5 ms·

Mozilla's position on the Web Serial API and their reason not to implement this in Firefox: "Devices that offer serial interfaces often expose powerful, low-le

Mozilla's position on the Web Serial API and their reason not to implement this in Firefox: "Devices that offer serial interfaces often expose powerful, low-level functions over the interface with little or no authentication. Exposing that sort of capability to the web without adequate safeguards presents a significant threat to those devices. A user deliberately installing a site-specific add-on may be adequate, given sufficiently understandable consent copy." (https://mozilla.github.io/standards-positions/#webserial https://mozilla.github.io/standards-positions/#webserial)

IshKebab 2y ago
Seems like a cop-out. If you are worried about adequate safeguards.... just implement it with adequate safeguards! And how many users that need safeguards are going to be actually using serial devices anyway? I wish people would be more honest about this sort of stuff. I am sure that the real reason is they just don't have enough resources to implement and support this very niche API.
- madeofpalk 2y ago
  The "just" is doing a lot of work here. It's not Mozilla's job to contribute back to every spec they disagree with. This feedback is given to those championing the specs, and it's up to them to build something better.
  - RobotToaster 2y ago
    We already have authorisation popup boxes for websites that want to use stuff like webcams, it doesn't seem unreasonable for them to just give a popup authorisation for web serial with a warning that it could set your printer on fire.
    - madeofpalk 2y ago
      You can read through the conversations to understand more of the context https://github.com/mozilla/standards-positions/issues/100#issuecomment-411931908 https://github.com/mozilla/standards-positions/issues/100#is... https://github.com/mozilla/standards-positions/issues/95#issuecomment-403139745 https://github.com/mozilla/standards-positions/issues/95#iss... https://github.com/mozilla/standards-positions/issues/336 https://github.com/mozilla/standards-positions/issues/336 The main struggle is around giving informed consent that explains the risks. Understandably, browsers don't want to ship a "Set my printer on fire" button. The web is held to a higher standard because it's so much more hostile than the native app environments, with arbitary code being executed, without permission, from unknown and untrustable origins.
    - WorldMaker 2y ago
      Mozilla has a lot of metrics of things like webcam permissions and quite a lot of data on how often that goes wrong in practice (websites that get more permissions than users meant to give them; websites that abuse permissions after they've been granted them; etc). If Mozilla thought a permissions flow was all that was needed to make Webserial safe, they would have suggested it. I'm sure they have plenty of empirical data to give them enough reasons why they suggested that a permissions flow wouldn't be enough to keep this safe.
    - troupo 2y ago
      > doesn't seem unreasonable for them to just give a popup authorisation for web serial Just a pop up for camera Just a popup for microphone Just a popup for location Just a popup for notifications Just a popup for Web Serial Just a popup for Web USB Just a popup for Web MIDI Just a popup for Web HID Just a popup for Web Bluetooth Just a popup for File System Access Just a popup for Network Information Just a popup for Web NFC Just a popup for ...
      - IshKebab 2y ago
        I don't really see any issue with that. What's the specific problem? I mean that's how Android and iOS work and it seems to work quite well in practice.
        troupo 2y ago
        > I don't really see any issue with that. You don't see an issue with a barrage of prompts that users have been conditioned to blindly accept? > I mean that's how Android and iOS work and it seems to work quite well in practice. It doesn't work that well in practice. This is an older study, but the results in section 7 remain as relevant: https://cups.cs.cmu.edu/soups/2012/proceedings/a3_Felt.pdf https://cups.cs.cmu.edu/soups/2012/proceedings/a3_Felt.pdf
        IshKebab 2y ago
        > You don't see an issue with a barrage of prompts that users have been conditioned to blindly accept? No, for two reasons: 1. This isn't like "are you sure you wish to run this program that you just downloaded?" where you pretty much have zero reason to ever say no. If a torrent site asks for USB access I'm going to say no. If a firmware update site asks, I'll say yes. It's easily actionable. 2. No sites ask for all of those permissions. At most they ask for one or two.
        troupo 2y ago
        > . If a torrent site asks for USB access I'm going to say no You keep pretending that only torrent sites (or scammy sites) will be asking for this. Here's an ad network on a legitimate site asking for access to MIDI:https://x.com/denschub/status/1582730985778556931 https://x.com/denschub/status/1582730985778556931 > No sites ask for all of those permissions. You don't have to ask for all permissions. There are so many permissions that you only need a subset
    - j45 2y ago
      A web cam doesn't seem like a universal interface to plug in anything through.
- troupo 2y ago
  > I wish people would be more honest about this sort of stuff. What if Mozilla is honest about this stuff? Have you ever tried to entertain this thought?
  - IshKebab 2y ago
    Are you asking if I thought about the thing I wrote? Obviously I did.
- j45 2y ago
  There was a lot of time spent securing browsers from Java applets, etc and others that free reign over the computers BUS. If you are in serious, actual need of serial interface today - get a device like a Tibbo and hit it over TCP/IP. I don't work for Tibbo but have use their products in the past.
skybrian 2y ago
I think they're right to be wary, but then again, Chrome shipped this in 2021. It's not widely used, but it seems like there should be some real-world experience to go on? Are Chrome's safely precautions inadequate? Is it being abused? In the end, though, it's not that big a deal. It's easy for technically minded people to have more than one browser installed. You can use Firefox and start Chrome for any websites that need this niche feature. I wrote a tool that uses WebSerial. It's a little annoying to ask people to switch browsers to use my tool, but it's doable. (Or perhaps use this extension, if you trust it.) In practice, nobody is using my tool much anyway, including me.
- troupo 2y ago
  > I think they're right to be wary, but then again, Chrome shipped this in 2021. Just because Chrome shipped something: - doesn't make it a standard - doesn't make it secure Can't say for WebSerial, but when Mozilla shipped WebMIDI they immediately discovered that it was used for fingerprinting (https://twitter.com/denschub/status/1582730985778556931 https://twitter.com/denschub/status/1582730985778556931), and Chrome was silently letting sites enumerate MIDI devices on a user's computer (https://twitter.com/denschub/status/1582730988118867968 https://twitter.com/denschub/status/1582730988118867968)
  - skybrian 2y ago
    No, of course not, but I think we should be curious about it. For example, what have security researchers discovered about WebSerial as implemented in Chrome?
    - troupo 2y ago
      You don't even have to discover anything. The spec itself lists unmitigated issues that are the same for other hardware APIs too: https://wicg.github.io/serial/#security https://wicg.github.io/serial/#security

IshKebab 2y ago

Seems like a cop-out. If you are worried about adequate safeguards.... just implement it with adequate safeguards! And how many users that need safeguards are going to be actually using serial devices anyway? I wish people would be more honest about this sort of stuff. I am sure that the real reason is they just don't have enough resources to implement and support this very niche API.

madeofpalk 2y ago
The "just" is doing a lot of work here. It's not Mozilla's job to contribute back to every spec they disagree with. This feedback is given to those championing the specs, and it's up to them to build something better.
- RobotToaster 2y ago
  We already have authorisation popup boxes for websites that want to use stuff like webcams, it doesn't seem unreasonable for them to just give a popup authorisation for web serial with a warning that it could set your printer on fire.
  - madeofpalk 2y ago
    You can read through the conversations to understand more of the context https://github.com/mozilla/standards-positions/issues/100#issuecomment-411931908 https://github.com/mozilla/standards-positions/issues/100#is... https://github.com/mozilla/standards-positions/issues/95#issuecomment-403139745 https://github.com/mozilla/standards-positions/issues/95#iss... https://github.com/mozilla/standards-positions/issues/336 https://github.com/mozilla/standards-positions/issues/336 The main struggle is around giving informed consent that explains the risks. Understandably, browsers don't want to ship a "Set my printer on fire" button. The web is held to a higher standard because it's so much more hostile than the native app environments, with arbitary code being executed, without permission, from unknown and untrustable origins.
  - WorldMaker 2y ago
    Mozilla has a lot of metrics of things like webcam permissions and quite a lot of data on how often that goes wrong in practice (websites that get more permissions than users meant to give them; websites that abuse permissions after they've been granted them; etc). If Mozilla thought a permissions flow was all that was needed to make Webserial safe, they would have suggested it. I'm sure they have plenty of empirical data to give them enough reasons why they suggested that a permissions flow wouldn't be enough to keep this safe.
  - troupo 2y ago
    > doesn't seem unreasonable for them to just give a popup authorisation for web serial Just a pop up for camera Just a popup for microphone Just a popup for location Just a popup for notifications Just a popup for Web Serial Just a popup for Web USB Just a popup for Web MIDI Just a popup for Web HID Just a popup for Web Bluetooth Just a popup for File System Access Just a popup for Network Information Just a popup for Web NFC Just a popup for ...
    - IshKebab 2y ago
      I don't really see any issue with that. What's the specific problem? I mean that's how Android and iOS work and it seems to work quite well in practice.
      - troupo 2y ago
        > I don't really see any issue with that. You don't see an issue with a barrage of prompts that users have been conditioned to blindly accept? > I mean that's how Android and iOS work and it seems to work quite well in practice. It doesn't work that well in practice. This is an older study, but the results in section 7 remain as relevant: https://cups.cs.cmu.edu/soups/2012/proceedings/a3_Felt.pdf https://cups.cs.cmu.edu/soups/2012/proceedings/a3_Felt.pdf
        IshKebab 2y ago
        > You don't see an issue with a barrage of prompts that users have been conditioned to blindly accept? No, for two reasons: 1. This isn't like "are you sure you wish to run this program that you just downloaded?" where you pretty much have zero reason to ever say no. If a torrent site asks for USB access I'm going to say no. If a firmware update site asks, I'll say yes. It's easily actionable. 2. No sites ask for all of those permissions. At most they ask for one or two.
        troupo 2y ago
        > . If a torrent site asks for USB access I'm going to say no You keep pretending that only torrent sites (or scammy sites) will be asking for this. Here's an ad network on a legitimate site asking for access to MIDI:https://x.com/denschub/status/1582730985778556931 https://x.com/denschub/status/1582730985778556931 > No sites ask for all of those permissions. You don't have to ask for all permissions. There are so many permissions that you only need a subset
  - j45 2y ago
    A web cam doesn't seem like a universal interface to plug in anything through.
troupo 2y ago
> I wish people would be more honest about this sort of stuff. What if Mozilla is honest about this stuff? Have you ever tried to entertain this thought?
- IshKebab 2y ago
  Are you asking if I thought about the thing I wrote? Obviously I did.
j45 2y ago
There was a lot of time spent securing browsers from Java applets, etc and others that free reign over the computers BUS. If you are in serious, actual need of serial interface today - get a device like a Tibbo and hit it over TCP/IP. I don't work for Tibbo but have use their products in the past.

skybrian 2y ago

I think they're right to be wary, but then again, Chrome shipped this in 2021. It's not widely used, but it seems like there should be some real-world experience to go on? Are Chrome's safely precautions inadequate? Is it being abused? In the end, though, it's not that big a deal. It's easy for technically minded people to have more than one browser installed. You can use Firefox and start Chrome for any websites that need this niche feature. I wrote a tool that uses WebSerial. It's a little annoying to ask people to switch browsers to use my tool, but it's doable. (Or perhaps use this extension, if you trust it.) In practice, nobody is using my tool much anyway, including me.

troupo 2y ago
> I think they're right to be wary, but then again, Chrome shipped this in 2021. Just because Chrome shipped something: - doesn't make it a standard - doesn't make it secure Can't say for WebSerial, but when Mozilla shipped WebMIDI they immediately discovered that it was used for fingerprinting (https://twitter.com/denschub/status/1582730985778556931 https://twitter.com/denschub/status/1582730985778556931), and Chrome was silently letting sites enumerate MIDI devices on a user's computer (https://twitter.com/denschub/status/1582730988118867968 https://twitter.com/denschub/status/1582730988118867968)
- skybrian 2y ago
  No, of course not, but I think we should be curious about it. For example, what have security researchers discovered about WebSerial as implemented in Chrome?
  - troupo 2y ago
    You don't even have to discover anything. The spec itself lists unmitigated issues that are the same for other hardware APIs too: https://wicg.github.io/serial/#security https://wicg.github.io/serial/#security