Is it possible you have an extension blocking scripts or redirects? I'm able to use Doordash just fine on Firefox.

At the risk of this being a tech support comment, I have definitely tried disabling all my extensions, but no luck. It might be some setting I have flipped on in Firefox, but in general I am about as paranoid about my privacy/security settings in both browsers.

The only two places I use Chrome are Netflix and Costco. Costco's behavior is just plain weird:

"Access Denied You don't have permission to access "http://www.costco.com/" on this server."

Is this from running NoScript? Or does it affect all Firefox users? (Also the URL is https://, not http://, so the error message doesn't match the URL).

I've used Costco's site plenty of times on Firefox. I just double-checked Windows right now, and I'm pretty sure I've used it on OSX/Firefox in the past.

I cleared my cookies in Firefox for everything Costco related, and it works now. Thanks for pointing out that it works. No clue how it got in that state.

Does Netflix not work in Firefox for you? Mozilla and Netflix have worked together a lot to make sure it does work.

Nope, I get Error Code F7701-1003. I have Wildvine enabled, and I tried completely disabling NoScript. It's easier to just use Chrome for that one thing than have to troubleshoot the problem.

I suppose that's true but it would be helpful for Mozilla if you filed a bug about it.

I think I figured out what it is. I turned off web assembly in Firefox to reduce my attack surface for general web browsing (I wish I could turn off Javascript completely, but that doesn't really work these days, so NoScript is as close as I can come). I think Netflix must be the only site I actually care about that won't work without WASM, so I'm fine relegating it to a separate browser with a higher exposed surface that I never use for untrusted sites.

OK, good to know.

Netflix has worked fine on Firefox on Mac, Windows and Linux for as long as I can remember.

Don't know if this is your issue, but it could be Enhanced Tracking Protection -- I have it turned up pretty high in Firefox and find that a lot of sites won't work until I turn it off. One example seems to be sites that use "Google Tag Manager."

Interesting, I blacklist googletagmanager.com in NoScript and have never had that break a single site.

Can't say about your bank, but I have used Doordash on Firefox regularly and never had any issues.

Not sure about U.S. Bank, but my brokerage, bank, and Doordash work great on FF. I'd try starting the browser in "safe mode"[0] to see if you have a setting or extension causing issues.

[0]: https://support.mozilla.org/en-US/kb/troubleshoot-firefox-is...

I use DoorDash with no issues on Firefox, with both uBlock Origin and NoScript running, some but not all stuff whitelisted in the latter.

I also have some "unusual" settings in about:config that I mostly don't even remember, for instance disabling service workers outright.

Why disable service workers?

They sound scary, I found the explanation as to what they actually are on Mozilla's site to be rather lacking, and I don't see any need to have them -- I've had them disabled for at least a year, and everything works fine.

The question becomes, why not disable them?

Service workers are used to cache a web app locally in order to make it load faster, and (if appropriate for the app) even run entirely offline. They also enable push notifications, though only after you explicitly allow them. You can read more about this under the umbrella term 'Progressive Web App' (PWA).

I am not aware of any attack vectors specifically related to service workers -- it's just normal JavaScript, but with more restrictions.

The impression I got was that it's JavaScript that can run even after I close the page, which sounds undesirable to me. I could be wrong about that, but like I said, I spent 5 or 10 minutes trying to understand Mozilla's page about it and ended up with more questions than answers.

Before I disabled them, I saw a ton of service workers registered from sites that I visited once and likely will never visit again, so even if there are no attack vectors, it seems like it's at the very least, "stuff that I don't need."

> cache a web app locally in order to make it load faster

Uh, isn't there already a browser cache for this?

> run entirely offline

No thanks.

> push notifications

No thanks. :)

Like I said I've had them disabled for a long time now and haven't had any issues, so at this point I'm not going to think about it again until and unless stuff I care about starts breaking.