What does the security model for opening the files look like? If you specify a directory chooser the app can span the directory tree and open/parse all files readable to the user? Any idea if it will walk symbolic links? I'm a bit surprised there isn't more of a user warning from the browser.
Nice proof of concept though! Very impressive what can be done. Worked well in stable channel + openSUSE.
Operating systems seem to care a lot about write access , less about read access. As much as browsers should care about this an OS should do some sandboxing.
The permission is implicitly granted by the user when they select a file. (Obviously this is implementation specific, but I think all implementations behave this was)
Worked well in Chrome 10 on Windows 7 for the first few minutes then crashed. Adding files was a little bit slow but the audio playback and tagging worked well. Nicely done though, it's very cool!
I'm quite curious about the file reading code. With a simple directory browse from the user couldn't you start to walk the file tree and read whatever you liked? Nothing I see to stop something like this then firing off Ajax calls to send up everything it finds. I think some digging through the code is in order.
It seems quite clear that you could package up all files and send them to the server. I've read through the code in this example though and I don't see anything that could be doing that here. Since all of the code is being served off of github I think it'd be pretty hard to switch in some malicious code at times, but I would be pretty wary of granting access to a webkitdirectory chooser type from a less transparent site.
Author of the app can read your directory listing (and whether that matters depends on what you have in this directory and whether you trust application's author)
Not talking about this specifically, but the model:
If an app only deals with local data, does it need to be a web app?, except that thereby it becomes zero-install, zero-update, global and cross-platform.
Could or is ChromeOS going to play local mp3s before? It's not much of an OS if it can only play mp3s on a server somewhere, with a browser plugin. Will Spotify and other streaming clients work on it? Is it cloud data only?
Well, it doesn't read ID3 tags, but if you just drag your music folder into Firefox, you can browse around and play MP3, Vorbis etc. files. It also works with videos.
Nice proof of concept though! Very impressive what can be done. Worked well in stable channel + openSUSE.