[whatwg] Device Element

[Glenn Maynard]

On Sun, Jan 9, 2011 at 4:10 PM, Bjartur Thorlacius <svartman95 at gmail.com> wrote:
> On 1/9/11, Glenn Maynard <glenn at zewt.org> wrote:
>> File access control is currently, very clearly and very deliberately,
>> handled by the browser: web pages can only access files the user gives
>> to the page by selecting them in form input boxes.  What you're
>> actually saying is that this should be removed, web pages should be
>> able to access any local file that the OS user account the script is
>> running as has access to, and that users should control what files
>> they want web pages to access by modifying the operating system's
>> ACL's to grant and revoke access to web pages.
> Precisely. Any hurdles I've foreseen with that method so far are OS' faults.

Browsers can use OS mechanisms *under the hood* if they want, but it's
absolutely the browser's job to expose website-specific privilege
escalation to the user, and it's absolutely the job of designers of
web APIs to design mechanisms to request it.  (For example, a file
input box is a form of requesting privilege escalation.  By selecting
a file, you elevate the page's permissions temporarily to give it
access to that file.)

I'm very certain that HTML5 file access will not be changed to allow
any script to access any file that the OS allows the Javascript engine
to access.

-- 
Glenn Maynard