5 ms·

> FileSystem Access is a significant security risk and we're not going to implement this Right now the Mozilla position is 'defer', not 'harmful'. See https://

> FileSystem Access is a significant security risk and we're not going to implement this Right now the Mozilla position is 'defer', not 'harmful'. See https://mozilla.github.io/standards-positions/#native-file-system https://mozilla.github.io/standards-positions/#native-file-s.... That means yes, they're not implemented today, but they're open to doing so later on, given further specification development and real-world investigation to confirm that the security implications are minimal. > No, we don't want fifteen different file access apis Looks like there is some ongoing work to synchronize these APIs to resolve that concern: https://docs.google.com/document/d/121OZpRk7bKSF7qU3kQLqAEUVSNxqREnE98malHYwWec/edit https://docs.google.com/document/d/121OZpRk7bKSF7qU3kQLqAEUV... --- I 100% agree Google is too aggressive at publishing and releasing these features without widespread consensus from other vendors. If they were doing so with just origin trials or behind a flag that would seem reasonable to me, but the widespread release is surely going to cause problems for these specs, when they must be aware that further development and changes is going to be required. I'm not clear how they intend to mature these standards without breaking the early adopters. I don't agree they're not desirable features though. Honestly I desperately wish Safari & Firefox would engage more and drive these specs themselves! It would be better to get their voices in the decisions that'll define these specs, rather than letting Google define the future of the web all by themselves. There's clearly demand for these features (read the comments of https://github.com/mozilla/standards-positions/issues/154 https://github.com/mozilla/standards-positions/issues/154 for some examples). It would be better to have privacy and security baked in with input from a broad group of actors (I think we can all agree that Firefox is going to be a more useful voice than Google in that sense). It's not helpful to let Google run off and write every standard themselves, with other browsers watching from the sidelines until it's sufficiently done (and unchangeable) and then having to either adopt the existing standard as-is by necessity or to refuse to support many real world web applications (for as long as that's tenable). Make no mistake - Chromium has the market share to be a workable target, and these APIs work well for developers and are genuinely useful. They will be used. There will be (in some areas there already is) a whole world of web apps using these APIs which only work in Chromium by necessity, no matter how much they'd like to support other browsers. As those get adopted by users, that's only going to drive the web further towards Chromium, until other browsers have to die or adopt the (entirely Google-written) standards themselves too to support the next generation of webapps. This is happening on desktop in some areas already. In IDEs, for example - if you buy any IoT based on Espruino, the primary dev tool only works in Chrome due to WebUSB/WebBluetooth (https://www.espruino.com/Web+IDE https://www.espruino.com/Web+IDE), while tools like Godot Editor are already talking about Chrome-only save/load support using these filesystem APIs (https://godotengine.org/article/godot-editor-running-web-browser https://godotengine.org/article/godot-editor-running-web-bro...), and I'd be extremely surprised if GitHub Codespaces and other tools aren't looking at doing the same. These are popular tools - many users want to use them, and they will have to switch to a Chromium-based browser to do so. Mobile is somewhat protected due to Safari being the only option on iPhone, but I wouldn't be surprised if the ongoing antitrust cases force them to open that up to make PWAs look like a plausible app store competitor, and the exact same thing happens there. WebExtensions is a case study of the same effect in the past. Chromium has so much weight that once they fully design and adopt an API and build an ecosystem around it, other browsers have to follow or get cut off. If Firefox & Safari had engaged with WebExtensions much earlier, they could have been driving it themselves and building consensus. Instead, they've had to copy every Google API while just tweaking around the edges. One exception, interestingly: Brave is doing some intriguing work on driving decentralization APIs for the web (native Web3, native IPFS). It's early days, but I'm hopeful that this might have the same effect in the opposite direction for those features!

dmitriid 5y ago
Firefox and Safari do engage early, and they do participate in discussions. GitHub comments are a very small visible part of it. However, Chrome simply inundates them with APIs. There are 50 to 100 new APIs that Chrome releases with each new version. And a new version comes out once every two months. So, Firefox and Safari have to be "actively engaged in discussions" on 300 to 600 new APIs a year [1]. This is not sustainable in any way, shape, or form. Hell, Microsoft gave up on developing a browser of their own, and they are definitely not lacking in resources. How is Mozilla expected to cope? Safari has decided to set their own pace, and flat out refuse APIs that breach security and privacy, because by this time Chrome teams should really know better (if only they cared). So, no, it's not true that Mozilla and Safari are "not engaged at an early stage". They are, to the best of their abilities and resources. But they also have browsers to develop, and in the end there are only so many hours in the day. [1] https://web-confluence.appspot.com/#!/confluence https://web-confluence.appspot.com/#!/confluence
- pimterry 5y ago
  I hear you, I'm not saying it's easy! Firefox especially desperately needs more funding here (and Apple more competition, on mobile at least). That said, that API count is referring to individual methods & fields (see https://web-confluence.appspot.com/#!/catalog https://web-confluence.appspot.com/#!/catalog) not whole specifications. I'm mainly concerned about them reviewing and making contributions to write these specs, rather the work to fully implement them, so that at least they end up with something they might be happy implementing in future. Either way, if every few months Chrome can genuinely churn out hundreds of APIs that developers genuinely want and use (a big caveat!) and Firefox/Safari can't keep up, then that's game over. Chromium has the market share, people will start using these APIs, serving a relatively worse and worse version for the slower browsers (if they bother), and eventually the older browsers will either have to implement them to according to these defacto standards, design & implement a sufficiently better alternative somehow, or die (for the average user, at least). Firefox beat IE last time because it took the 2nd option: it had better alternatives to Microsoft's non-standard web technologies (primarily: consistent APIs backed by clear standards and good tools that solved the same problems) and thereby managed to capture web developers and lead the compatibility game, rather than following. I don't see how they can do the same again if they can't propose workable alternatives to new standards other than 'defer' or 'reject'.

dmitriid 5y ago

Firefox and Safari do engage early, and they do participate in discussions. GitHub comments are a very small visible part of it. However, Chrome simply inundates them with APIs. There are 50 to 100 new APIs that Chrome releases with each new version. And a new version comes out once every two months. So, Firefox and Safari have to be "actively engaged in discussions" on 300 to 600 new APIs a year [1]. This is not sustainable in any way, shape, or form. Hell, Microsoft gave up on developing a browser of their own, and they are definitely not lacking in resources. How is Mozilla expected to cope? Safari has decided to set their own pace, and flat out refuse APIs that breach security and privacy, because by this time Chrome teams should really know better (if only they cared). So, no, it's not true that Mozilla and Safari are "not engaged at an early stage". They are, to the best of their abilities and resources. But they also have browsers to develop, and in the end there are only so many hours in the day. [1] https://web-confluence.appspot.com/#!/confluence https://web-confluence.appspot.com/#!/confluence

pimterry 5y ago
I hear you, I'm not saying it's easy! Firefox especially desperately needs more funding here (and Apple more competition, on mobile at least). That said, that API count is referring to individual methods & fields (see https://web-confluence.appspot.com/#!/catalog https://web-confluence.appspot.com/#!/catalog) not whole specifications. I'm mainly concerned about them reviewing and making contributions to write these specs, rather the work to fully implement them, so that at least they end up with something they might be happy implementing in future. Either way, if every few months Chrome can genuinely churn out hundreds of APIs that developers genuinely want and use (a big caveat!) and Firefox/Safari can't keep up, then that's game over. Chromium has the market share, people will start using these APIs, serving a relatively worse and worse version for the slower browsers (if they bother), and eventually the older browsers will either have to implement them to according to these defacto standards, design & implement a sufficiently better alternative somehow, or die (for the average user, at least). Firefox beat IE last time because it took the 2nd option: it had better alternatives to Microsoft's non-standard web technologies (primarily: consistent APIs backed by clear standards and good tools that solved the same problems) and thereby managed to capture web developers and lead the compatibility game, rather than following. I don't see how they can do the same again if they can't propose workable alternatives to new standards other than 'defer' or 'reject'.