Private client-side-only PWAs are hard, but now Apple made them impossible • Hacker News Board

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#601

Post by Dylan16807 » Wed, Mar 25, 2020, 9:14 PM UTC

bengale wrote: post #546

veeti wrote: post #518

Earlier quoted context omitted.

It's no less of an issue for an online-based PWA. Where do you store login credentials or session tokens? In local storage. What happens to them when Apple decides to arbitrarily throw it away? The user has to log in again and again. This sounds like a seriously poorly thought out idea. Want to clear tracking data from random websites I've been to? That's great. But you don't mess with the data stored by apps I have…

But only if they don’t interact with it for a week. I wouldn’t be surprised if a web app I hadn’t used for a week required me to login.

I wouldn't be surprised but I would definitely be upset.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#602

Post by jsmith45 » Wed, Mar 25, 2020, 9:15 PM UTC

ardy42 wrote: post #446

seanwilson wrote: post #421

Earlier quoted context omitted.

> Web applications added to the home screen are not part of Safari and thus have their own counter of days of use. Their days of use will match actual use of the web application which resets the timer. Can anyone explain this with an example? So web apps added to the home screen will have their storage wiped under some scenarios? If not, what does "have their own counter" mean? How are web applications added to the h…

> Can anyone explain this with an example? Note this is totally based on my reading of the GP: >> As mentioned, the seven-day cap on script-writable storage is gated on after seven days of Safari use without user interaction on the site.” I'm understanding this to mean: you access Site A and it stores data to your local storage on day 0. Then you use Safari for Sites B, C, and D, but not A for the next 7 days. Since…

Home screen installed PWAs are treated as a separate web browser.

So installed PWA's do have automatic deletion, but that basically only applies to third party content (like advertiser tracking cookies, or content from other sites you show inside an iframe), since the number of days used since last interaction counter will stay at zero for the main site.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#603

Post by lioeters » Wed, Mar 25, 2020, 9:16 PM UTC

wpietri wrote: post #572

judah wrote: post #505

Earlier quoted context omitted.

It's not just about the revenues of $100/year. It's also the revenue from 30% sharing of profits. And most importantly, it's the bigger revenue generated from having apps that work only on iOS, which drives users to buy iPhones and iPads.

Exactly. The app store's gross revenue was $54 billion last year. [1] Apple has a very strong incentive to make sure the only good way to deliver apps on iOS is the app store. [1] https://www.statista.com/statistics/296226/annual-apple-app-...

Interesting numbers. I see, "gross revenue" means:

> In the last reported year, customers spent an estimated 54.2 billion U.S. dollars on on in-app purchases, subscriptions, and premium apps in the Apple App store.

So, roughly 30% cut goes to Apple - which is around 16 billion; and developers got the rest, around 38 billion.

With PWAs, 100% goes to developers. As you pointed out, that's a threat and motivation for Apple to continue racheting up their closed ecosystem, and keep PWAs crippled on Apple devices.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#604

Post by mr_toad » Wed, Mar 25, 2020, 9:18 PM UTC

judah wrote: post #402

JumpCrisscross wrote: post #394

Earlier quoted context omitted.

> they had much better privacy / security policies Why is a PWA better from a privacy or security perspective than a native app?

Security: it runs in the browser's sandbox. Native apps by contrast generally have (or can request) full access to your system.

Not any more. Even the terminal needs to request access to parts of the file system.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#605

Post by tsimionescu » Wed, Mar 25, 2020, 9:19 PM UTC

judah wrote: post #511

alkonaut wrote: post #434

Did PWA's take off? What are some famous/big PWA's now? I can't remember ever "installing" anything in a browser as an app, or even being asked if I wanted to do it. Am I misunderstanding what they are?

Microsoft will be releasing PWA versions of the Office suite. Twitter, Instagram, Starbucks, Pinterest and more have PWAs as well.

Given that the OneNote web and Windows 10 apps don't implement Find&Replace (just Find), 5-10 years after their first release, I wouldn't hold my breath for usable Office PWAs.

Edit: the official help page on how to do Find&Replace reads like a joke until you realize it is very real:

https://support.microsoft.com/en-us/office/find-and-replace-...

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#606

Post by alkonaut » Wed, Mar 25, 2020, 9:20 PM UTC

SahAssar wrote: post #416

briandear wrote: post #374

What’s wrong with a “normal” app? No server required and data stays only on the device. The argument that the author is building a PWA because other people abuse privacy (with apps) doesn’t make much sense. Why not build the app, respect privacy, and be done with it? LocalStorage is not a substitute for an actual database, it’s a cache. The problem with the author’s technique is that privacy minded users clear their…

A normal app requires a separate build process, users to install it, manual review for each update, perhaps the platform owner will just deny it without reason, and for Mac/iOS it also requires actually owning or "borrowing" (using another persons/companies) build machine and software. I don't understand why an installed PWA should not be able to keep their storage just as a "normal" app can. It would clearly be bett…

Those sound like problems for the developer, and not the end user.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#607

Post by iameli » Wed, Mar 25, 2020, 9:21 PM UTC

kyralis wrote: post #580

iameli wrote: post #493

Earlier quoted context omitted.

> Web applications added to the home screen are not part of Safari and thus have their own counter of days of use. [...] We do not expect the first-party in such a web application to have its website data deleted. I don't get it. Which of these statements is correct? 1. "Web applications added to the home screen are not part of Safari and thus have their own counter of days of use. Of course, that counter doesn't do…

Neither. The counter is per days of application use, so (2) is false. Not using the app does not affect the counter. The counter is also per domain, and so while the first party domain for the PWA (which is likely to, of course, be loaded on each PWA launch) is effectively meaningless, if you visit other domains from within the PWA they will be subject to the counter independently.

Okay, that makes sense - counter is third-party domains only. Thanks!

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#608

Post by andrewrothman » Wed, Mar 25, 2020, 9:21 PM UTC

soapdog wrote: post #455

alkonaut wrote: post #434

Did PWA's take off? What are some famous/big PWA's now? I can't remember ever "installing" anything in a browser as an app, or even being asked if I wanted to do it. Am I misunderstanding what they are?

I'm the OP, I use a lot of PWAs. My main machine is a Surface Pro X and I don't have native apps (as in native aarch64 binaries) for many of the things I'd like to use. So, I'm using PWAs for Instagram, Twitter, Kindle, Pinafore (mastodon client), Spotify, and some of my own. I was developing a feed reader that was supposed to be a client-side-only PWA but that's tricky.

Off topic, but how is this experience using the Surface Pro X as a PWA machine? Does Windows / PWAs work well in tablet form? I was thinking of switching to a similar setup and using it essentially as you describe. Seems like it could be a really lightweight and simple computing environment similar to Chromebooks but still allows you to run traditional Windows apps as well if you need.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#609

Post by theamk » Wed, Mar 25, 2020, 9:22 PM UTC

vbezhenar wrote: post #450

theamk wrote: post #311

Earlier quoted context omitted.

The big difference is native apps require explicit user content to get installed, while localstorage can be used by any website without user consent. If browsers asked approval before using localstorage, we wouldn’t have this decision.

Installation of web app performed by bookmarking it or by pinning it to home screen. That's performed by explicit user decision and must be honored by browser if it wants to make a distinction between random website and useful website.

Not sure about pinning, but bookmarking should not grant any extra rights. Even the useful websites should not be able to track me forever.

Look, we already have lots of website prompts, like camera and location. The best thing, privacy-wise, would be an explicit prompt: "this website wants to store information, possibly including tracking identifiers, forever. Allow?"

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#610

Post by lnanek2 » Wed, Mar 25, 2020, 9:22 PM UTC

mr_toad wrote: post #590

It’s always been impossible to rely on local storage for long-term use. Users clear their caches. They swap browsers. They swap machines. They use their phone instead of their desktop. They use private mode, or sand boxing. They re-install their OS. They buy a new machine. Don’t be lazy. Using local storage without a backup is not acceptable. And what kind of ‘progressive’ web app expects all the features in every cl…

Based on the blog, it sounds like he wants to downloaded RSS feeds to the user's device, and not store them on his server to speed up development (all those complaints about FAANG being able to develop at web scale and him not wanting to run a backend).

Then, if the user clears cache or changes computers, they lose the stuff they were following and have to wait for new items, but it's not the end of the world. They might even expect it if you name/describe the app a certain way.

E.g. if you download an app called "Podcast Downloader" that says it just downloads any new podcasts from feeds you follow for your later offline consumption on your current device - you might not expect a podcast on your phone to magically jump to your desktop without a re-download from the original site.

Seems like it could be a valid trade off if it lets a front end only web dev publish apps he couldn't publish otherwise because he can't/won't do backend. Storing user media on the backend is not cheap. The company I'm at has spent months of developer time moving over from Google to Amazon, for example, just for infra cost improvements that come from serving terrabytes of data off one instead of the other.