Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Private client-side-only PWAs are hard, but now Apple made them impossible

andregarzia.com

Post reply on HN
Print view View original

801–810 of 927 posts

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#801

Post by ThePhysicist »

chrismarlow9 wrote: post #460
codesections wrote: post #30

Earlier quoted context omitted.

> Apple restricts tracking by limiting browser storage But the argument that this will protect privacy in the first place seems really weak. Before this change in Apple's policy, an app could store my config data on my PC. After this change, they'd need to have me log in and send the config data to their servers. That seems like I've lost privacy, not gained it.

Wouldn't it be possible to retain the data with privacy by: - Asking the user client side for a password - Encrypt data as a blob using some symmetric encryption (AES) - Push encrypted blob to the server with login attached If you're using SSO the client authenticates and then can pull down the encrypted blob based on the SSO auth being valid. You can tie 2FA in however you wish. At that point the user is prompted fo…

You can implement end-to-end encrypted applications e.g. with the subtle crypto API, though there’s always a debate of whether this really provides good privacy as the website owner or an adversary who can inject code can still change the JS and steal the data. Personally I think it’s still much better as the data at rest is encrypted and only the user can decrypt it. Now the problem is of course that if the user forgets his/her password the data is gone. To alleviate that you can again think up some schemes like encrypting the encryption key with an asymmetric scheme where the private key is kept secure by the website owner, but that then requires a process for securely using this key... So it’s possible but not trivial I would say!

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#802

Post by dmitriid »

jdauriemma wrote: post #748
comex wrote: post #710

Earlier quoted context omitted.

I tried using your app on an iPhone (with Add to Home Screen). - If I press the settings gear, the text on the settings page is about twice as wide as the screen, requiring horizontal scrolling. - On the front page, if I open the color picker, it's partially offscreen. - On all pages, if I do a scroll gesture in the wrong direction, it scrolls the entire UI rather than just the scrollable part. Admittedly, iOS has lo…

There are some fantastic PWAs out there. Twitter is the one I use most regularly. I think one of the reasons we see a lot of less-polished PWAs is that the idea of the PWA appeals to businesses at certain stages. Larger shops can afford to ship native binaries to more than one platform, but a smaller operation can't. PWAs are presumably tempting to those types of product teams: you get multi-platform reach while trul…

Twitter's "PWA" is crap. It has an unending stream of glaring UX/UI errors that only get worse over time.

I'm just gonna link to a small subset of failures we've documented: https://www.google.se/search?q=twitter+site:grumpy.website

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#803

Post by reilly3000 »

This is really in response to the irresponsible use of APIs for trackers. Evercookie is a stunning example of how far it can go... From their repo:

- Standard HTTP Cookies - Flash Local Shared Objects - Silverlight Isolated Storage - CSS History Knocking - Storing cookies in HTTP ETags (Backend server required) - Storing cookies in Web cache (Backend server required) - HTTP Strict Transport Security (HSTS) Pinning (works in Incognito mode) - window.name caching - Internet Explorer userData storage - HTML5 Session Storage - HTML5 Local Storage - HTML5 Global Storage - HTML5 Database Storage via SQLite - HTML5 Canvas - Cookie values stored in RGB data of auto-generated, force-cached PNG images (Backend server required) - HTML5 IndexedDB - Java JNLP PersistenceService - Java exploit CVE-2013-0422 - Attempts to escape the applet sandbox and write cookie data directly to the user's hard drive.

https://github.com/samyk/evercookie

In short, everything and more can be used for tracking, and that has really killed the party for the many people who have created responsible, useful applications of these browser APIs.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#804

Post by saagarjha »

pier25 wrote: post #765
Gaelan wrote: post #746

Earlier quoted context omitted.

For "regular websites" (visited through Safari) it's 7 days where you use Safari, but don't visit the site. So if you go on vacation for a month and don't touch your computer, or if you switch completely to using Firefox for a month, localStorage will remain untouched.

Where is this explained?

https://news.ycombinator.com/item?id=22681370

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#805

Post by saagarjha »

heavyset_go wrote: post #695
vosper wrote: post #577

Earlier quoted context omitted.

> There's no reason they can't have PWAs work well in Safari other than they want you to port your app to the App Store and get locked into their native APIs. Is it possible they also want you to port your app to the App Store to prevent an explosion of garbage and malware that could happen if PWAs really took off?

There is absolutely no reason that PWAs can't be sandboxed like native apps, or even more aggressively. In fact, native apps are more likely to be spyware, as they can collect much more information from the user than a browser-based app can.

Native apps ostensibly go through review so that Apple can flag malfeasant behavior that is nonetheless allowed by the sandbox. Think things like a $999 purchase request that pops up on app launch (Yes, I know Apple isn’t that great at this. But that’s the argument that they use for review.)

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#806

Post by saagarjha »

MFLoon wrote: post #467
madeofpalk wrote: post #349

Earlier quoted context omitted.

All parts of Apple's platform has had bugs that have kicked around for literally years . Their native SDK is infamously under documented and has all sorts of bugs https://twitter.com/caseyliss/status/1171778706878160897 The bugs in Apple's software, whether in web or native or in documentation are not part of some nefarious plot, its just a part of Apple's mismanagement and relatively minimal resources.

> relatively minimal resources Uh, they're the most well capitalized corporation in the world (or hovering in the top 3 plus or minus a few quarters). They have the resources to make it work if they wanted. There are undoubtedly thousands of engineers, hundreds of managers, and at least a handful of execs, working for Apple, lurking in this HN thread today, not because they're unaware of their ongoing sabotage of web…

You’re between one to two orders of magnitude off in you estimate of the size of Apple’s web technologies team.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#807

Post by saagarjha »

LocalPCGuy wrote: post #661
saagarjha wrote: post #335

Earlier quoted context omitted.

The people who work on making websites function better on iPad are literally a 20 second walk away from the people who work in Intelligent Tracking Prevention–do you really think that they'd seek to undermine each other in this way?

Absolutely, do you have evidence they are talking and consulting with each other? Obviously lack of evidence isn't evidence either, but departments do things all the time that are at odds with each other in companies like Apple.

> Absolutely, do you have evidence they are talking and consulting with each other?

Firsthand.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#808

Post by soapdog »

xingyzt wrote: post #712
soapdog wrote: post #687

Earlier quoted context omitted.

Their Kindle Cloud Reader is better than the native windows app IMO. I don't know when it was last updated, I first used it this year.

The Cloud Reader isn't a PWA. It's only available as a website and a Chrome OS app. Its UI is miles behind the Kindle apps on Android and iOS, which have better footnote support and font settings.

That is true but have you seen the windows app, the one they preferred to discontinue? It was awful.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#809

Post by saagarjha »

fierarul wrote: post #648
saagarjha wrote: post #343

Earlier quoted context omitted.

Do you have more details about this?

I think I gave quite some details. Do you need the exact AdoptOpenJDK version (11.0.5+10 for macOS)? And I made a test about the non-global rules too (by trying to submit the same binary and getting rejected).

Apple may have stepped up notarization requirements, but I never heard them be inconsistent across developers. Are you sure you submitted the same binary? Nothing different about the signing or bundle layout?

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#810

Post by schoenobates »

reilly3000 wrote: post #803

This is really in response to the irresponsible use of APIs for trackers. Evercookie is a stunning example of how far it can go... From their repo: - Standard HTTP Cookies - Flash Local Shared Objects - Silverlight Isolated Storage - CSS History Knocking - Storing cookies in HTTP ETags (Backend server required) - Storing cookies in Web cache (Backend server required) - HTTP Strict Transport Security (HSTS) Pinning (w…

“... abusing over a dozen technologies...” is this a proof-of-concept or a real thing ? It just seems too horrendous to be real.

I think your comment really hits the nail on the head, IMHO the frustration shouldn’t be directed toward Apple but more toward the groups who have pushed the tracking practice so far to necessitate such draconian measures.

Post reply on HN