Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Native File System API allows web apps to save directly to files

web.dev

Post reply on HN
Print view View original

141–150 of 155 posts

Re: The Native File System API allows web apps to save directly to files

#141

Post by tgv »

AnIdiotOnTheNet wrote: post #138
tgv wrote: post #114

Earlier quoted context omitted.

But then the solution becomes: stop using computers, because the kind of sophistication required is out of reach for a very large part of the population. So, computers will stay part of everyday life. Making the interface simple and predictable, and locking features that can be abused may be fighting the symptom, but it's better than nothing.

> Making the interface simple and predictable Please tell me who, in the entire computing industry, is actually working on that? Because I have seen no evidence of it.

First macOS, then iOS, and then Android, have made some inroads. My mother is very clumsy around computers, but a iPad she can manage. It's not perfect, but much better than 10 or 20 years ago.

Re: The Native File System API allows web apps to save directly to files

#142

Post by chromedev »

anaganisk wrote: post #102
chromedev wrote: post #89

Earlier quoted context omitted.

Should they block online email providers too because someone might send a phishing email?

Yeah so there are few dozens of ways people are getting spammed, why not lets add more ways. Here's an Idea let me write a blog post on how to make windows look cooler and ask my 12YO user to point me to their windows directory and let me use my API to inject my DLLs, none of the defenders of this API are not estimating the level of social engineering, and how dumb users can be, and also the reason why Android failed…

You forgot to read the part where they will block certain directories, and your 12 year old could easily install malware or give out his password, and Android did't fail in terms of privacy. Apple has failed by locking you into a closed-source ecosystem. Android is open source and has a lot of options, and a lot of open source apps you can review yourself and pick the best cryptography algorithms for password management, etc.

Re: The Native File System API allows web apps to save directly to files

#143

Post by chromedev »

imwillofficial wrote: post #98
chromedev wrote: post #88

Earlier quoted context omitted.

For filesystem access they are beholden to their enterprise users as well and Chromium still has a lot of open source developers that aren't simply looking out for Google's best interests. If they became overly hostile, then I'm sure we'd see a fork at some point. I'm not saying they are perfect, but a lot of Chromium hate is unfounded and exaggerated.

AMP waves “hello”

AMP isn't specific to Chromium

Re: The Native File System API allows web apps to save directly to files

#144

Post by tenebrisalietum »

tgv wrote: post #114
t0astbread wrote: post #87

I'm gonna throw an unpopular opinion out there: The real issue is not that phones or browsers have too much capabilities but rather that people fundamentally don't understand how to use computers. Locking things down and removing features doesn't really solve the problem just like wrapping your child in bubble wrap before crossing the street instead of teaching it to look both ways for cars doesn't solve the problem.…

But then the solution becomes: stop using computers, because the kind of sophistication required is out of reach for a very large part of the population. So, computers will stay part of everyday life. Making the interface simple and predictable, and locking features that can be abused may be fighting the symptom, but it's better than nothing.

> So, computers will stay part of everyday life

I don't think this is a guarantee. Already most people's primary computing device is their phone; there are households where everyone has a phone and a couple iPads and no PC; and iPads or Android tablets seem to be fairly common as POS terminals and kiosk devices.

PCs will definitely always be around for serious content creation and heavy work; but the group "very large part of the population" is also the group that is less and less likely to own a PC or use one other than at work or for school.

Re: The Native File System API allows web apps to save directly to files

#145

Post by SAI_Peregrinus »

yjftsjthsd-h wrote: post #134
BraveSnoo1028 wrote: post #124

Serious question. Since this is going to be enabled by default by Chrome 86, is there any way to block Javascript from using the API? Or force it to ask for permissions? Because it seems like anything that uses the API by default has full access to my filesystem (at least based on the demo on that page). That seems insane. I don't even want anything JS-based to see my filesystem. That's a huge breach of privacy.

Not exactly what you're asking, but some thoughts: * There is, for the moment, a flag to disable it, right? * You could probably just have noscript/umatrix block JS outright (yes, I know this is overkill) * Sibling comment is probably right in that Firefox is likely to not implement this immediately, if at all. * You could also do it from the outside by sandboxing the whole browser; this is a somewhat poor mitigation…

There's also Luminous[1], which can allow blocking individual JS events (eventAddListener and handleEvent calls). Something like that could also be extended to allow blocking of other API calls.

[1]https://gbaptista.github.io/luminous/doc/en-US/

Re: The Native File System API allows web apps to save directly to files

#146

Post by chromedev »

Spivak wrote: post #122
nirui wrote: post #6

Earlier quoted context omitted.

Not sure why you would say that. Maybe try some vscode extensions such as "Markdown Preview Enhanced" or "Markdown All In One"? Those works both offline and local.

"Don't use a web app that has an extremely constrained permissions model and only has access to the files you explicitly grant it using the file picker, use a native app that has unconstrained access to everything!"

That is what I was wondering, if you could grant it access to read/write to a specific folder.

Re: The Native File System API allows web apps to save directly to files

#147

Post by tgv »

tenebrisalietum wrote: post #144
tgv wrote: post #114

Earlier quoted context omitted.

But then the solution becomes: stop using computers, because the kind of sophistication required is out of reach for a very large part of the population. So, computers will stay part of everyday life. Making the interface simple and predictable, and locking features that can be abused may be fighting the symptom, but it's better than nothing.

> So, computers will stay part of everyday life I don't think this is a guarantee. Already most people's primary computing device is their phone; there are households where everyone has a phone and a couple iPads and no PC; and iPads or Android tablets seem to be fairly common as POS terminals and kiosk devices. PCs will definitely always be around for serious content creation and heavy work; but the group "very larg…

Tablets and phones are computers, IMO. They're still general purpose machines. For many tasks, their interfaces are less confusing than a desktop's interface, which is progress, but when it comes to web apps, there's no difference, and especially phones can be really clumsy.

Not using computers would be falling back to paper forms and mail.

Re: The Native File System API allows web apps to save directly to files

#148

Post by tomayac »

nuker wrote: post #115

There is a comment on this by Martin Thomson, Mozilla Distinguished Engineer, member of Internet Architecture Board: "But my initial assessment is that the protections described in the spec are inadequate and I am of the opinion that this should be marked harmful. " [0] [0] https://github.com/mozilla/standards-positions/issues/154#is... [1] Specification Positions https://mozilla.github.io/standards-positions/#native…

The points brought up by @cromwellian in https://news.ycombinator.com/item?id=24416738 are important in the context of the present comment, too.

Re: The Native File System API allows web apps to save directly to files

#149

Post by tomayac »

rainforest wrote: post #79
anoncareer0212 wrote: post #54

Earlier quoted context omitted.

The histrionics here are astounding considering they're about a _Save As_ dialog.

It appears I could use this to ask a victim to "select your downloads folder" to save files to and then steal or overwrite any file in it.

This folder specifically is blocked by the API.

Re: The Native File System API allows web apps to save directly to files

#150

Post by tomayac »

davidbanham wrote: post #60

It's not clear to me how the Native File System API relates to the existing File System API. https://developer.mozilla.org/en-US/docs/Web/API/FileSystem Is Google proposing this as a replacement? As a supplement? I made heavy use of the FileSystem API in a cross platform educational application a few years ago, tripping over a really hairy memory leak bug in Webkit along the way. By the end of that project the API ha…

The old File System API interface will not grant you access to the users filesystem. Instead you will have a "virtual drive" within the browser sandbox. The Native File System API gives you access to the actual file system.
Post reply on HN