Too many prompts and not an official API. Back in the day, IE also had tons of "great" and novel ideas, including COM+ something something.
ActiveX something something!
window.showDirectoryPicker opens up a whole new world
81–90 of 122 posts
Re: window.showDirectoryPicker opens up a whole new world
#82Earlier quoted context omitted.
> So websites can now nag users to allow access to the root of their local disk No, Chrome doesn't allow this. Here's a simple demo: https://output.jsbin.com/kekekac/quiet - note that you can't select root, Downloads etc.
In this example https://web.dev/patterns/files/open-a-directory I can select Downloads
I could select /boot and ~/.cache. Genius. Given how smart are many Internet users this will definitely not cause any misuse.
Re: window.showDirectoryPicker opens up a whole new world
#83This isn't new, the API has been around for several years. Unfortunately Mozilla and Apple say they are never going to implement it because of security concerns https://github.com/mozilla/standards-positions/issues/154 It is a great API though, I wish the other browser vendors liked it! Because currently us PWA developers are really limited when trying to make apps that work with local data, at least in non-Chrome br…
Firefox position is completely valid. I think a safe option would be to allow access only to a specific directory like "~/Internet files" or something like this. This way the user could grant the access but not to sensitive files. And add an option in about:config to lift the restriction for power users.
Also, there is a risk of a site writing malware executable, and Linux currently has no sandboxing for such executables so the system would be completely owned once the user runs the program. So the directory should not allow storing executables.
Re: window.showDirectoryPicker opens up a whole new world
#84Phishers and exploit developers are celebrating and jumping for joy over yet another way to deploy their payload to their victims. What are the many ways could this possibly go wrong?
"Choose your browser cache folder to improve performance"
Choose .autostart directory to install a video codec needed to play this video.
Re: window.showDirectoryPicker opens up a whole new world
#85Earlier quoted context omitted.
Looks like these safeguards are in place: * System and root directories cannot be selected. * Can only being activated after user action. * Requires https. * Double-confirmation for write access. No API like this could ever be bulletproof, but it's a start I guess. Very cool API though, and it really does open up a whole new world of possibilities.
> System and root directories cannot be selected. That desperately needs something like the Public Suffix List [1] - a community-managed list where authors of software can blacklist directories containing sensitive files or such files directly for all browsers implementing this feature. If I were to design such a list, it would include ~/.ssh, ~/.aws, ~/.config, ~/Library, ~/.{ba,z}sh{rc,_profile,_history}, ~/.m2, ~/…
Black listing is never secure. White listing is. Sadly some really smart person decided it was a good idea to store pictures and SSH keys within the same directory tree.
Re: window.showDirectoryPicker opens up a whole new world
#86Earlier quoted context omitted.
Yet. It’s not hard to imagine a case where it is a bad idea to give the browser access to the whole content of a directory. There is a reason why it’s Chromium browsers only, don’t you think?
So what should I do if I want to make an app with this functionality? Do I have to tell users to download and run some executable? You can imagine a case where that is a bit riskier than a nicely sandboxed web app with permission to access one directory.
> Do I have to tell users to download and run some executable?
Well, yes.
The alternative is to give any malicious ad the ability to drive-by-download malware onto your machine.
Re: window.showDirectoryPicker opens up a whole new world
#87Earlier quoted context omitted.
In this example https://web.dev/patterns/files/open-a-directory I can select Downloads
I could select /boot and ~/.cache. Genius. Given how smart are many Internet users this will definitely not cause any misuse.
After seeing a recaptcha with a QR code. Suddenly those fake recaptchas with a run dialog don't seem too far fetched.
Re: window.showDirectoryPicker opens up a whole new world
#88Earlier quoted context omitted.
It's been in Chrome for 6 years and I'm not aware of any problems it's caused.
Yet. It’s not hard to imagine a case where it is a bad idea to give the browser access to the whole content of a directory. There is a reason why it’s Chromium browsers only, don’t you think?
Apple will never implement anything in a browser that could make a web app as capable as a native mobile app, they are simply too greedy. Firefox typically doesn't implement these things unless they have to because they don't have the resources that Google and Apple do.
Re: window.showDirectoryPicker opens up a whole new world
#89This isn't new, the API has been around for several years. Unfortunately Mozilla and Apple say they are never going to implement it because of security concerns https://github.com/mozilla/standards-positions/issues/154 It is a great API though, I wish the other browser vendors liked it! Because currently us PWA developers are really limited when trying to make apps that work with local data, at least in non-Chrome br…
Ah, but it is new to Claude. Claude has main character vibes, so it is always about Claude. Isn't he clever?
Claude can stay in his own lane, I want to know how I can use this during development to simulate uploading photos, so Chrome only is okay for my purposes. But I want to know how to do it, not how much better Claude is than me, forever able to do anything I can do but better.
Re: window.showDirectoryPicker opens up a whole new world
#90This isn't new, the API has been around for several years. Unfortunately Mozilla and Apple say they are never going to implement it because of security concerns https://github.com/mozilla/standards-positions/issues/154 It is a great API though, I wish the other browser vendors liked it! Because currently us PWA developers are really limited when trying to make apps that work with local data, at least in non-Chrome br…
Firefox position is completely valid. I think a safe option would be to allow access only to a specific directory like "~/Internet files" or something like this. This way the user could grant the access but not to sensitive files. And add an option in about:config to lift the restriction for power users. Also, there is a risk of a site writing malware executable, and Linux currently has no sandboxing for such executa…
[deleted]