131–140 of 155 posts
Might not be appreciated opinion here but Personally, I think, the web starts to get feature parity in some way with Adobe Flash. Flash could do most of this back in the day and now the web is getting it too.
Earlier quoted context omitted.
Sure why not, let me just create a blog post, with exact steps on how to make your windows more colorfull, and make users inject my DLLs into filesystem. The user will do exactly if i give him exact copy paste paths and commands. And voila.
You can do the same exact thing without this API, so what’s your point? How do you think most call center scams work? By asking the user to download an executable that owns their system and run it.
Ok, so first, tell me how to block it. Running firefox in a container?
Serious question. Since this is going to be enabled by default by Chrome 86, is there any way to block Javascript from using the API? Or force it to ask for permissions? Because it seems like anything that uses the API by default has full access to my filesystem (at least based on the demo on that page). That seems insane. I don't even want anything JS-based to see my filesystem. That's a huge breach of privacy.
* There is, for the moment, a flag to disable it, right?
* You could probably just have noscript/umatrix block JS outright (yes, I know this is overkill)
* Sibling comment is probably right in that Firefox is likely to not implement this immediately, if at all.
* You could also do it from the outside by sandboxing the whole browser; this is a somewhat poor mitigation (ex. leaves your Downloads directory wide open), but it could help.
We've been trialling the Native File System API in our PWA Construct 3 (a browser based game editor - https://www.construct.net ). I think it's absolutely fantastic, and users love it too - it gives them exactly what they expect from IDE-style software in the browser, such as "Save as" to any location on disk, and the ability to use folder-based projects (that are spread across multiple files). The security concerns…
None of theses access are persistent though.
> the writing files part is new, and you cannot choose system directories, or ask for too much
If only that was enough.. there's plenty of important file outside of what will be defined as "system directories" by whoever define them.
I love particularly this part of the documentation:
> Another risk factor is that of ransomware attacks. The limitations described above regarding blocking access to certain sensitive directories helps limit the damage such an attack can do. Additionally user agents can grant write access to files at whatever granularity they deem appropriate.
They are perfectly aware of the risk, yet completely ignore it. At least it won't be whatever the browser define as "sensitive directories".
There is no way this isn't going to open up massive security holes. Even if the browser puts up alert after alert, people are just going to randomly click buttons and then all of a sudden wonder why some random web app is deleting all their files and adding malware. And the spec docs aren't exactly reassuring. This is an exact quote! "This API could be used by websites to try to store and/or execute malware on the us…
This is just a variation on as far as read-access is concerned. For write access, it certainly could be used to store malware on a user's system, but so can "Save As" or clicking a link with HTTP headers that triggers a download. Basically, the "Save As" dialog from browsers have the same issues. It is not downloading malware that is the issue, it's executing it. So unless you can trick the user into navigating to an…
I get that from your comment you agree that this is enough to mitigate the risk they themselves bring up:
>Another risk factor is that of ransomware attacks. The limitations described above regarding blocking access to certain sensitive directories helps limit the damage such an attack can do. Additionally user agents can grant write access to files at whatever granularity they deem appropriate.
I've been saying for 10+ years that browsers will integrate more and more into the OS until they become another layer that users aren't even aware of. Sort of like Electron. Imagine web apps that can render native widgets and show up in the taskbar separately.
This is just another inevitable step towards that. The only concern is how secure this will be, and from the sounds of it, the answer is not very. Still, it's inevitable that some form of this will become popular.
I'm gonna throw an unpopular opinion out there: The real issue is not that phones or browsers have too much capabilities but rather that people fundamentally don't understand how to use computers. Locking things down and removing features doesn't really solve the problem just like wrapping your child in bubble wrap before crossing the street instead of teaching it to look both ways for cars doesn't solve the problem.…
But then the solution becomes: stop using computers, because the kind of sophistication required is out of reach for a very large part of the population. So, computers will stay part of everyday life. Making the interface simple and predictable, and locking features that can be abused may be fighting the symptom, but it's better than nothing.
Please tell me who, in the entire computing industry, is actually working on that? Because I have seen no evidence of it.
Earlier quoted context omitted.
more like "you won't have a choice but to always use the newest version of the app"
I get that you dislike electron, but that doesn't take away from the truth: don't like the latest version of an app? too bad, you just have to get used to it or stop using it
I'm gonna throw an unpopular opinion out there: The real issue is not that phones or browsers have too much capabilities but rather that people fundamentally don't understand how to use computers. Locking things down and removing features doesn't really solve the problem just like wrapping your child in bubble wrap before crossing the street instead of teaching it to look both ways for cars doesn't solve the problem.…
But then the solution becomes: stop using computers, because the kind of sophistication required is out of reach for a very large part of the population. So, computers will stay part of everyday life. Making the interface simple and predictable, and locking features that can be abused may be fighting the symptom, but it's better than nothing.
It sounds a bit nuts and I'm being slightly hyperbolic on purpose but I think the way to go is to slow digitalization in the public (i.e. our everyday lives) down a bit and properly educate at least decision makers, children (or young adults) and teachers about how this sorta stuff really works and how their rights are being undermined in the digital world.
Alas, the pandemic has been a big blow to that as well.