Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Private client-side-only PWAs are hard, but now Apple made them impossible

andregarzia.com

Post reply on HN
Print view View original

641–650 of 927 posts

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#641

Post by pier25 »

davweb wrote: post #250

I think the original post is oversimplifying the new behaviour a little. If you look at the other blog post on ITP 2.3 [1] it says: > ITP 2.3 caps the lifetime of all script-writeable website data after a navigation with link decoration from a classified domain. i.e. the 7 day timeout for local storage only kicks in if you've been redirected from a domain that ITP has classified as one that tracks users. So, for exam…

> So, for example, web apps that users navigate to directly will be unaffected.

I don't think that's true.

I asked the head of Webkit dev on Twitter and he said:

> This time limit affects first-party storage

https://twitter.com/othermaciej/status/1242926762029285376

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#642

Post by fooey »

jfb wrote: post #494
ajford wrote: post #484

Earlier quoted context omitted.

No, it's a grab for money. Releasing an iOS app requires Apple hardware, X-code, and an Apple developer license which is $100/yr. Where as developing a PWA can be done on any hardware, and would be natively cross-platform. An offline PWA does not require an active connection, and in fact is the one of the reasons behind the idea of developing a PWA instead of a general webapp or website. All other browsers allow the…

I promise you that Apple does not give a shit about the revenue from the developer program.

They care about they revenue they get by making people buy the hardware that gives them access to the developer program.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#643

Post by [deleted] »

emmelaich wrote: post #638
gridlockd wrote: post #564

Earlier quoted context omitted.

Yes, it's confusing. It's not 7 days of non-use , it's seven days of application use without visiting the site. Safari is one application, the homescreen app is a separate application. Presumably, all the alt browsers or WebView apps are separate applications as well. Since you can't use a homescreen app without visiting the site, the 7 days of not visiting the site can't happen.

But .. if you don't use Safari for seven days, what happens?

[deleted]

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#644

Post by notduncansmith »

Silhouette wrote: post #532
notduncansmith wrote: post #521

Earlier quoted context omitted.

If you read the update from webkit.org, you'll see that it's still quite possible to store data locally. Link: https://webkit.org/blog/10218/full-third-party-cookie-blocki... Relevant quote (emphasis mine): > Now ITP has aligned the remaining script-writable storage forms with the existing client-side cookie restriction, deleting all of a website’s script-writable storage after seven days of Safari use without user i…

If a website hasn't been used for 7 days, I'm happy for its data to disappear and save space on my device. You might be, but maybe not everyone is. I've worked on apps based around multimedia content where downloading in advance to watch or listen later was a big deal, because a typical user also travels a lot and might well be going away for longer than a week. Even if they can get the same data again next time they…

Then wouldn't it be appropriate to offer a native app to offer that functionality? A web browser in 2020 is a place to run vast swathes of untrusted code safely; it is not a digital workstation platform, that is the job of the OS. If what I am downloading from you is important enough that I want to have it even offline, then I trust you enough to install your native app.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#645

Post by icebraining »

Jach wrote: post #560
icebraining wrote: post #451

Earlier quoted context omitted.

That works as long as the user keeps the tab open, but if they use a bookmark (or just remember the domain), the hash part will be lost.

The hash part is not lost to bookmarks, unless Apple broke that too. If it was, no one's MEGA bookmarks would work.

I mean, sure, the bookmark would save a snapshot, but the user would have to manually replace it every time.

Might be simpler to just give them a file to save / load.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#646

Post by MikusR »

jfb wrote: post #494
ajford wrote: post #484

Earlier quoted context omitted.

No, it's a grab for money. Releasing an iOS app requires Apple hardware, X-code, and an Apple developer license which is $100/yr. Where as developing a PWA can be done on any hardware, and would be natively cross-platform. An offline PWA does not require an active connection, and in fact is the one of the reasons behind the idea of developing a PWA instead of a general webapp or website. All other browsers allow the…

I promise you that Apple does not give a shit about the revenue from the developer program.

I think you missed the "requires Apple hardware". I know that rich Americans think everyone has Macbooks, but that is not the case.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#647

Post by joosters »

Silhouette wrote: post #557
rstupek wrote: post #544

Earlier quoted context omitted.

A PWA app isn't going to generate any 30% revenue share for Apple since no one is paying for it in the PWA case and thus likely won't be paying for it in the pure app case either.

Why would no-one be paying for a PWA? There are countless paid-for services available via web apps. Providing even a free native app via the App Store to access a service with a subscription model becomes a very risky proposition given Apple's rules, though.

Can you give a few examples of paid-for PWAs? Sure there are websites that are paid-for, but I've never seen a paid-for PWA.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#648

Post by fierarul »

saagarjha wrote: post #343
fierarul wrote: post #83

Earlier quoted context omitted.

Two counterpoints: * AdoptOpenJDK releases that were notarized some months ago are no longer accepted by Apple since they made the rules even more stringent. I had releases accepted by Apple that are not accepted today using the same AdoptOpenJDK binaries. * Apple's notarization rules are not global. There's whitelists for given companies/institutions/apps/files which means the same dylib might not have to be notariz…

Do you have more details about this?

I think I gave quite some details. Do you need the exact AdoptOpenJDK version (11.0.5+10 for macOS)?

And I made a test about the non-global rules too (by trying to submit the same binary and getting rejected).

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#649

Post by rhizome »

gridlockd wrote: post #564
untog wrote: post #545

Earlier quoted context omitted.

I don't think that's actually what it clarifies. Or at the very least it's very confusing. > have their own counter of days of use. Their days of use will match actual use of the web application which resets the timer. This makes it sound very much like homescreen apps will have their data wiped after 7 days of non-use. > We do not expect the first-party in such a web application to have its website data deleted. And…

Yes, it's confusing. It's not 7 days of non-use , it's seven days of application use without visiting the site. Safari is one application, the homescreen app is a separate application. Presumably, all the alt browsers or WebView apps are separate applications as well. Since you can't use a homescreen app without visiting the site, the 7 days of not visiting the site can't happen.

So this is a requirement that all webapps phone home, moreover that they have a home to phone?

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#650

Post by notduncansmith »

pier25 wrote: post #618
notduncansmith wrote: post #515

Earlier quoted context omitted.

I also don't understand the alarm. There is no hard limit on how long things will be stored. Data in localStorage might still be stored for weeks/months/years, as before. The only limit is on how long things will be stored if the user does not interact with the site/PWA . If you are a website, not a natively-installed app, that I haven't "used" in a first-party sense for 7 days or more, I don't think your data belong…

Aren't there websites you use less than once a week? If one of those is using a JWT for auth in localStorage (something which is extremely common) you'd need to login every time you visit such site.

Yes, and that's fine with me. Being on an iPhone, I use the built-in cloud-backed password manager which makes generating and entering credentials near-effortless. Furthermore, by not leaving long-lived tokens in my browser's storage, I'm less vulnerable to exploits that may exfiltrate that data.
Post reply on HN