file-system-access VS webusb

You can read about the privacy concerts the community group published [1].

[1]: https://wicg.github.io/file-system-access/#privacy-considera...

WHATWG File System Standard provides a means to write directories and files to the private origin storage associated with a Web page origin. If you want you can use WICG File System Access API to write data directly to your filesystem in the browser. WHATWG File System Standard uses the same FileSystemDirectoryHandle and FileSystemFileHandle defined by File System Access API.

Chromium-based browsers support File Systeam Access API.

We have stopped using the file system access API: https://github.com/WICG/file-system-access/issues/401

Where file handling is concerned, there are at least

- File System Access API, https://wicg.github.io/file-system-access/

- File Handling, https://github.com/WICG/file-handling/blob/master/explainer....

- Origin Private File System, https://github.com/WICG/file-system-access/blob/main/AccessH...

There was also Storage Foundation API to which the reaction was "I don't think it's an acceptable outcome for the web platform to have that many ways to work with files" :) https://github.com/mozilla/standards-positions/issues/481 This one never saw the light of day.

Huh. Disregard what I wrote entirely, then. Reading through https://github.com/WICG/file-system-access/blob/main/AccessH..., I can see how they’ve bypassed most of the problems I saw—I was making unnecessary assumptions.

Thank you for correcting me.

> Browsers have never let anything (not even JS) have raw access to the host FS

I'm not sure what you mean by "raw access", but the File System Access API certainly allows web applications to do a lot of things.

> The File System Access API (formerly known as Native File System API and prior to that it was called Writeable Files API) enables developers to build powerful web apps that interact with files on the user's local device, like IDEs, photo and video editors, text editors, and more.

https://web.dev/file-system-access/

> After a user grants a web app access, this API allows the app to read or save changes directly to files and folders on the user’s device. Beyond reading and writing files, this API provides the ability to open a directory and enumerate its contents. Additionally, web apps can use this API to store references to files and directories they’ve been given access to, allowing the web apps to later regain access to the same content without requiring the user to select the same file again.

> Additionally this API also makes it possible for websites to get access to some directory without having to first prompt the user for access.

https://wicg.github.io/file-system-access/

It's not just a draft, it's been part of Chrome since version 78 in 2019.

> After a user grants access, this API allows web apps to read or save changes directly to files and folders on the user's device. It does all this by invoking the platform's own open and save dialog boxes.

https://blog.chromium.org/2019/09/chrome-78-beta-new-houdini...

Discussion at the time:

https://news.ycombinator.com/item?id=21032537

In the post, the Vite webserver is only used to serve the HTML and JS static files to the browser. When the user saves or opens text files, the code uses the web File System Access API (https://wicg.github.io/file-system-access/) to interact with the user file system.

Have you heard of Project Fugu and their idea of a File System Access API in the browser? https://wicg.github.io/file-system-access/

I don't know a C++ equivalent of HTML , prompt(), or File System Access API (https://wicg.github.io/file-system-access/; https://web.dev/file-system-access/) using JavaScript in the browser window.

> WebUSB is actually a W3C open standard.

This is misleading at best. Here’s what the actual spec says <https://wicg.github.io/webusb/>:

> This specification was published by the Web Platform Incubator Community Group. It is not a W3C Standard nor is it on the W3C Standards Track.

It’s an experimental spec by Google (observe the affiliation of the three editors: all Google); Mozilla has adopted a negative position on it <https://mozilla.github.io/standards-positions/#webusb>; WebKit has not remarked upon it.

This is such a lame argument. You want it to be true but have no evidence that it actually is true.

A lot of the Chrome team's "standards" have problems with accessibility, workability on mobile, security[0], privacy[1], or just battery life. Some are neat experiments that are or only will be used in the wild by advertisers to track and identify users.

Because the Safari/WebKit team doesn't have to chase users for revenue like Mozilla does they can afford to be more conservative with what Google "standards" they support. Being able to offer a tighter privacy posture or efficiency is part of the iOS/macOS sales pitch.

[0] https://github.com/WICG/webusb/issues/50

[1] https://www.theverge.com/2021/4/16/22387492/google-floc-ad-t...

Limiting it to installed apps still has the problem of users blindly agreeing to something that is fundamentally super dangerous. I don’t believe installing PWAs currently exposes any new security surface, so this would be a significant change, and worse still a persistent hazard with probably no indication of what’s going on when it’s in use. I think there’s still potential in the general concept, but it’d take work and is certainly not ready yet in any browser.

Yes, certain classes are restricted from access via WebUSB for security, https://wicg.github.io/webusb/#protected-interface-classes. But as the note says, it’s about balance: that list is necessary for security, but not sufficient.