Mozilla Brings Web Serial Workflows to Firefox, Collaborates With Adafruit (mozilla.org) 43
The Web Serial API lets websites write to (and read from) serial devices using JavaScript, including USB and Bluetooth devices with virtual serial ports. And this week's Firefox 151 release introduced support for the Web Serial API on desktop.
"Most folks won't use this API," acknowledges Mozilla's blog, "but for our community of builders and tinkerers, it unlocks the ability to use Firefox to communicate directly with compatible hardware devices like microcontrollers, development boards, and other serial-connected devices..." With Firefox's browser engine, Gecko, now supporting Web Serial, users can now connect, code, configure, and control compatible hardware directly from the browser in many workflows, often without additional software or complicated setup...
As part of this week's launch, Adafruit, one of the internet's most beloved open-source hardware communities, is collaborating with us to test and validate what browser-based hardware development can look like in Firefox with Web Serial support... With Web Serial support in Firefox 151, Adafruit's browser-based hardware workflows now work directly in Firefox as well, with no additional software or complicated setup required for many projects. We invite you to give it a try...
We want the web to be open, flexible, and shaped by the diversity of people building on it. If you're wiring up your first board, experimenting with hardware projects, or dusting off an old electronics kit, give Adafruit and Web Serial in Firefox a try. Build something amazing. Make something useful. Tell us what works. Tell us what breaks. Most of all, make it your own.
Mozilla's "Hacks" blog demonstrates with an Adafruit ESP32-S2 based board "where messages sent from web code can be directly displayed on the device over Web Serial."
And Mozilla engineer Alex Franchuk even built a handheld device that changes a web page's CSS properties.
"Most folks won't use this API," acknowledges Mozilla's blog, "but for our community of builders and tinkerers, it unlocks the ability to use Firefox to communicate directly with compatible hardware devices like microcontrollers, development boards, and other serial-connected devices..." With Firefox's browser engine, Gecko, now supporting Web Serial, users can now connect, code, configure, and control compatible hardware directly from the browser in many workflows, often without additional software or complicated setup...
As part of this week's launch, Adafruit, one of the internet's most beloved open-source hardware communities, is collaborating with us to test and validate what browser-based hardware development can look like in Firefox with Web Serial support... With Web Serial support in Firefox 151, Adafruit's browser-based hardware workflows now work directly in Firefox as well, with no additional software or complicated setup required for many projects. We invite you to give it a try...
We want the web to be open, flexible, and shaped by the diversity of people building on it. If you're wiring up your first board, experimenting with hardware projects, or dusting off an old electronics kit, give Adafruit and Web Serial in Firefox a try. Build something amazing. Make something useful. Tell us what works. Tell us what breaks. Most of all, make it your own.
Mozilla's "Hacks" blog demonstrates with an Adafruit ESP32-S2 based board "where messages sent from web code can be directly displayed on the device over Web Serial."
And Mozilla engineer Alex Franchuk even built a handheld device that changes a web page's CSS properties.
This Is Great News (Score:5, Interesting)
Re: (Score:2)
All this time I've bee doing it wrong. Using minicom to browse the internet.
Re: (Score:2)
Re: (Score:2)
You're using lynx and you rely on a mouse?
Re: (Score:3)
Yes I'm happy to see this as well. It's funny to read the comments here on slashdot. It's readily apparent those who know what this API is for and those that don't! Indeed the Web Serial API makes it fast and easy for beginners to get into Arduino using the web-based Arduino cloud IDE, or even just to install Circuit Python or MicroPython to a microcontroller. Also good for interacting with and setting up IOT devices.
Re: (Score:2)
In my case I was using Chrome to run configurators for drones.
And what I was thinking is that it would be nice to have a web-based version of CHIRP.
Re: This Is Great News (Score:2)
100% same.
This is great. (Score:4, Insightful)
I do love it when malware advert javascripts can upload random new firmware updates into my mouse and keyboard turning them into stealth keyloggers. This is great.
This feels like when Flash sandbox breaks became a thing, but worse. At least in those days we got smooth fullscreen vector animations and games to enjoy. I'd rather Flash had just been bloody fixed instead of browsers themselves becoming Shit Flash But Holy Cow It Runs Worse And Gets Worse.
Re: (Score:1)
I do love it when malware advert javascripts can upload random new firmware updates into my mouse and keyboard turning them into stealth keyloggers. This is great.
so you're using a serial mouse in 2026 to browse porn? that's so "cool"!!
Re: (Score:3, Insightful)
All keyboards are serial. In fact, almost every keyboard ever is a giant parallel to serial convertor.
Re: (Score:2)
in that sense so is every display monitor, but nowadays we use things like hdmi or displayport. this api is about ports that everyday hardware (like e.g. mice and keyboards) hasn't used for decades, and is only used in very specific gadgets or virtualized in tinkering gear sold for people who likes tinkering.
telling you this just so you know that you can safely keep surfing malware ads with your mouse and keyboard, this nasty devil's api will not hurt you.
Re: (Score:2)
> this api is about ports that everyday hardware (like e.g. mice and keyboards) hasn't used for decades,
If by "decades" you mean to this very day. A serial port is not the physical connector. Your keyboard is almost certainly USB (no points for guessing what the "S" in "USB" stands for). It presents as a serial device at the hardware and OS level, like all USB devices do. If your OS puts it into a special category and doesn't explicitly label it as a serial device, that still doesn't mean it's not a ser
Re: (Score:2)
If by "decades" you mean to this very day.
what else :-?
A serial port is not the physical connector.
you're really splitting hairs, that's not what is meant. a serial port is very much the physical rs232 "connector" or an emulation of it. usb devices can ofc identify as serial devices and prompt the os to provide such emulation. so what?
That's *already* well within the realm of plausible exploits, even without the WebSerial API. This is just another surface to attack.
of course, which is why the browser asks the user for permission to acces all these devices! i do agree that 0.000001 more surface is technically "more surface", but this is splitting hairs, and doesn't help the claim I do love it when malware advert javascript
Re: (Score:2)
> you're really splitting hairs, that's not what is meant. a serial port is very much the physical rs232 "connector" or an emulation of it.
Key word "or an emulation of it." From the software point of view, all it's doing is sending and receiving bits at some baud rate. The physical hardware interface no longer matters. That's kind of the whole point of these things. Beyond the hardware interface, modern keyboard and mouse speak exactly the same protocol as they have since the PS/2 days. In fact USB keybo
Re: (Score:2)
They don't "identify as" serial devices. The are serial devices.
i don't see how this nitpicking is relevant.
which is why the browser asks the user for permission to acces all these devices
That's a strange way to admit you don't know how security vulnerabilities work. "There's no way someone could get in uninvited; there's a lock on the door!"
that's a disingenuous and dumb adhominem, really. locks exist for a reason. are they invulnerable? no. this is exactly how all security works in software and hardware: puting in locks, all sorts and layers of them. if you want absolute security just airgap your system, bury it in a bunker, hope it is deep enough underground and then for the best.
now, if you have valid criticism as to why you think that this api's implementration or design in particular are flawed
Re: This is great. (Score:3)
I've never had my keyboard or mouse show up as options when using web serial. It opens a bog and you have to select the specific device that you want to connect through. Then you still have to get all the connection options just like with a normal serial port. If you somehow manage to stumble through all of that and force your keyboard to talk to the website that you already trust, THEN they have to have a firmware hack for your specific keyboard model out of the millions of options. If you're that paranoid
Re: (Score:1)
WebSerial is about USB. As far as I know it doesn't even support any other kind of serial port.
Re: (Score:2)
All keyboards are serial. In fact, almost every keyboard ever is a giant parallel to serial convertor.
Every modern keyboard speaks USB, and while that has "serial" in the name, it's not the same as the "serial" interface which is being controlled by this functionality. I'm told many or most of them don't even have PS/2 support any more, but I wouldn't know because it's been decades since it mattered. The keyboard cannot speak USB serial to my PC, it can only speak USB keyboard, mouse, and joystick. Also, nobody can reflash my keyboard unless I plug it in while holding down a certain key.
Re: This is great. (Score:2)
It's called Universal SERIAL Bus, btw.
Re: (Score:3)
You'd get a popup to choose the port and grant permissions.
Have you ever flashed a Meshtastic or ESPHome device or updated firmware on a radio transceiver?
That's what they're talking about here.
Re: (Score:2)
Re: (Score:2)
How did this get modded insightful? Kameniko uses rs232 keyboards? Obviously they don't have any clue what web serial is used for.
Re: (Score:1)
You'd have to really be terrible to let it happen. First,
Sounds peachy (Score:2)
It had better be disabled by default.
Re: (Score:3)
Re: (Score:3)
At the very least it should probably be something that has to be enabled in settings. And maybe it does I haven't looked into it. There are too many examples of security vulnerabilities that can bypass permissions. That's what the grandparents is worried about
Years ago... (Score:3)
...a way to freeze Internet explorer was by inserting a < img src=lpt1: > tag in the html code.
Re: Years ago... (Score:1)
Or you could crash windows just by letting it run for a month. Errors were made. One must walk before they can run.
it's about firggin time (Score:3)
Does it support token certificates? (Score:2)
Because it's the first thing that comes to my mind: much easier support for client-side digital document signatures using token certificates (like thumbdrive or smartcard devices) plugged in the client machine.
This has been a pain in both my previous and current job. Both provided SaaS products that worked with digitally-signed XML files. But when the client opted for using tokens/smartcards, we had no other choice than make the client install a client-side software to do it locally and send it back to the
My first thought (Score:2)
was "uh-oh". I really hope I'm wrong but I don't want Chrome to gain access to my hardware. Nope. How to disable this thing? As far as making a device to change css, okay Adafruit is cool but did Chrome need to blow open a whole new manifold of attack surfaces for this otherwise fun project? (again hope I'm wrong but tldr so will wait for someone else to figure it out)
Re: My first thought (Score:2)
Just like chrome, you have to specifically enable it. And then select the device you want to access every single time you access it. You're fine. Nothing to see here unless it's a feature you actively already use.
Re: (Score:2)
Chrome has had web serial for at least five years. Not really sure what you're talking about with adafruit and css.
Moz innovation, just copy chrome from 5 years ago (Score:2)
Jaw on the floor how this makes it sound like some amazing new things from Mozilla and Adafruit. This was in Chrome over 5 years ago and has been use by countless projects along the way. Great to see it finally get in Firefox but, uh, how about "after objecting this provably useful API for years, we finally implemented it" as a more accurate summary.
Safer than the alternative (Score:2)
I could see this also being very useful for people wanting to flash embedded devices from cloud based software. But it could also be used to drive braille readers, point of sale terminals and anything else that works over serial.
Good riddance (Score:2)
This was one of the few things I still used Chrome for. Just hope there are not stupid restrictions like not being able to access the serial API from local files.
Not As Bad As It Sounds (Score:2)
Re: (Score:2)
The consumer stuff is generally all USB and the ship sailed a long time ago on the browser having access to that.
Browser access to virtual com ports is more an issue for things like industrial control. Somebody is defininitely going to make their SCADA system web based for the "easy updates" and find out.
Still, the ship sailed on that one a long time ago with Chrome too, and more generally a long, long time ago when Google convinced us all it's a great idea for your operating system to download software off