I have the utmost respect for the engineers at Facebook. They are a very talented bunch, and the few of them I’ve had the pleasure to meet in person have even been nice folks to boot. Generally, they come up with very innovative and progressive engineering solutions to the huge problems they face, but their new photo uploader is one decision I completely disagree with.
The new Facebook in-browser photo uploaderĀ is detailed well in a post from their engineering blog (along with a slightly more detailed look at security), but in a nutshell, it involves installing a browser plugin to handle file uploads in a separate thread. This plugin also creates Javascript APIs to gain full filesystem access to your computer, and sets up a small web server to allow Facebook to ping back to your local machine to check the status of your uploads. The primary reason to use this plugin-based approach is to allow a user to begin uploading photos and have them continue in the background while continuing to browse around the site.
This is a noble thought, but I really think it’s just engineering for engineering sake. The multitude of issues surrounding creating and maintaining a plugin of this nature far outweigh the advantage of allowing background uploads. And if background uploads are really that important to them, they could have come up with a smart solution to make use of their current AJAX page loading process. This process, currently in place, allows certain browsers like Firefox to surf around Facebook without re-loading the whole page, so technically a simple Flash uploader could continue as part of the original parent page. It’s called progressive enhancement folks – the browsers that don’t support Facebook’s AJAX page loads can just use a normal uploading process.
And apart from all of that, what is stopping users from opening a new tab or window to continue browsing? Seems to work well for every other site out there.
Yes Facebook, your current photo uploader is awful, but let’s not create a huge security hole by exposing filesystem access to Javascript and running a little web server on everyone’s machine. I really don’t want to have to trust you to maintain security on your plugin (on three platforms, even), just so I can upload a photo.