren't focusing on what the community wants and are doing questionable and, frankly bad or pointless decisions and they're really gonna start losing users over it soon if they don't get their act together

[zoonman]

Meanwhile Arduino released in-browser IDE that works with every other browser except Firefox https://blog.arduino.cc/2024/10/28/the-web-based-arduino-lab-for-micropython-editor-is-out-with-chro...

Arduino is the most popular platform amongst the ideal target audience for Firefox.

It is sad to see how Firefox turns into Internet Explorer.

[KellyClowers]

Actually you are right. Why not do it? Heck, let's give websites Ring -1 privileges on the CPU, it can make remote debugging so much easier!

[tjhorner]

That's an absolutely insane false equivalency. You can't seriously compare sandboxed, limited access to hardware devices authorized by the user to granting websites unfettered hypervisor access. This is just a disingenuous argument.

Adding any new feature will increase attack surface, and how low level a feature is does not necessarily dictate how much risk is involved. Most vulnerabilities in browsers these days are because of poor memory management, not due to the nature of the APIs that are implemented. For example, the very recent CVE-2024-9680 was due to a bug in the AnimationTimeline API. It is ostensibly a high-level API, but resulted in arbitrary code execution in which the attacker could do pretty much anything.

So just because a feature allows lower-level access to hardware devices does not mean it's any more likely to introduce a vulnerability than any other feature. The risk introduced by a feature must be evaluated against the usefulness of it, and so far it seems Web USB, Web Bluetooth, etc. have filled a niche that has seen adoption with some great use cases, for example:

• Arduino has a web-based IDE which can flash directly from the browser. This is advantageous because Arduino hardware is often used in educational settings, where weak and often locked-down devices like Chromebooks or netbooks are ubiquitous. It simplifies setup for educators, administrators, and school IT, and in fact hardens security posture.
• iFixit's soldering iron can be configured from the web without installing any native software.
• Pixel phones can be recovered from a bricked state using a web-based tool, without the need to install any additional software.
• ESPHome and the related ESP Web Tools project are often-used in the home automation space to facilitate quick configuration or flashing of firmware onto ESP-based devices.

I'm sure there are others I've missed; these are just from the top of my head. What all of these things have in common are that end users do not need to install an additional piece of software to work with their device, and the hardware manufacturers do not need to worry about maintaining a tool (including: updating dependencies that have bugs, being careful with memory management, etc.) for many different platforms. See my previous comment for more thoughts on that.

As this suite of APIs sees more mainstream adoption, Firefox will be seen as lagging behind other browsers.

[Espionage724]

[deleted]

[spap]

Having to install Google Chrome on Linux in order to replace Stock Android on a pixel device with a more privacy-respecting OS is soooo twisted 😵... C'mon Firefox! 😉

[bdjohnson79]

Another vote for proper support of WebSerial in Firefox.  I've got several devices I use regularly that I have to go over to Chrome or Edge to configure:

• My ergo keyboard (uses the Vial extensions to QMK)
• My Flipper Zero
• Arduino type devices

I get that there are probably some legitimate security concerns.  But Firefox devs seem to think that metaphorically burying their heads in the sand is a legitimate response, and that's just sad. 

[k2here]

⌛⏳⌛

[Delopa]

The lack of support for WebUSB is the only reason I have a Chromium-based browser installed on my computer, and it's sad.

[Jon]

(Note: similar ideas have been merged into this thread)

[Tyeth]

@Jon this feels like a dumping ground with merged threads and no official interest.

Please lock and close the thread or maybe see if someone at Mozilla cares (maybe try find an embedded developer)

[PseudoNym2112]

I'd hate to see the thread close and I do appreciate that at least someone is taking random posts from interested parties and connecting them to here.

Don't give up! Fight the power!