Private client-side-only PWAs are hard, but now Apple made them impossible • Hacker News Board

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#391

Post by JumpCrisscross » Wed, Mar 25, 2020, 7:05 PM UTC

Animats wrote: post #385

What are private client-side PWAs anyway? Good question. The definition of a "progressive web app" is vague. What they seem to mean is a web page which, once you visit it, is cached locally, and thereafter runs locally. The web page accesses various servers, not necessarily ones from the same domain as the web page. Persistent state, if any, is stored locally. The page gets its own icon on the home screen somehow, so…

> Apple apparently dislikes this because they don't get to force people to use their store

This is part of the motivation. The other is advertisers using persistent local storage to track users [1].

[1] https://clearcode.cc/blog/alternatives-to-cookie-tracking/

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#392

Post by deedubaya » Wed, Mar 25, 2020, 7:05 PM UTC

thehappypm wrote: post #377

Maybe I'm being cynical here -- I'm not a web developer but have lots of experiencing managing web-based products -- but if you want to have state you should store it in the cloud, because local devices are volatile. Xbox Live, for example, uses a fairly simple service for cloud saves for games; local saves still happen but any developer has the option to push saves to the cloud. The author definitely raises good poi…

Yes, you're correct, but have you ever used an app that worked offline or performed well with a poor network connection? Or a website maybe provided wicked fast data access despite only having a 2G connection?

These technologies can be leveraged to improve usability. Unfortunately, advertisers and 3rd party trackers make it so we can't have nice things.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#393

Post by KarlKemp » Wed, Mar 25, 2020, 7:05 PM UTC

redindian75 wrote: post #375

soapdog wrote: post #368

Earlier quoted context omitted.

Even web apps that you add to your home screen are subjected to this.

"Web applications added to the home screen are not part of Safari and thus have their own counter of days of use."[1] From WebKit: [1] https://webkit.org/blog/10218/full-third-party-cookie-blocki... A Note On Web Applications Added to the Home Screen As mentioned, the seven-day cap on script-writable storage is gated on after seven days of Safari use without user interaction on the site.” That is the case in Safari.…

Of not, this also contradicts the article‘s scenario of going on vacation. Only days with some browser use are counted.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#394

Post by JumpCrisscross » Wed, Mar 25, 2020, 7:06 PM UTC

nicoburns wrote: post #358

I really hope the outcry about this is big enough to get Apple / Webkit reconsider. With service workers and improvements in browsers/cpus "PWA"s (aka web apps) were just getting to the point where they could compete with native apps for a number of use cases. And they had much better privacy / security policies. This doesn't completely kill that, but it's a big setback.

> they had much better privacy / security policies

Why is a PWA better from a privacy or security perspective than a native app?

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#395

Post by soapdog » Wed, Mar 25, 2020, 7:06 PM UTC

Animats wrote: post #385

What are private client-side PWAs anyway? Good question. The definition of a "progressive web app" is vague. What they seem to mean is a web page which, once you visit it, is cached locally, and thereafter runs locally. The web page accesses various servers, not necessarily ones from the same domain as the web page. Persistent state, if any, is stored locally. The page gets its own icon on the home screen somehow, so…

> Does this only apply to pages read through Apple's browser, or does it impact Firefox, too?

This applies to WebKit, but if that decision sticks Mozilla might follow. Who knows... I hope not. Also be aware that Firefox on iOS is WebKit.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#396

Post by stqism » Wed, Mar 25, 2020, 7:09 PM UTC

diggan wrote: post #325

thefounder wrote: post #320

Earlier quoted context omitted.

Let me correct that for you: When they get caught thet get a small fine(somewhere close to 1% of their profit) or no fine at all.

Well, we're talking about a hypothetical law here, so we don't really know the amount... The low amounts for fines when it comes to big companies is a different problem that should also be fixed.

Often, the fines for breaking the law are factored in to the cost of choosing to do so in the first place.

This is justified, of course, because the gain for doing so vastly exceeds losses due to the fines.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#397

Post by eyesee » Wed, Mar 25, 2020, 7:09 PM UTC

Would it be possible for Apple to relax the 7 day limit for apps that are strictly client side only? I.e. sandbox the apps to not allow access to any remote resources? It seems to me the opportunity to exploit a user's privacy would be very limited without exfil.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#398

Post by judah » Wed, Mar 25, 2020, 7:09 PM UTC

Animats wrote: post #385

What are private client-side PWAs anyway? Good question. The definition of a "progressive web app" is vague. What they seem to mean is a web page which, once you visit it, is cached locally, and thereafter runs locally. The web page accesses various servers, not necessarily ones from the same domain as the web page. Persistent state, if any, is stored locally. The page gets its own icon on the home screen somehow, so…

> Is that about right?

Progressive Web Apps are strictly defined:

1. The app has an app manifest describing metadata about the web app, enabling it to be treated like an app (e.g. it can be installed)

2. The app has a service worker, enabling it to work offline like a native app.

3. It's served over HTTPS.

Those are the 3 technical requirements of a PWA.

There's also the philosophical direction of Progressive Web Apps: they're progressive, meaning they offer the app's essential experience no matter the device, but enhance progressively based on the device they're running on. That is, more capable devices let the app offer more functionality without blocking out users on lower-end devices.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#399

Post by soapdog » Wed, Mar 25, 2020, 7:09 PM UTC

finaliteration wrote: post #372

soapdog wrote: post #367

Earlier quoted context omitted.

It is not fine if you're creating apps that don't have a backend.

Honest question - If you're creating an app like that, is a PWA really the right way to go? Aren't there other options available (such as creating a native app with a SQLite database)?

Honest answer, it depends on the app. For some cases sure, just throw it in cordova and be happy.

It is my own personal take that PWAs are more powerful than we give them credit and that they could be used for private apps without backends where you leverage the benefits of web distribution while keeping data private. Doing the native/hybrid app forces you into dealing with gatekeepers, distributing on the web does not.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#400

Post by sj4nz » Wed, Mar 25, 2020, 7:09 PM UTC

briandear wrote: post #374

What’s wrong with a “normal” app? No server required and data stays only on the device. The argument that the author is building a PWA because other people abuse privacy (with apps) doesn’t make much sense. Why not build the app, respect privacy, and be done with it? LocalStorage is not a substitute for an actual database, it’s a cache. The problem with the author’s technique is that privacy minded users clear their…

The problem with a "normal" app is now you are beholden to the rules/regulations/evaluations of a third party that can easily decide without recourse that your "app" should not be in their store. Even if your app "is fine" every update and upgrade incurs a delay through the third party's reviewing process before your users receive it.

If the web browsers would provide _some API_ for persistent storage without yanking the carpet out from underneath developers this wouldn't be such a huge problem. There _used_ to be a file-access API but it was removed.

Personally, I think web browsers are too large a surface area to secure/keep secure and the world is probably going to swing the opposite direction to native, downloadable applications without the interference of a third-party store.