Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Private client-side-only PWAs are hard, but now Apple made them impossible

andregarzia.com

Post reply on HN
Print view View original

561–570 of 927 posts

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#561

Post by untog »

Aaargh20318 wrote: post #524
beering wrote: post #442

Earlier quoted context omitted.

If you read the article, that's the issue the author was talking about: it's basically impossible to make an app that can store its data locally, instead of on some web server. All apps that you download from App Store can live offline, where they're usable without Internet or trusting some faraway web server. You can't make a web app that can do that, and to some people it smells like Apple trying to force developer…

> it's basically impossible to make an app that can store its data locally, instead of on some web server. No, that is trivial to do: just make an actual damn application. What the author is complaining about is that it’s impossible to make a text document that pretends to be an application that stores data in ways they were never intended to be stored.

I'm sorry but I find this argument utterly tedious.

A Swift file is no less a "text document" than a JavaScript file is. There are APIs available in the browser to store data offline, so I have no idea what "in ways they were never intended to be stored" means here.

A webapp is "an actual damn application". Can we just dispense with the repetitive arguments about this every time anyone so much as mentions adding interactivity to a web page?

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#562

Post by veeti »

bengale wrote: post #546
veeti wrote: post #518

Earlier quoted context omitted.

It's no less of an issue for an online-based PWA. Where do you store login credentials or session tokens? In local storage. What happens to them when Apple decides to arbitrarily throw it away? The user has to log in again and again. This sounds like a seriously poorly thought out idea. Want to clear tracking data from random websites I've been to? That's great. But you don't mess with the data stored by apps I have…

But only if they don’t interact with it for a week. I wouldn’t be surprised if a web app I hadn’t used for a week required me to login.

There are many apps on my phone that I only use every once in a while, yet every single one of them remembers me. No matter how long I've been gone. Technology is amazing!

Where is Apple's famous UX here? What legitimate argument is there for clearing data of an app the user has added to their home screen?

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#563

Post by iameli »

wubin wrote: post #483

The source clarifies that this only applies to websites run within the Safari browser.[1] PWAs added to the home screen aren't affected. > As mentioned, the seven-day cap on script-writable storage is gated on "after seven days of Safari use without user interaction on the site." That is the case in Safari. Web applications added to the home screen are not part of Safari and thus have their own counter of days of use…

"Web applications added to the home screen are not part of Safari and thus have their own counter of days of use. Their days of use will match actual use of the web application which resets the timer."

But said timer... does nothing? Why does it exist?

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#564

Post by gridlockd »

untog wrote: post #545
wubin wrote: post #483

The source clarifies that this only applies to websites run within the Safari browser.[1] PWAs added to the home screen aren't affected. > As mentioned, the seven-day cap on script-writable storage is gated on "after seven days of Safari use without user interaction on the site." That is the case in Safari. Web applications added to the home screen are not part of Safari and thus have their own counter of days of use…

I don't think that's actually what it clarifies. Or at the very least it's very confusing. > have their own counter of days of use. Their days of use will match actual use of the web application which resets the timer. This makes it sound very much like homescreen apps will have their data wiped after 7 days of non-use. > We do not expect the first-party in such a web application to have its website data deleted. And…

Yes, it's confusing.

It's not 7 days of non-use, it's seven days of application use without visiting the site.

Safari is one application, the homescreen app is a separate application. Presumably, all the alt browsers or WebView apps are separate applications as well.

Since you can't use a homescreen app without visiting the site, the 7 days of not visiting the site can't happen.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#565

Post by estreeper »

TheKarateKid wrote: post #323
cageface wrote: post #89

Earlier quoted context omitted.

moving forward we can expect Apple to start systemically hindering web apps They have been doing this for quite some time now. Always ostensibly to protect users but always also conveniently putting webapps at a permanent disadvantage to native apps. For my part I'm not interested in being a user of a platform so hostile to the web that it disallows any third party browsers.

> Always ostensibly to protect users but always also conveniently putting webapps at a permanent disadvantage to native apps. This isn't always a bad thing though. For example, Safari has prohibited some obnoxious behavior that Chrome has allowed: Autoplaying videos, tab suspension, push notifications. These hog CPU and destroy battery life, worsening the user experience. Remember, making everything a web app is Goog…

I would just point out there are very valid use cases for these things, i.e. push notifications are very useful to me (from certain apps). The problem is one of consent.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#566

Post by threeseed »

judah wrote: post #402
JumpCrisscross wrote: post #394

Earlier quoted context omitted.

> they had much better privacy / security policies Why is a PWA better from a privacy or security perspective than a native app?

Security: it runs in the browser's sandbox. Native apps by contrast generally have (or can request) full access to your system.

As others have mentioned this is simply not true on MacOS/iOS.

Also would add that Apple vets native apps.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#567

Post by CodesInChaos »

fiddlerwoaroof wrote: post #448
seanwilson wrote: post #421

Earlier quoted context omitted.

> Web applications added to the home screen are not part of Safari and thus have their own counter of days of use. Their days of use will match actual use of the web application which resets the timer. Can anyone explain this with an example? So web apps added to the home screen will have their storage wiped under some scenarios? If not, what does "have their own counter" mean? How are web applications added to the h…

If you add the Twitter PWA to the homescreen and don’t use it for seven days, it’s storage will be reset and you’ll have to log in again. I think WebKit’s handling of local storage is the prime example of how optimizing for privacy to the exclusion of every other consideration is user-hostile

I don't read it like that. It's not about 7 days real time, it's about 7 days on which you use the app.

Since you can use Safari without visiting the PWA's domain, this feature can delete the data of a PWA which runs in Safari.

Since you can't use a homescreened PWA without it visiting the associated domain, the data saved by the PWA's domain will never be deleted for homescreened applications. But data associated saved by other domains can still get deleted if you use the application for 7 days without it opening that domain.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#568

Post by untog »

gridlockd wrote: post #564
untog wrote: post #545

Earlier quoted context omitted.

I don't think that's actually what it clarifies. Or at the very least it's very confusing. > have their own counter of days of use. Their days of use will match actual use of the web application which resets the timer. This makes it sound very much like homescreen apps will have their data wiped after 7 days of non-use. > We do not expect the first-party in such a web application to have its website data deleted. And…

Yes, it's confusing. It's not 7 days of non-use , it's seven days of application use without visiting the site. Safari is one application, the homescreen app is a separate application. Presumably, all the alt browsers or WebView apps are separate applications as well. Since you can't use a homescreen app without visiting the site, the 7 days of not visiting the site can't happen.

Ah OK that makes sense. They should really copy and paste what you just said into their post!

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#570

Post by osrec »

rstupek wrote: post #551
osrec wrote: post #500

Earlier quoted context omitted.

Your app needs to be downloaded the first time too. In fact, a downloaded app can run riot on your filesystem. A web app runs in the "cage" of the browser, and is arguably more secure and explicit about permissions it requests.

"... can run riot on your filesystem"? Citation needed because an app is as heavily sandboxed as a web page running in a browser. An ios app gets no view into anything you as a user don't choose to give it (no access to photos, etc).

I mean, if you give the app access to your filesystem (which a lot of non-tech users would, almost without thinking), it can potentially access/modify/delete your files and folders. With PWAs, that's not really a possibility.
Post reply on HN