Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Private client-side-only PWAs are hard, but now Apple made them impossible

andregarzia.com

Post reply on HN
Print view View original

401–410 of 927 posts

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#401

Post by judge2020 »

duxup wrote: post #389
sidhanthp wrote: post #373

I think this is a good idea. Developers should not be able to store something on my computer indefinitely without my consent. This doesn't apply to applications users add to their home screen. This doesn't "destroy" the PWA ecosystem. Just makes a user's intention explicit when they save a PWA to their home screen, rather than continuing to use it within the browser. From the WebKit Blog ( https://webkit.org/blog/102…

Your browser is already caching a whole lot of stuff that you don't know about just by visiting a site. A little LocalStorage isn't going to hurt you. Cookies I get, but I don't know of any dark patterns with localstorage / the benefits are pretty great.

I asked about the dark patterns above and got answers confirming it https://news.ycombinator.com/item?id=22687214

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#402

Post by judah »

JumpCrisscross wrote: post #394
nicoburns wrote: post #358

I really hope the outcry about this is big enough to get Apple / Webkit reconsider. With service workers and improvements in browsers/cpus "PWA"s (aka web apps) were just getting to the point where they could compete with native apps for a number of use cases. And they had much better privacy / security policies. This doesn't completely kill that, but it's a big setback.

> they had much better privacy / security policies Why is a PWA better from a privacy or security perspective than a native app?

Security: it runs in the browser's sandbox. Native apps by contrast generally have (or can request) full access to your system.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#403

Post by dwnvoted2hell »

pat2man wrote: post #362

Sounds like the solution is to add the app to your home screen. I don't think its reasonable for a browser to let any site I ever interact with to store data on my device indefinitely

I don't understand why you wouldn't rely on some other normal local storage for an app, except to be super lazy making cross device apps with some platform. I think that's what all the screaming is about. Low budget cross compatible apps will suffer.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#404

Post by cosmie »

Dylan16807 wrote: post #337
tyingq wrote: post #182

Earlier quoted context omitted.

If the cookie is set by http headers, yes. If it's set with client side js, though, it's capped at 7 days (since ITP 2.1).

What if you have a cookie set by http and try to update it with js? Will it self-destruct now?

Technically, when you update it via js you're overwriting the existing cookie with a new one. And, from my understanding, it's then subject to the same restrictions as any other cookie set client side.

So in order to have a long-lived cookie, you essentially need to treat them as read-only client side, and push any and all update/write logic to the server such that it'll return a set-cookie header with any changes you require.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#405

Post by JumpCrisscross »

judah wrote: post #402
JumpCrisscross wrote: post #394

Earlier quoted context omitted.

> they had much better privacy / security policies Why is a PWA better from a privacy or security perspective than a native app?

Security: it runs in the browser's sandbox. Native apps by contrast generally have (or can request) full access to your system.

> Native apps by contrast generally have full access to your system

This doesn't accurately describe iOS apps, the pertinent comparison with respect to the article.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#406

Post by fomojola »

judah wrote: post #388

On one hand, I don't like this direction from Apple because it's meant to boost Apple's proprietary app store business -- which directly competes with the open web -- but masquerades as a privacy issue. On the other hand, this direction keeps web devs honest: local storage, service worker, cookies and other script-writable areas are meant to be temporary.

I see nothing in any of the specs that implies local storage was intended to be temporary? You could argue cookies, maybe, but even that I'd dispute: it is a user-agent, I should be able to tell it "don't delete my stuff". I already have browser controls over my local storage: I can go into settings in every reasonable browser and flush that down the tubes.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#407

Post by soapdog »

JumpCrisscross wrote: post #394
nicoburns wrote: post #358

I really hope the outcry about this is big enough to get Apple / Webkit reconsider. With service workers and improvements in browsers/cpus "PWA"s (aka web apps) were just getting to the point where they could compete with native apps for a number of use cases. And they had much better privacy / security policies. This doesn't completely kill that, but it's a big setback.

> they had much better privacy / security policies Why is a PWA better from a privacy or security perspective than a native app?

This depends on many factors but a PWA can be inspected by third-party using the browser developer tools which makes easier to find out about its communication. You can do that with proxies and other heavier tools for native apps, but it it requires more skills than the former. Also the web platform is very private, you don't get access to files and many other features without user consent. Native apps might not be like that even though Catalina is going crazy with the permission dialogs.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#408

Post by nicoburns »

judah wrote: post #402
JumpCrisscross wrote: post #394

Earlier quoted context omitted.

> they had much better privacy / security policies Why is a PWA better from a privacy or security perspective than a native app?

Security: it runs in the browser's sandbox. Native apps by contrast generally have (or can request) full access to your system.

And Privacy the same: Native apps often have access to e.g. microphone. Web apps only have that for the duration that you enable it for.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#409

Post by Cu3PO42 »

finaliteration wrote: post #372
soapdog wrote: post #367

Earlier quoted context omitted.

It is not fine if you're creating apps that don't have a backend.

Honest question - If you're creating an app like that, is a PWA really the right way to go? Aren't there other options available (such as creating a native app with a SQLite database)?

Sure you can do that. But now you need a Mac, probably an iOS device and pay $99/yr to Apple. If you're just providing a small one-off solution for a particular problem that you're not monetizing, the above may pose a serious problem.

For example, I (used to) maintain a tool that is essentially a save file viewer, but must store some data for decryption of said files. It's an Electron app, but could work as a normal website for the most part as well. I got a prototype of that up and it stores the required data in local storage. I don't want to maintain and host a backend for it, and I'm not too hot on paying Apple's developer fee for it, either.

You may say it's a fringe use case, and it probably is, but it's very much legitimate. I don't know why they couldn't have made storage for longer than 7 days with an extra permission to be requested.

Post reply on HN