Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Private client-side-only PWAs are hard, but now Apple made them impossible

andregarzia.com

Post reply on HN
Print view View original

871–880 of 927 posts

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#871

Post by marmada »

readarticle wrote: post #825
marmada wrote: post #755

Earlier quoted context omitted.

"just making native apps"

Hiring aside, it’s probably simpler than attempting to reconcile souped up document viewers with contemporary expectations of “apps”, iOS and Android being purposefully built for the task and all.

Having done native Android/iOS and web dev, web dev is much easier than Android and at least on par/if not easier than iOS.

There's a bunch of very complex web/electron apps that disprove the idea that the web is only for static documentation and web-inspired ideas are coming to mobile (React --> Jetpack Compose/Swift UI).

More importantly, hiring can't be put aside, and it's much easier to adapt your web app to work for mobile (since websites should be screen size agnostic anyway) than it is to build a fully native app from scratch.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#872

Post by heavyset_go »

saagarjha wrote: post #805
heavyset_go wrote: post #695

Earlier quoted context omitted.

There is absolutely no reason that PWAs can't be sandboxed like native apps, or even more aggressively. In fact, native apps are more likely to be spyware, as they can collect much more information from the user than a browser-based app can.

Native apps ostensibly go through review so that Apple can flag malfeasant behavior that is nonetheless allowed by the sandbox. Think things like a $999 purchase request that pops up on app launch (Yes, I know Apple isn’t that great at this. But that’s the argument that they use for review.)

It's not a good argument because I can find Bonzai Buddy-like apps on the Mac App Store, and they ban any GPL apps on their iPhone App Store.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#873

Post by saagarjha »

heavyset_go wrote: post #872
saagarjha wrote: post #805

Earlier quoted context omitted.

Native apps ostensibly go through review so that Apple can flag malfeasant behavior that is nonetheless allowed by the sandbox. Think things like a $999 purchase request that pops up on app launch (Yes, I know Apple isn’t that great at this. But that’s the argument that they use for review.)

It's not a good argument because I can find Bonzai Buddy-like apps on the Mac App Store, and they ban any GPL apps on their iPhone App Store.

GPL apps are not banned on the iPhone App Store.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#874

Post by scarface74 »

the_gipsy wrote: post #851
scarface74 wrote: post #827

Earlier quoted context omitted.

Seeing that most major subscription services on the App Store are already forcing users to subscribe outside of the App Store, Apple isn’t getting a cut of subscriptions from the most popular service. How many apps require a subscription and cannot be a web app because of limitations of Safari? How many paid apps would be websites if it weren’t for limitations of Safari?

The moment you offer in-app payment, apple gets a cut. This goes as far as not allowing apps that link to payment outside of the appstore's payment system. There is a huge number of cordova apps out there. These are webapps inside a native wrapper, to access exactly those features that are crippled in safari. Reliable storage, push notifications, and not much more.

Yet dozens on companies have had successful businesses not doing in app purchases - like Amazon.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#875

Post by admax88q »

dieulot wrote: post #870
untog wrote: post #545

Earlier quoted context omitted.

I don't think that's actually what it clarifies. Or at the very least it's very confusing. > have their own counter of days of use. Their days of use will match actual use of the web application which resets the timer. This makes it sound very much like homescreen apps will have their data wiped after 7 days of non-use. > We do not expect the first-party in such a web application to have its website data deleted. And…

A clearer explanation has now been delivered by Safari’s evangelist: https://twitter.com/jonathandavis/status/1243228885006708737 Data isn’t deleted after 7 days for home screen web apps.

Jesus christ.

It sounds like there's a time bomb in safari web views just waiting to happen. The timer is supposed to be reset every time you open the app, so there won't ever be seven days of opening the app and not using it. But it sounds like the code path is just there, they just don't ever expect it to be hit because the timer _should_ reset every time the user opens the app.

I can't _wait_ to deploy an application where there is literally an "rm -rf" pointed at my users data, with a complex conditional blocking it. That makes it far to easy for a webview bug to nuke my users data.

This is shoddy engineering. Could you imagine a filesystem being implemented the same way? You would never include a code path in your "mount" logic the says "if ( some condition ) delete everything;" that would rightfully be viewed as a terrible idea and a disaster just waiting to happen.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#876

Post by brlewis »

joeblau wrote: post #761
kstrauser wrote: post #730

Earlier quoted context omitted.

Except that by "Safari quirk" you mean "the way that all common browsers are heading". Safari is the first here. Firefox is certain to be right behind them. Google, probably not, but I bet Edge does the same thing before too long.

Google is planning on implementing part of this in 2022[1]. Not sure what they are going to do about the browser storage though. [1] - https://www.theverge.com/2020/1/14/21064698/google-third-par...

That article mentions third party cookies. Nothing about nerfing localStorage.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#877

Post by brlewis »

wmeredith wrote: post #836
schoenobates wrote: post #810

Earlier quoted context omitted.

“... abusing over a dozen technologies...” is this a proof-of-concept or a real thing ? It just seems too horrendous to be real. I think your comment really hits the nail on the head, IMHO the frustration shouldn’t be directed toward Apple but more toward the groups who have pushed the tracking practice so far to necessitate such draconian measures.

This is 100% correct. Being upset at Apple here is exactly like publishers whining about ad blockers when they should direct their frustration and anger directly at the ad creators (or themselves) for foolishly abusing their audience.

No, the two are different. Ads are only used for ads. localStorage has lots of uses, tracking users being only one of them. Apple is throwing out the baby with the bath water. Ad blockers merely throw out bath water with varying levels of dirtiness.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#879

Post by brlewis »

dep_b wrote: post #854
reilly3000 wrote: post #803

This is really in response to the irresponsible use of APIs for trackers. Evercookie is a stunning example of how far it can go... From their repo: - Standard HTTP Cookies - Flash Local Shared Objects - Silverlight Isolated Storage - CSS History Knocking - Storing cookies in HTTP ETags (Backend server required) - Storing cookies in Web cache (Backend server required) - HTTP Strict Transport Security (HSTS) Pinning (w…

You could permissionwall that stuff, just like iOS asks for permissions to ask your location. If a random website wants to mess with Local Storage I know that I need to turn around.

Yes, that would have been a much better approach. It would hinder trackers, but not valid uses of localStorage.
Post reply on HN