DEV Community


Discussion on: Google Chrome enables file system API ... Super Cool 😁

rubenwap profile image
Ruben Sanchez

Cannot wait for an exploit to be discovered and observe how personal information is stolen via this API.... or even without exploit, people being tricked into accepting this permission and then having malicious apps taking advantage of this.

Why is this API even necessary? I understand that for Google there is an amazing appeal about getting access to your local drive, but for the end user this means that native apps will be slowly disappearing to make room for horrible slow clunky web apps that can read all your files.

epavanello profile image
Emanuele Pavanello

For the same reason of leave horses to get heavier cars.
Or leave assembly to get slower programming languages.
It's called evolution.

sharadcodes profile image
Sharad Raj (He/Him) Author

Indeed, but there are advantages for PWAs especially in Android based like DEV itself

ivanjeremic profile image
Ivan Jeremic

I use only Web Apps, I replaced all the native apps with web apps and I love it!

genspirit profile image

I think it is obvious why the API is useful, productivity apps(as well as anything else that needs open and save files) on the web suffer from the friction of uploading and then downloading a file which makes for bad UX.

You can't account for every possibility but the permission management seems clear and doesn't persist. The notifications seem fairly overt as well. The fact that it is user driven too makes it hard to imagine that many/any users would not only accidentally allow permissions but then also accidentally select a sensitive file/directory. Only time will tell though.

ahferroin7 profile image
Austin S. Hemmelgarn

The 'upload' issue is actually a non-issue even without the FS API. You can (on a vast majority of modern browsers) pull off a 'fake' upload in any number of ways that works just fine without hitting the remote server.

Downloads are the big issue, because the current behavior of web browsers does not allow for apps to hint the browser that links should use 'Save As' behavior (but, FWIW, downloads don’t actually need to hit the server either, you can use either a Data URI (if the file is small enough) or the Blob API to generate a 'donwload' client side).

Thread Thread
qm3ster profile image
Mihail Malo

There's at least (or for older browsers, it actually took me longer to figure out "uploading" files locally than saving files.

moranmono profile image

Definitely true, the file upload bottle neck is the main reason I keep going back to desktop app

Thread Thread
sugumarworkspace profile image

Just a thought here. The overall the file system related use-cases on the web applications can be tackled like google drive or one drive sync pattern. Something like how our files from the local machine (in google/one drive) sync with cloud in timely fashion.

Instead of user upload directly on the web app via browser, they can upload into the sync path in local machine and that will sync the files to cloud.

z00md profile image

I also have the same view. The example use cases given on googles web dev page doesnt seem that relevant(Online IDE, Photo/Video editors etc). Also, spec does cover the security aspect but I still feel that this could go wrong.

Maybe this is geared towards converting web apps to offline mode. But sooner or later scammers will definitely find a way to abuse it. I would surely never give this permission to any site.

metruzanca profile image
Samuele Zanca

"horrible slow clunky web apps"

Last I checked web assembly is very usesable now. E.g. Blazor(c#) for something more mature and Yew(rust) for something still being worked on.