Earlier quoted context omitted.
Exactly, the focus must be on trying to mitigate it, not make it more easier.
Should they block online email providers too because someone might send a phishing email?
Is that an argument in good faith?
The Native File System API allows web apps to save directly to files
111–120 of 155 posts
Re: The Native File System API allows web apps to save directly to files
#112Were there users that were asking for this feature?
Re: The Native File System API allows web apps to save directly to files
#113Earlier quoted context omitted.
Precisely. You'll also gain the ability to update your apps cheaply (via the web) and bonus security points by not being beholden to Electron updates.
more like "you won't have a choice but to always use the newest version of the app"
I get that you dislike electron, but that doesn't take away from the truth: don't like the latest version of an app? too bad, you just have to get used to it or stop using it
Re: The Native File System API allows web apps to save directly to files
#114I'm gonna throw an unpopular opinion out there: The real issue is not that phones or browsers have too much capabilities but rather that people fundamentally don't understand how to use computers. Locking things down and removing features doesn't really solve the problem just like wrapping your child in bubble wrap before crossing the street instead of teaching it to look both ways for cars doesn't solve the problem.…
But then the solution becomes: stop using computers, because the kind of sophistication required is out of reach for a very large part of the population. So, computers will stay part of everyday life. Making the interface simple and predictable, and locking features that can be abused may be fighting the symptom, but it's better than nothing.
Re: The Native File System API allows web apps to save directly to files
#115There is a comment on this by Martin Thomson, Mozilla Distinguished Engineer, member of Internet Architecture Board:
"But my initial assessment is that the protections described in the spec are inadequate and I am of the opinion that this should be marked harmful." [0]
[0] https://github.com/mozilla/standards-positions/issues/154#is...
[1] Specification Positions https://mozilla.github.io/standards-positions/#native-file-s...
Re: The Native File System API allows web apps to save directly to files
#116Earlier quoted context omitted.
It's important not to forget about drive-by DLL injection when making the "execution is the problem" argument. Lots of executables on Windows link to DLLs that are not protected by the "KnownDLLs" protection. This means that if you can save a malicious DLL next to that executable you can make a perfectly legitimate executable run malicious code. I haven't read into the API yet to determine how it protects against thi…
Ugh, my Win32 security knowledge is non-existent, but this sounds horrible. Seems to me that nothing marked 'from web' and non-executable should be loadable into a memory segment which can be executed, and nothing in the system partition should be overridable like this. This sounds like a flaw in the OS design. The real irony of the comments on HN that "it's dead on mobile because Apple won't support it", is iOS is o…
> nothing marked 'from web' and non-executable should be loadable into a memory segment
How would you "mark something 'from web'"? This is a file after all.
There are ways to sign files (executable or not) but there is no 'from web' flag as far as I know.
Re: The Native File System API allows web apps to save directly to files
#117Earlier quoted context omitted.
Ugh, my Win32 security knowledge is non-existent, but this sounds horrible. Seems to me that nothing marked 'from web' and non-executable should be loadable into a memory segment which can be executed, and nothing in the system partition should be overridable like this. This sounds like a flaw in the OS design. The real irony of the comments on HN that "it's dead on mobile because Apple won't support it", is iOS is o…
> nothing marked 'from web' and non-executable should be loadable into a memory segment How would you "mark something 'from web'"? This is a file after all. There are ways to sign files (executable or not) but there is no 'from web' flag as far as I know.
Sure there is:
https://textslashplain.com/2016/04/04/downloads-and-the-mark...
Windows File System is very advanced and has metadata streams.
Re: The Native File System API allows web apps to save directly to files
#118Earlier quoted context omitted.
Ugh, my Win32 security knowledge is non-existent, but this sounds horrible. Seems to me that nothing marked 'from web' and non-executable should be loadable into a memory segment which can be executed, and nothing in the system partition should be overridable like this. This sounds like a flaw in the OS design. The real irony of the comments on HN that "it's dead on mobile because Apple won't support it", is iOS is o…
> nothing marked 'from web' and non-executable should be loadable into a memory segment How would you "mark something 'from web'"? This is a file after all. There are ways to sign files (executable or not) but there is no 'from web' flag as far as I know.
> How would you "mark something 'from web'"? This is a file after all.
Files can have metadata, and most modern filesystems provide some kind of file attribute facility. On macOS browsers do exactly what described, setting a file attribute on downloaded files. The user will then be warned when trying to execute the file.
Re: The Native File System API allows web apps to save directly to files
#119Earlier quoted context omitted.
Ugh, my Win32 security knowledge is non-existent, but this sounds horrible. Seems to me that nothing marked 'from web' and non-executable should be loadable into a memory segment which can be executed, and nothing in the system partition should be overridable like this. This sounds like a flaw in the OS design. The real irony of the comments on HN that "it's dead on mobile because Apple won't support it", is iOS is o…
> nothing marked 'from web' and non-executable should be loadable into a memory segment How would you "mark something 'from web'"? This is a file after all. There are ways to sign files (executable or not) but there is no 'from web' flag as far as I know.
You would be incorrect.
File Quarantine on OSX:
> https://support.apple.com/en-us/HT201940
Alternate data stream on Windows:
> https://www.howtogeek.com/70012/what-causes-the-file-downloa...
I wouldn't be surprised if Linux had it but I haven't used desktop Linux in a long time so I don't know what to search for, but generally having browsers annotate their file streams isn't an uncommon thing to support for filesystems & browsers.
Re: The Native File System API allows web apps to save directly to files
#120Earlier quoted context omitted.
> nothing marked 'from web' and non-executable should be loadable into a memory segment How would you "mark something 'from web'"? This is a file after all. There are ways to sign files (executable or not) but there is no 'from web' flag as far as I know.
You would be incorrect. File Quarantine on OSX: > https://support.apple.com/en-us/HT201940 Alternate data stream on Windows: > https://www.howtogeek.com/70012/what-causes-the-file-downloa... I wouldn't be surprised if Linux had it but I haven't used desktop Linux in a long time so I don't know what to search for, but generally having browsers annotate their file streams isn't an uncommon thing to support for filesyst…
OK thanks - so this is a NTFS feature, meaning that if the file is stored on an non-NTFS partition, or sent further that "flag" is cancelled.