The Native File System API allows web apps to save directly to files • Hacker News Board

Re: The Native File System API allows web apps to save directly to files

#61

Post by chromedev » Wed, Sep 09, 2020, 5:46 AM UTC

or-gate wrote: post #50

sayhello wrote: post #46

Earlier quoted context omitted.

We made sure that the activation of the API is gated by: 1) User Activation checks 2) When access to the file system is requested, a File Picker is necessary 3) When the API is in use, there are plenty of indication that it's being used We put a lot of thought in Privacy and Security, as we do for all APIs.

> We put a lot of thought in Privacy and Security, as we do for all APIs. but somehow, data is heavily harvested thru browsers(chrome), apps(android). Do you even test your APIs with a sample audience, like real tech ignorant people and see how they are blind to all those and just click yes, and don't care?

Data is easily harvested in Firefox and Safari too

Re: The Native File System API allows web apps to save directly to files

#62

Post by cromwellian » Wed, Sep 09, 2020, 5:55 AM UTC

ssss11 wrote: post #28

chromedev wrote: post #4

Finally, we can have a local markdown editor with live preview. I just hope it can read files and folders in a particular directory as well, with permission of course.

Sounds like the plan is to make Chrome the OS. Native apps already do things like that.

Native apps are really poor at collaboration and composition. School districts around the world are effortlessly doing distance learning by giving parents and kids URLs, which open Web based editors, science experiments, music and art 'web apps', etc all at one click, without worry about whether the kids own iPhones or Android, or desktops, and whether or not they can install it, or have it installed.

Any solution that requires you to write a multipage doc for parents and kids, to go follow two different sets of rules depending on devices and install 2 dozen apps, just so they can take class at home, is a non-starter for school districts.

A link is all you need with the Web for most things. No install. No uninstall. No worry about OS.

Ever since the fanboyism between mobile platforms started, people have started worshipping at the church of the native app, which is say, before the Web once broke us away finally from Windows, and now we're back asking people to install heavyweight native apps for things like "Order a Burger" or "Pay a Parking Meter"

Re: The Native File System API allows web apps to save directly to files

#63

Post by pskinner » Wed, Sep 09, 2020, 5:59 AM UTC

Reminds me of the old ActiveX days - I wrote a whole WYSIWYG website editor using the ActiveX component that let you read/write files.

I mean that was fun for a young budding developer, but I can see the major security issues with this. I really hope this has been thought through.

I can imagine this being another one of those popups that constantly appear on websites - are certain files protected like your hosts file or does it rely upon the access level of the user running the browser?

Re: The Native File System API allows web apps to save directly to files

#64

Post by CGamesPlay » Wed, Sep 09, 2020, 6:00 AM UTC

I read over the document and the security considerations don't seem super clear. If I find an XSS on Cloud 9 or some other web-based IDE that users are likely to grant directory permissions to, I can ransomware every file in that directory without requiring extra permissions?

In other words, granting this permission is effectively the same level of severity as downloading and running an app.

Am I missing some extra consideration here?

Re: The Native File System API allows web apps to save directly to files

#65

Post by rasz » Wed, Sep 09, 2020, 6:04 AM UTC

sriku wrote: post #49

sayhello wrote: post #46

Earlier quoted context omitted.

We made sure that the activation of the API is gated by: 1) User Activation checks 2) When access to the file system is requested, a File Picker is necessary 3) When the API is in use, there are plenty of indication that it's being used We put a lot of thought in Privacy and Security, as we do for all APIs.

If I disable the file system API, can an "is file system API available" check be used as a bit to fingerprint my browser?

Sure, currently you can fingerprint checking available free Storage API space for example.

Re: The Native File System API allows web apps to save directly to files

#66

Post by pjmlp » Wed, Sep 09, 2020, 6:09 AM UTC

nuker wrote: post #8

jaredcwhite wrote: post #7

There is no way this isn't going to open up massive security holes. Even if the browser puts up alert after alert, people are just going to randomly click buttons and then all of a sudden wonder why some random web app is deleting all their files and adding malware. And the spec docs aren't exactly reassuring. This is an exact quote! "This API could be used by websites to try to store and/or execute malware on the us…

It won't work on iPhones, which means no one will use it, I hope.

In plenty of countries iPhone has 0% market share, the local companies don't care about iPhone support.

Re: The Native File System API allows web apps to save directly to files

#67

Post by saagarjha » Wed, Sep 09, 2020, 6:11 AM UTC

inetknght wrote: post #52

armada651 wrote: post #41

Earlier quoted context omitted.

It's important not to forget about drive-by DLL injection when making the "execution is the problem" argument. Lots of executables on Windows link to DLLs that are not protected by the "KnownDLLs" protection. This means that if you can save a malicious DLL next to that executable you can make a perfectly legitimate executable run malicious code. I haven't read into the API yet to determine how it protects against thi…

> This means that if you can save a malicious DLL next to that executable you can make a perfectly legitimate executable run malicious code. Some people install browsers onto a USB drive -- or even run a browser directly from their Downloads directory. Such people are easy targets for this type of thing.

Running a browser from the downloads directory is unlikely to work correctly on macOS.

Re: The Native File System API allows web apps to save directly to files

#68

Post by pjmlp » Wed, Sep 09, 2020, 6:17 AM UTC

randtrain34 wrote: post #2

As much as they try to add security to this feature it inherently breaks out of the "sandbox" concept of the browser and scares me.

With WebApps, it is enough to exploit sandbox contents itself.

Re: The Native File System API allows web apps to save directly to files

#69

Post by snvzz » Wed, Sep 09, 2020, 6:22 AM UTC

chromedev wrote: post #58

snvzz wrote: post #42

Earlier quoted context omitted.

>So in essence, all this new API is mostly buying you is offline mode. There's been, for a long time, local storage APIs. This is filesystem access, which is very different.

Which has policies that can be enabled to block it if necessary

Users click "accept" to make things work.

Filesystem access is going to have nefarious consequences.

Re: The Native File System API allows web apps to save directly to files

#70

Post by pjmlp » Wed, Sep 09, 2020, 6:23 AM UTC

cromwellian wrote: post #62

ssss11 wrote: post #28

Earlier quoted context omitted.

Sounds like the plan is to make Chrome the OS. Native apps already do things like that.

Native apps are really poor at collaboration and composition. School districts around the world are effortlessly doing distance learning by giving parents and kids URLs, which open Web based editors, science experiments, music and art 'web apps', etc all at one click, without worry about whether the kids own iPhones or Android, or desktops, and whether or not they can install it, or have it installed. Any solution th…

And that is how Linux became irrelevant on the desktop.

Modern native apps support links, by the way, they just need to be explicitly enabled.

https://developer.apple.com/documentation/xcode/allowing_app...

https://developer.android.com/training/app-links/deep-linkin...

https://docs.microsoft.com/en-us/windows/uwp/launch-resume/w...