Mega/Chrome not releasing temporary space

[watercooled]

I noticed my Chrome folder was getting fairly big so set about finding out why. Turns out it was the ...Chrome\User Data\Default\File System\ folder, or more specifically a file buried within.

After finding out the file system folder is used for HTML5 sandbox storage, I opened the file with 7zip and saw it contained something a friend had sent to me via Mega, a fairly large video file.

I understand the use of the sandbox for the Mega encryption/features/etc, but why isn't it/Chrome releasing the space? It's been several days since I downloaded it and clearing browser data doesn't empty it either. Also note, the contents were not encrypted in any way.

Considering they're flaunting the security of the system, why is a plaintext copy of the download silently stored in the Chrome directory? I know the 'security' is more about plausible deniability for themselves, but still...

If you've used it, check for yourselves, I'd be interested to know if you find anything.

[TheAnimus]

http://feross.org/fill-disk/

HTML5 web storage.... Yeah, not thrilled with it myself...

[watercooled]

Ah, brilliant, don't see any problem with that at all...

[BobF64]

Hmm, interesting.

I can see why it works like that, after all www.somesite.com might well be the same as stuff.somesite.com, but what about actually different subdomains? Where do you draw the line at the sites being the same or different?

[watercooled]

Limits per domain, or at least a conformation beyond a certain limit would be a start.

I find the fact a website can quite easily fill your HDD quite shocking TBH, even if it is sandboxed. Visit one malicious website and there goes a write cycle of your SSD. Not to mention Windows really doesn't like having zero free space.

Why am I reminded of the early days of Activex? Granted, the sandbox shouldn't allow anything more sinister to happen, but it's bad enough.

[watercooled]

Just noticed something rather ironic, the Google preview of the exploit site says it's using 150MB of space.

[Agent]

Why am I reminded of the early days of Activex?

Now now, let's not go totally insane!

[TheAnimus]

Now now, let's not go totally insane!

It is the problem thou isn't it.

Google and MS are really banging the HTML5 drum, firefox kind of are, but are trying to make HTML more in to an operating system in their phone (interesting concept, a security researchers wet dream too!)

MS haven't really done much with their OS integration stuff, originally they where talking about IE10 as having features to allow you to make your app "pinned" so the user couldn't tell it wasn't a regular desktop app. But that kinda fell by the wayside for metro. One of the things I find funny about people criticising metro is it has the simplicity to host exactly what people say they want from an HTML5 OS. No OS bits in the way, just a pure canvas..... But I digress.

People want HTML5 to do everything, but the problem is even something simple like clipboard is a fishy one. How should a web page go about pasting data? You could make something iirksome with it! Constantly blatting trollolol etc. Worse yet reading it!

You also have the other issue, windows is 'better'. Putting on my asbestos suit right now, but there still isn't anything as good as OLE/COM stuff yet that is mainstream and expected on every desktop. So how could I go about allowing someone to paste in something rich? What i want someone to be able to have a graph from an excel sheet which is actively ticking put in my webpage? Someone asked me for this a couple of months back. What about the inverse, someone wanting to paste a Table of data from a webpage, and have that table update as the webpage does? That was a massive bloody hack I don't mind telling you, but I managed that only because I could just write some native code inside Excel. I'll go off on one and explain what I mean, under windows I can find the source of the clipboard data, grab the HTML representation, find the tag in it that identifies its source, talk to the browser (only supported IE because its external automation support is better, well not just better its the only one that really has any) find the URL etc, pull out the session details, username, password, start a background thread which will constantly subscribe for the ajax notifications, then call excel with the new data.

The fun thing is, when you copy to the clipboard it is copied in multiple formats, people think of the clipboard as one thing... it isn't. Copy a bunch of table data from Excel that has differen't colours and text. Paste it once into Wordpad, Word, Notepad, Paint and <yourfavHtmlIde> you will get differen't bits of data. It's not that web browsers don't support clipboard, they don't even begin to start to support it.

And now you see why I get pissed off everyone is going on about HTML5. The vast majority of web devs I've met 90%+ are thick as constipated horse crap. True the vast majority of devs are useless. But web devs, you know, PHP, enough said. They constantly bang on about exciting new features which other mainstream platforms and languages have had for decades. And it creates a buzz.

This isn't to say that HTML isn't the exact right thing to make AirBnB in, but lets be honest, what that, and most websites do, is completely simple. Even the complex ones like Online Offices are utter poo. In fact the only thing which people appear to like is email. I think that is because the bar for offline email applications was so low.

[watercooled]

Although I've naively argued on the subject on the past, I'm no security expert, but I can see plenty of problems with bridging things to CSS without confirmation. On the subject of clipboard, based on the way HTML5 currently appears i.e. allow everything without question, what's to stop some rogue website nabbing the contents of the clipboard which could contain anything private/personal?

As facepalm-worthy as Java often is, at least it generally asks you before it runs and has decent access to your machine; as that website proves, HTML5 can be exploited to do strange things on your computer with no warning.