5 ms·

You can check why Mozilla and Apple have opted to not support this. https://github.com/mozilla/standards-positions/issues/154 https://github.com/mozilla/standa

You can check why Mozilla and Apple have opted to not support this. https://github.com/mozilla/standards-positions/issues/154 https://github.com/mozilla/standards-positions/issues/154 https://github.com/WebKit/standards-positions/issues/28 https://github.com/WebKit/standards-positions/issues/28 Neither Mozilla or Webkit are satisfied that the proposal is safe by default, and contains footguns for the user that can be pretty destructive.

agust 3y ago
And what are they suggesting to improve the proposal? Apple, which makes $20B a year with Safari, surely has enough resources to make a counter-proposal?
- L3viathan 3y ago
  The counter-proposal is: don't do it. This comment by the Apple guy sums it up well IMHO: > Colleagues and I have discussed this and don't see a way to grant write access to the end user's local file system in a way that safeguards the end user's interests.
  - agust 3y ago
    So they can make it to work for platform-specific apps that they tax 30%, but can't make it to work for interoperable web apps which they can't tax. How convenient.
    - madeofpalk 3y ago
      Safari already supports a permission-less file system API with a very similar security model to iOS's filesystem access. https://developer.mozilla.org/en-US/docs/Web/API/File_System_API/Origin_private_file_system https://developer.mozilla.org/en-US/docs/Web/API/File_System... https://webkit.org/blog/12257/the-file-system-access-api-with-origin-private-file-system/ https://webkit.org/blog/12257/the-file-system-access-api-wit... It's able to support this because the 'file system' is scoped specifically to that origin, and doesn't allow access to any aribtary location on the file sytem, just like iOS.
      - hu3 3y ago
        Your parent comment point still valid. If Apple made arbitrary file access work for apps [1], surely they could make it work for Safari. But apps pay 30% and websites don't, so it's easy to conclude why they don't want to. [1] https://developer.apple.com/documentation/uikit/view_controllers/providing_access_to_directories https://developer.apple.com/documentation/uikit/view_control...
mg 3y ago
I think there is a pretty secure approach of doing it. 1) When loading a file, nothing needs to be different from the already available upload functionality. The user picks the file to load. 2) When saving a new file, nothing needs to be different from the already available download functionality. The user picks the name and the place to save it. Only after 1 or 2 have already happened can the page request to update the file. With the same name and location. In this case, the user gets a prompt that explains the risks and asks the them to confirm the update.
- madeofpalk 3y ago
  Yup - As commented in 2021 a 'Save As' API was seen as reasonable by Mozilla. I'm not sure what progress has been on the proposal since then. https://github.com/mozilla/standards-positions/issues/154#issuecomment-863349817 https://github.com/mozilla/standards-positions/issues/154#is...

agust 3y ago

And what are they suggesting to improve the proposal? Apple, which makes $20B a year with Safari, surely has enough resources to make a counter-proposal?

L3viathan 3y ago
The counter-proposal is: don't do it. This comment by the Apple guy sums it up well IMHO: > Colleagues and I have discussed this and don't see a way to grant write access to the end user's local file system in a way that safeguards the end user's interests.
- agust 3y ago
  So they can make it to work for platform-specific apps that they tax 30%, but can't make it to work for interoperable web apps which they can't tax. How convenient.
  - madeofpalk 3y ago
    Safari already supports a permission-less file system API with a very similar security model to iOS's filesystem access. https://developer.mozilla.org/en-US/docs/Web/API/File_System_API/Origin_private_file_system https://developer.mozilla.org/en-US/docs/Web/API/File_System... https://webkit.org/blog/12257/the-file-system-access-api-with-origin-private-file-system/ https://webkit.org/blog/12257/the-file-system-access-api-wit... It's able to support this because the 'file system' is scoped specifically to that origin, and doesn't allow access to any aribtary location on the file sytem, just like iOS.
    - hu3 3y ago
      Your parent comment point still valid. If Apple made arbitrary file access work for apps [1], surely they could make it work for Safari. But apps pay 30% and websites don't, so it's easy to conclude why they don't want to. [1] https://developer.apple.com/documentation/uikit/view_controllers/providing_access_to_directories https://developer.apple.com/documentation/uikit/view_control...

mg 3y ago

I think there is a pretty secure approach of doing it. 1) When loading a file, nothing needs to be different from the already available upload functionality. The user picks the file to load. 2) When saving a new file, nothing needs to be different from the already available download functionality. The user picks the name and the place to save it. Only after 1 or 2 have already happened can the page request to update the file. With the same name and location. In this case, the user gets a prompt that explains the risks and asks the them to confirm the update.

madeofpalk 3y ago
Yup - As commented in 2021 a 'Save As' API was seen as reasonable by Mozilla. I'm not sure what progress has been on the proposal since then. https://github.com/mozilla/standards-positions/issues/154#issuecomment-863349817 https://github.com/mozilla/standards-positions/issues/154#is...