9 ms·

WebUSB Extension for Firefox

271 points by tuananh 6mo ago

Orygin 6mo ago
No thanks. I'll accept it in my browser when they fix the security implications this raises, and when the Spec is no longer in draft.
- gear54rus 6mo ago
  And I'll just fire up a chrome instance which I specifically keep for when my daily driver firefox decides to spazz out and not implement basics in 2026 :'(
  - lpcvoid 6mo ago
    How do you make sure that technically illiterate people don't just click away the requestDevice() popup? IMHO a browser offering device level USB access is a security nightmare and there is no way this can ever be made safe and convenient at the same time.
    - zb3 6mo ago
      They can click everything away, so maybe educate them or buy an ios device for your relatives instead of breaking computing for everyone else.
      - lpcvoid 6mo ago
        Fair, but remember that we are the <~1% of people who even know what webusb is. I'm not sure I share your view on this. Maybe an about:config switch to enable it would be enough to stop casuals from pwning their peripherals.
        barnabee 6mo ago
        I’d be ok with an about:config switch, but given that many people will install anything, paste arbitrary text into terminals, and share their password/pin code with complete strangers for almost no reason, I think we need to stop making our tools less powerful in pursuit of an impossible goal.
      - Orygin 6mo ago
        > breaking computing for everyone else How is not implementing a Draft spec, which may compromise security badly, breaking computing? Overreacting much?
        zb3 6mo ago
        This is not just an isolated incident, it's the whole trend of limiting capabilities in the name of security and that's what I was referring to. However in this particular case, even the security argument doesn't hold, either I: a) know that I want to use USB - in that case I'll switch browsers or download a native binary (even more unsafe), it's not that I'd decide that I no longer want to flash my smartphone b) I don't understand what's happening but I follow arbitrary instructions anyway - WebUSB changes nothing.
        skydhash 6mo ago
        So instead of using trusted vendors or requiring tools with auditable code, we just allow everyone to be able to access the user’s devices?
        CamperBob2 6mo ago
        What a concept. We could call it "Personal Computing."
        skydhash 6mo ago
        Not really that personal when every webpage is itching to put their hands on it.
        Orygin 6mo ago
        A native binary can be verified by anti malware systems, and once installed and working, poses no security risk. A 0day in a browser for the WebUSB system would allow any website to mess with arbitrary USB devices connected to your computer. While the browser sandbox is generally safe, it is also a huge target, and with a security risk like that, it wouldn't surprise me if it's a prime target for black hats.
      - troupo 6mo ago
        > They can click everything away, so maybe So maybe don't populate the browser with dozens of features requiring permission popups?
    - exe34 6mo ago
      You can ask them to type one of the following sentences: "I know what I'm doing, and giving a random website access to my USB host is the right thing to do." "I'm an idiot."
      - jayd16 6mo ago
        I love this because the idiots would type out that they know what they're doing and the pros would save time by typing "I'm an idiot."
        exe34 6mo ago
        hah I did think of the second one, but the first didn't occur to me.
    - gear54rus 6mo ago
      You simply don't. This quest of saving idiots from themselves is not gaining anyone anything and meanwhile other people get more and more useless restrictions.
      - Orygin 6mo ago
        Or you can just not give a loaded shotgun to every browser user on the off chance they need to interact with 1 (one) usb device per year.
        leptons 6mo ago
        Or you can just not use the web at all. If you're so scared of it, why are you using it with browsers that have implemented all kinds of APIs that probably already scare you? You may as well just use the Lynx browser if you really want want to put your money where your (security) mouth is. It doesn't do anything, not even display images or CSS or run Javascript.
    - limagnolia 6mo ago
      Isn't that the same excuse Gooogle is using to lrevent folks from installing what they want on Android phones?
      - baby_souffle 6mo ago
        Essentially, yeah.
      - skydhash 6mo ago
        I do not agree with Google on preventing apk installation. But unknown apk is a different risk profile than letting unknown entities to access local usb devices. The main issue in the former case is that google is posing itself as a gatekeeper instead of following a repo model like Debian or FreeBSD. That’s wanting control over people’s device. Allowing USB access is just asking to break the browser sandbox, by equating the browser with the operating system.
    - mvdtnz 6mo ago
      I'm tired of my computing being kneecapped in service of incompetent boomers. Enough is enough. If they're going to fall for dumb scams let them.
  - yjftsjthsd-h 6mo ago
    Are you calling WebUSB a basic feature? Because I'm willing to discuss whether we should have it, but that seems like an exaggeration.
- Retr0id 6mo ago
  The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.
  - skydhash 6mo ago
    That sounds like a Windows problem.
    - Retr0id 6mo ago
      I'm not familiar with the Windows platform but although you can have userspace USB drivers on linux, you still need to be able to run code that can talk to the sysfs interface.
    - Lerc 6mo ago
      The Linux problem is more Hope every time you want to interface with a USB device.
    - monegator 6mo ago
      Not really, as long as the firmware developers used OS 2.0 descriptors (For the rare occurences that our customer is using 7 or earlier, we tell them to use zadig and be done with it.)
  - PunchyHamster 6mo ago
    You can have userspace drivers for usb devices in Linux
    - scottbez1 6mo ago
      How does the security of userspace drivers compare to having drivers within a sandboxed web environment with access to only the devices you’ve explicitly allowlisted?
      - bigfishrunning 6mo ago
- zb3 6mo ago
  What are the security implications this raises that downloading native programs (needed for example to flash my smartphone) doesn't raise?
  - barnabee 6mo ago
    None. People will follow any instruction presented to them when they think it will get them something they want. Mozilla’s stance here is infuriating.
  - troupo 6mo ago
    > What are the security implications this raises that downloading native programs (needed for example to flash my smartphone) doesn't raise? 1. Permission popups fatigue 2. Usually users select the apps they install, most sites are ephemeral. And yes, even with apps, especially on Android, people click through permission dialogs without looking because they are often too broad and confusing. With expected results such as exfiltrating user data.
    - oofdere 6mo ago
      > Permission popups fatigue Native apps also have this, and it's worse because they usually just ask for sweeping admin access on windows, unlike WebUSB which just brings up a device selection menu
      - troupo 6mo ago
        > Native apps also have this, and it's worse because they usually just ask for sweeping admin access on windows On iOS they only pop up the menu when they try to access the required functionality, and there's a limited number of things they can do. > unlike WebUSB which just brings up a device selection menu So the user has to contend with permissions on phones, in desktop OSes, but 26 more potential permissions [1] from a browser are fine because a) it's just a single permission window and b) the browser exists in total vacuum from all other user experiences. [1] Counted in Chrome settings -> Site settings -> permissions. Why Chrome? Because they are the ones pushing all the hardware APIs, among others
- leptons 6mo ago
  The spec is still in draft because Apple refuses to let it move forward - because WebUSB, WebBluetooth and other APIs would compete with their app store, where they can make money from purchases made through apps. They prioritize profits over progress. It has nothing to do with security, as WebUSB has no ability to interact with any device unless the user explicitly allows each and every website that requests access to do so. It's the same security as any other browser API that requests access.
  - JimDabell 6mo ago
    > The spec is still in draft because Apple refuses to let it move forward This is untrue. Web standards need two independent implementations. Google can’t convince any other rendering engine besides their own to implement it. It doesn't take a single no from Apple to veto it; it takes a single yes from anybody outside of Blink to move it forward. Nobody is doing that. Here is what Mozilla have to say about WebUSB: > Because many USB devices are not designed to handle potentially-malicious interactions over the USB protocols and because those devices can have significant effects on the computer they're connected to, we believe that the security risks of exposing USB devices to the Web are too broad to risk exposing users to them or to explain properly to end users to obtain meaningful informed consent. It also poses risks that sites could use USB device identity or data stored on USB devices as tracking identifiers. — https://mozilla.github.io/standards-positions/#webusb https://mozilla.github.io/standards-positions/#webusb Until Google can convince anybody outside of Blink to implement it, it is not a standard it’s a Blink-only API.
    - leptons 6mo ago
      Apple has provided no alternative, and no suggestions for how to improve the draft. They are not helping advance the draft only for selfish reasons. They also won't allow any other browser on iOS for the same selfish reasons. Apple continues to use abusive business tactics, and it's why they are being sued by the DOJ in an antitrust lawsuit. Them not implementing and not even suggesting changes to WebUSB and WebBluetooth are just further examples of it. https://www.justice.gov/archives/opa/media/1344546/dl?inline https://www.justice.gov/archives/opa/media/1344546/dl?inline >Because many USB devices are not designed to handle potentially-malicious interactions over the USB protocols and because those devices can have significant effects on the computer they're connected to So the alternative is installing questionable drivers from questionable websites that give an attacker full-access to the entire computer. This is far less good for security, and is unfortunately the norm right now. >we believe that the security risks of exposing USB devices to the Web are too broad to risk exposing users to them or to explain properly to end users to obtain meaningful informed consent. So is every other browser API that's currently implemented that requires explicit approval from a user. It's nonsense to single out WebUSB specifically. > It also poses risks that sites could use USB device identity or data stored on USB devices as tracking identifiers. Bullshit. You have to explicitly allow WebUSB to interact with any website that requests it. It does NOT allow arbitrary tracking, and this sentence proves that whatever Mozilla writes about it is disingenuous, trying to incite hysteria about an API.
afavour 6mo ago
Looks to be a great proof of concept. No, running a standalone executable alongside the browser is not the way you'd want to do WebUSB. But it's great to see someone working on it.
- Orygin 6mo ago
  Running directly in the browser is also not how I'd want to do USB.
  - afavour 6mo ago
    When the alternative is downloading arbitrary executables I find the browser sandbox to be a reassurance.
    - Orygin 6mo ago
      Except the sandbox is a huge target already, and breaking it means any website can now access and mess with your usb devices. If you can develop an exploit for Chrome's WebUSB system, you potentially have millions upon millions of targets available. Downloading an arbitrary executable can be made safe (via multiple avenues: trust, anti virus software, audits, artifact signing, reproducible builds, etc) and once the software is vetted, it exposes (or it should at least) little to no attack vector during daily use.
      - bastawhiz 6mo ago
        > trust, anti virus software, audits, artifact signing, reproducible builds, etc My mom has six weather apps on her phone.
    - michaelt 6mo ago
      Buddy if your "sandbox" lets code inside it replace your keyboard's firmware you don't have a sandbox.
      - sagarm 6mo ago
sva_ 6mo ago
I recently flashed GrapheneOS on a Pixel for a friend. I was very surprised that you can do this entire process from the browser using WebUSB - the only downside being that it required me to launch Chromium.
- infogulch 6mo ago
  You can flash GrapheneOS on a Pixel from another pixel, no pc required at all. I've done it several times, this is what sold me on the utility of WebUSB. You can use GOS' own distribution of chromium, Vanadium, if you have a GOS device and you want to avoid Chrome.
  - embedding-shape 6mo ago
    Is there something specific in that process that required WebUSB vs just normal USB? Sounds like phone makers could have done this since forever if they wanted to, what makes WebUSB particularly useful for this?
    - Retr0id 6mo ago
      Native android apps can talk to regular USB devices, if granted the necessary permissions. But it's exposed through a Java api (and Kotlin I suppose, these days), which is fine, but it means you need to write your client logic twice. If you target the web, you can do it once. (Yes, you could try to bulid some common interface, libusb-style, but I think you'll have a bad time with minor behavioural differences, especially around permissions. libusb itself does ostensibly support Android but there are several caveats: https://github.com/libusb/libusb/wiki/Android#does-libusb-support-android https://github.com/libusb/libusb/wiki/Android#does-libusb-su... )
      - Gander5739 6mo ago
        So you can't just use fastboot in termux, with https://github.com/nohajc/termux-adb https://github.com/nohajc/termux-adb, then?
shevy-java 6mo ago
Can't Mozilla hand over Firefox to another team?
dreknows 6mo ago
[dead]
Zopieux 6mo ago
And Web Serial reached mainline Firefox last week. I hope Mozilla can eventually stop playing their silly role in the security theater of “but what if our users are dumb” and actually deliver those "power-user" features that would allow me to uninstall Chrome for good. Oh, and also, --app= flag please.
- troupo 6mo ago
  > their silly role in the security theater of “but what if our users are dumb” It's not security theater. If you go to Chromium settings -> Site settings -> permissions, and expand "additional permissions", you will see a total of 26 different permissions, each gated by the same generic "you want to use this" popup. Permission popup fatigue is quite real, and not a security theater. And that's on top of the usual questions of implementation complexity etc.
  - strbean 6mo ago
    They should just add a "Security Console", with black background and green text, and a simple shell interface for enabling/disabling flags that gate whether these requests are automatically denied or create a permissions popup. Anything dangerous starts disable by default. Short of crippling capabilities to save dumb users, the best we can do is make the process scary enough that Grandma won't do it without calling her grandson first.
    - troupo 6mo ago
      Yup, I would agree to an about:config
- catfood 6mo ago
  >And Web Serial reached mainline Firefox last week. That's good news. I wish FF wasn't so conservative... they're missing a lot of cool APIs. Sometimes I wonder who they think their audience is. I suppose they would know better than I would.
  - 6mo ago
nezza-_- 6mo ago
WebUSB is so great. I can ship a cross-platform application that accesses a hardware device without having to deal with all the platform specifics, and with decent sandboxing of my driver. I think one way to make it more "secure" against unwitting users would be to only support WebUSB for devices that have a WebUSB descriptor - would allow "origin" checking.
- gear54rus 6mo ago
  Yep. FlipperZero, Android, now some random chinese handheld radio - just some of the things I didn't have to install some crap unsandboxed app to flash in the last 3 months. Absolutely revolutionary.
  - miladyincontrol 6mo ago
    This right here is the reason I like it and web bluetooth too, with them 'just working' regardless of platform I'm using. Miss me with some unsigned questionable app that only runs on windows as admin.
- scottbez1 6mo ago
  Yep, I’ve bought a few thermal printers recently and webusb support (marketed as Chromebook support) was a major deciding factor. Thermal printers aren’t well supported by built in printer drivers, so it’s nice to not have to install some questionable driver software with access to my whole computer and instead have a sandboxed chrome extension with enumerated permissions. I’ve also poked around the extensions’ minified js source out of curiosity and as a basic security audit It was also nice trying out some RTL-SDR apps as soon as I got it without having to figure out how to build and install the Debian packages from source first. It drives me nuts every time I have to switch from Firefox to Chrome to use webusb or webserial.
- lxgr 6mo ago
  Let's please not (or at most, add a scary warning for non-tagged devices), as this would break the use case for at least all retrocomputing.
npodbielski 6mo ago
Interesting. So I could use that to install Graphene OS?
- DANmode 6mo ago
  from a Graphene device!
chillfox 6mo ago
Well, this seems like a terrible idea. I really don't want websites to be able to access hardware. I am already uncomfortable with the webcam access.
- q3k 6mo ago
  Then don't select the device and don't press the 'allow' button when prompted.
- Brian_K_White 6mo ago
  Whether we like it or not, the distinction between an app and a web page has already eroded, and is, and only will be, eroding more. Even for local apps it's starting to become common to ship the app in an interpreted language where the interpreter is a browser instead of say python & qt.
  - traderj0e 6mo ago
    They're converging towards the middle, which is good, but it's not going to be the same thing. Apps use web tech for convenience and native APIs for things you can't do in web. You're expected to trust apps and extensions more than websites.
- deeringc 6mo ago
  I see this slightly differently. Before, if I wanted to be able to do something like flash firmware onto some device I would have to download some random C++ application and install and run it on my local machine. As well as having access to all of my USB devices, it also had access to everything else on my system's user context. I didn't have a way of running that code and only giving it access to a single USB device and nothing else. Now, I can avoid installing anything at all. I visit the project page and opt-in to some flashing flow that's running in a sandboxed env. When the app requests it, the browser asks me for permission and I get to choose exactly which USB device I want to give it access too. That's picking exactly the minimum "outside" access I want to give it, nothing more. It doesnt get to read/write other USB devices I didnt choose. I doesnt get to read/write to my filesystem. It doesnt get to call system APIs. It doesnt get to set itself to start at startup. It doesnt get to install an auto-updater. For me, this is a better security posture than installing random win32 apps.
Brian_K_White 6mo ago
People are starting to ship even local apps only in the form of some html & js that only works on Chrome because only Chrome has webusb. Whether we like the idea of the browser having access to usb or not, I at least like even less the idea of being forced to install and use Chrome for the same reasons as the bad old days of being forced to use IE.
- colechristensen 6mo ago
  I still want to reinvent the web with a hypertext document reader that doesn't include the kitchen sink. I suppose with LLMs these days this is actually an achievable prototype.
  - angra_mainyu 6mo ago
    nyxt? helium? midori? There are hundreds of browsers these days, you shouldn't have a hard time finding one that fits your needs.
    - hollerith 6mo ago
      No offense, but you don't get it.
      - goodmythical 6mo ago
        w3m, lynks, elinks? falkon? I'm not sure what you mean given that JS and CSS account for at least half of the kitchen sink. Hell, wasn't there someone that implemented an entire OS stack in CSS?
        colechristensen 6mo ago
        My point is a new standard, document format, and browser that doesn't have the capabilities which limits publishers to ... not what we have now. The existence of elinks which is marginally useful on the modern web doesn't make the cut nor do tools to un-shitify the existing web.
coupdejarnac 6mo ago
Having WebUSB and WebBle everywhere would allow me to ship my IoT application via web only. That would be a win for my productivity, no more messing about with app store shenanigans.
- aitchnyu 6mo ago
  Just heard of this. Still wondering if my fantasy CCTV DVR can serve a web app to my phone and stream the feed. Hard to google, use "Web Bluetooth API" instead of webble
  - coupdejarnac 6mo ago
    You probably don't need any Web hardware API for that, just WebRTC.
MisterTea 6mo ago
As much as I understand the ease of deployment this brings people, it puts a massive amount of code between the device and the user. Will webusb software written today work in 5, 10, 15 years? Personally, I think webusb is a giant contraption.
- charcircuit 6mo ago
  In 5, 10, and 15 years LLMs will make maintaining the massive amount of code trivial.
  - deleted 6mo ago
    [deleted]
  - ezst 6mo ago
    If history is a lesson (of going from lower level to higher level programming languages), the exact opposite will happen: there'll just be so much stuff out there that any eventual gain in efficiency will be dwarfed in the grand scheme of things.
  - MisterTea 6mo ago
    Please, lord, let this be sarcasm.
    - allthetime 6mo ago
      Look at the current state of YC. It’s not. This is the mindset now. Move fast, explicitly pile up mountains of technical debt with mindless code generation. The code generators of the future will fix it later.
jonhohle 6mo ago
So we can’t trust simple things like back-button hijacking, so let’s open up access to all attached hardware. Sounds stupid.
Devasta 6mo ago
I really don't understand the use case. Why would I want hardware that I own to be managed by a web app that could disappear?
suryajena 6mo ago
Will this work on Firefox Android? I recently wanted to try the printervention.app website to print from my phone over an OTG cable.
- RunningDroid 6mo ago
  Firefox on Android doesn't support Native Messaging‡, so no, this extension won't work ‡: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/runtime/sendNativeMessage#browser_compatibility https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...
ezst 6mo ago
I was rather hostile towards WebUSB/Bluetooth for ideological reasons, until I came across some cool apps like a climbing board control app (Bluetooth) or a netMD (to transfer to minidisks, via USB), which I would have found overkill to install a "hard App" for. I'm glad that there's an option for Firefox at last.
- QuantumNomad_ 6mo ago
  Same here, was skeptical at first but then I used a web app that supports WebUSB to configure my mechanical keyboard and it lets you flash the firmware right there from the browser and that’s pretty nice and convenient. https://www.zsa.io/flash https://www.zsa.io/flash Even before WebUSB, I was using ZSA Oryx to create my keyboard layout for my first ZSA keyboard. But back then I had to download the file and then flash it using a dedicated program on the computer. Now with WebUSB I could both create the layout for my new ZSA keyboard there, and flash it from there without any additional software other than a Chromium based desktop web browser.
  - crote 6mo ago
    The whole dance has been made significantly easier by the adoption of UF2 flashing by large parts of the custom keyboard hobby: the device temporarily pretends to be a USB storage device, so you can now download the file and drag&drop it to your device. Still not quite WebUSB-easy, but a massive improvement over needing dedicated programming software!
    - tredre3 6mo ago
      Firmware updates with UF2 over the emulated mass storage aren't bad, I agree. But config updates that way still suck. The best implementation I've seen will present you with an empty drive with a README explaining how to drop a uf2 + an editable config file that contains all options with comments. That's definitely workable for us tech people, but it absolutely sucks for the vast majority of users (including us tech people). Just think about having to learn the syntax, or simple things like picking a color or mapping keys on a keyboard. IMHO Mozilla should have at least adopted WebSerial. It wouldn't give the entire USB freedom, but it has fewer privacy and security concerns and devices would have make it work. But now it's too late, WebUSB has been adopted widely and Mozilla will eventually have to adopt it or perish.
sturbes 6mo ago
BBC Microbit kids hardware platform uses WebUSB. It’s a game changer for introducing hardware to students. Just works. Makecode.microbit.org is the web IDE. Reference URLs for the code make sharing and debugging easy.
prism56 6mo ago
I keep chrome installed just to flash my meshcore devices... I doubt i'll try this but it's a nice step, hopefully we can get something akin to native adoption.
jdalgetty 6mo ago
Does this work with Web MiniDisc Pro?
- SpecialistK 6mo ago
  I just did a quick test with a N920 on Windows (Zadig installed, WebUSB stub installed) and I get the popup from Firefox and see the N920 in the extension but WMDpro fails with "Transfer error" I'm pretty sure the lead dev is a Firefox user so he may be interested in getting this to work: https://github.com/asivery/webminidisc https://github.com/asivery/webminidisc
uyzstvqs 6mo ago
WebUSB has been used by projects like GrapheneOS, ESPHome, and Meshtastic. Google has used WebUSB to let users convert Stadia controllers to regular bluetooth input devices. Some manufacturers of keyboards use WebUSB for their configuration utilities. It's an incredibly useful API, and it's secure. You have to explicitly pick a device to give access to. Mozilla's attitude in refusing to natively implement it seems neither reasonable nor rational. Though that is unfortunately on-par with what I've come to expect from them over the past ten or so years.
- hulitu 6mo ago
  > It's an incredibly useful API, and it's secure. Citation needed. Web browsers, with their many CVEs, do not look like the pinnacle of security.
  - saagarjha 6mo ago
    Web browsers, with their many CVEs, are the pinnacle of security.
- ninkendo 6mo ago
  Honestly, an extension seems like the perfect solution for this. Wanting a website to access your USB stack directly (or Bluetooth, which has a similar standard) is such an extremely niche use case that it’s probably better for it to be available only as an opt-in extension. They can still standardize it, but… let me just not have it by default please. On iOS, there’s a “Bluetooth browser” app which is basically a simple WebView-based browser, but with the Bluetooth JS spec implemented so that you can use it to configure whatever Bluetooth device you have that wants to use a webapp for configuration. And you know what? That’s fine. It’s perfect, actually. A separate app I can use for the 0.0001% of the time I actually need to interact with some random IoT device’s Bluetooth configuration UI, and my normal web browser doesn’t need the bloat and increased attack surface. It just seems like good engineering to me to do it this way. More of the enormous bloated JS web API specs should be implemented as browser plugins. Let’s make the default footprint even smaller.
  - 6mo ago
nektro 6mo ago
is this satire? firefox does not implement it intentionally
bauratynov 6mo ago
WebUSB as an extension is the right approach. The security concern isn't the API itself — it's the default-on expectation that Chrome created. Firefox's model of "opt-in via extension" gives power users what they need without expanding the attack surface for everyone else. I've used WebUSB for flashing keyboard firmware and it's genuinely better than downloading random executables from GitHub. The permission model is more transparent than a native app that silently gets full USB access.
- vbezhenar 6mo ago
  The whole point of WebUSB is to create a tool that works with USB device, without all the risks and issues of installing external programs. If I need to install a program, browser extension, just to work with a given tool, I probably would just prefer an ordinary program without browser at all. Chrome approach is correct. It allows user to work with USB devices without exposing computer to the risks of installing a host software.
  - bjord 6mo ago
    ...in your opinion. the firefox team disagrees.
    - vbezhenar 6mo ago
      They already killed Firefox. It has 2% marketshare. Next to something called "Samsung Internet" LoL. They're not in position to force technology usage.
    - paradox460 6mo ago
      They'd much rather show me full screen ads for Disney movies, install extensions advertising TV shows, or try and get me to use pocket
      - bjord 6mo ago
        sorry, what are you talking about?
gmac 6mo ago
This is great. It makes https://printervention.app https://printervention.app (https://news.ycombinator.com/item?id=47677885 https://news.ycombinator.com/item?id=47677885) and the soon-to-be-released https://yes-we-scan.app https://yes-we-scan.app work on Firefox. It would be even greater if it were possible to avoid the two-step installation. It certainly used to be possible to ship a binary inside a Firefox extension (I did that here: https://mackerron.com/zot2bib/ https://mackerron.com/zot2bib/), but I guess they may have shut that capability down for security reasons?
drawliin 6mo ago
[dead]
m4rtink 6mo ago
MeshCore also uses WebBluetooth for some very useful stuff when working with MeshCore devices. :)

271 points by tuananh 6mo ago

No thanks. I'll accept it in my browser when they fix the security implications this raises, and when the Spec is no longer in draft.

gear54rus 6mo ago
And I'll just fire up a chrome instance which I specifically keep for when my daily driver firefox decides to spazz out and not implement basics in 2026 :'(
- lpcvoid 6mo ago
  How do you make sure that technically illiterate people don't just click away the requestDevice() popup? IMHO a browser offering device level USB access is a security nightmare and there is no way this can ever be made safe and convenient at the same time.
  - zb3 6mo ago
    They can click everything away, so maybe educate them or buy an ios device for your relatives instead of breaking computing for everyone else.
    - lpcvoid 6mo ago
      Fair, but remember that we are the <~1% of people who even know what webusb is. I'm not sure I share your view on this. Maybe an about:config switch to enable it would be enough to stop casuals from pwning their peripherals.
      - barnabee 6mo ago
        I’d be ok with an about:config switch, but given that many people will install anything, paste arbitrary text into terminals, and share their password/pin code with complete strangers for almost no reason, I think we need to stop making our tools less powerful in pursuit of an impossible goal.
    - Orygin 6mo ago
      > breaking computing for everyone else How is not implementing a Draft spec, which may compromise security badly, breaking computing? Overreacting much?
      - zb3 6mo ago
        This is not just an isolated incident, it's the whole trend of limiting capabilities in the name of security and that's what I was referring to. However in this particular case, even the security argument doesn't hold, either I: a) know that I want to use USB - in that case I'll switch browsers or download a native binary (even more unsafe), it's not that I'd decide that I no longer want to flash my smartphone b) I don't understand what's happening but I follow arbitrary instructions anyway - WebUSB changes nothing.
        skydhash 6mo ago
        So instead of using trusted vendors or requiring tools with auditable code, we just allow everyone to be able to access the user’s devices?
        CamperBob2 6mo ago
        What a concept. We could call it "Personal Computing."
        skydhash 6mo ago
        Not really that personal when every webpage is itching to put their hands on it.
        Orygin 6mo ago
        A native binary can be verified by anti malware systems, and once installed and working, poses no security risk. A 0day in a browser for the WebUSB system would allow any website to mess with arbitrary USB devices connected to your computer. While the browser sandbox is generally safe, it is also a huge target, and with a security risk like that, it wouldn't surprise me if it's a prime target for black hats.
    - troupo 6mo ago
      > They can click everything away, so maybe So maybe don't populate the browser with dozens of features requiring permission popups?
  - exe34 6mo ago
    You can ask them to type one of the following sentences: "I know what I'm doing, and giving a random website access to my USB host is the right thing to do." "I'm an idiot."
    - jayd16 6mo ago
      I love this because the idiots would type out that they know what they're doing and the pros would save time by typing "I'm an idiot."
      - exe34 6mo ago
        hah I did think of the second one, but the first didn't occur to me.
  - gear54rus 6mo ago
    You simply don't. This quest of saving idiots from themselves is not gaining anyone anything and meanwhile other people get more and more useless restrictions.
    - Orygin 6mo ago
      Or you can just not give a loaded shotgun to every browser user on the off chance they need to interact with 1 (one) usb device per year.
      - leptons 6mo ago
        Or you can just not use the web at all. If you're so scared of it, why are you using it with browsers that have implemented all kinds of APIs that probably already scare you? You may as well just use the Lynx browser if you really want want to put your money where your (security) mouth is. It doesn't do anything, not even display images or CSS or run Javascript.
  - limagnolia 6mo ago
    Isn't that the same excuse Gooogle is using to lrevent folks from installing what they want on Android phones?
    - baby_souffle 6mo ago
      Essentially, yeah.
    - skydhash 6mo ago
      I do not agree with Google on preventing apk installation. But unknown apk is a different risk profile than letting unknown entities to access local usb devices. The main issue in the former case is that google is posing itself as a gatekeeper instead of following a repo model like Debian or FreeBSD. That’s wanting control over people’s device. Allowing USB access is just asking to break the browser sandbox, by equating the browser with the operating system.
  - mvdtnz 6mo ago
    I'm tired of my computing being kneecapped in service of incompetent boomers. Enough is enough. If they're going to fall for dumb scams let them.
- yjftsjthsd-h 6mo ago
  Are you calling WebUSB a basic feature? Because I'm willing to discuss whether we should have it, but that seems like an exaggeration.
Retr0id 6mo ago
The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.
- skydhash 6mo ago
  That sounds like a Windows problem.
  - Retr0id 6mo ago
    I'm not familiar with the Windows platform but although you can have userspace USB drivers on linux, you still need to be able to run code that can talk to the sysfs interface.
  - Lerc 6mo ago
    The Linux problem is more Hope every time you want to interface with a USB device.
  - monegator 6mo ago
    Not really, as long as the firmware developers used OS 2.0 descriptors (For the rare occurences that our customer is using 7 or earlier, we tell them to use zadig and be done with it.)
- PunchyHamster 6mo ago
  You can have userspace drivers for usb devices in Linux
  - scottbez1 6mo ago
    How does the security of userspace drivers compare to having drivers within a sandboxed web environment with access to only the devices you’ve explicitly allowlisted?
    - bigfishrunning 6mo ago
zb3 6mo ago
What are the security implications this raises that downloading native programs (needed for example to flash my smartphone) doesn't raise?
- barnabee 6mo ago
  None. People will follow any instruction presented to them when they think it will get them something they want. Mozilla’s stance here is infuriating.
- troupo 6mo ago
  > What are the security implications this raises that downloading native programs (needed for example to flash my smartphone) doesn't raise? 1. Permission popups fatigue 2. Usually users select the apps they install, most sites are ephemeral. And yes, even with apps, especially on Android, people click through permission dialogs without looking because they are often too broad and confusing. With expected results such as exfiltrating user data.
  - oofdere 6mo ago
    > Permission popups fatigue Native apps also have this, and it's worse because they usually just ask for sweeping admin access on windows, unlike WebUSB which just brings up a device selection menu
    - troupo 6mo ago
      > Native apps also have this, and it's worse because they usually just ask for sweeping admin access on windows On iOS they only pop up the menu when they try to access the required functionality, and there's a limited number of things they can do. > unlike WebUSB which just brings up a device selection menu So the user has to contend with permissions on phones, in desktop OSes, but 26 more potential permissions [1] from a browser are fine because a) it's just a single permission window and b) the browser exists in total vacuum from all other user experiences. [1] Counted in Chrome settings -> Site settings -> permissions. Why Chrome? Because they are the ones pushing all the hardware APIs, among others
leptons 6mo ago
The spec is still in draft because Apple refuses to let it move forward - because WebUSB, WebBluetooth and other APIs would compete with their app store, where they can make money from purchases made through apps. They prioritize profits over progress. It has nothing to do with security, as WebUSB has no ability to interact with any device unless the user explicitly allows each and every website that requests access to do so. It's the same security as any other browser API that requests access.
- JimDabell 6mo ago
  > The spec is still in draft because Apple refuses to let it move forward This is untrue. Web standards need two independent implementations. Google can’t convince any other rendering engine besides their own to implement it. It doesn't take a single no from Apple to veto it; it takes a single yes from anybody outside of Blink to move it forward. Nobody is doing that. Here is what Mozilla have to say about WebUSB: > Because many USB devices are not designed to handle potentially-malicious interactions over the USB protocols and because those devices can have significant effects on the computer they're connected to, we believe that the security risks of exposing USB devices to the Web are too broad to risk exposing users to them or to explain properly to end users to obtain meaningful informed consent. It also poses risks that sites could use USB device identity or data stored on USB devices as tracking identifiers. — https://mozilla.github.io/standards-positions/#webusb https://mozilla.github.io/standards-positions/#webusb Until Google can convince anybody outside of Blink to implement it, it is not a standard it’s a Blink-only API.
  - leptons 6mo ago
    Apple has provided no alternative, and no suggestions for how to improve the draft. They are not helping advance the draft only for selfish reasons. They also won't allow any other browser on iOS for the same selfish reasons. Apple continues to use abusive business tactics, and it's why they are being sued by the DOJ in an antitrust lawsuit. Them not implementing and not even suggesting changes to WebUSB and WebBluetooth are just further examples of it. https://www.justice.gov/archives/opa/media/1344546/dl?inline https://www.justice.gov/archives/opa/media/1344546/dl?inline >Because many USB devices are not designed to handle potentially-malicious interactions over the USB protocols and because those devices can have significant effects on the computer they're connected to So the alternative is installing questionable drivers from questionable websites that give an attacker full-access to the entire computer. This is far less good for security, and is unfortunately the norm right now. >we believe that the security risks of exposing USB devices to the Web are too broad to risk exposing users to them or to explain properly to end users to obtain meaningful informed consent. So is every other browser API that's currently implemented that requires explicit approval from a user. It's nonsense to single out WebUSB specifically. > It also poses risks that sites could use USB device identity or data stored on USB devices as tracking identifiers. Bullshit. You have to explicitly allow WebUSB to interact with any website that requests it. It does NOT allow arbitrary tracking, and this sentence proves that whatever Mozilla writes about it is disingenuous, trying to incite hysteria about an API.

afavour 6mo ago

Looks to be a great proof of concept. No, running a standalone executable alongside the browser is not the way you'd want to do WebUSB. But it's great to see someone working on it.

Orygin 6mo ago
Running directly in the browser is also not how I'd want to do USB.
- afavour 6mo ago
  When the alternative is downloading arbitrary executables I find the browser sandbox to be a reassurance.
  - Orygin 6mo ago
    Except the sandbox is a huge target already, and breaking it means any website can now access and mess with your usb devices. If you can develop an exploit for Chrome's WebUSB system, you potentially have millions upon millions of targets available. Downloading an arbitrary executable can be made safe (via multiple avenues: trust, anti virus software, audits, artifact signing, reproducible builds, etc) and once the software is vetted, it exposes (or it should at least) little to no attack vector during daily use.
    - bastawhiz 6mo ago
      > trust, anti virus software, audits, artifact signing, reproducible builds, etc My mom has six weather apps on her phone.
  - michaelt 6mo ago
    Buddy if your "sandbox" lets code inside it replace your keyboard's firmware you don't have a sandbox.
    - sagarm 6mo ago

sva_ 6mo ago

I recently flashed GrapheneOS on a Pixel for a friend. I was very surprised that you can do this entire process from the browser using WebUSB - the only downside being that it required me to launch Chromium.

infogulch 6mo ago
You can flash GrapheneOS on a Pixel from another pixel, no pc required at all. I've done it several times, this is what sold me on the utility of WebUSB. You can use GOS' own distribution of chromium, Vanadium, if you have a GOS device and you want to avoid Chrome.
- embedding-shape 6mo ago
  Is there something specific in that process that required WebUSB vs just normal USB? Sounds like phone makers could have done this since forever if they wanted to, what makes WebUSB particularly useful for this?
  - Retr0id 6mo ago
    Native android apps can talk to regular USB devices, if granted the necessary permissions. But it's exposed through a Java api (and Kotlin I suppose, these days), which is fine, but it means you need to write your client logic twice. If you target the web, you can do it once. (Yes, you could try to bulid some common interface, libusb-style, but I think you'll have a bad time with minor behavioural differences, especially around permissions. libusb itself does ostensibly support Android but there are several caveats: https://github.com/libusb/libusb/wiki/Android#does-libusb-support-android https://github.com/libusb/libusb/wiki/Android#does-libusb-su... )
    - Gander5739 6mo ago
      So you can't just use fastboot in termux, with https://github.com/nohajc/termux-adb https://github.com/nohajc/termux-adb, then?

shevy-java 6mo ago

Can't Mozilla hand over Firefox to another team?

dreknows 6mo ago

[dead]

Zopieux 6mo ago

And Web Serial reached mainline Firefox last week. I hope Mozilla can eventually stop playing their silly role in the security theater of “but what if our users are dumb” and actually deliver those "power-user" features that would allow me to uninstall Chrome for good. Oh, and also, --app= flag please.

troupo 6mo ago
> their silly role in the security theater of “but what if our users are dumb” It's not security theater. If you go to Chromium settings -> Site settings -> permissions, and expand "additional permissions", you will see a total of 26 different permissions, each gated by the same generic "you want to use this" popup. Permission popup fatigue is quite real, and not a security theater. And that's on top of the usual questions of implementation complexity etc.
- strbean 6mo ago
  They should just add a "Security Console", with black background and green text, and a simple shell interface for enabling/disabling flags that gate whether these requests are automatically denied or create a permissions popup. Anything dangerous starts disable by default. Short of crippling capabilities to save dumb users, the best we can do is make the process scary enough that Grandma won't do it without calling her grandson first.
  - troupo 6mo ago
    Yup, I would agree to an about:config
catfood 6mo ago
>And Web Serial reached mainline Firefox last week. That's good news. I wish FF wasn't so conservative... they're missing a lot of cool APIs. Sometimes I wonder who they think their audience is. I suppose they would know better than I would.
- 6mo ago

nezza-_- 6mo ago

WebUSB is so great. I can ship a cross-platform application that accesses a hardware device without having to deal with all the platform specifics, and with decent sandboxing of my driver. I think one way to make it more "secure" against unwitting users would be to only support WebUSB for devices that have a WebUSB descriptor - would allow "origin" checking.

gear54rus 6mo ago
Yep. FlipperZero, Android, now some random chinese handheld radio - just some of the things I didn't have to install some crap unsandboxed app to flash in the last 3 months. Absolutely revolutionary.
- miladyincontrol 6mo ago
  This right here is the reason I like it and web bluetooth too, with them 'just working' regardless of platform I'm using. Miss me with some unsigned questionable app that only runs on windows as admin.
scottbez1 6mo ago
Yep, I’ve bought a few thermal printers recently and webusb support (marketed as Chromebook support) was a major deciding factor. Thermal printers aren’t well supported by built in printer drivers, so it’s nice to not have to install some questionable driver software with access to my whole computer and instead have a sandboxed chrome extension with enumerated permissions. I’ve also poked around the extensions’ minified js source out of curiosity and as a basic security audit It was also nice trying out some RTL-SDR apps as soon as I got it without having to figure out how to build and install the Debian packages from source first. It drives me nuts every time I have to switch from Firefox to Chrome to use webusb or webserial.
lxgr 6mo ago
Let's please not (or at most, add a scary warning for non-tagged devices), as this would break the use case for at least all retrocomputing.

npodbielski 6mo ago

Interesting. So I could use that to install Graphene OS?

DANmode 6mo ago
from a Graphene device!

chillfox 6mo ago

Well, this seems like a terrible idea. I really don't want websites to be able to access hardware. I am already uncomfortable with the webcam access.

q3k 6mo ago
Then don't select the device and don't press the 'allow' button when prompted.
Brian_K_White 6mo ago
Whether we like it or not, the distinction between an app and a web page has already eroded, and is, and only will be, eroding more. Even for local apps it's starting to become common to ship the app in an interpreted language where the interpreter is a browser instead of say python & qt.
- traderj0e 6mo ago
  They're converging towards the middle, which is good, but it's not going to be the same thing. Apps use web tech for convenience and native APIs for things you can't do in web. You're expected to trust apps and extensions more than websites.
deeringc 6mo ago
I see this slightly differently. Before, if I wanted to be able to do something like flash firmware onto some device I would have to download some random C++ application and install and run it on my local machine. As well as having access to all of my USB devices, it also had access to everything else on my system's user context. I didn't have a way of running that code and only giving it access to a single USB device and nothing else. Now, I can avoid installing anything at all. I visit the project page and opt-in to some flashing flow that's running in a sandboxed env. When the app requests it, the browser asks me for permission and I get to choose exactly which USB device I want to give it access too. That's picking exactly the minimum "outside" access I want to give it, nothing more. It doesnt get to read/write other USB devices I didnt choose. I doesnt get to read/write to my filesystem. It doesnt get to call system APIs. It doesnt get to set itself to start at startup. It doesnt get to install an auto-updater. For me, this is a better security posture than installing random win32 apps.

Brian_K_White 6mo ago

People are starting to ship even local apps only in the form of some html & js that only works on Chrome because only Chrome has webusb. Whether we like the idea of the browser having access to usb or not, I at least like even less the idea of being forced to install and use Chrome for the same reasons as the bad old days of being forced to use IE.

colechristensen 6mo ago
I still want to reinvent the web with a hypertext document reader that doesn't include the kitchen sink. I suppose with LLMs these days this is actually an achievable prototype.
- angra_mainyu 6mo ago
  nyxt? helium? midori? There are hundreds of browsers these days, you shouldn't have a hard time finding one that fits your needs.
  - hollerith 6mo ago
    No offense, but you don't get it.
    - goodmythical 6mo ago
      w3m, lynks, elinks? falkon? I'm not sure what you mean given that JS and CSS account for at least half of the kitchen sink. Hell, wasn't there someone that implemented an entire OS stack in CSS?
      - colechristensen 6mo ago
        My point is a new standard, document format, and browser that doesn't have the capabilities which limits publishers to ... not what we have now. The existence of elinks which is marginally useful on the modern web doesn't make the cut nor do tools to un-shitify the existing web.

coupdejarnac 6mo ago

Having WebUSB and WebBle everywhere would allow me to ship my IoT application via web only. That would be a win for my productivity, no more messing about with app store shenanigans.

aitchnyu 6mo ago
Just heard of this. Still wondering if my fantasy CCTV DVR can serve a web app to my phone and stream the feed. Hard to google, use "Web Bluetooth API" instead of webble
- coupdejarnac 6mo ago
  You probably don't need any Web hardware API for that, just WebRTC.

MisterTea 6mo ago

As much as I understand the ease of deployment this brings people, it puts a massive amount of code between the device and the user. Will webusb software written today work in 5, 10, 15 years? Personally, I think webusb is a giant contraption.

charcircuit 6mo ago
In 5, 10, and 15 years LLMs will make maintaining the massive amount of code trivial.
- deleted 6mo ago
  [deleted]
- ezst 6mo ago
  If history is a lesson (of going from lower level to higher level programming languages), the exact opposite will happen: there'll just be so much stuff out there that any eventual gain in efficiency will be dwarfed in the grand scheme of things.
- MisterTea 6mo ago
  Please, lord, let this be sarcasm.
  - allthetime 6mo ago
    Look at the current state of YC. It’s not. This is the mindset now. Move fast, explicitly pile up mountains of technical debt with mindless code generation. The code generators of the future will fix it later.

jonhohle 6mo ago

So we can’t trust simple things like back-button hijacking, so let’s open up access to all attached hardware. Sounds stupid.

Devasta 6mo ago

I really don't understand the use case. Why would I want hardware that I own to be managed by a web app that could disappear?

suryajena 6mo ago

Will this work on Firefox Android? I recently wanted to try the printervention.app website to print from my phone over an OTG cable.

RunningDroid 6mo ago
Firefox on Android doesn't support Native Messaging‡, so no, this extension won't work ‡: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/runtime/sendNativeMessage#browser_compatibility https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

ezst 6mo ago

I was rather hostile towards WebUSB/Bluetooth for ideological reasons, until I came across some cool apps like a climbing board control app (Bluetooth) or a netMD (to transfer to minidisks, via USB), which I would have found overkill to install a "hard App" for. I'm glad that there's an option for Firefox at last.

QuantumNomad_ 6mo ago
Same here, was skeptical at first but then I used a web app that supports WebUSB to configure my mechanical keyboard and it lets you flash the firmware right there from the browser and that’s pretty nice and convenient. https://www.zsa.io/flash https://www.zsa.io/flash Even before WebUSB, I was using ZSA Oryx to create my keyboard layout for my first ZSA keyboard. But back then I had to download the file and then flash it using a dedicated program on the computer. Now with WebUSB I could both create the layout for my new ZSA keyboard there, and flash it from there without any additional software other than a Chromium based desktop web browser.
- crote 6mo ago
  The whole dance has been made significantly easier by the adoption of UF2 flashing by large parts of the custom keyboard hobby: the device temporarily pretends to be a USB storage device, so you can now download the file and drag&drop it to your device. Still not quite WebUSB-easy, but a massive improvement over needing dedicated programming software!
  - tredre3 6mo ago
    Firmware updates with UF2 over the emulated mass storage aren't bad, I agree. But config updates that way still suck. The best implementation I've seen will present you with an empty drive with a README explaining how to drop a uf2 + an editable config file that contains all options with comments. That's definitely workable for us tech people, but it absolutely sucks for the vast majority of users (including us tech people). Just think about having to learn the syntax, or simple things like picking a color or mapping keys on a keyboard. IMHO Mozilla should have at least adopted WebSerial. It wouldn't give the entire USB freedom, but it has fewer privacy and security concerns and devices would have make it work. But now it's too late, WebUSB has been adopted widely and Mozilla will eventually have to adopt it or perish.

sturbes 6mo ago

BBC Microbit kids hardware platform uses WebUSB. It’s a game changer for introducing hardware to students. Just works. Makecode.microbit.org is the web IDE. Reference URLs for the code make sharing and debugging easy.

prism56 6mo ago

I keep chrome installed just to flash my meshcore devices... I doubt i'll try this but it's a nice step, hopefully we can get something akin to native adoption.

jdalgetty 6mo ago

Does this work with Web MiniDisc Pro?

SpecialistK 6mo ago
I just did a quick test with a N920 on Windows (Zadig installed, WebUSB stub installed) and I get the popup from Firefox and see the N920 in the extension but WMDpro fails with "Transfer error" I'm pretty sure the lead dev is a Firefox user so he may be interested in getting this to work: https://github.com/asivery/webminidisc https://github.com/asivery/webminidisc

uyzstvqs 6mo ago

WebUSB has been used by projects like GrapheneOS, ESPHome, and Meshtastic. Google has used WebUSB to let users convert Stadia controllers to regular bluetooth input devices. Some manufacturers of keyboards use WebUSB for their configuration utilities. It's an incredibly useful API, and it's secure. You have to explicitly pick a device to give access to. Mozilla's attitude in refusing to natively implement it seems neither reasonable nor rational. Though that is unfortunately on-par with what I've come to expect from them over the past ten or so years.

hulitu 6mo ago
> It's an incredibly useful API, and it's secure. Citation needed. Web browsers, with their many CVEs, do not look like the pinnacle of security.
- saagarjha 6mo ago
  Web browsers, with their many CVEs, are the pinnacle of security.
ninkendo 6mo ago
Honestly, an extension seems like the perfect solution for this. Wanting a website to access your USB stack directly (or Bluetooth, which has a similar standard) is such an extremely niche use case that it’s probably better for it to be available only as an opt-in extension. They can still standardize it, but… let me just not have it by default please. On iOS, there’s a “Bluetooth browser” app which is basically a simple WebView-based browser, but with the Bluetooth JS spec implemented so that you can use it to configure whatever Bluetooth device you have that wants to use a webapp for configuration. And you know what? That’s fine. It’s perfect, actually. A separate app I can use for the 0.0001% of the time I actually need to interact with some random IoT device’s Bluetooth configuration UI, and my normal web browser doesn’t need the bloat and increased attack surface. It just seems like good engineering to me to do it this way. More of the enormous bloated JS web API specs should be implemented as browser plugins. Let’s make the default footprint even smaller.
- 6mo ago

nektro 6mo ago

is this satire? firefox does not implement it intentionally

bauratynov 6mo ago

WebUSB as an extension is the right approach. The security concern isn't the API itself — it's the default-on expectation that Chrome created. Firefox's model of "opt-in via extension" gives power users what they need without expanding the attack surface for everyone else. I've used WebUSB for flashing keyboard firmware and it's genuinely better than downloading random executables from GitHub. The permission model is more transparent than a native app that silently gets full USB access.

vbezhenar 6mo ago
The whole point of WebUSB is to create a tool that works with USB device, without all the risks and issues of installing external programs. If I need to install a program, browser extension, just to work with a given tool, I probably would just prefer an ordinary program without browser at all. Chrome approach is correct. It allows user to work with USB devices without exposing computer to the risks of installing a host software.
- bjord 6mo ago
  ...in your opinion. the firefox team disagrees.
  - vbezhenar 6mo ago
    They already killed Firefox. It has 2% marketshare. Next to something called "Samsung Internet" LoL. They're not in position to force technology usage.
  - paradox460 6mo ago
    They'd much rather show me full screen ads for Disney movies, install extensions advertising TV shows, or try and get me to use pocket
    - bjord 6mo ago
      sorry, what are you talking about?

gmac 6mo ago

This is great. It makes https://printervention.app https://printervention.app (https://news.ycombinator.com/item?id=47677885 https://news.ycombinator.com/item?id=47677885) and the soon-to-be-released https://yes-we-scan.app https://yes-we-scan.app work on Firefox. It would be even greater if it were possible to avoid the two-step installation. It certainly used to be possible to ship a binary inside a Firefox extension (I did that here: https://mackerron.com/zot2bib/ https://mackerron.com/zot2bib/), but I guess they may have shut that capability down for security reasons?

drawliin 6mo ago

[dead]

m4rtink 6mo ago

MeshCore also uses WebBluetooth for some very useful stuff when working with MeshCore devices. :)