Mozilla's disagreement about those APIs is primarily about security, not privacy. For example, here on WebUSB: "Because many USB devices are not designed to handle potentially-malicious interactions over the USB protocols and because those devices can have significant effects on the computer they're connected to, we believe that the security risks of exposing USB devices to the Web are too broad to risk exposing users to them or to explain properly to end users to obtain meaningful informed consent. It also poses risks that sites could use USB device identity or data stored on USB devices as tracking identifiers."
Similarly, for Web Bluetooth: "This API provides access to the Generic Attribute Profile (GATT) of Bluetooth, which is not the lowest level of access that the specifications allow, but its generic nature makes it impossible to clearly evaluate. Like WebUSB there is significant uncertainty regarding how well prepared devices are to receive requests from arbitrary sites. The generic nature of the API means that this risk is difficult to manage. The Web Bluetooth CG has opted to only rely on user consent, which we believe is not sufficient protection. This proposal also uses a blocklist, which will require constant and active maintenance so that vulnerable devices aren't exploited. This model is unsustainable and presents a significant risk to users and their devices."
My read of the disagreement is it it's about a core design trade-off: how important is it that a browser can do anything that an app can do? I think it's very important (https://www.jefftk.com/p/we-need-browsers-as-platforms) and I'm frustrated that Mozilla no longer does.
(Disclosure: I work at Google, speaking only for myself)
I'm frustrated Google brushes aside any security and privacy concerns and just charges ahead and unleashes them onto the world. Mozilla may still think that browser-as-a-platform is important. However, they are clearly not willing to sacrifice security and privacy of users to achieve that goal.
The only reason is that Google wants to own the web stack (see Ars Technica article I'm alluding to: [1]), and no objections to what they propose, and do, will stop them. Honestly, I'm surprised they still ask other browser vendors for their positions (see, e.g. [2]), as they clearly couldn't care less.
- Apple has been removing many PWA apps from their App Store.
- For Google login and Play Store, Google often has new requirements, like adding more info about privacy to PWA website without replying to questions about more details with robot like answers.
Because of those increasingly more strict requirements and always changing APIs, it seems that in future web is the platform, and not mobile apps.
Similarly, for Web Bluetooth: "This API provides access to the Generic Attribute Profile (GATT) of Bluetooth, which is not the lowest level of access that the specifications allow, but its generic nature makes it impossible to clearly evaluate. Like WebUSB there is significant uncertainty regarding how well prepared devices are to receive requests from arbitrary sites. The generic nature of the API means that this risk is difficult to manage. The Web Bluetooth CG has opted to only rely on user consent, which we believe is not sufficient protection. This proposal also uses a blocklist, which will require constant and active maintenance so that vulnerable devices aren't exploited. This model is unsustainable and presents a significant risk to users and their devices."
My read of the disagreement is it it's about a core design trade-off: how important is it that a browser can do anything that an app can do? I think it's very important (https://www.jefftk.com/p/we-need-browsers-as-platforms) and I'm frustrated that Mozilla no longer does.
(Disclosure: I work at Google, speaking only for myself)