The Native File System API allows web apps to save directly to files • Hacker News Board

Re: The Native File System API allows web apps to save directly to files

#151

Post by davidbanham » Thu, Sep 10, 2020, 9:53 AM UTC

tomayac wrote: post #150

davidbanham wrote: post #60

It's not clear to me how the Native File System API relates to the existing File System API. https://developer.mozilla.org/en-US/docs/Web/API/FileSystem Is Google proposing this as a replacement? As a supplement? I made heavy use of the FileSystem API in a cross platform educational application a few years ago, tripping over a really hairy memory leak bug in Webkit along the way. By the end of that project the API ha…

The old File System API interface will not grant you access to the users filesystem. Instead you will have a "virtual drive" within the browser sandbox. The Native File System API gives you access to the actual file system.

Ah, yes that makes sense. Thanks for clearing it up.

Re: The Native File System API allows web apps to save directly to files

#152

Post by nuker » Thu, Sep 10, 2020, 1:53 PM UTC

tomayac wrote: post #148

nuker wrote: post #115

There is a comment on this by Martin Thomson, Mozilla Distinguished Engineer, member of Internet Architecture Board: "But my initial assessment is that the protections described in the spec are inadequate and I am of the opinion that this should be marked harmful. " [0] [0] https://github.com/mozilla/standards-positions/issues/154#is... [1] Specification Positions https://mozilla.github.io/standards-positions/#native…

The points brought up by @cromwellian in https://news.ycombinator.com/item?id=24416738 are important in the context of the present comment, too.

cromwellian > "But what really bothers me is people making uninformed comments. Rather than knee jerk trigger anytime any browser API is changed without fully reading the spec and then actually pointing out any weaknesses, we get the same low signal commentaries."

This may sound dumb too, but I expect my browser just show me web. When I reset my browser (and IP address), I expect a clean slate, and with this API I won't get it. When I install apps, I use very different due diligence. Without clean slate after resetting my browser, I'd have to change my browsing habits radically [0].

A side note, DNS over HTTP (DoH) bothers me too, spec is silent about setting cookies, DoT is cleaner in this regard.

[0] https://en.wikipedia.org/wiki/Chilling_effect

Re: The Native File System API allows web apps to save directly to files

#153

Post by vlovich123 » Thu, Sep 10, 2020, 7:26 PM UTC

yjftsjthsd-h wrote: post #127

vlovich123 wrote: post #119

Earlier quoted context omitted.

You would be incorrect. File Quarantine on OSX: > https://support.apple.com/en-us/HT201940 Alternate data stream on Windows: > https://www.howtogeek.com/70012/what-causes-the-file-downloa... I wouldn't be surprised if Linux had it but I haven't used desktop Linux in a long time so I don't know what to search for, but generally having browsers annotate their file streams isn't an uncommon thing to support for filesyst…

A decent number of linux filesystems do support extended attributes, which is how I assume you'd do this (actually, looking at https://en.wikipedia.org/wiki/Extended_file_attributes a lot of OSs support xattrs), but I'm not aware of any browsers using them to mark downloads.

I'm not aware of any browsers that don't mark files downloaded from the web as such.

Re: The Native File System API allows web apps to save directly to files

#154

Post by rewq4321 » Sat, Sep 19, 2020, 1:39 PM UTC

daleharvey wrote: post #81

kissgyorgy wrote: post #78

Earlier quoted context omitted.

I'm sure you worked hard and thought a lot about the security of this, but you have to be really arrogant to think that this will be fine because you thought about everything. I'm pretty sure this will open up a lot more possibilities for malware, viruses, harmful web pages than the convenience it will provide.

The alternatives arent that people just dont use it, the alternative is are that people download some random executable that has much larger security vector, ie some electron app that has unlimited file system access.

I have no idea why you were down-voted here. Non-technical people are downloading executable files on their systems by the millions every day.

People can argue about how scary the warning messages should be on this new API, but they can't argue that this is not the way forward to a more secure world.

With this new API in place we'll be one step closer to the goal of having all consumer applications running inside a progressively-permissioned sandbox. It's a dream come true and will allow the culture and OSes to even more strongly stigmatise the opening of executables which immediately gain full system access - something that's completely absurd, but was a necessary evil.

Re: The Native File System API allows web apps to save directly to files

#155

Post by rewq4321 » Sat, Sep 19, 2020, 1:48 PM UTC

nuker wrote: post #152

tomayac wrote: post #148

Earlier quoted context omitted.

The points brought up by @cromwellian in https://news.ycombinator.com/item?id=24416738 are important in the context of the present comment, too.

cromwellian > "But what really bothers me is people making uninformed comments. Rather than knee jerk trigger anytime any browser API is changed without fully reading the spec and then actually pointing out any weaknesses, we get the same low signal commentaries." This may sound dumb too, but I expect my browser just show me web. When I reset my browser (and IP address), I expect a clean slate, and with this API I wo…

> When I reset my browser (and IP address), I expect a clean slate, and with this API I won't get it.

Browsers don't currently give you that, and never have. You can download files, and these files remain on your system even if you re-install your browser.

> This may sound dumb too, but I expect my browser just show me web.

Browsers are just a sandbox for running applications that are downloaded over the network. Some applications need web cam access, some need access to files on your system, some need geolocation, and so on. Browsers let you choose what permissions to give applications. Because of this, you're completely free to let your browser just "show you the web" in whatever sense you like.