Re: Intent to ship: Directory picking and directory drag-and-drop

[Andrea Marchesini]

I'm working on this. From an implementation point of view, we have almost
everything done and behind pref.
There are still some patches to review but it should not take too long.
The only missing piece is to change form submission but I should be able to
finish it for the next week.

More important is the security implications for the directory picker: bug
907707.

b


On Fri, Apr 15, 2016 at 5:31 AM,  wrote:

> Am Mittwoch, 23. September 2015 02:33:52 UTC+2 schrieb Jonas Sicking:
> > On Tue, Sep 22, 2015 at 11:16 PM, Eric Rescorla  wrote:
> > >> The api has been extensively discussed with all browser vendors and
> has
> > >> changed substantially in response to this
> > >
> > > Can you please point me to those changes and to the security analysis?
> >
> > Security wasn't discussed much in these conversations, and the changes
> > were all syntactical and didn't affect security. That's not to say
> > that no one has cared about security or been unaware about the
> > security implications, it's more due to the fact that any security
> > aspects here are likely to influence the API or the normative spec
> > text.
> >
> > But yes, I agree that we should have the security team look at this
> feature.
> >
> > / Jonas
>
> Any updates on this? How is the status? Feature is not shipped even in
> version 45 :(. Thanks.
> ___
> dev-platform mailing list
> dev-platform@lists.mozilla.org
> https://lists.mozilla.org/listinfo/dev-platform
>
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[google]

Am Mittwoch, 23. September 2015 02:33:52 UTC+2 schrieb Jonas Sicking:
> On Tue, Sep 22, 2015 at 11:16 PM, Eric Rescorla  wrote:
> >> The api has been extensively discussed with all browser vendors and has
> >> changed substantially in response to this
> >
> > Can you please point me to those changes and to the security analysis?
> 
> Security wasn't discussed much in these conversations, and the changes
> were all syntactical and didn't affect security. That's not to say
> that no one has cared about security or been unaware about the
> security implications, it's more due to the fact that any security
> aspects here are likely to influence the API or the normative spec
> text.
> 
> But yes, I agree that we should have the security team look at this feature.
> 
> / Jonas

Any updates on this? How is the status? Feature is not shipped even in version 
45 :(. Thanks.
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Jonas Sicking]

On Tue, Sep 22, 2015 at 11:16 PM, Eric Rescorla  wrote:
>> The api has been extensively discussed with all browser vendors and has
>> changed substantially in response to this
>
> Can you please point me to those changes and to the security analysis?

Security wasn't discussed much in these conversations, and the changes
were all syntactical and didn't affect security. That's not to say
that no one has cared about security or been unaware about the
security implications, it's more due to the fact that any security
aspects here are likely to influence the API or the normative spec
text.

But yes, I agree that we should have the security team look at this feature.

/ Jonas
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Jonathan Watt]

On 22/09/2015 15:46, Anne van Kesteren wrote:

On Mon, Sep 21, 2015 at 5:37 PM, Jonathan Watt  wrote:

2. https://wicg.github.io/directory-upload/proposal.html


It still seems bad that this is not being integrated into whatwg/html
directly.


It's not that this isn't going to happen (I would certainly expect it will), 
it's just that MS's strong preference is to work in WICG at the moment.



A ton of things are basically not defined right now.


Can you file issues for what you see in 
https://github.com/WICG/directory-upload/issues ? I've just been added as an 
editor and can hopefully promptly update the text.



It's
also unclear how this feature should work together with other
proposals that make .files writable and such.


When directory picking .files is required to be null. I'd think it would be up 
to such specs that make .files editable to also make the sequence 
getFilesAndDirectories resolves to editable too.



For a method that returns a promise, part of its definition says "If
the input type is not "file", nothing occurs." which doesn't really
mean anything.


Yeah, I already noted that in:

  https://github.com/WICG/directory-upload/issues/13

and now that I can edit the text I'll fix that up shortly.


This draft is a good sketch, but it's not a specification from which
we can create long term interoperable implementations.


If you can file the issues you see (or ping me on IRC) hopefully we can fill in 
the gaps to make it so.


___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Eric Rescorla]

On Tue, Sep 22, 2015 at 7:07 AM, Jonas Sicking  wrote:

>
> On Sep 21, 2015 11:57, "Eric Rescorla"  wrote:
> >
> > On Mon, Sep 21, 2015 at 11:23 AM, Jonas Sicking 
> wrote:
> >>
> >> Note that this, similarly to clipboard integration, is already exposed
> >> to the web through flash. So the main goal of this feature is to
> >> enable developers to migrate off of flash and instead use Gecko.
> >
> >
> > I'm not sure that this is the right standard. The reason that we are
> removing
> > Flash is that people are sad about some things in Flash. So I think we
> need
> > to replicate enough of Flash to get people to stop using it, but that
> doesn't
> > mean we need to have it be bug-for-bug compatible with every feature
> Flash
> > has, including features we think are bad.
>
> There are spec drafts written for most of this feature, with remaining
> parts on the way.
>
To the extent to which you're referring to:
https://wicg.github.io/directory-upload/proposal.html

I find it notable that it does not contain any security section, or to the
extent I can determine, even the word "security".

The api has been extensively discussed with all browser vendors and has
> changed substantially in response to this
>
Can you please point me to those changes and to the security analysis?

-Ekr
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Jonathan Watt]

On 22/09/2015 00:27, Richard Barnes wrote:

On Mon, Sep 21, 2015 at 6:58 PM, Jonathan Watt  wrote:

I don't think directory picking is bad - there are many sites with
legitimate uses. I think it's right that we need to think about the
security implications though, and members of the security team have been
looped in to consider these issues.



Who have you been talking to on the security team?  I haven't heard any
discussion of this in our security engineering meetings.  And I share EKR's
concerns here.


Yourself, dveditz and Jesse have all commented in the bug.

https://bugzilla.mozilla.org/show_bug.cgi?id=907707

When I said "looped in to consider these issues" that's what I meant.

___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Jet Villegas]

It looks like most of the Security discussion is happening in this bug now:
https://bugzilla.mozilla.org/show_bug.cgi?id=907707

--Jet

On Mon, Sep 21, 2015 at 9:18 PM, Eric Rescorla  wrote:

> On Mon, Sep 21, 2015 at 8:48 PM, Eric Shepherd 
> wrote:
>
> > Eric Rescorla wrote:
> >
> > I think there are some fairly obvious issues here, including:
> >
> > - There are obvious sensitive files you shouldn't upload under
> >   basically any conditions.
> > - It's hard for the client to know what the implications of any directory
> > upload are
> >   because they may not know what's in a given directory.
> >
> > I'm not a big fan of "the user is stupid and we have to protect him" as
> an
> > argument. :)
> >
>
> Conveniently, that's not what I said. There's lots of stuff that's in
> people's directories
> that they're not readily aware of, including dotfiles, missaves, etc.
>
>
>
> > There are a lot of genuinely valid use cases for this feature; yes,
> > security concerns should definitely be considered, but it's important to
> be
> > clear that if you want to address security concerns, or kill off the
> > feature entirely.
> >
>
> What's needed here is a real security assessment. That might lead to some
> sort of security mediations, and might also lead to the conclusion that it
> needs
> to be killed. But the first thing to do is an assessment. So far I haven't
> seen
> one.
>
> -Ekr
> ___
> dev-platform mailing list
> dev-platform@lists.mozilla.org
> https://lists.mozilla.org/listinfo/dev-platform
>
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Jonas Sicking]

On Sep 21, 2015 11:57, "Eric Rescorla"  wrote:
>
> On Mon, Sep 21, 2015 at 11:23 AM, Jonas Sicking  wrote:
>>
>> Note that this, similarly to clipboard integration, is already exposed
>> to the web through flash. So the main goal of this feature is to
>> enable developers to migrate off of flash and instead use Gecko.
>
>
> I'm not sure that this is the right standard. The reason that we are
removing
> Flash is that people are sad about some things in Flash. So I think we
need
> to replicate enough of Flash to get people to stop using it, but that
doesn't
> mean we need to have it be bug-for-bug compatible with every feature Flash
> has, including features we think are bad.

There are spec drafts written for most of this feature, with remaining
parts on the way. The api has been extensively discussed with all browser
vendors and has changed substantially in response to this.

/ Jonas
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Jonas Sicking]

On Sep 21, 2015 11:57, "Eric Rescorla"  wrote:
>
> On Mon, Sep 21, 2015 at 11:23 AM, Jonas Sicking  wrote:
>>
>> Note that this, similarly to clipboard integration, is already exposed
>> to the web through flash. So the main goal of this feature is to
>> enable developers to migrate off of flash and instead use Gecko.
>
>
> I'm not sure that this is the right standard. The reason that we are
removing
> Flash is that people are sad about some things in Flash. So I think we
need
> to replicate enough of Flash to get people to stop using it, but that
doesn't
> mean we need to have it be bug-for-bug compatible with every feature Flash
> has, including features we think are bad.

Sure, I agree that we shouldn't copy all of flash. But this is a feature
requested both by developers and users (again, like clipboard integration)
so I do think that this is a feature that we should copy.

/ Jonas
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Anne van Kesteren]

On Mon, Sep 21, 2015 at 5:37 PM, Jonathan Watt  wrote:
> 2. https://wicg.github.io/directory-upload/proposal.html

It still seems bad that this is not being integrated into whatwg/html
directly. A ton of things are basically not defined right now. It's
also unclear how this feature should work together with other
proposals that make .files writable and such.

For a method that returns a promise, part of its definition says "If
the input type is not "file", nothing occurs." which doesn't really
mean anything.

This draft is a good sketch, but it's not a specification from which
we can create long term interoperable implementations.


-- 
https://annevankesteren.nl/
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Anne van Kesteren]

On Tue, Sep 22, 2015 at 4:46 PM, Anne van Kesteren  wrote:
> This draft is a good sketch, but it's not a specification from which
> we can create long term interoperable implementations.

E.g., it claims  to build on the FileSystem API, but defines an
additional path member on Directory without mentioning why that is
done. And nobody (until I just did it) raised an issue on that. The
draft also doesn't define the directory content attribute at all as
far as I can tell, although the examples do assume it does
something... And that's just from a couple of minutes review.


-- 
https://annevankesteren.nl/
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Jonathan Watt]

That's a good question. There's been a bunch of discussion about this in 
https://bugzilla.mozilla.org/show_bug.cgi?id=907707


On 21/09/2015 16:49, Eric Rescorla wrote:

This seems like a fantastically dangerous feature and ripe for abuse.

Are we doing anything in the UI to make very clear to users what's going on?
Is there going to be a way to disable it?

-Ekr


On Mon, Sep 21, 2015 at 8:37 AM, Jonathan Watt  wrote:


Targeting Firefox 44 we intend to ship[1] Directory Upload[2], which
provides directory picking (via ) and directory
drag-and-drop. Our implementation has been developed behind the
`dom.input.dirpicker` preference, enabled only in Nightly builds so far.

In addition to previously announcing our intent to implement[3], Directory
Upload has also been publicized to public-wicg[4], public-webapps[5], and
planet.mozilla.org via my blog[6]. There has been very little formal
feedback other than a suggestion to also support Directory integration with
FormData (that would be a good and obvious enhancement) and some
questioning of whether I/O blocking is really an issue (it can be).
Informal feedback has been along the lines of "seems good to me". Further
feedback continues to be welcome of course.

Our informal understanding is that MS will not ship an implementation in
Edge until at least the new year.

-Jonathan

1. https://bugzilla.mozilla.org/show_bug.cgi?id=110
2. https://wicg.github.io/directory-upload/proposal.html
3.
https://groups.google.com/forum/#!topic/mozilla.dev.platform/Q3BLd4Cwj6Q
4. https://lists.w3.org/Archives/Public/public-wicg/2015Sep/.html
5.
https://lists.w3.org/Archives/Public/public-webapps/2015JulSep/0347.html
6. https://jwatt.org/blog/2015/09/14/directory-picking-and-drag-and-drop
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform



___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Eric Rescorla]

On Mon, Sep 21, 2015 at 8:48 PM, Eric Shepherd 
wrote:

> Eric Rescorla wrote:
>
> I think there are some fairly obvious issues here, including:
>
> - There are obvious sensitive files you shouldn't upload under
>   basically any conditions.
> - It's hard for the client to know what the implications of any directory
> upload are
>   because they may not know what's in a given directory.
>
> I'm not a big fan of "the user is stupid and we have to protect him" as an
> argument. :)
>

Conveniently, that's not what I said. There's lots of stuff that's in
people's directories
that they're not readily aware of, including dotfiles, missaves, etc.



> There are a lot of genuinely valid use cases for this feature; yes,
> security concerns should definitely be considered, but it's important to be
> clear that if you want to address security concerns, or kill off the
> feature entirely.
>

What's needed here is a real security assessment. That might lead to some
sort of security mediations, and might also lead to the conclusion that it
needs
to be killed. But the first thing to do is an assessment. So far I haven't
seen
one.

-Ekr
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Eric Shepherd]

Eric Rescorla wrote:
> I think there are some fairly obvious issues here, including:
>
> - There are obvious sensitive files you shouldn't upload under
>   basically any conditions.
> - It's hard for the client to know what the implications of any directory
> upload are
>   because they may not know what's in a given directory.
I'm not a big fan of "the user is stupid and we have to protect him" as
an argument. :)

There are a lot of genuinely valid use cases for this feature; yes,
security concerns should definitely be considered, but it's important to
be clear that if you want to address security concerns, or kill off the
feature entirely. I hope it's the former, because the number of times
this exact thing has come up for me is not easy to dig up, since it's
been a lot of times, especially when working on web deployments or
staging of assets for media services.

-- 

Eric Shepherd
Senior Technical Writer
Mozilla 
Blog: http://www.bitstampede.com/
Twitter: http://twitter.com/sheppy
Check my Availability 
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Eric Rescorla]

On Mon, Sep 21, 2015 at 3:58 PM, Jonathan Watt  wrote:

> On 21/09/2015 19:57, Eric Rescorla wrote:
>
>> On Mon, Sep 21, 2015 at 11:23 AM, Jonas Sicking  wrote:
>>
>> Note that this, similarly to clipboard integration, is already exposed
>>> to the web through flash. So the main goal of this feature is to
>>> enable developers to migrate off of flash and instead use Gecko.
>>>
>>>
>> I'm not sure that this is the right standard. The reason that we are
>> removing
>> Flash is that people are sad about some things in Flash. So I think we
>> need
>> to replicate enough of Flash to get people to stop using it, but that
>> doesn't
>> mean we need to have it be bug-for-bug compatible with every feature Flash
>> has, including features we think are bad.
>>
>
> I don't think directory picking is bad - there are many sites with
> legitimate uses


There are lots of features with legitimate uses which are also dangerous.
For instance, it would be convenient to be able to get access to your camera
and microphone without a prompt.

I think there are some fairly obvious issues here, including:

- There are obvious sensitive files you shouldn't upload under
  basically any conditions.
- It's hard for the client to know what the implications of any directory
upload are
  because they may not know what's in a given directory.



> . I think it's right that we need to think about the security implications
> though, and members of the security team have been looped in to consider
> these issues.
>

This seems like a procedural response, not a substantive one.

Where is the security analysis for this feature?

-Ekr
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Jonathan Watt]

On 21/09/2015 19:57, Eric Rescorla wrote:

On Mon, Sep 21, 2015 at 11:23 AM, Jonas Sicking  wrote:


Note that this, similarly to clipboard integration, is already exposed
to the web through flash. So the main goal of this feature is to
enable developers to migrate off of flash and instead use Gecko.



I'm not sure that this is the right standard. The reason that we are
removing
Flash is that people are sad about some things in Flash. So I think we need
to replicate enough of Flash to get people to stop using it, but that
doesn't
mean we need to have it be bug-for-bug compatible with every feature Flash
has, including features we think are bad.


I don't think directory picking is bad - there are many sites with legitimate 
uses. I think it's right that we need to think about the security implications 
though, and members of the security team have been looped in to consider these 
issues.


___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Jonathan Watt]

On 21/09/2015 19:31, Eric Shepherd wrote:

Jonas Sicking wrote:

Note that this, similarly to clipboard integration, is already exposed
to the web through flash. So the main goal of this feature is to
enable developers to migrate off of flash and instead use Gecko.

That said, if there are ways we can improve the UI here to further
explain to users what is going on, then that sounds good to me.

My concern with shipping this would be that it seems very far removed
from being a proper proposed spec at this point. Seems to just be an
unofficial draft. Shouldn't it spend more time preffed off to give
developers more time to offer feedback? It's only been a few weeks since
this was first brought up, and we've not exactly made it broadly known
that it could use some trying-out.


Fair points. Note than 44 doesn't ride the trains for another 6 weeks.

___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Eric Rescorla]

This seems like a fantastically dangerous feature and ripe for abuse.

Are we doing anything in the UI to make very clear to users what's going on?
Is there going to be a way to disable it?

-Ekr


On Mon, Sep 21, 2015 at 8:37 AM, Jonathan Watt  wrote:

> Targeting Firefox 44 we intend to ship[1] Directory Upload[2], which
> provides directory picking (via ) and directory
> drag-and-drop. Our implementation has been developed behind the
> `dom.input.dirpicker` preference, enabled only in Nightly builds so far.
>
> In addition to previously announcing our intent to implement[3], Directory
> Upload has also been publicized to public-wicg[4], public-webapps[5], and
> planet.mozilla.org via my blog[6]. There has been very little formal
> feedback other than a suggestion to also support Directory integration with
> FormData (that would be a good and obvious enhancement) and some
> questioning of whether I/O blocking is really an issue (it can be).
> Informal feedback has been along the lines of "seems good to me". Further
> feedback continues to be welcome of course.
>
> Our informal understanding is that MS will not ship an implementation in
> Edge until at least the new year.
>
> -Jonathan
>
> 1. https://bugzilla.mozilla.org/show_bug.cgi?id=110
> 2. https://wicg.github.io/directory-upload/proposal.html
> 3.
> https://groups.google.com/forum/#!topic/mozilla.dev.platform/Q3BLd4Cwj6Q
> 4. https://lists.w3.org/Archives/Public/public-wicg/2015Sep/.html
> 5.
> https://lists.w3.org/Archives/Public/public-webapps/2015JulSep/0347.html
> 6. https://jwatt.org/blog/2015/09/14/directory-picking-and-drag-and-drop
> ___
> dev-platform mailing list
> dev-platform@lists.mozilla.org
> https://lists.mozilla.org/listinfo/dev-platform
>
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Intent to ship: Directory picking and directory drag-and-drop

[Jonathan Watt]

Targeting Firefox 44 we intend to ship[1] Directory Upload[2], which provides 
directory picking (via ) and directory drag-and-drop. 
Our implementation has been developed behind the `dom.input.dirpicker` 
preference, enabled only in Nightly builds so far.


In addition to previously announcing our intent to implement[3], Directory 
Upload has also been publicized to public-wicg[4], public-webapps[5], and 
planet.mozilla.org via my blog[6]. There has been very little formal feedback 
other than a suggestion to also support Directory integration with FormData 
(that would be a good and obvious enhancement) and some questioning of whether 
I/O blocking is really an issue (it can be). Informal feedback has been along 
the lines of "seems good to me". Further feedback continues to be welcome of course.


Our informal understanding is that MS will not ship an implementation in Edge 
until at least the new year.


-Jonathan

1. https://bugzilla.mozilla.org/show_bug.cgi?id=110
2. https://wicg.github.io/directory-upload/proposal.html
3. https://groups.google.com/forum/#!topic/mozilla.dev.platform/Q3BLd4Cwj6Q
4. https://lists.w3.org/Archives/Public/public-wicg/2015Sep/.html
5. https://lists.w3.org/Archives/Public/public-webapps/2015JulSep/0347.html
6. https://jwatt.org/blog/2015/09/14/directory-picking-and-drag-and-drop
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Mats Palmgren]

On 09/21/2015 05:37 PM, Jonathan Watt wrote:

Targeting Firefox 44 we intend to ship[1] Directory Upload[2],


It seems there are many security, privacy and UI issues discussed in
bug 907707 that are still unresolved.  I see that it's blocking the
ship-it tracking bug, but it seems premature to discuss shipping this
feature before we have consensus on those issues.

https://bugzilla.mozilla.org/show_bug.cgi?id=907707

/Mats

___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Jonas Sicking]

Note that this, similarly to clipboard integration, is already exposed
to the web through flash. So the main goal of this feature is to
enable developers to migrate off of flash and instead use Gecko.

That said, if there are ways we can improve the UI here to further
explain to users what is going on, then that sounds good to me.

/ Jonas



On Mon, Sep 21, 2015 at 8:49 AM, Eric Rescorla  wrote:
> This seems like a fantastically dangerous feature and ripe for abuse.
>
> Are we doing anything in the UI to make very clear to users what's going on?
> Is there going to be a way to disable it?
>
> -Ekr
>
>
> On Mon, Sep 21, 2015 at 8:37 AM, Jonathan Watt  wrote:
>
>> Targeting Firefox 44 we intend to ship[1] Directory Upload[2], which
>> provides directory picking (via ) and directory
>> drag-and-drop. Our implementation has been developed behind the
>> `dom.input.dirpicker` preference, enabled only in Nightly builds so far.
>>
>> In addition to previously announcing our intent to implement[3], Directory
>> Upload has also been publicized to public-wicg[4], public-webapps[5], and
>> planet.mozilla.org via my blog[6]. There has been very little formal
>> feedback other than a suggestion to also support Directory integration with
>> FormData (that would be a good and obvious enhancement) and some
>> questioning of whether I/O blocking is really an issue (it can be).
>> Informal feedback has been along the lines of "seems good to me". Further
>> feedback continues to be welcome of course.
>>
>> Our informal understanding is that MS will not ship an implementation in
>> Edge until at least the new year.
>>
>> -Jonathan
>>
>> 1. https://bugzilla.mozilla.org/show_bug.cgi?id=110
>> 2. https://wicg.github.io/directory-upload/proposal.html
>> 3.
>> https://groups.google.com/forum/#!topic/mozilla.dev.platform/Q3BLd4Cwj6Q
>> 4. https://lists.w3.org/Archives/Public/public-wicg/2015Sep/.html
>> 5.
>> https://lists.w3.org/Archives/Public/public-webapps/2015JulSep/0347.html
>> 6. https://jwatt.org/blog/2015/09/14/directory-picking-and-drag-and-drop
>> ___
>> dev-platform mailing list
>> dev-platform@lists.mozilla.org
>> https://lists.mozilla.org/listinfo/dev-platform
>>
> ___
> dev-platform mailing list
> dev-platform@lists.mozilla.org
> https://lists.mozilla.org/listinfo/dev-platform
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Eric Shepherd]

Jonas Sicking wrote:
> Note that this, similarly to clipboard integration, is already exposed
> to the web through flash. So the main goal of this feature is to
> enable developers to migrate off of flash and instead use Gecko.
>
> That said, if there are ways we can improve the UI here to further
> explain to users what is going on, then that sounds good to me.
My concern with shipping this would be that it seems very far removed
from being a proper proposed spec at this point. Seems to just be an
unofficial draft. Shouldn't it spend more time preffed off to give
developers more time to offer feedback? It's only been a few weeks since
this was first brought up, and we've not exactly made it broadly known
that it could use some trying-out.

I like the idea in general though; having no way to do this has been a
long-standing problem when trying to build file server managers, sharing
services, and the like.

-- 

Eric Shepherd
Senior Technical Writer
Mozilla 
Blog: http://www.bitstampede.com/
Twitter: http://twitter.com/sheppy
Check my Availability 
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Intent to ship: Directory picking and directory drag-and-drop

[Eric Rescorla]

On Mon, Sep 21, 2015 at 11:23 AM, Jonas Sicking  wrote:

> Note that this, similarly to clipboard integration, is already exposed
> to the web through flash. So the main goal of this feature is to
> enable developers to migrate off of flash and instead use Gecko.
>

I'm not sure that this is the right standard. The reason that we are
removing
Flash is that people are sad about some things in Flash. So I think we need
to replicate enough of Flash to get people to stop using it, but that
doesn't
mean we need to have it be bug-for-bug compatible with every feature Flash
has, including features we think are bad.

-Ekr


> That said, if there are ways we can improve the UI here to further
> explain to users what is going on, then that sounds good to me.
>
> / Jonas
>
>
>
> On Mon, Sep 21, 2015 at 8:49 AM, Eric Rescorla  wrote:
> > This seems like a fantastically dangerous feature and ripe for abuse.
> >
> > Are we doing anything in the UI to make very clear to users what's going
> on?
> > Is there going to be a way to disable it?
> >
> > -Ekr
> >
> >
> > On Mon, Sep 21, 2015 at 8:37 AM, Jonathan Watt  wrote:
> >
> >> Targeting Firefox 44 we intend to ship[1] Directory Upload[2], which
> >> provides directory picking (via ) and
> directory
> >> drag-and-drop. Our implementation has been developed behind the
> >> `dom.input.dirpicker` preference, enabled only in Nightly builds so far.
> >>
> >> In addition to previously announcing our intent to implement[3],
> Directory
> >> Upload has also been publicized to public-wicg[4], public-webapps[5],
> and
> >> planet.mozilla.org via my blog[6]. There has been very little formal
> >> feedback other than a suggestion to also support Directory integration
> with
> >> FormData (that would be a good and obvious enhancement) and some
> >> questioning of whether I/O blocking is really an issue (it can be).
> >> Informal feedback has been along the lines of "seems good to me".
> Further
> >> feedback continues to be welcome of course.
> >>
> >> Our informal understanding is that MS will not ship an implementation in
> >> Edge until at least the new year.
> >>
> >> -Jonathan
> >>
> >> 1. https://bugzilla.mozilla.org/show_bug.cgi?id=110
> >> 2. https://wicg.github.io/directory-upload/proposal.html
> >> 3.
> >>
> https://groups.google.com/forum/#!topic/mozilla.dev.platform/Q3BLd4Cwj6Q
> >> 4. https://lists.w3.org/Archives/Public/public-wicg/2015Sep/.html
> >> 5.
> >>
> https://lists.w3.org/Archives/Public/public-webapps/2015JulSep/0347.html
> >> 6.
> https://jwatt.org/blog/2015/09/14/directory-picking-and-drag-and-drop
> >> ___
> >> dev-platform mailing list
> >> dev-platform@lists.mozilla.org
> >> https://lists.mozilla.org/listinfo/dev-platform
> >>
> > ___
> > dev-platform mailing list
> > dev-platform@lists.mozilla.org
> > https://lists.mozilla.org/listinfo/dev-platform
>
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform