[dead]
window.showDirectoryPicker opens up a whole new world
41–50 of 122 posts
Re: window.showDirectoryPicker opens up a whole new world
#42Earlier quoted context omitted.
Looks like these safeguards are in place: * System and root directories cannot be selected. * Can only being activated after user action. * Requires https. * Double-confirmation for write access. No API like this could ever be bulletproof, but it's a start I guess. Very cool API though, and it really does open up a whole new world of possibilities.
> System and root directories cannot be selected. That desperately needs something like the Public Suffix List [1] - a community-managed list where authors of software can blacklist directories containing sensitive files or such files directly for all browsers implementing this feature. If I were to design such a list, it would include ~/.ssh, ~/.aws, ~/.config, ~/Library, ~/.{ba,z}sh{rc,_profile,_history}, ~/.m2, ~/…
This is still a security nightmare! You won't get every folder, or even enough folders.
Re: window.showDirectoryPicker opens up a whole new world
#43I think something that is a mix between localStorage or IndexedDB and access to the user's filesystem would be better.
I agree with the comments about how much of a security risk this poses. But, isn't that the case with any binary or executable files and apps we download from the internet anyway?
It would be cool if you could have a specially-demarcated directory (e.g. even inside the application like `~/Applications/Chrome//local_files`) which you can just open super easily with a button from Chrome, and just copy files over into that directory as needed. Would provide the benefits of a more secure enclave with the flexibility of being on the filesystem.
Re: window.showDirectoryPicker opens up a whole new world
#44I'm not sure if this is meant to be ironic?
"You can also create folders within the app and move photos into them, and it all happens on your filesystem."
Why, yes. But you can also do that with Finder.
And if you want to work with local data, why use the often inferior web-based widgets and toolkits instead of native ones?
This seems to be the worst of both worlds so to speak.
Re: window.showDirectoryPicker opens up a whole new world
#45Unfortunately currently only supported by Chrome/Chromium: https://developer.mozilla.org/en-US/docs/Web/API/Window/show...
(intentionally, because it's a massive security risk and only Google doesn't care about endpoint security)
Re: window.showDirectoryPicker opens up a whole new world
#46Too many prompts and not an official API. Back in the day, IE also had tons of "great" and novel ideas, including COM+ something something.
They also popularized XMLHttpRequest. Sometimes a flexible idea can trend to the greater ecosystem.
Re: window.showDirectoryPicker opens up a whole new world
#47This isn't new, the API has been around for several years. Unfortunately Mozilla and Apple say they are never going to implement it because of security concerns https://github.com/mozilla/standards-positions/issues/154 It is a great API though, I wish the other browser vendors liked it! Because currently us PWA developers are really limited when trying to make apps that work with local data, at least in non-Chrome br…
You could implement it this way:
- the first time you select a directory it must be empty
- you can drag files in there afterwards
- the directory gets whitelisted for future use
Probably has bad usability, but would be more secure.
Re: window.showDirectoryPicker opens up a whole new world
#48So websites can now nag users to allow access to the root of their local disk and then read all their files and settings, all their SSH keys and other passwords? From what I gather from the docs [1], this API gives you a FileSystemDirectoryHandle object, and then you just call getDirectoryHandle() on that to recursively read the the entire filesystem. The spec [2] has some vague suggestions about blacklisting certain…
> So websites can now nag users to allow access to the root of their local disk No, Chrome doesn't allow this. Here's a simple demo: https://output.jsbin.com/kekekac/quiet - note that you can't select root, Downloads etc.
[deleted]
Re: window.showDirectoryPicker opens up a whole new world
#49This isn't new, the API has been around for several years. Unfortunately Mozilla and Apple say they are never going to implement it because of security concerns https://github.com/mozilla/standards-positions/issues/154 It is a great API though, I wish the other browser vendors liked it! Because currently us PWA developers are really limited when trying to make apps that work with local data, at least in non-Chrome br…
fortunately*
Re: window.showDirectoryPicker opens up a whole new world
#50[flagged]