A new release of Google Chrome enables Native File System API so the developers can build web apps that interact with files on the user’s local device.
How will you use it ? 🙂
For further actions, you may consider blocking this person and/or reporting abuse
Latest comments (35)
TiddlyWiki
Heres a diagram of Chromes new FootGun API
Yet another reason to never install Chrome. I imagine many security conscious businesses who currently use it will be having serious conversations about removing it from their networks.
Well it will eventually be in the chromium based browsers, it was already there in flags, just disabled for everyone.
nice. next is kernel access to the browser followed by access to CPU Registers.
🤣
Yeah... This seems like a huge security issue. Correct me if I'm wrong, but most web browsers run in a sandboxed environment, making malicious attacks through just a website pretty much impossible. But with this, some website can just ask for file permissions and totally just wipe all your stuff. There would be no way to know whether or not the website is trustworthy. That's just my two cents.
There are security implications but what you are talking about isn't really feasible. The website needs permission and the picker is user controlled. A website can only access files/directories selected by the user. Saving/Editing is also another user prompt(once permission is provided for a single file it remains until the tab is closed).
So in order for what you are discussing to happen a user would have to give permission and open up a directory on the site then also hit confirm every time the site tried to overwrite a file. It's not impossible but there are notable safeguards in place to prevent this.
You're right
Oh... it must observe strictly :D
I'm make a malware that accepts "file submission", but requests write permission from the careless user, and overwrites the file when the permission was granted.
🤒
It reminds me when they disabled
SharedArrayBufferbecause of the massive Meltdown/Spectre stuff. I hope something similar doesn't happen with this.I'm definitely disabling it for everything.
I didn't know
I won't, and this "feature" needs to disappear again. That's horrid.
😅