Only works in Google Chrome

[da2x]

Hi. The 90s called, and they want their "Only works in Netscape" error page back.

What about Windows 10 S where only Microsoft Edge browser is available? What about iOS with Safari only? or Nintendo Wii U or Xbox One. On these platforms you can’t install another browser. I personally prefer Firefox and have no intention of installing Chrome or another browser.

There should at least be a way to say “I understand that you guys don’t bother testing in other browsers, now let me proceed anyway.”

[Bard09]

This definitely needs to be addressed at some point soon. It's ridiculous to only support one modern browser in this day and age, especially if we expect clinics to be able to use Tidepool. A lot of hospital PCs are deliberately locked down and Chrome may not be able to be installed.

[stephencmorton]

I have a User Agent faker plugin on Firefox and app.tidepool.org works just fine for me. I'm curious what the specific technical reason is for saying that only Chrome is supported. It's not as if --from what I can tell-- the tidepool app is doing anything that cutting-edge, it's just displaying some simple graphs.

[thecosas]

I would be happy to regression test using safari on iPhone, iPad etc.

I’ve worked around it by using iCab and faking the user agent and so far no issues yet.

[steviator]

Absolutely pathetic and disgusting that THREE YEARS have passed and nothing has been done about this.

Completely unacceptable in the modern age to be forcing users onto data-harvesting surveillance tools disguised as browsers for something as sensitive as health data.

Shame on you for being so hateful towards users who often have little choice, what other corporate backdoors are there in your platform?

How much are these companies paying you to allow them surreptitiously harvest people's health data - or do you expect us to believe that there's some other reason that you just happen to only support browsers made by the worlds most prolific invaders of privacy?

[clintonium-119]

Thank you for sharing your concerns. We understand the frustration, and we want to be transparent about our situation.

As a small non-profit organization, we would genuinely love to support additional browsers. However, given the sensitive nature of health data, we maintain rigorous QA protocols to ensure the security and reliability of our platform. Expanding browser support would multiply our testing workload significantly, and with our current resources, this would directly reduce our capacity to serve our users and develop meaningful features.

Our decision is purely a matter of limited bandwidth - not any partnership or financial arrangement with browser vendors. We receive no compensation from any browser company, and we remain fully transparent about how we handle user data.

We have commented on some of the regulatory requirements we need to satisfy in a comment on this related thread.

The reality is that Tidepool Web is classified as a Class I Exempt Medical Device Data System (MDDS) by the FDA. This classification carries very specific QA / validation responsibilities that are meant to prevent incorrect patient diagnosis and/or treatment. Longer version here.

We hear you, and broader browser support remains something we'd like to achieve when our resources allow.

[steviator]

I'm sorry but I simply don't believe you.

Your claims of transparency are undermined by the fact that the tidepool site doesn't simply state what browsers are supported. Instead it forces the use of a supported browser, and not only that, takes steps beyond simply querying the browser's identification string and uses a fingerprinting probe to defeat attempts to use different browsers, these invasive fingerprinting probes go beyond identifying the browser and de-anonymize and permit tracking of individual users on the larger web outside of the usual "cookie" tracking mechanisms that are under user control.

Why would this be necessary to simply stop people from using untested browsers?

Why do you need to use such invasive methods of browser identification? This goes much further than simply protecting yourselves from liability when someone uses an untested browser

This is not some kind of conspiratorial delusion on my part, the behavior of the tidepool website is demonstrably slimy, and your excuses for blocking other browsers simply don't add up. A disclaimer explaining your supported browser would be enough to indemnify your organization, instead you're using an invasive tool that could very well be used for identifying and tracking users across websites to force the use of browsers with a track record of harming users privacy.

The fact that you keep making excuses that don't really add up, and that years have passed since you supposedly began work to allow other browsers makes me deeply suspicious that, charitably, at least some individuals within your organization are not being completely honest about the reasons for tracking users and strongly enforcing the use of only certain browsers that are known to leak information.

I feel that this is not being taken seriously, and goes far beyond a simple restriction of browser choice.

[clintonium-119]

I would encourage anyone following this thread to rest assured that my previous comment accurately reflects the reasoning behind our collective decision at Tidepool to only support Chrome.

There's not much more we can add at this point that hasn't been said. I don't expect anything I could say would change @steviator 's mind, but I would like to address a couple of insinuations in his last comment - mainly regarding use of "an invasive tool that could very well be used for identifying and tracking users across websites to force the use of browsers with a track record of harming users privacy".

I can't say for sure what he means by this, however given that the only browser checking we do involves plain javascript checking the native window.navigator object, without relying on any potentially-unsafe 3rd-party library, I don't feel that this is a reasonable assessment / indictment of how we are determining browser support.

For anyone interested, here is the code responsible for this check:

blip/app/core/utils.js

Lines 82 to 100 in 562fc16

	utils.isSupportedBrowser = () => {
	const userAgent = navigator.userAgent.toLowerCase();
	const isOpera = userAgent.indexOf('opr') > -1;
	const isBrave = userAgent.indexOf('brave') > -1;
	const isFirefox = userAgent.indexOf('firefox') > -1;
	const isFirefoxIOS = userAgent.indexOf('fxios') > -1;
	if (isOpera || isBrave || isFirefox || isFirefoxIOS) return false;
	const isEdgeIOS = userAgent.indexOf('edgios') > -1;
	const isChrome = userAgent.indexOf('chrome') > -1;
	const isChromeIOS = userAgent.indexOf('crios') > -1;
	const isSafariIOS = userAgent.indexOf('safari') > -1 && /iphone|ipad/.test(userAgent);
	if (isChrome || isChromeIOS || isEdgeIOS || isSafariIOS) return true;
	return false;
	};

We do take privacy and user safety seriously, and I've been completely transparent about our reasons for only supporting chromium-based browsers at this time. We will expand beyond chromium support when we are able to, but we don't have a set date for this.

I don't plan on continuing to engage back and forth on this issue here. If there is a different security/privacy concern you had in mind, @steviator, please open a new issue, and thoroughly explain the vulnerability within our codebase, and we'll be happy to investigate it.

[ryceg]

@clintonium-119 your user agent test is a heuristic which does nothing to actually safeguard the user against the problem of the Tidepool application requiring certain properties being available on the navigator object.

There's no reason to not simply test for the features which you require-

if ("hid" in navigator) {
  console.log("WebHID is supported!");
} else {
  console.log("WebHID is NOT supported.");
}

When Firefox and Safari eventually add support for those features, you don't have to do anything. This is a heuristic bandaid which doesn't shield users on old versions of Chrome (which I would wager represent a far greater slice of the userbase than Firefox users) from bad code.