SoylentNews is people
SoylentNews
Google and Mozilla are working together on a method to let web apps gain access to users' files.
A group led by Google and Mozilla is working to make it easy to edit files using browser-based web apps but wants advice on how to guard against the "major" security and privacy risks.
The idea is to allow users to save changes they've made using web apps, without the hassle of having to download new files after each edit, as is necessary today.
[...] the W3C Web Incubator Community Group (WICG), which is chaired by representatives from Chrome developer Google and Firefox developer Mozilla, is working on developing the new Writable Files API, which would allow web apps running in the browser to open a file, edit it, and save the changes back to the same file.
However, the group says the biggest challenge will be guarding against malicious sites seeking to abuse persistent access to files on a user's system.
"By far the hardest part for this API is of course going to be the security model to use," warns the WICG's explainer page for the API.
"The API provides a lot of scary power to websites that could be abused in many terrible ways.
What could possibly go wrong?
(Score: 3, Interesting) by JoeMerchant on Sunday November 25 2018, @02:40AM (5 children)
Days gone by, you could click on an .exe on a webpage and run it. That didn't last too long, and the various sandboxes have gotten smaller and smaller over the years.
Personally, I don't see a problem with establishing a DMZ where files are accessible to the web browser, and it's as simple as that. People who want to leave their life history and financial records in the DMZ get what they deserve, otherwise: if you want to share a file, put it in the exposed folder and explicitly grant access to the folder when a website wants to slurp your file. End of story, what's to develop?
🌻🌻 [google.com]
(Score: 0) by Anonymous Coward on Sunday November 25 2018, @02:44AM
This never actually ended in the IE side of things because DirectX files are no different from EXE's (both are PE's, one is just not ran standalone but technically still has the same level of access if allowed to run).
(Score: 1, Insightful) by Anonymous Coward on Sunday November 25 2018, @09:55PM (3 children)
Bold of you to assume that users know what folders are and won't automatically click the "make it work and stop annoying me" button. I'm all for "fuck it, leave them to crash if they don't learn to drive and use a car anyway" but Google actively courts these idiots as customers as has a duty to them. Making cars safer to crash* and all that.
*crumple zones, airbags, seat belts, testing and caring about performance in crashes, &c
(Score: 4, Informative) by JoeMerchant on Monday November 26 2018, @01:49AM
Oh, no. I taught senior level computer engineering and actually had students tell me "this is a digital design class, I don't have to know how folders work for this subject..." Private university, I was later informed by management that "these are paying customers, as long as they show up they get at least a C." Welcome to quality education in the USA.
🌻🌻 [google.com]
(Score: 0) by Anonymous Coward on Monday November 26 2018, @03:21AM (1 child)
If you treat users like idiots they will become and remain greater idiots.
(Score: 0) by Anonymous Coward on Monday November 26 2018, @09:51PM
But would they be better enough to reduce harm further than the suite of modern safety features does?