A new release of Google Chrome enables Native File System API so the developers can build web apps that interact with files on the user’s local device.
How will you use it ? 🙂
Google Chrome enables file system API ... Super Cool 😁
Publish Date: Oct 12 '20
30 36Comments 36 total
- Ben HalpernOct 12, 2020
Yup, not surprised about this for now, but anybody have an idea of where this might fit into the broader browser plans? I've seen this talked about, but only in the Chrome context.
Ben CalderOct 13, 2020I would expect no sane browser manufacturer to follow suit. Right now I can envision thousands of security admins having a complete meltdown over this and scrambling to remove Chrome from their networks ASAP. In a business environment this 'feature' is toxic.
David Dal BuscoOct 13, 2020It's part of the project Fugu, you can probably ping Thomas Steiner about it.
I'll be interested to know the answer, so far my understanding was that it was a Chrome initiative.
This article on web.dev sums up the usage and status.
Ruben SanchezOct 12, 2020Cannot wait for an exploit to be discovered and observe how personal information is stolen via this API.... or even without exploit, people being tricked into accepting this permission and then having malicious apps taking advantage of this.
Why is this API even necessary? I understand that for Google there is an amazing appeal about getting access to your local drive, but for the end user this means that native apps will be slowly disappearing to make room for horrible slow clunky web apps that can read all your files.
- Sharad Raj (He/Him)Oct 12, 2020
Indeed, but there are advantages for PWAs especially in Android based like DEV itself
amt8uOct 12, 2020I also have the same view. The example use cases given on googles web dev page doesnt seem that relevant(Online IDE, Photo/Video editors etc). Also, spec does cover the security aspect but I still feel that this could go wrong.
Maybe this is geared towards converting web apps to offline mode. But sooner or later scammers will definitely find a way to abuse it. I would surely never give this permission to any site.
GenspiritOct 12, 2020I think it is obvious why the API is useful, productivity apps(as well as anything else that needs open and save files) on the web suffer from the friction of uploading and then downloading a file which makes for bad UX.
You can't account for every possibility but the permission management seems clear and doesn't persist. The notifications seem fairly overt as well. The fact that it is user driven too makes it hard to imagine that many/any users would not only accidentally allow permissions but then also accidentally select a sensitive file/directory. Only time will tell though.
Austin S. HemmelgarnOct 13, 2020The 'upload' issue is actually a non-issue even without the FS API. You can (on a vast majority of modern browsers) pull off a 'fake' upload in any number of ways that works just fine without hitting the remote server.
Downloads are the big issue, because the current behavior of web browsers does not allow for apps to hint the browser that links should use 'Save As' behavior (but, FWIW, downloads don’t actually need to hit the server either, you can use either a Data URI (if the file is small enough) or the Blob API to generate a 'donwload' client side).
Mihail MaloOct 13, 2020There's at least github.com/jimmywarting/StreamSave... (or for older browsers github.com/eligrey/FileSaver.js), it actually took me longer to figure out "uploading" files locally than saving files.
Ivan JeremicOct 13, 2020I use only Web Apps, I replaced all the native apps with web apps and I love it!
Samuele ZancaOct 13, 2020"horrible slow clunky web apps"
Last I checked web assembly is very usesable now. E.g. Blazor(c#) for something more mature and Yew(rust) for something still being worked on.
Emanuele PavanelloOct 13, 2020For the same reason of leave horses to get heavier cars.
Or leave assembly to get slower programming languages.
It's called evolution.
Alvin BryanOct 12, 2020It reminds me when they disabled
SharedArrayBufferbecause of the massive Meltdown/Spectre stuff. I hope something similar doesn't happen with this.
I'm definitely disabling it for everything.
Junxiao ShiOct 13, 2020I'm make a malware that accepts "file submission", but requests write permission from the careless user, and overwrites the file when the permission was granted.
Graham SmithOct 13, 2020Yeah... This seems like a huge security issue. Correct me if I'm wrong, but most web browsers run in a sandboxed environment, making malicious attacks through just a website pretty much impossible. But with this, some website can just ask for file permissions and totally just wipe all your stuff. There would be no way to know whether or not the website is trustworthy. That's just my two cents.
- GenspiritOct 13, 2020
There are security implications but what you are talking about isn't really feasible. The website needs permission and the picker is user controlled. A website can only access files/directories selected by the user. Saving/Editing is also another user prompt(once permission is provided for a single file it remains until the tab is closed).
So in order for what you are discussing to happen a user would have to give permission and open up a directory on the site then also hit confirm every time the site tried to overwrite a file. It's not impossible but there are notable safeguards in place to prevent this.
Raghuram Iyer "Ragzzy-R"Oct 13, 2020nice. next is kernel access to the browser followed by access to CPU Registers.
- Ben CalderOct 13, 2020
Yet another reason to never install Chrome. I imagine many security conscious businesses who currently use it will be having serious conversations about removing it from their networks.
- Sharad Raj (He/Him)Oct 13, 2020
Well it will eventually be in the chromium based browsers, it was already there in flags, just disabled for everyone.
Alain D'EttorreOct 13, 2020- Cool: web apps take a step forward towards native
- NOT cool: possibility of stealing data increases massively
How does this relate to standards, is this coming to Firefox, Safari, etc?