loading...
Cover image for Google Chrome enables file system API ... Super Cool 😁

Google Chrome enables file system API ... Super Cool 😁

sharadcodes profile image Sharad Raj (He/Him) ・1 min read

A new release of Google Chrome enables Native File System API so the developers can build web apps that interact with files on the user’s local device.

How will you use it ? πŸ™‚

Discussion

pic
Editor guide
Collapse
rubenwap profile image
Ruben Sanchez

Cannot wait for an exploit to be discovered and observe how personal information is stolen via this API.... or even without exploit, people being tricked into accepting this permission and then having malicious apps taking advantage of this.

Why is this API even necessary? I understand that for Google there is an amazing appeal about getting access to your local drive, but for the end user this means that native apps will be slowly disappearing to make room for horrible slow clunky web apps that can read all your files.

Collapse
genspirit profile image
Genspirit

I think it is obvious why the API is useful, productivity apps(as well as anything else that needs open and save files) on the web suffer from the friction of uploading and then downloading a file which makes for bad UX.

You can't account for every possibility but the permission management seems clear and doesn't persist. The notifications seem fairly overt as well. The fact that it is user driven too makes it hard to imagine that many/any users would not only accidentally allow permissions but then also accidentally select a sensitive file/directory. Only time will tell though.

Collapse
ahferroin7 profile image
Austin S. Hemmelgarn

The 'upload' issue is actually a non-issue even without the FS API. You can (on a vast majority of modern browsers) pull off a 'fake' upload in any number of ways that works just fine without hitting the remote server.

Downloads are the big issue, because the current behavior of web browsers does not allow for apps to hint the browser that links should use 'Save As' behavior (but, FWIW, downloads don’t actually need to hit the server either, you can use either a Data URI (if the file is small enough) or the Blob API to generate a 'donwload' client side).

Thread Thread
qm3ster profile image
Mihail Malo

There's at least github.com/jimmywarting/StreamSave... (or for older browsers github.com/eligrey/FileSaver.js), it actually took me longer to figure out "uploading" files locally than saving files.

Collapse
moranmono profile image
moranmono

Definitely true, the file upload bottle neck is the main reason I keep going back to desktop app

Thread Thread
sugumarworkspace profile image
sugumarworkspace

Just a thought here. The overall the file system related use-cases on the web applications can be tackled like google drive or one drive sync pattern. Something like how our files from the local machine (in google/one drive) sync with cloud in timely fashion.

Instead of user upload directly on the web app via browser, they can upload into the sync path in local machine and that will sync the files to cloud.

Collapse
z00md profile image
z00md

I also have the same view. The example use cases given on googles web dev page doesnt seem that relevant(Online IDE, Photo/Video editors etc). Also, spec does cover the security aspect but I still feel that this could go wrong.

Maybe this is geared towards converting web apps to offline mode. But sooner or later scammers will definitely find a way to abuse it. I would surely never give this permission to any site.

Collapse
epavanello profile image
Emanuele Pavanello

For the same reason of leave horses to get heavier cars.
Or leave assembly to get slower programming languages.
It's called evolution.
Horses

Collapse
ivanjeremic profile image
Ivan Jeremic

I use only Web Apps, I replaced all the native apps with web apps and I love it!

Collapse
metruzanca profile image
Samuele Zanca

"horrible slow clunky web apps"

Last I checked web assembly is very usesable now. E.g. Blazor(c#) for something more mature and Yew(rust) for something still being worked on.

Collapse
sharadcodes profile image
Sharad Raj (He/Him) Author

Indeed, but there are advantages for PWAs especially in Android based like DEV itself

Collapse
adam_cyclones profile image
Adam Crockett

Heres a diagram of Chromes new FootGun API

A diagram of the File System API

Collapse
ben profile image
Ben Halpern

How does this relate to standards, is this coming to Firefox, Safari, etc?

Collapse
daviddalbusco profile image
David Dal Busco

It's part of the project Fugu, you can probably ping Thomas Steiner about it.

I'll be interested to know the answer, so far my understanding was that it was a Chrome initiative.

This article on web.dev sums up the usage and status.

Collapse
sharadcodes profile image
Sharad Raj (He/Him) Author

Chrome 86 only for now I guess.

Collapse
ben profile image
Ben Halpern

Yup, not surprised about this for now, but anybody have an idea of where this might fit into the broader browser plans? I've seen this talked about, but only in the Chrome context.

Thread Thread
blindfish3 profile image
Ben Calder

I would expect no sane browser manufacturer to follow suit. Right now I can envision thousands of security admins having a complete meltdown over this and scrambling to remove Chrome from their networks ASAP. In a business environment this 'feature' is toxic.

Collapse
hedgy134117 profile image
Graham Smith

Yeah... This seems like a huge security issue. Correct me if I'm wrong, but most web browsers run in a sandboxed environment, making malicious attacks through just a website pretty much impossible. But with this, some website can just ask for file permissions and totally just wipe all your stuff. There would be no way to know whether or not the website is trustworthy. That's just my two cents.

Collapse
genspirit profile image
Genspirit

There are security implications but what you are talking about isn't really feasible. The website needs permission and the picker is user controlled. A website can only access files/directories selected by the user. Saving/Editing is also another user prompt(once permission is provided for a single file it remains until the tab is closed).

So in order for what you are discussing to happen a user would have to give permission and open up a directory on the site then also hit confirm every time the site tried to overwrite a file. It's not impossible but there are notable safeguards in place to prevent this.

Collapse
sharadcodes profile image
Collapse
shaijut profile image
Shaiju T

What about security ? Can user Allow or Disallow File access ?

Collapse
futureistaken profile image
R Z

Why did you ask? It's obvious!

Collapse
sharadcodes profile image
Sharad Raj (He/Him) Author

Yeah it asks for permission

Collapse
alvinometric profile image
Alvin Bryan

It reminds me when they disabled SharedArrayBuffer because of the massive Meltdown/Spectre stuff. I hope something similar doesn't happen with this.
I'm definitely disabling it for everything.

Collapse
sharadcodes profile image
Collapse
zilti profile image
Daniel Ziltener

I won't, and this "feature" needs to disappear again. That's horrid.

Collapse
sharadcodes profile image
Collapse
cawoodm profile image
Marc

TiddlyWiki

Collapse
yoursunny profile image
Junxiao Shi

I'm make a malware that accepts "file submission", but requests write permission from the careless user, and overwrites the file when the permission was granted.

Collapse
sharadcodes profile image
Collapse
quangpl profile image
Quang Phan

Oh... it must observe strictly :D

Collapse
ragzzyr profile image
Raghuram Iyer "Ragzzy-R"

nice. next is kernel access to the browser followed by access to CPU Registers.

Collapse
sharadcodes profile image
Collapse
blindfish3 profile image
Ben Calder

Yet another reason to never install Chrome. I imagine many security conscious businesses who currently use it will be having serious conversations about removing it from their networks.

Collapse
sharadcodes profile image
Sharad Raj (He/Him) Author

Well it will eventually be in the chromium based browsers, it was already there in flags, just disabled for everyone.

Collapse
alaindet profile image
Alain D'Ettorre
  • Cool: web apps take a step forward towards native
  • NOT cool: possibility of stealing data increases massively