Private client-side-only PWAs are hard, but now Apple made them impossible • Hacker News Board

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#501

Post by untog » Wed, Mar 25, 2020, 8:02 PM UTC

redindian75 wrote: post #375

soapdog wrote: post #368

Earlier quoted context omitted.

Even web apps that you add to your home screen are subjected to this.

"Web applications added to the home screen are not part of Safari and thus have their own counter of days of use."[1] From WebKit: [1] https://webkit.org/blog/10218/full-third-party-cookie-blocki... A Note On Web Applications Added to the Home Screen As mentioned, the seven-day cap on script-writable storage is gated on after seven days of Safari use without user interaction on the site.” That is the case in Safari.…

> Web applications added to the home screen are not part of Safari and thus have their own counter of days of use. Their days of use will match actual use of the web application which resets the timer.

This is a baffling word salad. So they are tracking days of use of home screen web apps... which sounds like it means that if you do not use the app for seven days the cache will be deleted... but they don't expect a web app to have its data deleted. What?

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#502

Post by EvanAnderson » Wed, Mar 25, 2020, 8:02 PM UTC

mulmen wrote: post #449

beering wrote: post #442

Earlier quoted context omitted.

If you read the article, that's the issue the author was talking about: it's basically impossible to make an app that can store its data locally, instead of on some web server. All apps that you download from App Store can live offline, where they're usable without Internet or trusting some faraway web server. You can't make a web app that can do that, and to some people it smells like Apple trying to force developer…

I don't really understand this. If you want to make something local, make an app and distribute through the app store, that's what it is for. A web app on the other hand is connected by definition, no? Apple forcing local apps to distribute through the app store is a feature .

You should research the original plan for "apps" on the iOS platform. There was no "native app" story originally, and Javascript-based applications were expected to be the only 3rd party platform on the OS.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#503

Post by untog » Wed, Mar 25, 2020, 8:03 PM UTC

finaliteration wrote: post #372

soapdog wrote: post #367

Earlier quoted context omitted.

It is not fine if you're creating apps that don't have a backend.

Honest question - If you're creating an app like that, is a PWA really the right way to go? Aren't there other options available (such as creating a native app with a SQLite database)?

Well it isn't now, no, because Apple have made the platform unsuitable for it. But it was fine.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#504

Post by lliamander » Wed, Mar 25, 2020, 8:04 PM UTC

jfb wrote: post #494

ajford wrote: post #484

Earlier quoted context omitted.

No, it's a grab for money. Releasing an iOS app requires Apple hardware, X-code, and an Apple developer license which is $100/yr. Where as developing a PWA can be done on any hardware, and would be natively cross-platform. An offline PWA does not require an active connection, and in fact is the one of the reasons behind the idea of developing a PWA instead of a general webapp or website. All other browsers allow the…

I promise you that Apple does not give a shit about the revenue from the developer program.

Then why not make it free?

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#505

Post by judah » Wed, Mar 25, 2020, 8:04 PM UTC

jfb wrote: post #494

ajford wrote: post #484

Earlier quoted context omitted.

No, it's a grab for money. Releasing an iOS app requires Apple hardware, X-code, and an Apple developer license which is $100/yr. Where as developing a PWA can be done on any hardware, and would be natively cross-platform. An offline PWA does not require an active connection, and in fact is the one of the reasons behind the idea of developing a PWA instead of a general webapp or website. All other browsers allow the…

I promise you that Apple does not give a shit about the revenue from the developer program.

It's not just about the revenues of $100/year. It's also the revenue from 30% sharing of profits. And most importantly, it's the bigger revenue generated from having apps that work only on iOS, which drives users to buy iPhones and iPads.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#506

Post by szc » Wed, Mar 25, 2020, 8:05 PM UTC

mattl wrote: post #379

> By now, most people are aware of the amount of surveillance and tracking that their web usage is subject to on a daily basis and how this data can be used in ways that do not match their own personal values. Sorry, but no way.

The data for "Local Storage" is stored in ~/Library/Safari/Databases -- you will need to give Terminal access to the Safari directory as the current Sandboxing works both ways, Safari stores security config info in this directory and scripted malware could / can exfiltrate data and change values in this location.

To violate privacy (aka enable tracking) a sub-iFrame could be set up that uses "local storage" with a parent page security policy that allows communication across the iFrame boundary. Sorry, yes, I am being a bit vague.

Who cleans up ~/Library/Safari/Databases? I personally see crud in this directory from 2011 that has been migrated from older systems.

Almost not relevant now, but Flash also had a "local storage" system that was shared across all Flash Apps. It also allowed (before sandboxing) local apps to proxy and communicate (via shared memory) with any standalone Flash App on the system through any page that used the Flash plugin -- i.e any running web browser, violating all attempts to have web compartmentalization rules.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#507

Post by asadlionpk » Wed, Mar 25, 2020, 8:06 PM UTC

seanabrahams wrote: post #473

alkonaut wrote: post #434

Did PWA's take off? What are some famous/big PWA's now? I can't remember ever "installing" anything in a browser as an app, or even being asked if I wanted to do it. Am I misunderstanding what they are?

PWAs haven't taken off because Apple won't implement full Push API support in Safari thus forcing you to go through the App Store if your web site or application needs push notifications. The App Store then complains if you try to publish an app that just wraps your web site so that you can have push notifications. It's... infuriating.

Seeing all the "enable notifications" popups on every site I visit, I am happy that Apple doesn't allow this for websites.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#508

Post by riquito » Wed, Mar 25, 2020, 8:06 PM UTC

dubcanada wrote: post #436

I don't understand what the problem is. I can easily go to the settings area and delete my entire browser cache (Remove All Website Data), in fact if you are running low of space it even tells you to do it. Why are people assuming things stored on a browser are a good place to store things. Nothing stored on a browser should be assumed to be forever.

If you are distribting a PWA through e.g. electron the user does not have (easily) the means to delete the cache. Web app is a misnomer in that case, they are just applications running inside a somewhat hidden browser.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#509

Post by the_other » Wed, Mar 25, 2020, 8:06 PM UTC

vbezhenar wrote: post #464

finaliteration wrote: post #372

Earlier quoted context omitted.

Honest question - If you're creating an app like that, is a PWA really the right way to go? Aren't there other options available (such as creating a native app with a SQLite database)?

What if I want to create a porn app which Apple does not allow to be present in AppStore?

Can you describe this porn app which also benefits from being a PWA and doesn’t need a backend?

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#510

Post by jmull » Wed, Mar 25, 2020, 8:07 PM UTC

Ah.. well, ok, but this is pure nonsense.

First of all, the various kinds of browser local storage have always been volatile. It has always been a bad idea to treat it as permanent storage. Maybe it's a little more obvious now? Not exactly a bad thing.

> the PWAs I was building here might just be dead for iOS users

If so, it was already dead for your users, whether you realized it or not. I guess you were going to implicitly promise something you could not deliver: that your PWA would keep track of the feeds the user was subscribed to (and perhaps also keep track of what had been read, and other user state). But you were going to screw your users, because a PWA without external persistent storage could not do that reliably. It's really luck for your users that this caught your attention and has you rethinking your app.

A partial list of things completely external to your app (not including this change) that could cause your users to lose things important to them that you stored in various local storage...

    * user switches browser
    * user has multiple devices 
    * user upgrades phone (or tablet, or workstation, or laptop)
    * phone (or other device) goes in for repair or upgrade
    * major change to browser (like Edge moving to chromium)
    * some OS updates
    * user clears browser data (as innumerable troubleshooting processes suggest)

It's wrong to think browser-based storage used to be stable but now isn't. It never was. Browser-based storage was never going to be a good place to store your user's important, persistent data.