8 ms·

One of the great things about browsers is the way you can trust them to be reasonably sandboxed from the rest of your machine. Features like this chip away at t

One of the great things about browsers is the way you can trust them to be reasonably sandboxed from the rest of your machine. Features like this chip away at that trust model and open up new attack vectors against unsuspecting users. I get the usability benefits, but the security implications are scary. How easy would it be to trick my mother into uploading her profile picture and have the site change that file into a malicious executable without her realizing? At a minimum, I'd hope you would be restricted from changing file permissions or editing any executables.

nine_k 8y ago
As you surely noticed, for last 10 years the browser is actively trying to replace your desktop OS, so that the browser would become the platform, instead of Windows / macOS / Linux / anything else. Imagine the desktop becoming ChromeOS on any computer, not just Chromebooks. For this, the browser must make all the traditional OS interfaces available. It has interfaces for accelerated 2D and 3D graphics, audio, USB, process management (workers), networking (including peer-to-peer), and a number of persistence mechanisms. But before it takes over completely, it has to interoperate with the host OS a bit, too, by exposing the filesystem. (A decade more, and maybe the vision of Inferno [1] will sort of kind of be implemented.) [1]: https://en.wikipedia.org/wiki/Inferno_(operating_system) https://en.wikipedia.org/wiki/Inferno_(operating_system)
- Individualist 8y ago
  I would argue that you could use a combination of local storage and global state in these web apps to approximate a file system already. Not to mention lazy loading and web workers to cache larger files needed to run a web app. As well as parrelism and currency already offered by web workers.
  - nine_k 8y ago
    Approximation is not what it's about. It's about integration. Write that google doc and store it as a local .docx or .odc. Edit that 20 MB raw picture in a browser app and store it back to the disk, instantly, then feed it to a traditional desktop editor. Write that Python script in a Web IDE, store locally, and upload it to an Arduino.
    - coverband 8y ago
      All those use cases and more can be accomplished if the Write API is limited to a sandboxed local storage with a configurable size limit per domain. I would hate to see all the gains made by sandboxing the browser fly away by allowing it to access any file on the user's system.
      - nicoburns 8y ago
        I think the idea here is that you'd whitelist files/folders on your actual filesystem for use with the app. This sounds fantastic for me. There's so many useful web based tools that are a pain to work with because you have to manually sync files to and from them.
- justizin 8y ago
  The ChromeOS browser does not have access to local files, it can download files to a ~/Downloads folder, but it cannot manipulate local files. The entire point of ChromeOS is aggressive sandboxing, not breaking out of the sandbox.
  - pjmlp 8y ago
    Apparently I can write files in ChromeOS. https://developer.chrome.com/apps/fileSystem https://developer.chrome.com/apps/fileSystem
    - xrd 8y ago
      You get access to this if you have written a Chromebook app. If you get a user to install that, there is a clear set of permissions they are accepting. See the section on permissions, which is specified in the app manifest. It is not an open hole for anything running on a Chromebook.
      - pjmlp 8y ago
        Or a Chrome app, even though they are currently deprecated. Yes the user needs to install it, and then it is free reign for $HOME. So it isn't Download location only.
- rkagerer 8y ago
  Am I the only crusty old fart who thinks this a lousy trend? I worry the next talented generation of developers is being alienated from the desktop, and as a result my computing experience will degrade as Chrome's piecemeal attempts to reinvent the OS leave me with an inferior selection of browser-based toys that are awkward and clunky compared to their native counterparts. I grant the browser fixes a couple things my OS got wrong: installation/uninstallation and updates. But it feels like it does everything else worse.
  - Spivak 8y ago
    Is it really surprising that in the wake of multiple platforms that refuse to interoperate that an OS that runs on top of every other OS is massively popular? It doesn't matter that it's clunky and bad, CS people love working with hard to use systems, it just matters that it works.
    - millstone 8y ago
      The websites google.com and facebook.com and twitter.com (to distinguish from their mobile apps) are very popular, but the most part these sites just render text and images. google.com doesn't try to search my local drive. faceboook.com doesn't offer to share my local photos. Their usage of "browser as an OS" is extremely limited. I worry about the other problem: the browser becomes so ubiquitous the OS disappears, along with any platform conventions and application interop.
  - rhlsthrm 8y ago
    But why is it always necessarily "awkward and clunky"? As always on network connection becomes more and more ubiquitous, internet connected experiences become better and better. Just look at (well-designed) experiences today like streaming video. I'm excited about things like WASM that will allow browser-based experiences to close the gap more and more with native apps. The web infrastructure is extremely powerful and has a fairly low barrier to entry so lots of people throw crappy experiences up, granted, but it's generally a good thing to have the resources so accessible.
- gojomo 8y ago
  Just the "last 10 years"? Nah, replacing the desktop OS has been the goal of browser-makers since the founding of Netscape nearly 25 years ago.
  - grayrest 8y ago
    I'd agree with the 10 year timeframe. Before that browsers were basically aiming for HyperCard. It was only after the combination of the WhatWG and the emergence of the app store as an ecosystem threat that the browser vendors have pushed the browser towards OS replacement.
    - gojomo 8y ago
      Sorry, the 90s were a real time, and the ambition to replace the desktop OS was already there, as per the ~1995 Bob Metcalfe quip (popularized by Marc Andreesen) that the Netscape browser would soon reduce Windows to "a poorly debugged set of device drivers". There was a bit of a lull in progress in the mid-2000s, after the fall of Netscape Inc, until the rise of the mobile app threat you mention.
    - goatlover 8y ago
      Bill Gates did see Netscape as a potential threat to Windows. Java with Sun's "the network is the computer" motto as well. So yeah, people in the 90s were dreaming big. And then in the 2000s people were complaining that Microsoft set computing back by a decade.
fouc 8y ago
And more than that, I honestly wonder about the motives of an advertising driven company these days. It feels like 5 years later this will come to bite us in the ass as another way of exploiting access to our computer and data. What if websites start requiring specific files to exist before allowing access?
- dmurray 8y ago
  > What if websites start requiring specific files to exist before allowing access? Like session cookies, or SSL certificates?
- politician 8y ago
  > What if websites start requiring specific files to exist before allowing access? This is certainly going to be immediately abused for encrypted storage of persistent cookies and tracking identifiers. - If my site generates cat pics, I'll put identifiers in the metadata fields of the image format. - If my site generates markdown, I'll put identifiers in an alternate data stream (Windows) or encoded in the whitespace. Since the files exist outside of the sandbox, they'll be outside of the scope of privacy features like clearing the cache or cookies, and outside of the reach of adblocker extensions.
  - icebraining 8y ago
    Nobody said the sites would have unfettered access to these files like they do with their cookies. Putting an ID on a photo is useless if you then have to ask the user to read it again the next time. Also, why would they be outside the reach of adblockers? WebExtensions can already intercept and manipulate the use of certain APIs by sites, the same can easily apply here.
  - gdfasfklshg4 8y ago
    I suspect it will start with persistent login based on a file and grow from there.
- Ajedi32 8y ago
  > What if websites start requiring specific files to exist before allowing access? This isn't just unrestricted filesystem access. The site would need to request file system permission first, _and_ get the user to select the file in a file picker. In short, that's not a serious concern.
the8472 8y ago
You could set the whole directory tree to no-execute via ACLs. Anyway, more interoperability with the native environment is a good thing. Right now browsers are an alien implant in every operating system that can't communicate with anything else.
- iforgotpassword 8y ago
  Which is a good thing and should be kept that way. If you want to interoperate, release a program.
- why_only_15 8y ago
  Do ACLs exist in Windows? I suppose you could just forbid the .exe extension to be used, but that doesn't seem like a very foolproof system.
  - the8472 8y ago
    Yes, NT ACLs are more fine-grained than posix acls.
abtinf 8y ago
Even if it doesn't result in executable code, there are dangers - browser-based ransomware attacks.
- joshfraser 8y ago
  That's a terrifying thought. Congrats, you're two clicks away from having your entire machine bricked & held for ransom.

nine_k 8y ago

As you surely noticed, for last 10 years the browser is actively trying to replace your desktop OS, so that the browser would become the platform, instead of Windows / macOS / Linux / anything else. Imagine the desktop becoming ChromeOS on any computer, not just Chromebooks. For this, the browser must make all the traditional OS interfaces available. It has interfaces for accelerated 2D and 3D graphics, audio, USB, process management (workers), networking (including peer-to-peer), and a number of persistence mechanisms. But before it takes over completely, it has to interoperate with the host OS a bit, too, by exposing the filesystem. (A decade more, and maybe the vision of Inferno [1] will sort of kind of be implemented.) [1]: https://en.wikipedia.org/wiki/Inferno_(operating_system) https://en.wikipedia.org/wiki/Inferno_(operating_system)

Individualist 8y ago
I would argue that you could use a combination of local storage and global state in these web apps to approximate a file system already. Not to mention lazy loading and web workers to cache larger files needed to run a web app. As well as parrelism and currency already offered by web workers.
- nine_k 8y ago
  Approximation is not what it's about. It's about integration. Write that google doc and store it as a local .docx or .odc. Edit that 20 MB raw picture in a browser app and store it back to the disk, instantly, then feed it to a traditional desktop editor. Write that Python script in a Web IDE, store locally, and upload it to an Arduino.
  - coverband 8y ago
    All those use cases and more can be accomplished if the Write API is limited to a sandboxed local storage with a configurable size limit per domain. I would hate to see all the gains made by sandboxing the browser fly away by allowing it to access any file on the user's system.
    - nicoburns 8y ago
      I think the idea here is that you'd whitelist files/folders on your actual filesystem for use with the app. This sounds fantastic for me. There's so many useful web based tools that are a pain to work with because you have to manually sync files to and from them.
justizin 8y ago
The ChromeOS browser does not have access to local files, it can download files to a ~/Downloads folder, but it cannot manipulate local files. The entire point of ChromeOS is aggressive sandboxing, not breaking out of the sandbox.
- pjmlp 8y ago
  Apparently I can write files in ChromeOS. https://developer.chrome.com/apps/fileSystem https://developer.chrome.com/apps/fileSystem
  - xrd 8y ago
    You get access to this if you have written a Chromebook app. If you get a user to install that, there is a clear set of permissions they are accepting. See the section on permissions, which is specified in the app manifest. It is not an open hole for anything running on a Chromebook.
    - pjmlp 8y ago
      Or a Chrome app, even though they are currently deprecated. Yes the user needs to install it, and then it is free reign for $HOME. So it isn't Download location only.
rkagerer 8y ago
Am I the only crusty old fart who thinks this a lousy trend? I worry the next talented generation of developers is being alienated from the desktop, and as a result my computing experience will degrade as Chrome's piecemeal attempts to reinvent the OS leave me with an inferior selection of browser-based toys that are awkward and clunky compared to their native counterparts. I grant the browser fixes a couple things my OS got wrong: installation/uninstallation and updates. But it feels like it does everything else worse.
- Spivak 8y ago
  Is it really surprising that in the wake of multiple platforms that refuse to interoperate that an OS that runs on top of every other OS is massively popular? It doesn't matter that it's clunky and bad, CS people love working with hard to use systems, it just matters that it works.
  - millstone 8y ago
    The websites google.com and facebook.com and twitter.com (to distinguish from their mobile apps) are very popular, but the most part these sites just render text and images. google.com doesn't try to search my local drive. faceboook.com doesn't offer to share my local photos. Their usage of "browser as an OS" is extremely limited. I worry about the other problem: the browser becomes so ubiquitous the OS disappears, along with any platform conventions and application interop.
- rhlsthrm 8y ago
  But why is it always necessarily "awkward and clunky"? As always on network connection becomes more and more ubiquitous, internet connected experiences become better and better. Just look at (well-designed) experiences today like streaming video. I'm excited about things like WASM that will allow browser-based experiences to close the gap more and more with native apps. The web infrastructure is extremely powerful and has a fairly low barrier to entry so lots of people throw crappy experiences up, granted, but it's generally a good thing to have the resources so accessible.
gojomo 8y ago
Just the "last 10 years"? Nah, replacing the desktop OS has been the goal of browser-makers since the founding of Netscape nearly 25 years ago.
- grayrest 8y ago
  I'd agree with the 10 year timeframe. Before that browsers were basically aiming for HyperCard. It was only after the combination of the WhatWG and the emergence of the app store as an ecosystem threat that the browser vendors have pushed the browser towards OS replacement.
  - gojomo 8y ago
    Sorry, the 90s were a real time, and the ambition to replace the desktop OS was already there, as per the ~1995 Bob Metcalfe quip (popularized by Marc Andreesen) that the Netscape browser would soon reduce Windows to "a poorly debugged set of device drivers". There was a bit of a lull in progress in the mid-2000s, after the fall of Netscape Inc, until the rise of the mobile app threat you mention.
  - goatlover 8y ago
    Bill Gates did see Netscape as a potential threat to Windows. Java with Sun's "the network is the computer" motto as well. So yeah, people in the 90s were dreaming big. And then in the 2000s people were complaining that Microsoft set computing back by a decade.

fouc 8y ago

And more than that, I honestly wonder about the motives of an advertising driven company these days. It feels like 5 years later this will come to bite us in the ass as another way of exploiting access to our computer and data. What if websites start requiring specific files to exist before allowing access?

dmurray 8y ago
> What if websites start requiring specific files to exist before allowing access? Like session cookies, or SSL certificates?
politician 8y ago
> What if websites start requiring specific files to exist before allowing access? This is certainly going to be immediately abused for encrypted storage of persistent cookies and tracking identifiers. - If my site generates cat pics, I'll put identifiers in the metadata fields of the image format. - If my site generates markdown, I'll put identifiers in an alternate data stream (Windows) or encoded in the whitespace. Since the files exist outside of the sandbox, they'll be outside of the scope of privacy features like clearing the cache or cookies, and outside of the reach of adblocker extensions.
- icebraining 8y ago
  Nobody said the sites would have unfettered access to these files like they do with their cookies. Putting an ID on a photo is useless if you then have to ask the user to read it again the next time. Also, why would they be outside the reach of adblockers? WebExtensions can already intercept and manipulate the use of certain APIs by sites, the same can easily apply here.
- gdfasfklshg4 8y ago
  I suspect it will start with persistent login based on a file and grow from there.
Ajedi32 8y ago
> What if websites start requiring specific files to exist before allowing access? This isn't just unrestricted filesystem access. The site would need to request file system permission first, _and_ get the user to select the file in a file picker. In short, that's not a serious concern.

the8472 8y ago

You could set the whole directory tree to no-execute via ACLs. Anyway, more interoperability with the native environment is a good thing. Right now browsers are an alien implant in every operating system that can't communicate with anything else.

iforgotpassword 8y ago
Which is a good thing and should be kept that way. If you want to interoperate, release a program.
why_only_15 8y ago
Do ACLs exist in Windows? I suppose you could just forbid the .exe extension to be used, but that doesn't seem like a very foolproof system.
- the8472 8y ago
  Yes, NT ACLs are more fine-grained than posix acls.

abtinf 8y ago

Even if it doesn't result in executable code, there are dangers - browser-based ransomware attacks.

joshfraser 8y ago
That's a terrifying thought. Congrats, you're two clicks away from having your entire machine bricked & held for ransom.