News for hackers. Stuff that matters.
Re:Web Writable Files API: Simplifying Local File Access by joshfraser on Monday November 12, 2018 @03:01PM (#18435205)
One of the great things about browsers is the way you can trust them to be reasonably sandboxed from the rest of your machine. Features like this chip away at that trust model and open up new attack vectors against unsuspecting users. I get the usability benefits, but the security implications are scary. How easy would it be to trick my mother into uploading her profile picture and have the site change that file into a malicious executable without her realizing? At a minimum, I'd hope you would be restricted from changing file permissions or editing any executables.
Re:Web Writable Files API: Simplifying Local File Access by nine_k on Monday November 12, 2018 @03:25PM (#18435412)
As you surely noticed, for last 10 years the browser is actively trying to replace your desktop OS, so that the browser would become the platform, instead of Windows / macOS / Linux / anything else. Imagine the desktop becoming ChromeOS on any computer, not just Chromebooks.

For this, the browser must make all the traditional OS interfaces available. It has interfaces for accelerated 2D and 3D graphics, audio, USB, process management (workers), networking (including peer-to-peer), and a number of persistence mechanisms. But before it takes over completely, it has to interoperate with the host OS a bit, too, by exposing the filesystem.

(A decade more, and maybe the vision of Inferno [1] will sort of kind of be implemented.)

[1]: https://en.wikipedia.org/wiki/Inferno_(operating_system)

Re:Web Writable Files API: Simplifying Local File Access by rkagerer on Monday November 12, 2018 @05:07PM (#18436393)
Am I the only crusty old fart who thinks this a lousy trend?

I worry the next talented generation of developers is being alienated from the desktop, and as a result my computing experience will degrade as Chrome's piecemeal attempts to reinvent the OS leave me with an inferior selection of browser-based toys that are awkward and clunky compared to their native counterparts.

I grant the browser fixes a couple things my OS got wrong: installation/uninstallation and updates. But it feels like it does everything else worse.

Re:Web Writable Files API: Simplifying Local File Access by AnIdiotOnTheNet on Monday November 12, 2018 @06:50PM (#18437073)
You're not alone. In another 20 years, you'll get to laugh tragically as a new generation of naive young techs invent yet another layer of abstraction on top of the browsers and gush about how this time it will finally be a universal platform. And your old 2TB of ram, 50 core cpu laptop might even still be able to run a text editor with only a few seconds of latency.

And it goes without saying that, for your own safety, none of these platforms will run code that hasn't been delivered by a trusted and approved corporate appstore.

The future of computing is very grim.

Re:Web Writable Files API: Simplifying Local File Access by gitgud on Tuesday November 13, 2018 @08:09AM (#18440636)
With more power, comes more stacks of needless abstractions...
Re:Web Writable Files API: Simplifying Local File Access by watersb on Wednesday November 14, 2018 @12:45AM (#18447783)
20 years? Is that a typo? Actually sincere question -- because it feels like the time horizon for adding another layer is closer to 2 years, not 20.
Re:Web Writable Files API: Simplifying Local File Access by jolmg on Monday November 12, 2018 @07:06PM (#18437157)
No, I hate it too. As a consumer, I wish to do my computing in my machine and not in SaaS provider's machines, having to share with them personal data when there's no technical reason to do so.

I think the main driving forces on this are:

1. It's easier for computer illiterate people to use web services, since they don't have to go through an installation process.

2. It's easier for developers to support their users because they don't have to worry about their users' computer environments, which is largely out of their control.

3. It's also harder/impossible for their users to pirate their software, since they it never runs in their machines.

I think the biggest reason (and the one harder to fix) is the piracy one.

Re:Web Writable Files API: Simplifying Local File Access by asdfasgasdgasdg on Monday November 12, 2018 @11:38PM (#18438635)
> 3. It's also harder/impossible for their users to pirate their software, since they it never runs in their machines.

I think your second point is actually the dominant one, but you're not wrong about this either. In some sense, we get the computing landscape that we (collectively) asked for.

Re:Web Writable Files API: Simplifying Local File Access by jack_jennings on Tuesday November 13, 2018 @01:51AM (#18439162)
4. It's easier to justify charging a subscription to your web app customers
Re:Web Writable Files API: Simplifying Local File Access by rhlsthrm on Monday November 12, 2018 @06:46PM (#18437051)
But why is it always necessarily "awkward and clunky"? As always on network connection becomes more and more ubiquitous, internet connected experiences become better and better. Just look at (well-designed) experiences today like streaming video.

I'm excited about things like WASM that will allow browser-based experiences to close the gap more and more with native apps. The web infrastructure is extremely powerful and has a fairly low barrier to entry so lots of people throw crappy experiences up, granted, but it's generally a good thing to have the resources so accessible.

Re:Web Writable Files API: Simplifying Local File Access by millstone on Monday November 12, 2018 @11:33PM (#18438616)
The web is awkward and clunky because it's a document markup format with bad application APIs layered on top.

WASM solves certain problems like arithmetic being slow. This doesn't fix the web's problems; it merely enables a new class of bad apps to be written on the web.

The best streaming video services are not web based. Thank goodness Netflix and Hulu have native iPad apps to spare me their websites.

Re:Web Writable Files API: Simplifying Local File Access by saagarjha on Tuesday November 13, 2018 @12:05AM (#18438735)
> As always on network connection becomes more and more ubiquitous, internet connected experiences become better and better. Just look at (well-designed) experiences today like streaming video.

As not everyone even has a network connection, I find this kind of viewpoint outright dangerous because it leaves out hundreds of millions of people. Streaming video, in particular, seems to choke if you don't if you don't have the absolutely best connection.

Re:Web Writable Files API: Simplifying Local File Access by Spivak on Monday November 12, 2018 @06:40PM (#18437012)
Is it really surprising that in the wake of multiple platforms that refuse to interoperate that an OS that runs on top of every other OS is massively popular?

It doesn't matter that it's clunky and bad, CS people love working with hard to use systems, it just matters that it works.

Re:Web Writable Files API: Simplifying Local File Access by millstone on Monday November 12, 2018 @11:54PM (#18438697)
The websites google.com and facebook.com and twitter.com (to distinguish from their mobile apps) are very popular, but the most part these sites just render text and images.

google.com doesn't try to search my local drive. faceboook.com doesn't offer to share my local photos. Their usage of "browser as an OS" is extremely limited.

I worry about the other problem: the browser becomes so ubiquitous the OS disappears, along with any platform conventions and application interop.

Re:Web Writable Files API: Simplifying Local File Access by candiodari on Monday November 12, 2018 @06:59PM (#18437117)
Not to mention that cloud based software inherently gives MUCH less control to the user.
Re:Web Writable Files API: Simplifying Local File Access by pjmlp on Tuesday November 13, 2018 @01:23AM (#18439045)
Same here.

I also get to pick native development over Web whenever possible.

However many of the gigs happen to be Web based, thus here we are.

Re:Web Writable Files API: Simplifying Local File Access by Individualist on Monday November 12, 2018 @03:34PM (#18435489)
I would argue that you could use a combination of local storage and global state in these web apps to approximate a file system already. Not to mention lazy loading and web workers to cache larger files needed to run a web app. As well as parrelism and currency already offered by web workers.
Re:Web Writable Files API: Simplifying Local File Access by nine_k on Monday November 12, 2018 @03:51PM (#18435658)
Approximation is not what it's about. It's about integration. Write that google doc and store it as a local .docx or .odc. Edit that 20 MB raw picture in a browser app and store it back to the disk, instantly, then feed it to a traditional desktop editor. Write that Python script in a Web IDE, store locally, and upload it to an Arduino.
Re:Web Writable Files API: Simplifying Local File Access by coverband on Monday November 12, 2018 @04:32PM (#18436065)
All those use cases and more can be accomplished if the Write API is limited to a sandboxed local storage with a configurable size limit per domain. I would hate to see all the gains made by sandboxing the browser fly away by allowing it to access any file on the user's system.
Re:Web Writable Files API: Simplifying Local File Access by nicoburns on Monday November 12, 2018 @05:21PM (#18436500)
I think the idea here is that you'd whitelist files/folders on your actual filesystem for use with the app. This sounds fantastic for me. There's so many useful web based tools that are a pain to work with because you have to manually sync files to and from them.
Re:Web Writable Files API: Simplifying Local File Access by gojomo on Monday November 12, 2018 @05:29PM (#18436574)
Just the "last 10 years"?

Nah, replacing the desktop OS has been the goal of browser-makers since the founding of Netscape nearly 25 years ago.

Re:Web Writable Files API: Simplifying Local File Access by grayrest on Monday November 12, 2018 @05:48PM (#18436721)
I'd agree with the 10 year timeframe. Before that browsers were basically aiming for HyperCard. It was only after the combination of the WhatWG and the emergence of the app store as an ecosystem threat that the browser vendors have pushed the browser towards OS replacement.
Re:Web Writable Files API: Simplifying Local File Access by gojomo on Monday November 12, 2018 @06:23PM (#18436936)
Sorry, the 90s were a real time, and the ambition to replace the desktop OS was already there, as per the ~1995 Bob Metcalfe quip (popularized by Marc Andreesen) that the Netscape browser would soon reduce Windows to "a poorly debugged set of device drivers".

There was a bit of a lull in progress in the mid-2000s, after the fall of Netscape Inc, until the rise of the mobile app threat you mention.

Re:Web Writable Files API: Simplifying Local File Access by goatlover on Tuesday November 13, 2018 @04:26AM (#18439729)
Bill Gates did see Netscape as a potential threat to Windows. Java with Sun's "the network is the computer" motto as well. So yeah, people in the 90s were dreaming big. And then in the 2000s people were complaining that Microsoft set computing back by a decade.
Re:Web Writable Files API: Simplifying Local File Access by justizin on Monday November 12, 2018 @03:56PM (#18435713)
The ChromeOS browser does not have access to local files, it can download files to a ~/Downloads folder, but it cannot manipulate local files.

The entire point of ChromeOS is aggressive sandboxing, not breaking out of the sandbox.

Re:Web Writable Files API: Simplifying Local File Access by pjmlp on Monday November 12, 2018 @04:12PM (#18435870)
Apparently I can write files in ChromeOS.

https://developer.chrome.com/apps/fileSystem

Re:Web Writable Files API: Simplifying Local File Access by xrd on Monday November 12, 2018 @04:27PM (#18436011)
You get access to this if you have written a Chromebook app. If you get a user to install that, there is a clear set of permissions they are accepting. See the section on permissions, which is specified in the app manifest. It is not an open hole for anything running on a Chromebook.
Re:Web Writable Files API: Simplifying Local File Access by pjmlp on Monday November 12, 2018 @04:58PM (#18436312)
Or a Chrome app, even though they are currently deprecated.

Yes the user needs to install it, and then it is free reign for $HOME.

So it isn't Download location only.

Re:Web Writable Files API: Simplifying Local File Access by fouc on Monday November 12, 2018 @03:25PM (#18435413)
And more than that, I honestly wonder about the motives of an advertising driven company these days.

It feels like 5 years later this will come to bite us in the ass as another way of exploiting access to our computer and data.

What if websites start requiring specific files to exist before allowing access?

Re:Web Writable Files API: Simplifying Local File Access by politician on Monday November 12, 2018 @04:29PM (#18436024)
> What if websites start requiring specific files to exist before allowing access?

This is certainly going to be immediately abused for encrypted storage of persistent cookies and tracking identifiers.

- If my site generates cat pics, I'll put identifiers in the metadata fields of the image format.

- If my site generates markdown, I'll put identifiers in an alternate data stream (Windows) or encoded in the whitespace.

Since the files exist outside of the sandbox, they'll be outside of the scope of privacy features like clearing the cache or cookies, and outside of the reach of adblocker extensions.

Re:Web Writable Files API: Simplifying Local File Access by icebraining on Monday November 12, 2018 @04:55PM (#18436267)
Nobody said the sites would have unfettered access to these files like they do with their cookies. Putting an ID on a photo is useless if you then have to ask the user to read it again the next time.

Also, why would they be outside the reach of adblockers? WebExtensions can already intercept and manipulate the use of certain APIs by sites, the same can easily apply here.

Re:Web Writable Files API: Simplifying Local File Access by gdfasfklshg4 on Tuesday November 13, 2018 @04:16AM (#18439704)
I suspect it will start with persistent login based on a file and grow from there.
Re:Web Writable Files API: Simplifying Local File Access by Ajedi32 on Monday November 12, 2018 @04:35PM (#18436089)
> What if websites start requiring specific files to exist before allowing access?

This isn't just unrestricted filesystem access. The site would need to request file system permission first, _and_ get the user to select the file in a file picker.

In short, that's not a serious concern.

Re:Web Writable Files API: Simplifying Local File Access by arve0 on Monday November 12, 2018 @05:11PM (#18436431)
Not parent, but I think you are missing the point parent is making.

Suppose an app which does not really needs file permission to work, like Facebook, but asks anyhow. If you opt out, you cannot access the app.

That pattern does not need to exist.

Re:Web Writable Files API: Simplifying Local File Access by nicoburns on Monday November 12, 2018 @05:22PM (#18436512)
I mean, they could already do that with say, the webcam permission.
Re:Web Writable Files API: Simplifying Local File Access by piscisaureus on Monday November 12, 2018 @06:38PM (#18437006)
> And more than that, I honestly wonder about the motives of an advertising driven company these days.

I wonder about ulterior motives too.

But in a world where even local apps increasingly try to make me store files in the cloud, I can only consider this as a move in the right direction.

All web apps can offer today is either (1) re-download the file (as the article mentions) or (2) save to GDrive/iCloud /OneDrive.

Working with local files is a win for user freedom.

Re:Web Writable Files API: Simplifying Local File Access by dmurray on Monday November 12, 2018 @03:51PM (#18435656)
> What if websites start requiring specific files to exist before allowing access?

Like session cookies, or SSL certificates?

Re:Web Writable Files API: Simplifying Local File Access by joesb on Tuesday November 13, 2018 @04:48AM (#18439823)
You mean user name and password?
Re:Web Writable Files API: Simplifying Local File Access by the8472 on Monday November 12, 2018 @04:47PM (#18436183)
You could set the whole directory tree to no-execute via ACLs.

Anyway, more interoperability with the native environment is a good thing. Right now browsers are an alien implant in every operating system that can't communicate with anything else.

Re:Web Writable Files API: Simplifying Local File Access by iforgotpassword on Monday November 12, 2018 @04:50PM (#18436215)
Which is a good thing and should be kept that way. If you want to interoperate, release a program.
Re:Web Writable Files API: Simplifying Local File Access by why_only_15 on Monday November 12, 2018 @04:52PM (#18436234)
Do ACLs exist in Windows? I suppose you could just forbid the .exe extension to be used, but that doesn't seem like a very foolproof system.
Re:Web Writable Files API: Simplifying Local File Access by the8472 on Monday November 12, 2018 @05:09PM (#18436412)
Yes, NT ACLs are more fine-grained than posix acls.
Re:Web Writable Files API: Simplifying Local File Access by abtinf on Monday November 12, 2018 @07:22PM (#18437245)
Even if it doesn't result in executable code, there are dangers - browser-based ransomware attacks.
Re:Web Writable Files API: Simplifying Local File Access by joshfraser on Monday November 12, 2018 @08:35PM (#18437656)
That's a terrifying thought.

Congrats, you're two clicks away from having your entire machine bricked & held for ransom.