Intent to ship: Add-On-Gated WebMIDI

[Bobby Holley]

In Firefox 108, we plan to enable the WebMIDI API along with an experimental mechanism for controlling access to dangerous capabilities.

Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1795025

Specification: https://www.w3.org/TR/webmidi/

Standards Body: W3C

Position Discussion: https://github.com/mozilla/standards-positions/issues/58

Platform Coverage: Desktop

Preference: dom.webmidi.enabled

Other browsers: Shipped in Chrome since version 43 [1], unsupported in Safari.

We prototyped WebMIDI in 2017, but never shipped it due to safety concerns. MIDI devices are not generally hardened against adversarial input, so WebMIDI is only safe if you trust the site. This is not how the Web ordinarily works, nor how we want it to work. Browsing should be casual and low-friction, which means it must be safe to visit a site whether or not that site is trustworthy [2].

The historical escape hatch from the casual Web is software installation. Users can waive the protections of the Web sandbox by installing native packages or browser extensions, which offer elevated capabilities but require trusting the source not to harm you. This matches the characteristics of WebMIDI, and indeed, users can already enable WebMIDI in Firefox by installing an add-on [3].

Site permission add-ons are an experimental mechanism in Firefox designed to eliminate the incidental friction of add-on-based polyfills while maintaining the essential friction of a high-trust installation experience. The add-on is automatically generated and offered to the user when the site requests MIDI access (and at least one MIDI device is connected), so the site doesn't need any special handling or instructions for Firefox users. The installation experience is similar to that of ordinary self-hosted add-ons, with slightly modified language and a dedicated "learn more" link [4]. The add-on only exposes capabilities to the site for which it was generated.

Please reach out to me directly with any questions.

Bobby

[1] Chrome automatically grants MIDI access to any site without user consent, though they have expressed an interest in changing this.

[2] https://www.mozilla.org/en-US/about/webvision/full/#safety

[3] https://addons.mozilla.org/en-US/firefox/addon/jazz-midi

[4] https://support.mozilla.org/en-US/kb/site-permission-addons