On Saturday, November 19, 2016 at 10:38:26 PM UTC+1, Josiah wrote:
>
> (3) Remains an issue.
>
> Whilst I understand there are things I don't grasp about browser limits, 
> I'm still finding it hard to grasp this ...
>
> ... why on earth its SO difficult to get a browser to stop saving 
> (downloading) TW as TW, TW(1), TW(2) etc, rather than being nudged to 
> overwrite TW as TW.
>

There are only 3 things that are essential for browsers. 

 1) security
 2) security.
 3) security!

Most browser vendors consider an "active" write from a web page to the 
harddisk as a security risk. 
Most vendors consider an active write from an file:// URI as a security 
risk too!

So they don't let us do this. period.

------- more detailed info ------------

A browser basically is a sandbox, that lets us (the users) execute 
untrusted code, from potentially evil sites, on our private computers, with 
a lot of private stuff on it. 
In favour of security, it is essential, that browsers don't allow javscript 
programs full access to the PC resources. I think, that's a good thing. 
right?


That's why browser vendors limit the access to the users harddisk in 
different ways. Depending on the browser vendor, those methods are 
completely different. 

eg: 

WebKit <https://en.wikipedia.org/wiki/WebKit>based browsers like Chrome, 
Safari, Opera and others *don't* allow javascript to *actively *write 
anything to the harddisk at all! It's forbidden! They don't let us do this! 
They provide us the "passive" file download feature instead :/

Gecko <https://en.wikipedia.org/wiki/Gecko_(software)>based browsers like 
FireFox and its cousins, let javascript actively write to the hardisk, if "
signed <https://wiki.mozilla.org/Add-ons/Extension_Signing>" AddOns are 
involved. The signing and review mechanism should protect users from evil 
software. 

Chakra <https://en.wikipedia.org/wiki/Chakra_(JScript_engine)>based 
browsers like IE10 allow AddOns 
<https://en.wikipedia.org/wiki/Chakra_(JScript_engine)> to actively write 
to the disk. The HTA file extension 
<https://en.wikipedia.org/wiki/HTML_Application> is treated as a trusted 
application, that allows an hta app file access out of the box. 

EdgeHTML <https://en.wikipedia.org/wiki/Microsoft_Edge#EdgeHTML>based 
browser like MS Edge try hard to be WebKit compatible. I don't know the 
details about MS Edge web extensions 
<https://en.wikipedia.org/wiki/Microsoft_Edge>. ... So not much info here. 
... Just NO active write, if WebKit compatibility is true!


An "active write" works like this: 

 - a javascript program says to the browser: "Hey browser, I want to save 
some content to the disk." 
   - "Give me a container, where I can write to"
 - The browser does as requested and offers a file-handler. (after the user 
explicitly allowed the AddOn to do so)
 - The program writes a new file to the harddisk. 
   - If the file exists, it's overwritten.  


A "passive" write / download works like this:

 1 a javascript program tells the browser, there is a file at location xxx 
with the name yyy.html, 
    - please download it. 
 2 The browser sends a request to the server: "Hey server send me file 
yyy.html"
 3 The server does this and
 4 the browser saves it as file: yyy.html
 5 If the user requests the same file-name again, the browser wants to be 
helpful and it doesn't overwrite the file
    - instead it saves the new file as yyy(1).html, because it could be a 
different file with the same name. 

With some js magic 
<https://developer.mozilla.org/en-US/docs/Web/API/URL/createObjectURL> its 
possible to do step 2,3,4 without the need of a server. So a javscript 
program like TW can use the "passive" download mechanism. 

I hope you can see, these 2 file saving mechanisms are completely 
different! 

-------------

So the reason why we can't just overwrite tw.html is: Many browser vendors 
just don't allow active file saving, initiated by a javascript app!
Even if we go like this 
<https://www.youtube.com/watch?v=snKGh-dahTA&feature=youtu.be&t=3356>, imo 
it won't happen ;)

------------

The full truth is: Also FireFox will make it harder or even impossible to 
use TiddlyFox in the future. IMO both security and performance wise. 
TiddlyFox type of plugins are incompatible with the new Webkit like 
WebExtensions 
<https://developer.mozilla.org/en-US/Add-ons/WebExtensions/What_are_WebExtensions>.
 


See paragraph 4. 

Before WebExtensions, you could develop Firefox add-ons using one of three 
> different systems: XUL/XPCOM overlays 
> <https://developer.mozilla.org/en-US/Add-ons/Overlay_Extensions>, 
> bootstrapped 
> extensions 
> <https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Bootstrapped_extensions>,
>  
> or the Add-on SDK 
> <https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/SDK>. In the 
> future, WebExtensions will be the recommended way to develop Firefox 
> add-ons, and other systems will be deprecated.
>

More research needs to be done!

I hope I could shed some more light on the topic. 

have fun!
mario




-- 
You received this message because you are subscribed to the Google Groups 
"TiddlyWiki" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to tiddlywiki+unsubscr...@googlegroups.com.
To post to this group, send email to tiddlywiki@googlegroups.com.
Visit this group at https://groups.google.com/group/tiddlywiki.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/tiddlywiki/07b802a0-d43d-40e1-b8b3-c13cbfdeb3a4%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Reply via email to