HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
mozilla
standards-positions
HTML2019–2026
mozilla / standards-positions

standards-positions

Discover this repository through its Hacker News conversations.

119Distinct people
192Mentions
2Explicit recommenders
764GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

A public description has not been verified.

Where it is used

No documented product use was verified in the last source check.

What people are saying

I love firefox except for a fairly recent feature adopted by chrome, which is the ability to update usb device firmware through a web browser via the Web Serial API. I do a lot…

cronix used a recommendation phrase. 2 indexed comments match. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 6:59:22 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year192 dated mentions

Observed mentions: 2019-03-13 13:55:54 UTC to 2026-10-18 02:52:23 UTC.

0102030402019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 11 mentions; 0 submissions, 11 comments20192020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 12 mentions; 0 submissions, 12 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 30 mentions; 3 submissions, 27 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 15 mentions; 1 submissions, 14 comments20222023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 39 mentions; 6 submissions, 33 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 30 mentions; 3 submissions, 27 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 29 mentions; 0 submissions, 29 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 26 mentions; 1 submissions, 25 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC11011
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC12012
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC30327
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC15114
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC39633
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC30327
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC29029
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC26125

From the project README

An excerpt from the repository, fetched Nov 13, 2026.

Read the project’s introduction
Mozilla's Positions on Emerging Web Specifications See the dashboard for Mozilla's current positions. What is this Repository? This repo is where Mozilla decides and documents what it thinks about emerging technical specifications for the Web. Typically they're draft documents in the IETF, W3C (including the WICG), WHATWG, and Ecma TC39, but they could come from elsewhere too. Having a clear Mozilla position on these specifications helps us align our thinking and communicate it clearly to these standards bodies, as well as other browsers. Implementation status (or even intention) isn't tracked here; see dev-platform. Possible Specification Positions We will seek to apply one of three labels to new specifications: positive - Mozilla regards this work as a potential improvement to the web. neutral - Mozilla is not convinced of the merits of this work, but does not see any significant negative potential. negative - Mozilla believes that pursuing this work in its current form would not be good for the web. These positions will be based on our best assessment of the current state of the specification and the potential for it to benefit our users and the web as a whole. We consider the intended purpose and the design fundamentals of each specification. Incomplete documentation, minor issues, or lack of interoperability testing are not reasons for a negative position, provided that intent is clear. We might also use the following labels for specifications where we have not formed a position: defer - Mozilla takes no position on this work. under consideration - Mozilla has not taken a position on this work and is gathering more information. What about Firefox? A position here does not address whether Mozilla will commit resources to developing a specification. In particular, taking a position does not commit Mozilla to implementing a specification in Firefox. Requesting a Position See our contribution guidelines for information about how you can participate. Building locally See DEVELOP.md.
Read the full README on GitHub

What Hacker News says

15 sources
> Say something connected to reality. Easy. I even gave links to show how modern web "standards" work. To quote myself: "Is this true for 100% of things that Chrome is shipping? No. But it's so asymptotically close that the difference doesn't matter. They ship 40 to 70 new web APIs in each version. That is, 40 to 70 new Web APIs every month. Over 500 new APIs a year. How many do you imagine they even pretend to be a standard?" All this with response to literally what has been happening for the past several years: Chrome ships its own non-standards (even if it spits out a spec doesn't make it a standard), developers start using them, due to Chrome dominance its now a de facto standard. To think otherwise is to be completely oblivious to what's happening in web standards. Edit. As to "then someone writes a standard". This also happens. See
Read the rest
Web HID timeline: https://github.com/mozilla/standards-positions/issues/459#is... Same happened to WebRTC, by the way. Stable spec version was finally complete in 2018, 7 years after Chrome spat it out and called it a standard. And so on and so on.
In Web apps could de-monopolize mobile devices
> A quick search show plenty of articles talking about the limitations of webapps on iOS. Again: "PWAs" are a dozen different standards (or perhaps more). And everyone selects a different subset of them to call "the one true PWA". For example, some may say that "omg I need direct access to Bluetooth or other hardware APIs". Well, those are Chrome-only non-standards that neither Firefox nor Safari will implement. There are some like push notifications which are debatable (but arriving in Safari this year). And then there's background sync that Chrome enabled by default in 2016, and which still had issues in 2019 that both Firefox and Safari objected to: https://github.com/mozilla/standards-positions/issues/214 No idea what their position on it is now. And so on and so forth. But these articles and half of HN will scream until they are blue
Read the rest
in the face claiming that "it's Safari that's holding the PWAs back". Where reality is more complex and the narrative is mostly driven by Chrome, unfortunately.
In Wasmer takes WebAssembly libraries mainstream with WAI
Mozilla's engineers are enthusiastic about JPEG XL, but their directors less so. Mozilla's director a year ago: "I'm locking this conversation as it has passed the new information stage." This is not a great position, as loads of new information about human rater studies has been obtained, the codecs have advanced further significantly, the ecosystems are developing, industry is developing their stance, and even new objective metrics to evaluate codecs have been developed. I'd like to highlight two things there: My arguments for JPEG XL: https://github.com/mozilla/standards-positions/issues/522#is... -- it comes with links to 3rd party evidence of the somewhat outrageous but correct claims. Jon's arguments for JPEG XL: https://github.com/mozilla/standards-positions/issues/522#is...
In The case for JPEG XL
Frankly, the official justification[1] for the deprecation is ridiculous. > There is not enough interest from the entire ecosystem to continue experimenting with JPEG XL In the very same ticket that comment was made, the companies such as Adobe, Facebook, The Guardian and Shopify voiced their support for the format. In fact, Adobe has just added support for JPEG XL to Camera Raw[2]. Also, Cloudflare[3] and Flickr[4] endorsed JXL in Mozilla's bugtrackers. Plenty of open-source projects have implemented support for JXL images. For example: ExifTool[5], FFmpeg[6], GIMP[7], ImageMagick[8], Krita[9]. Is this really "not enough interest"? > The new image format does not bring sufficient incremental benefits over existing formats to warrant enabling it by default The ability to losslessly recompress already exisiting JPEG images is the killer fe
Read the rest
ature of JPEG XL. It allows seamless transition to the new format by converting old images. AVIF can't do that. To be honest, their explanations feel like post-hoc rationalizations. It seems Google invested too much into an inferior format (AVIF) and now because of the sunk cost fallacy they can't pivot to JPEG XL. [1] - https://bugs.chromium.org/p/chromium/issues/detail?id=117805... [2] - https://helpx.adobe.com/camera-raw/using/hdr-output.html [3] - https://github.com/mozilla/standards-positions/issues/522#is... [4] - https://bugzilla.mozilla.org/show_bug.cgi?id=1539075#c23 [5] - https://github.com/exiftool/exiftool/blob/master/Changes#L44... [6] - https://git.videolan.org/?p=ffmpeg.git;a=commit;h=0008c15956... [7] - https://www.gimp.org/news/2021/10/20/gimp-2-99-8-released/#i... [8] - https://imagemagick.org/script/formats.php [9] - https://docs.krita.org/en/general_concepts/file_formats/file...
In Google set to deprecate JPEG XL support in Chrome 110
As it stands today, the spec has issues when considering other pre-existing options and future compatibility. For example, there is no way to get the URL if the protocol is `file://`. For a real world example: https://github.com/mozilla/standards-positions/issues/194#is... See the stack overflow issue: https://stackoverflow.com/questions/67039633/get-the-text-fr... (See also the currently "conflicting" library for URL fragment queries: https://github.com/Cyphrme/URLFormJS) I think it can be easily fixed, using solutions like a delimiter, but that discussion probably needs to be apart of a wider discussion concerning URL extensibility.
In Deviations from Chromium (features we disable or remove)
> If there are examples of 'Apple ignoring standards' actually meaning Chrome-only features please tell me one. Easy. The most obvious/glaring one is WebHID. Enjoy the timeline: https://github.com/mozilla/standards-positions/issues/459 It's not just HID, of course. All/most of the hardware APIs are considered harmful by both Safari and Mozilla. Chrome is shipping them enabled by default, and there's no end to clueless developers moaning about this and calling Safari (mostly) and Firefox (from time to time) too slow in "moving the web forward". Needless to say that all those non-standards are pushed forward by Chrome. The less obvious one is Constructable Stylesheets. The spec had an obvious flaw that could lead to easily reproducible deadlocks. And that is on top with other issues with design, API naming etc. A team within Google (lit-htm
Read the rest
l) wanted this feature, so Chrome shipped it against clear objections from both Safari and Firefox. And then refused to move the feature back under a flag because "0.8% of page views in Chrome" were suddenly using this feature. And proceded to gaslight other browsers' developers https://github.com/WICG/construct-stylesheets/issues/45. See e.g. a response to that https://github.com/WICG/construct-stylesheets/issues/45#issu... Of course there's now a "looking ahead" that wants to do exactly what Safari and Mozilla wanted to do in the first place: https://web.dev/constructable-stylesheets/#looking-ahead In general, Chrome pushes 40 to over 100 new Web APIs with each release (that is, every two months). How many of them are actual standards that had actual input from other browser developers? In how many Chrome actually listened and implemented suggestions? https://web-confluence.appspot.com/#!/confluence
In Apple is not defending browser engine choice
> Says the only person in this thread slinging vile insults left and right Maybe? We're both pretty hot here, perhaps; I can ignore that jive. The difference is, I am swinging for progressiveness & growth & possibility. Yes I am anti a lot of what I see. I'm huge anti. I'm anti-fascist, I'm anti-top-down-control, I'm anti-conservative-mindsets, because these things threaten diversity, progress, possibility, & growth. The whole purpose & nature of tech is to enable possibility, to beget enhanceability, & rejecting that is folly. There are many enemies about to letting people do things with computers, alas. (Plenty just need a little more help, some deserve vitriol.) > 2. I even gave you a link showing how patently false your statements about Google being careful with specs are That's what I was replying to. Let's sidestep your overreaction
Read the rest
there-in & ignoring a vast swarth of evidence about process you just straight up ignored (both times) in that thread, & talk about the spec. Yes, Mozilla team/present-leader Martin is far far far less willing to entertain any possible "risk," here & more at length in WebUSB[1]. Fear that devices might not want to be accessible, to me, reads more like propaganda against the Hacker spirit & creativity, bends to the corporation owning our devices & not us. We do need to shield users, but shielding users absolutely from any possibility, to save them from a couple possibly risky possibilities, is a damned & infernal decision. Alas Mozilla/Martin not only make a harsh & greatly constraining decision readily, they make this decision lightly & without any interest in remedy, show no interest in exploring possibility. Martin's complaint in WebUSB seems to revolve entirely around imagining that it'll be hard to update a blocklist to access usb-bluetooth (and potentially other high security devices) devices: > This proposal also uses a blocklist, which will require constant and active maintenance so that vulnerable devices aren't exploited. This model is unsustainable and presents a significant risk to users and their devices For one, I'm not even sure why we'd want to block access to bluetooth devices. If a user wants to go to a webpage that tries to act like a bluetooth sniffer (or something far more prosaic), & give the page permission to use their bluetooth devices, I don't think that's unreasonable or should be prohibited. But let's grant that mid-level bluetooth interfacing is just too much freedom to handle. There's still nearly zero evidence this blocklist has been hard to maintain. Google has required scant updates. The concerns Martin projects haven't panned out yet: vanishingly few cases of abuse, and the blocklist has required nearly no tending to. Even though the most popular browser on the planet has shipped this feature for half a decade now. As a recent-ish comment says: > The discussion here seems to mostly be around vague concerns that have not been proven to be problematic [in the half-decade since it got shipped]. I find the Mozilla positions here to be immoral & indefensible, especially as they stand without any suggestion of remedy. Denial of possibility, without suggestion or willingness to progress, is an anethema, & Mozilla has been unwilling to demonstrate any buy in, hasn't shown any interest in helping progress things. Their pretenses of security-mindedness are damaging & detrimental, & out of touch, inflexible, and haven't changed across half-a-decade of evidence stacked against them. Denying WebUSB & WebHID is a tragedy, firewalls off the web from essential & basic computing that it ought be able to involve itself with, & that is used to enormously good effect, such as the schoolchildren's ability to work with their BBC:MicroBit[2] with whatever computer they have about. I'm sorry it's like this- I wish there were healthier engagement on all sides- but the harsh descriptions I keep using are deserved. Mozilla and Safari seem to have "ganged" up, & have a campaign "marching" against growing the web. I'm not sure where to go find the links, but like ~2 years ago there was a big series of blog posts by Apple and Mozilla proudly advertising that they were rejecting many features like Battery sensors, Ambient Light sensors... I get that a lot of people don't think this stuff is valuable, that it's trendy to want a minimalist web. But this conservative software ideology[3] isn't about helping people. It's about jumping on a bandwagon, about being vile and nasty. There's no evidence these company's are interested or willing to talk about what we could to offer elevated capabilities, to make maybe PWA's for example get access to these capabilities. It's a party of haters (and astroturfed covert App-Store interests). Yes, I do keep being a bit strong in my accusations, because these people are doing bad, & uncompromisingly so. [1] https://github.com/mozilla/standards-positions/pull/368/file... [2] https://microbit.org/get-started/user-guide/web-usb/ [3] https://gist.github.com/cornchz/3313150
In What’s new in Safari and WebKit
> Chrome has an incredibly responsible practice, of reporting well ahead of time their "Intent to Experiment" & "Intent to Prototype". Ah yes. "Responsible". Here's a prime example of responsibility: https://github.com/mozilla/standards-positions/issues/459 > Chrome wants & believes in an alive standards making process, in advancing, carefully, cautiously. Ah yes. Carefully and cautiously as in: shipping 400 new Web APIs a year with very little to no discussion and dismissing most concerns from other browser implementors. The rest of your comment is your regular madman rant with zero substance (because you know nothing of substance on this topic)
In What’s new in Safari and WebKit
> As long as AP cryptographically signs the outcome of the game (as they do for all HTTPS served content) I looked into this use case before and came to the conclusion that it can't work because TLS is not non-repudiable. Once the initial public-key handshake is finished, the rest of the session uses a symmetric cipher. Because anyone with the symmetric cipher's key can encrypt their own data with it, you could encrypt your own spoofed response from the server in any transcript of the session. https://crypto.stackexchange.com/questions/29751/are-https-w... One solution to this is to use the site's public key to sign a Web Bundle instead of using TLS: https://web.dev/web-bundles/ https://wicg.github.io/webpackage/draft-yasskin-http-origin-... Web bundles can be served from any origin (and I'd imagine can be verified by oracles) as the data
Read the rest
itself is signed. However, this requires the server to use web bundles in the first place, which likely isn't happening any time soon. Mozilla considers the proposal harmful: they expect Google will serve the majority of web bundles, allowing them to see what sites the user is visiting. https://github.com/mozilla/standards-positions/issues/264 https://www.ghacks.net/2020/08/30/google-proposed-web-bundle...
In $34M permanently locked into AkuDreams contract forever due to bad code
<portal> is an experiment/pet project pushed (and only implemented!) by one browser vendor, which as far as I know remains feature flagged. It was shipped behind a flag with an initial implementation vulnerable to a same origin policy bypass as well as local file disclosure. As far as I can tell the only reason it wasn't assigned a Moz standards position of "harmful" is because Google argued "it's actually still a work in progress!" (three years ago). Refs: - https://research.securitum.com/security-analysis-of-portal-e... - https://github.com/mozilla/standards-positions/issues/157
In Twitter is using its embedded JavaScript to hide tweets that have been deleted
I was responding to WebUSB, and tacked a few other hardware APIs there. Both Firefox and Safari view them as harmful in their current form. They are not really on a standards track for now, they are "Draft Community Reports" or somesuch. For something to become a standard that something needs two independent implementations. Before that it's just some browser's prototyping stage, no matter how many times Chrome will tell you otherwise. According to chromestatus, WebMIDI now has positive position from Mozilla and negative position from Safari: https://chromestatus.com/feature/4923613069180928 Just three years ago Firefox's position was also largely negative due to unresolved security issues: https://github.com/mozilla/standards-positions/issues/58 It's possible those issues are now resolved, that's why it's making its way into Firefox. Thi
Read the rest
s means that Safari's stance may also change. Same goes for other hardware APIs: from the point of view of both Safari and Firefox those specs have security and privacy holes the size of Jupiter. Not to mention that the quality of some of these so-called specs is very low. If/When these issues are resolved, we may see them implemented in these browsers, too.
In New WebKit features in Safari 15.4
Someone linked "Request for position" on these APIs: https://github.com/mozilla/standards-positions/issues/519#is... Here's Mozilla's response: --- start quote --- 4x4 transforms: There are a bunch of implementation concerns here (and mentioned on that issue) with regards to availability on various native 2d backends... Needs more investigation SVG filter interface: We would really rather people use WebGL if you want fast/efficient filters. (I made a number of comments on that issue) As is, we're generally against this one for the time being --- end quote --- There's literally zero response on that from @mysteryDate who is now gaslighting Safari in the comment above, and presenting these API additions as fait accompli. Honestly, at this point any time I see any public Chrome person write anything I immediately assume it's a distortion of
Read the rest
reality at best and a blatant lie at worst. And this is always the case. But sure. "Safari is the bad guy".
In It's always been you, Canvas2D
> We're happy to target anti-competitive behaviour from any operating system or browser if it relates to the open-web. Currently our main focus is user's browser choice It means you're not really focusing on the open web. You have a very specific, very narrow beef that you're pursuing. And it's parroting Chrome's propaganda basically word-for-word both on the website and here in the comments. > they have to be well understood and documented. If you're willing to type this up in detail... In Discord, right? You could start by actually looking around and figuring out these things yourself, too. Not just repeating Google's talking points. Good starting point: https://www.quirksmode.org/blog/archives/2021/08/breaking_th... Or maybe look at the status of the APIs you so ardently defend. Example, WebHID timeline: https://github.com/mozilla/stan
Read the rest
dards-positions/issues/459#is... etc. > It's also really important to be specific as to why the behaviour is harmful to end consumers. We also need to order the issues in terms of priority and how damaging they are to the wider ecosystem. You've already stated your priorities loud and clear > and respecting a user's browser choice via Android or Google apps. Yup, it's s good one. Since Google doesn't respect that and ignores all/most input on the non-standards it's pushing out at neck-breaking speed, you can see where it's going if you "allow browser choice on iOS"
In Open Web Advocacy

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.