Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Things you can do with a browser in 2020

github.com

Post reply on HN
Print view View original

161–170 of 387 posts

Re: Things you can do with a browser in 2020

#161

Post by beagle3 »

saagarjha wrote: post #140
geofft wrote: post #85

Earlier quoted context omitted.

What's fantastic about native apps? I mean, I know why nation-state attackers love them - it's super easy to exploit them, and once you do, you have full access to everything in the user account (including all browser login sessions). But what's the advantage to users?

> I mean, I know why nation-state attackers love them - it's super easy to exploit them, and once you do, you have full access to everything in the user account (including all browser login sessions). Not on mobile.

https://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537a... (and google "pegasus nso whatsapp" for more)

tl;dr: The exploitation was indeed done through apps. The OS itself is harder to exploit, but most apps are not as secure and provide the first foot-in-the-door for the attacker.

Re: Things you can do with a browser in 2020

#162

Post by dzonga »

browsers are truly a universal too and a great equalizer. not only do they enable open platforms, away from the walled gardens. they also provide a way to share software for 94% majority. But alas, people these days are fighting against browsers. heck a good portion of web developers out there don't know semantic html or what good it can do. they were raised in the SPA era. view source is now foreign to most people. or that html pages are automatically cached for offline is foreign to most people too. what a sad state of affairs.

Re: Things you can do with a browser in 2020

#163

Post by findyourexit »

nneonneo wrote: post #159

The Web Coffee API ( https://github.com/luruke/browser-2020#web-coffee-api ) is my favorite of the bunch. I definitely recommend checking out the linked WHATWG documentation, as well as the relevant RFC for the HTTP protocol: https://tools.ietf.org/html/rfc2324 What can’t a browser do these days?

The Web Coffee API caught my attention, and was the first link I clicked through... Needless to say, I was not disappointed!

Re: Things you can do with a browser in 2020

#164

Post by AgentME »

eeZah7Ux wrote: post #145
modeless wrote: post #54

Earlier quoted context omitted.

If operating systems had ever provided security strong enough to run untrusted code, we wouldn't have needed to. It's really a failing of operating system security. Even today no operating system provides an application sandbox as strong and versatile as the browser. Platforms have fallen back on walled gardens (app stores) with centralized control of all code execution to compensate for the deficiencies of their sec…

> It's really a failing of operating system security Please stop the gaslighting. Virtual machines and sandboxes existed decades before browsers.

It counts whether the platform makes it easy to use and promotes it in a way so that average users actually use it.

If I create a native Windows app and link people the .exe to try it out, approximately 0% of people who run it are going to run it in a securely sandboxed way. If I create a web app and link people it to try it out, approximately 100% of people who run it are going to run it in a securely sandboxed way.

Furthermore, some people will specifically avoid trying out the .exe I send them because they don't trust me fully with everything on their computer. As a developer that wants to show off things I make, I don't want this obstacle to exist. If I make a web app instead, I know it's more likely people will try it out.

Re: Things you can do with a browser in 2020

#165

Post by saagarjha »

beagle3 wrote: post #161
saagarjha wrote: post #140

Earlier quoted context omitted.

> I mean, I know why nation-state attackers love them - it's super easy to exploit them, and once you do, you have full access to everything in the user account (including all browser login sessions). Not on mobile.

https://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537a... (and google "pegasus nso whatsapp" for more) tl;dr: The exploitation was indeed done through apps. The OS itself is harder to exploit, but most apps are not as secure and provide the first foot-in-the-door for the attacker.

I am responding specifically to the claim that once you've exploited an app, you have full access to the user's entire account (which is true to some extent on desktop platforms, but not on mobile OSes by default). I left a comment elsewhere about the kind of attack you're talking about: https://news.ycombinator.com/item?id=22632756

Re: Things you can do with a browser in 2020

#166

Post by millstone »

AgentME wrote: post #99
millstone wrote: post #68

Earlier quoted context omitted.

Yes, OS-specific applications are good, and we should have more of them. By "sticking to one OS", and apps that follow the OS's conventions, users actually have a chance to develop expertise in those apps. But the web ensures that everyone stays an amateur. While website capabilities have evolved, the web UI itself has regressed. No major UI paradigms have emerged from the web since the 90s (except tabs, arguably). U…

My point is that if the web didn't evolve, then Windows would have further cemented its position. If people made Windows apps instead of websites, then other operating systems and mobile wouldn't have taken off as much because fewer people would make multiple apps than the number of people in our world who made cross-platform web apps. Also, all of those features that rkagerer complained about would be even more abus…

No OS has "taken off" because of the web. Windows is as cemented on desktop as ever, and ChromeOS (the only post-web desktop OS of note) has a fraction of a percent marketshare.

iOS initially had a web-app-only developer story (the "sweet solution"), but the quality gap between web and native apps was so undeniable that Apple reversed course and shipped a native SDK. It would be no different today.

The quality gap is not about buttons that look different. It's that nothing behaves consistently. Every site does its own custom thing, so users are forced into the lowest common denominator of interactivity (click or tap).

Examples: Gmail has its own fake windows, context menus, dropdowns, drag and drop, key equivalents, etc. and they all fall apart as soon as you try to do anything nontrivial with them. And it's been like this for 15 years, so I don't see any cause for optimism on this front.

Re: Things you can do with a browser in 2020

#167

Post by snazz »

jfkebwjsbx wrote: post #158
TheCoelacanth wrote: post #147

Earlier quoted context omitted.

kernel = browser, user land = web apps I don't understand what you mean by "In the browser everything is exposed to everyone by default". Browsers have a much more robust security and privacy model than normal OSes.

False. For starters, browsers can only implement sandboxing thanks to the OS facilities, otherwise it would be impossible. And that is modern ones. 5 years ago some browsers were still a security nightmare with not even multiprocess separation.

Five years ago was 2015. Chrome has had multiprocess and sandboxing for a lot longer than that.

Re: Things you can do with a browser in 2020

#168

Post by wffurr »

rkagerer wrote: post #28

As a user, so many of these I wish did NOT exist. E.g: Push Notifications, Banners, Web Share, Contacts, Page Visibility, Badging. Uncertain about USB, Bluetooth, Locks, Keyboard Lock, and Native File System. I don't want my browser doing those things.

I want useful programs that happen to run in a browser to do these things, after asking my permission.

I don't want every random local news paper or internet chum site prompting me for every permission under the sun every visit.

Re: Things you can do with a browser in 2020

#169

Post by deadmutex »

saagarjha wrote: post #148
deadmutex wrote: post #53

Earlier quoted context omitted.

That has its own set of challenges -- now you have to design your game so that the battery indicator doesn't cover up an important part of the game. Also, what if the OS allows it to be configurable location/size, etc.

Sounds like a job for safe area insets.

Thanks! I did not know about these before. It looks like a step in the right direction. Though what would be the next step? It seems like there would still the complexity of laying out all the controls/HUD (or other visual elements) in the game.

Re: Things you can do with a browser in 2020

#170

Post by deadmutex »

CraneWorm wrote: post #73
deadmutex wrote: post #53

Earlier quoted context omitted.

That has its own set of challenges -- now you have to design your game so that the battery indicator doesn't cover up an important part of the game. Also, what if the OS allows it to be configurable location/size, etc.

> now you have to design your game so that the battery indicator doesn't cover up an important part of the game You should not be able to do that; It's a feature that you cannot do that.

? You should not be able to re-layout your visual elements in the game if the battery indicator hides it?
Post reply on HN