DEV Community πŸ‘©β€πŸ’»πŸ‘¨β€πŸ’»

DEV Community πŸ‘©β€πŸ’»πŸ‘¨β€πŸ’» is a community of 966,155 amazing developers

We're a place where coders share, stay up-to-date and grow their careers.

Create account Log in
Cover image for Google Chrome enables file system API ... Super Cool 😁
Sharad Raj (He/Him)
Sharad Raj (He/Him)

Posted on

Google Chrome enables file system API ... Super Cool 😁

A new release of Google Chrome enables Native File System API so the developers can build web apps that interact with files on the user’s local device.

How will you use it ? πŸ™‚

Top comments (36)

Collapse
 
rubenwap profile image
Ruben Sanchez

Cannot wait for an exploit to be discovered and observe how personal information is stolen via this API.... or even without exploit, people being tricked into accepting this permission and then having malicious apps taking advantage of this.

Why is this API even necessary? I understand that for Google there is an amazing appeal about getting access to your local drive, but for the end user this means that native apps will be slowly disappearing to make room for horrible slow clunky web apps that can read all your files.

Collapse
 
genspirit profile image
Genspirit

I think it is obvious why the API is useful, productivity apps(as well as anything else that needs open and save files) on the web suffer from the friction of uploading and then downloading a file which makes for bad UX.

You can't account for every possibility but the permission management seems clear and doesn't persist. The notifications seem fairly overt as well. The fact that it is user driven too makes it hard to imagine that many/any users would not only accidentally allow permissions but then also accidentally select a sensitive file/directory. Only time will tell though.

Collapse
 
ahferroin7 profile image
Austin S. Hemmelgarn

The 'upload' issue is actually a non-issue even without the FS API. You can (on a vast majority of modern browsers) pull off a 'fake' upload in any number of ways that works just fine without hitting the remote server.

Downloads are the big issue, because the current behavior of web browsers does not allow for apps to hint the browser that links should use 'Save As' behavior (but, FWIW, downloads don’t actually need to hit the server either, you can use either a Data URI (if the file is small enough) or the Blob API to generate a 'donwload' client side).

Thread Thread
 
qm3ster profile image
Mihail Malo

There's at least github.com/jimmywarting/StreamSave... (or for older browsers github.com/eligrey/FileSaver.js), it actually took me longer to figure out "uploading" files locally than saving files.

Collapse
 
amt8u profile image
amt8u

I also have the same view. The example use cases given on googles web dev page doesnt seem that relevant(Online IDE, Photo/Video editors etc). Also, spec does cover the security aspect but I still feel that this could go wrong.

Maybe this is geared towards converting web apps to offline mode. But sooner or later scammers will definitely find a way to abuse it. I would surely never give this permission to any site.

Collapse
 
epavanello profile image
Emanuele Pavanello • Edited on

For the same reason of leave horses to get heavier cars.
Or leave assembly to get slower programming languages.
It's called evolution.
Horses

Collapse
 
ivanjeremic profile image
Ivan Jeremic

I use only Web Apps, I replaced all the native apps with web apps and I love it!

Collapse
 
metruzanca profile image
Samuele Zanca

"horrible slow clunky web apps"

Last I checked web assembly is very usesable now. E.g. Blazor(c#) for something more mature and Yew(rust) for something still being worked on.

Collapse
 
sharadcodes profile image
Sharad Raj (He/Him) Author • Edited on

Indeed, but there are advantages for PWAs especially in Android based like DEV itself

Collapse
 
adam_cyclones profile image
Adam Crockett • Edited on

Heres a diagram of Chromes new FootGun API

A diagram of the File System API

Collapse
 
ben profile image
Ben Halpern

How does this relate to standards, is this coming to Firefox, Safari, etc?

Collapse
 
daviddalbusco profile image
David Dal Busco • Edited on

It's part of the project Fugu, you can probably ping Thomas Steiner about it.

I'll be interested to know the answer, so far my understanding was that it was a Chrome initiative.

This article on web.dev sums up the usage and status.

Collapse
 
sharadcodes profile image
Sharad Raj (He/Him) Author

Chrome 86 only for now I guess.

Collapse
 
ben profile image
Ben Halpern

Yup, not surprised about this for now, but anybody have an idea of where this might fit into the broader browser plans? I've seen this talked about, but only in the Chrome context.

Thread Thread
 
blindfish3 profile image
Ben Calder

I would expect no sane browser manufacturer to follow suit. Right now I can envision thousands of security admins having a complete meltdown over this and scrambling to remove Chrome from their networks ASAP. In a business environment this 'feature' is toxic.

Collapse
 
hedgy134117 profile image
Graham Smith

Yeah... This seems like a huge security issue. Correct me if I'm wrong, but most web browsers run in a sandboxed environment, making malicious attacks through just a website pretty much impossible. But with this, some website can just ask for file permissions and totally just wipe all your stuff. There would be no way to know whether or not the website is trustworthy. That's just my two cents.

Collapse
 
genspirit profile image
Genspirit

There are security implications but what you are talking about isn't really feasible. The website needs permission and the picker is user controlled. A website can only access files/directories selected by the user. Saving/Editing is also another user prompt(once permission is provided for a single file it remains until the tab is closed).

So in order for what you are discussing to happen a user would have to give permission and open up a directory on the site then also hit confirm every time the site tried to overwrite a file. It's not impossible but there are notable safeguards in place to prevent this.

Collapse
 
sharadcodes profile image
Sharad Raj (He/Him) Author

You're right

Collapse
 
shaijut profile image
Shaiju T

What about security ? Can user Allow or Disallow File access ?

Collapse
 
futureistaken profile image
R Z

Why did you ask? It's obvious!

Collapse
 
sharadcodes profile image
Sharad Raj (He/Him) Author

Yeah it asks for permission

 
sugumarworkspace profile image
sugumarworkspace

Just a thought here. The overall the file system related use-cases on the web applications can be tackled like google drive or one drive sync pattern. Something like how our files from the local machine (in google/one drive) sync with cloud in timely fashion.

Instead of user upload directly on the web app via browser, they can upload into the sync path in local machine and that will sync the files to cloud.

Collapse
 
alvinb profile image
Alvin Bryan

It reminds me when they disabled SharedArrayBuffer because of the massive Meltdown/Spectre stuff. I hope something similar doesn't happen with this.
I'm definitely disabling it for everything.

Collapse
 
sharadcodes profile image
Sharad Raj (He/Him) Author

I didn't know

Collapse
 
zilti profile image
Daniel Ziltener

I won't, and this "feature" needs to disappear again. That's horrid.

Collapse
 
sharadcodes profile image
Sharad Raj (He/Him) Author

πŸ˜…

Collapse
 
cawoodm profile image
Marc

TiddlyWiki

Collapse
 
yoursunny profile image
Junxiao Shi

I'm make a malware that accepts "file submission", but requests write permission from the careless user, and overwrites the file when the permission was granted.

Collapse
 
sharadcodes profile image
Sharad Raj (He/Him) Author

πŸ€’

Collapse
 
quangpl profile image
Quang Phan

Oh... it must observe strictly :D

Collapse
 
ragzzyr profile image
Raghuram Iyer "Ragzzy-R"

nice. next is kernel access to the browser followed by access to CPU Registers.

Collapse
 
sharadcodes profile image
Sharad Raj (He/Him) Author

🀣

Collapse
 
blindfish3 profile image
Ben Calder

Yet another reason to never install Chrome. I imagine many security conscious businesses who currently use it will be having serious conversations about removing it from their networks.

Collapse
 
sharadcodes profile image
Sharad Raj (He/Him) Author

Well it will eventually be in the chromium based browsers, it was already there in flags, just disabled for everyone.

Collapse
 
alaindet profile image
Alain D'Ettorre
  • Cool: web apps take a step forward towards native
  • NOT cool: possibility of stealing data increases massively

"I made 10x faster JSON.stringify() functions, even type safe"

☝️ Must read for JS devs