Is Google Gears safe?

Maybe early.

I am assuming the faq is slightly dated, but it does say

"Google Gears is currently an early-access developers' release. It is not yet intended for use by real users in production applications at this time."

I read developers page and they just allowed users to do off-line access to Google docs. I know they abuse the beta designation outrageously, but this does appear to be very early going for this stuff. If people like you point out the mistakes it's possible they will change it before it's out of beta (in twenty years or so). No never in hell would I trust it, but then I am like that never trust anyone or any software.

Security

Regarding the issue of security of the written data:

Why not just use one file per domain to store all data - ie. a database. Also, the content could be encrypted with a random key created during install. Even if you did try to write an executable to the database it would be impossible to run as it would be encrypted.

Unncessary

I'd say the dialog is unnecessary in the first place. The HTML 5 spec (and Safari) contain a similar sqlite-based client-side database already without any user prompts.

I take extreme exception to this statement:

"Avoid Gears when used by smaller organizations that might not have sites well defended against malware."

NO.

That comment is tantamount to a direct attack on SMBs. Money != security - Windows is the archetypal example of that. Just because SMBs don't spend millions on security doesn't mean their sites are not secure. Security is a matter of common sense and comprehensive testing, not the size of your bank account. And the attitude behind the comment - that SMBs are untrustworthy and you should only deal with large multinationals - is playing into the hands of big business and denying small ventures a slice of the market by spreading FUD about the supposed insecurity of SMB sites. As if the big sites are any more secure - witness Facebook and MySpace security as an example. Shame on you.

As the IT Manager for an SMB web developer, security of all our sites is my foremost concern. All our back-end code is developed in-house and tested exhaustively against all known attacks before being deployed. All user input is escaped and parsed before being processed, all our back-end scripts are refreshed daily from backups in case any become compromised, complete logs are kept of all site activity, and I liase regularly with our hosting provider on security issues. Yes, there have indeed been a few hack attempts on our sites (mostly attempts at XSS injection and uploading images containing malware) but so far all have been successfully foiled and all details have been forwarded to the relevant authorities.

Our clients rely heavily on their websites, and the few customers they can glean from major sites, for their relatively meagre income, and FUD like this doesn't help their cause. If everyone adopted this attitude towards SMBs, we would soon see a nice unsafe Internet with only 4 or 5 constantly-hacked websites ruled by a few massive corporations. Do not want.

Google Gears looks like it has the potential to make many webmasters' lives easier and allow the creation of much more effective and personalised websites. Don't let this innovation become the province only of the big players. Just as the terrorists win if we lose all our freedoms, so too the spammers and scammers win if your fear drives all but the major players off the Internet.

Security...

Not completely sure on this point, but afaik isn't Google Gears using a SQLite backend - i.e. there is never a question of file storage nor of executable content- it's a normal relational database.

You can't run a file through it any more than you can through javascript [and there's the rub]

Additionally, the level of trust in the URL is somewhat irrelevant, if you didn't have gears you wouldn't have seen anything different that would stopped you using javascript?

Security is the browser's responsibility

Surely everyone's missing the the obvious? The crux is that Gears is a piece of software that runs inside a browser, at the browser's discretion and under the browser's supervision. The user ought to be able to look at the browser logo and think "I know I'm safe with anything running inside this".

It shouldn't matter whether Gears is a product of Google, USA or Giggle, Sidcup, the security buck should stop with the browser, which should isolate Gears' data (whether SQL DB or exe or HTML or whatever) within the browser's execution context, and cache it within a private disk area.

And what's so special about Gears when we're talking about access to local disk resources? The browser should provide a caching facility to any other app wanting to preserve state.

It all boils down to the ever increasing prominence and functionality of the browser and the net and it's encroachment into the arena formerly dominated by OS-dependent applications. Microsoft has finally cottoned on to this and is scrambling to play catch-up.