Live data from Hacker News

Private client-side-only PWAs are hard, but now Apple made them impossible

andregarzia.com

341–350 of 927 posts

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#341

I think looking at Apple as saviour of Privacy, is for lack of better term just wrong. They have always favoured closed systems even if didn't provide privacy advantages or as in this case was counter-intuitive for privacy. I feel the comparison of Apple with data companies such as Google, Facebook is by itself at fault. Apple like any computer company of 70's was not into data, just because Internet itself didn't ex…

> They have always favoured closed systems even if didn't provide privacy advantages

Yes.

> or as in this case was counter-intuitive for privacy

I fail to see how this is counter-intuitive for privacy.

> iCloud hack

Targeted spearphising?

> Apple's response to iOS vulnerabilities targeted by state actors

https://news.ycombinator.com/item?id=20897368

> Newer Safari being incompatible with privacy extensions such as uBO etc.

https://news.ycombinator.com/item?id=21025252

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#342
post #314

Earlier quoted context omitted.

There are many legit uses for localStorage. Storing JWTs, game state data, etc.

why to store JWT in local storage. Localstorage can be accessed by CDN scripts also. Please don't put risk on ur users data.

Localstorage is limited to a domain, a common security model in the browser also used by cookies, and prevents cross-origin leaks... (unless a developer volunteers to expose the data via postmessage whose destination can also be limited to specific origins).

This is also why it is important to load your apps JS on your domain or same-origin and not offloaded to a 3rd party server which you might not control (libraries like jQuery CDNs and whatnot are still a minor risk, particularly from a privacy perspective, but not as bad, although I never saw the point with the large variety of versions).

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#343

Earlier quoted context omitted.

They do not "change from one week to another". They have changed, what, twice ever?

Two counterpoints: * AdoptOpenJDK releases that were notarized some months ago are no longer accepted by Apple since they made the rules even more stringent. I had releases accepted by Apple that are not accepted today using the same AdoptOpenJDK binaries. * Apple's notarization rules are not global. There's whitelists for given companies/institutions/apps/files which means the same dylib might not have to be notariz…

Do you have more details about this?

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#344
post #250

I think the original post is oversimplifying the new behaviour a little. If you look at the other blog post on ITP 2.3 [1] it says: > ITP 2.3 caps the lifetime of all script-writeable website data after a navigation with link decoration from a classified domain. i.e. the 7 day timeout for local storage only kicks in if you've been redirected from a domain that ITP has classified as one that tracks users. So, for exam…

This! ^ Could someone please change the title of this post? It's rather inaccurate and spreading FUD... legitimate offline web applications are not going to randomly lose their storage abilities in Safari. Tons of people read this (admittedly hard to follow) blog post quickly and then took a nose-dive into their own hot takes. Hoping Webkit pushes another of these posts later to clear things up.

They already have–the post referred above is old.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#345
post #314
post #309

Earlier quoted context omitted.

For your app, maybe. But most apps cannot be used offline at all, and instead they use localstorage as another place that can store tracking cookie. So as a user, I fully support this change, because there should not be a loophole like this.

There are many legit uses for localStorage. Storing JWTs, game state data, etc.

I have an old HTML5 game I made that stores a high score in localStorage. I might have to figure out an alternative solution later down the road.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#346

Earlier quoted context omitted.

So i can start to manage save files on my disk? in 2020?? this is absurd. apple should fix their safari bugs first before starting with this nonsense.

After the number of times my Firefox and Chromium profiles have been wiped clean due to browser or packaging bugs it's become clear to me that localStorage is not the end-all in terms of data persistence. It's always been a "best effort" rather than a guarantee. Browsers offer a lot of useful functionality, but people increasingly expect them to be a replacement or substitute for an operating system, and in terms of…

Well I've never lost anything other than the list of open tabs, and that's despite using alpha versions of firefox and chrome half the time. Cookies and localStorage aren't guaranteed but they're pretty reliable. I've had more trouble from native phone apps losing data than browsers on all platforms combined.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#347
post #71

Earlier quoted context omitted.

Good luck with telling people not to use Safari (or more accurately WebKit) on iOS....

You’re right. Tell people not to use iOS https://www.forbes.com/sites/gordonkelly/2020/03/14/apple-io... You Apple users will put up with anything! (disclaimer: iOS user)

By Gordon Kelly, who gained notoriety for his "nasty surprise" set of iOS articles he'd put out whenever there was a new iOS update. Glad to see he's still at it.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#348

Earlier quoted context omitted.

No, Apple offers anonymous user credential technology. Server gets unique identifier and ability to authenticate with no actual user info. Server gets an anonymous redirected email for sending info to the user. Apple is the intermediary. Of course, you can choose not to trust Apple, but Apple already has my info and their business model is not predicated on tracking and advertising. I'd rather continue to trust them…

I choose differently, but my choice may matter to you if I throw up my hands and say "Too much effort; if the user visits my site in Safari, I'm just going to toss up a banner page that says "this site does not work in your browser." It's a power-play on Apple's part to intermediate themselves where their inter-mediation isn't necessary. And all kinds of customers (enterprise in particular) won't appreciate Apple get…

Same. We momentarily considered adding Apple Login to our app when they changed the rules a couple weeks back, but instead we are removing all social login and migrating all accounts to (email/username)/password. Why?

Because a) it's even more code we now have to support, both in our apps even on android and on web -- a huge investment we are not prepared to make, and b) because for what we do, we actually do need to know the user is who they say they are (we offer the ability to contract a service between third parties, which means anonymity is NOT desired). I was never really comfortable using social login at all, for that second reason, but was pressed to by my peers; after Apple's shenanigans we came to the mutual decision that it was time to cut the cord. The login screen is already busy enough, we don't need yet another button. So we'll simplify.

For this latest change, it won't affect us much because I have always made it a policy neither to trust, nor to rely on, the data in Local Storage, and only to use it for performance boosting via caching. If data isn't there, it isn't there, and we go get it. This is largely due to historical reasons where browsers have always borked the LS implementation in one way or another, but it's beneficial now in that it won't really change anything for us.

I do feel for folks that are using it for genuine storage though, I know some apps that use it in order to AVOID storing private data on their servers, which will now have problems and be forced to reduce privacy in order to adapt.

This is definitely a power play on Apple's part to further weaken the web ecosystem. Device sales have been falling for years, they know their cash cow is their 30% cut on app purchases and IAP, and they aren't going to let the browser cut into that. Any "privacy" benefit in this case is purely incidental (and as noted above I believe it will do the opposite in many cases).

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#349
post #134

Earlier quoted context omitted.

> I’m guessing that Apple will start hindering web apps because the new mouse support in iPadOS is going to be such a boon to web apps. As a web developer , I've never believed Apple has hindered web development on their platform, purposefully or not. They just don't spend their resources adding in WebBluetooth or whatever new API-of-the-day Google has decided to come up with. As I see it, their focus is on the user…

That’s a very rosy way of looking at it. iOS has had bugs with its “add to home screen” webapps that kicked around literally for years . If they were being “user first” they’d support it fully or not support it at all. Instead they implemented then neglected it.

All parts of Apple's platform has had bugs that have kicked around for literally years. Their native SDK is infamously under documented and has all sorts of bugs https://twitter.com/caseyliss/status/1171778706878160897

The bugs in Apple's software, whether in web or native or in documentation are not part of some nefarious plot, its just a part of Apple's mismanagement and relatively minimal resources.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#350
I’m a little confused by this and maybe I’m missing something. Wasn’t localStorage always intended to be treated as a volatile storage mechanism for non-critical data and caching? The advice I’ve seen for several years says to avoid storing sensitive or critical data there.

Can PWAs not switch to using IndexedDB which seems like it’s more purpose-built for this use case?

No snark intended. I’m legitimately curious what the situation is and where any blockers are.

Post reply on HN