Earlier quoted context omitted.
Just get .tk[1] domains. [1] http://www.nic.tk
Is there a catch?
Yes, there are several (it involves signing up for a "win free ipod" type deal) but not really anything that would stop a bad guy.
HTML5 localStorage allows sites to fill up users' hard disks
161–170 of 191 posts
Re: HTML5 localStorage allows sites to fill up users' hard disks
#162So. The question I'm asking myself now is how to fix this. Giving .domain.com a shared quota will allow one tumblr or github pages user to monopolize all storage, effectively removing local storage for this kind of scenario (also removing it for the host which is even more annoying). A maybe workable solution would be to only allow creation of new keys for the first-party origin. What I mean is that whatever.example.…
> The question I'm asking myself now is how to fix this. Doesn't the website answer that? Just follow the spec! Firefox isn't vulnerable…
If you do that (like Firefox admittedly does), then my issue with subdomain users using up all local storage comes into place.
It would really suck for github (for example) not to be able to use local storage in their UI because pilif.github.com used up all available storage for the whole domain.
Re: HTML5 localStorage allows sites to fill up users' hard disks
#163Earlier quoted context omitted.
Sorry, maybe this is obvious, but — how do you fill up a remote HD with just an IP and hostname with nmap and friends?
Well, I meant you can use these tools to gain access to the remote machine to do some real damage. Nmap and friends are usually for finding running services, list of open ports, knock on a few doors (run some queries?) etc... and if someone were to gain access to a machine this way, filling up their hard drive may not be on their list of priorities. Unless incrimination was the intention.
I don't think this is as easy or as common as you think it is. For one, almost every computer is behind a firewall these days and remote vulnerabilities for common services aren't anywhere near as common as they used to be.
Re: HTML5 localStorage allows sites to fill up users' hard disks
#164Earlier quoted context omitted.
Prompt is a horrible solution from a UX perspective. Essentially you're asking the user a question you, as a developer, couldn't or didn't want to answer. But the user has no idea either. Heck, she doesn't even know that there are limits in place or what DOM local storage even is.
I'd argue that a user generally has an idea that there is a persistent storage ("disk") locally held in their computer and that they have a good idea whether they want a website to use that space or not. The developer lacks the knowledge of the users requirements, that is why they can't answer the question. For "power users" the user is far better placed than the developer to answer the question about how much local…
> and that they have a good idea whether they want a website to use that space or not.
"What's a website? I just double-clicked on my e-mail google and now Foxfire wants to fill up my disks. Is this going to put a virus on my Microsoft? Why don't they put it up in the clouds?"
Re: HTML5 localStorage allows sites to fill up users' hard disks
#165The Chromium developers really dislike localStorage ( http://code.google.com/p/chromium/issues/detail?id=58985#c7 ) They'll have to fix this bug, but I won't be surprised if they try to remove localStorage entirely soon.
It sound like they hate synchronous APIs. Well, the synchronous nature of it wouldn't be a problem if:
1. JS has a language-level support for asyncrony. 2. The implementation of retrieval was performant enough or allowed for some way to control granularity of reads from the code.
I really dislike that the idea that the only simple API for local storage will be gutted because of reasons quite tangential for what it does.
Re: HTML5 localStorage allows sites to fill up users' hard disks
#166Earlier quoted context omitted.
5MB per subdomain, 100MB per domain, configurable limits, prompt when a site/subdomain requires more.
The 100MB per domain includes the subdomain storage? Then it doesn't solve what parent comment described - few subdomains could use up all the storage. If it doesn't include it and it's separate then it is exactly like it is now.
This really isn't that hard of a problem – allow X MB per domain and Y per sub-domain (user configurable or set by the browser developer to some sane limit – the actual number doesn't matter too much within certain ranges, in reality).
After either of those limits is hit, prompt the user to grant another increment of allowed storage or a customized amount, possibly (and disclose how much each domain and subdomain is using under a detailed view option). In the end, this puts the power back in the hands of the user and prevents any malicious usage while not allowing one subdomain to effectively deny storage to others, etc.
Re: HTML5 localStorage allows sites to fill up users' hard disks
#167Ahhh.... I wrote a response wondering out loud why this doesn't work on my browser, then checked the source, and it's javascript. No wonder, I browse without it! "Yeeaahhpp, with enough javascript one can blow up just about anything." ~Tyler Durden
How do you know if someone browses with JavaScript disabled? Don't worry, they'll tell you.
Re: HTML5 localStorage allows sites to fill up users' hard disks
#168Is there a means to inspect (and or modify) what apps are putting into my local storage? something similar to cookie inspection?
In Chrome, you can go to Settings->Advanced Settings->Content Settings->Cookies->All Cookies and Site Data, and it will list sites using your localStorage.
There does not seem to be a way to disable localStorage entirely.
Re: HTML5 localStorage allows sites to fill up users' hard disks
#169Here is how it looked in Opera: http://i.imgur.com/SOoadOB.png
Too bad that outstanding solution will be vaporized from the face of this earth and replaced by Chrome's implementation!
Why is it assumed that Opera will be exactly the same as Chrome?
Is it not possible for Opera to keep their own implementation of LocalStorage (and other things)?
Am I wrong in assuming RenderEnginge != Browser?
Re: HTML5 localStorage allows sites to fill up users' hard disks
#170So. The question I'm asking myself now is how to fix this. Giving .domain.com a shared quota will allow one tumblr or github pages user to monopolize all storage, effectively removing local storage for this kind of scenario (also removing it for the host which is even more annoying). A maybe workable solution would be to only allow creation of new keys for the first-party origin. What I mean is that whatever.example.…
Maybe stop the whole thing about "let's pretend common nth level domain signifies something about web page relatioships"? It's just baseless.
Yet, often sub-domains are parts of a larger webapp or ecosystem, for which things like authentication are truly shared, or owned by one entity.
Perhaps for storage purposes, this is not a meaningful assumption.