Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Private client-side-only PWAs are hard, but now Apple made them impossible

andregarzia.com

Post reply on HN
Print view View original

311–320 of 927 posts

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#311

Post by theamk »

felixfbecker wrote: post #117
im3w1l wrote: post #103

Earlier quoted context omitted.

It doesn't change the status quo. Important data wasn't put in cookies before, and it wont be after. It was always a recipe for data loss. Server side, or if you need privacy, have the user export to / import from a local file.

This is also about IndexedDB. Imagine native apps had all their data wiped if you don't open them (with an active internet connection) every 7 days. Not just on an iPhone, but also on macOS.

The big difference is native apps require explicit user content to get installed, while localstorage can be used by any website without user consent.

If browsers asked approval before using localstorage, we wouldn’t have this decision.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#313

Post by gridlockd »

diegoperini wrote: post #256
gridlockd wrote: post #240

Earlier quoted context omitted.

Dear lord, I hope you don't have any UX design responsibilies. > Apple didn't kill offline web apps. Yes, they did. For an app to work offline, you need to be able to at least cache the app itself. If that gets wiped after seven days, you can't call your app "offline capable". > If anything died here, it is the implicit consent by the user for allowing unnoticed storage space consumption. What about the "implicit con…

Your response sound a little angry but maybe the tone is lost in the text so I will respond in good faith. > I hope you don't have any UX design responsibilies. I don't. We are safe. :) > For an app to work offline, you need to be able to at least cache the app itself. You can still do it, for a limited time. Your mission critical app will work offline if you are not planning to isolate your device from the internet…

> If it is valuable, maybe browser is not the best medium for it.

Progressive web apps are not "the browser". It's a platform to ship apps using web technology that integrate into the operating system pretty like any other app, at least from the user's perspective. It works well enough on Android.

If you have to explain to your users all the caveats that such an app has on their platform, it just becomes pointless. If it becomes pointless on iOS, then it becomes pointless in general. You might as well go with a Web View app then.

Of course Apple has never been all that enthusiastic about PWAs, giving half-assed support at best. It was never a great platform to begin with, but now it's effectively dead in the water, at least for apps that are expected to work offline.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#314

Post by pier25 »

theamk wrote: post #309
matsemann wrote: post #76

Earlier quoted context omitted.

But wouldn't that make it have less privacy? Now my webapp cannot be used offline and anonymously, user has to be logged in and tracked

For your app, maybe. But most apps cannot be used offline at all, and instead they use localstorage as another place that can store tracking cookie. So as a user, I fully support this change, because there should not be a loophole like this.

There are many legit uses for localStorage.

Storing JWTs, game state data, etc.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#315

Post by Hackbraten »

throaway9aaaapp wrote: post #131

Our company has started shaming iOS. We tell users that because of a commercial policy aiming to increase their revenue from their App Store, iPhones and Ipads "do not support the Web 2.0 technology enabling powerful experiences for web sites and web applications, while Android and Windows devices have been supporting this technology since 201x". We briefly explain in one sentence that it would not be the best use of…

Are you aware of the poor security a $30 phone has?

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#316

Post by pier25 »

BiteCode_dev wrote: post #304
davweb wrote: post #250

I think the original post is oversimplifying the new behaviour a little. If you look at the other blog post on ITP 2.3 [1] it says: > ITP 2.3 caps the lifetime of all script-writeable website data after a navigation with link decoration from a classified domain. i.e. the 7 day timeout for local storage only kicks in if you've been redirected from a domain that ITP has classified as one that tracks users. So, for exam…

> website.example will be marked for non-cookie website data deletion if the user is navigated from a domain classified with cross-site tracking capabilities to a final URL with a query string and/or a fragment identifier, such as website.example?clickID=0123456789. So my guess is you are fine most of the time, except if you allow other sites to embed your content in their page. In that case, you should: - provide th…

It's very confusing...

I still don't understand if Safari will delete a JWT in localStorage used to talk to different microservices.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#317

Post by roblabla »

theamk wrote: post #311
felixfbecker wrote: post #117

Earlier quoted context omitted.

This is also about IndexedDB. Imagine native apps had all their data wiped if you don't open them (with an active internet connection) every 7 days. Not just on an iPhone, but also on macOS.

The big difference is native apps require explicit user content to get installed, while localstorage can be used by any website without user consent. If browsers asked approval before using localstorage, we wouldn’t have this decision.

Apple is actively refusing to implement the standard for installable webapps (PWA). So, Apple is intentionally crippling a feature on the grounds of privacy with no possible remedy.

This decision comes from an actor that is protecting their business interests. It might have some positive side-effect for some users, and of course Apple will spin it that way. But in the end Apple is very agressively hampering the web's progress to get their sweet 30% cut.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#318

Post by summerlight »

tekstar wrote: post #255
testtesttest wrote: post #254

Earlier quoted context omitted.

Open source is not the same as open. You can't run Firefox on an iPhone.

Sure you can https://apps.apple.com/ca/app/firefox-private-safe-browser/i...

Sure you can't. That's not Firefox, but Firefox-branded Safari.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#319

Post by BiteCode_dev »

pier25 wrote: post #316
BiteCode_dev wrote: post #304

Earlier quoted context omitted.

> website.example will be marked for non-cookie website data deletion if the user is navigated from a domain classified with cross-site tracking capabilities to a final URL with a query string and/or a fragment identifier, such as website.example?clickID=0123456789. So my guess is you are fine most of the time, except if you allow other sites to embed your content in their page. In that case, you should: - provide th…

It's very confusing... I still don't understand if Safari will delete a JWT in localStorage used to talk to different microservices.

It is confusing indeed.

My guess would be that if your user uses service site.com, calling using microservice micro.com, then you have to store the JWT in the localstorage of site.com, but cannot store it on the localStorage of micro.com.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#320

Post by thefounder »

diggan wrote: post #306
thefounder wrote: post #281

Earlier quoted context omitted.

>> I simply see no technological solution to this problem, it'll always be a cat-and-mouse game, until governments catch up and makes it illegal. Then you we will have privacy-avoidance companies just like we have tax avoidance. Problem solved!

Exactly, and when they get caught, they get fines or prison. Sounds good to me, let's ship it.

Let me correct that for you: When they get caught thet get a small fine(somewhere close to 1% of their profit) or no fine at all.
Post reply on HN