Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Datasette Apps: Host custom HTML applications inside Datasette

simonwillison.net

Post reply on HN
Print view View original

61–70 of 76 posts

Re: Datasette Apps: Host custom HTML applications inside Datasette

#61

Post by simonw »

cxr wrote: post #60
simonw wrote: post #54

Earlier quoted context omitted.

If you host iframe apps at a fixed URL like: /-/apps/iframe-content/timeline.html You can protect it with CSP headers, but you can't also protect it with the sandbox="" attribute (should a user visit it directly) If you want both sandbox= restrictions and CSP headers at the same time the only way I've found that works cross all major borders is the iframe plus srcdoc="" with injected CSP meta headers patterns. Note t…

CSP is optional and designed to be one part of a defense-in-depth strategy (to extent that it was thoughtfully designed at all—it's an awful standard that should not have made it past proposal stage). It's not a solution for sandboxing untrusted content and should not be relied upon that way. Treating it like one is a great demonstration of how some uses of CSP make people more vulnerable.

Right, which is why I'm combining it with - which really is designed to be used as a sandbox (if you can figure out the right way to implement it.)

Re: Datasette Apps: Host custom HTML applications inside Datasette

#62

Post by mpeg »

simonw wrote: post #55
mpeg wrote: post #47

Earlier quoted context omitted.

I disagree, a lot of the time people buy "serious BI tools" precisely because they think they need all that power and complexity. In reality, what most people need is much simpler, a mini app with some curated datasets and simple filters, maybe some AI querying if we want to get fancy. There's some companies out there that work with big data, but for the rest of us small data is ok.

I think of Datasette as a "small data" platform, where small data is anything that would fit on my phone. My phone has 1TB of storage.

I've used that with companies I consult for, everyone thinks they should do what Google does, so sometimes I'll drop them the "your whole company data fits in my phone/laptop" line to make them understand the (lack of) scale

Re: Datasette Apps: Host custom HTML applications inside Datasette

#63

Post by mpeg »

uberex wrote: post #58
mpeg wrote: post #47

Earlier quoted context omitted.

I disagree, a lot of the time people buy "serious BI tools" precisely because they think they need all that power and complexity. In reality, what most people need is much simpler, a mini app with some curated datasets and simple filters, maybe some AI querying if we want to get fancy. There's some companies out there that work with big data, but for the rest of us small data is ok.

duckdb -ui

Data engineers hate this one simple trick

Re: Datasette Apps: Host custom HTML applications inside Datasette

#64

Post by hbcondo714 »

fsuts wrote: post #39

To save anyone else wondering what is Datasette a search: “Datasette is a tool for exploring and publishing data. It helps people take data of any shape, analyze and explore it, and publish it as an interactive website and accompanying API. Datasette is aimed at data journalists, museum curators, archivists, local governments, scientists, researchers and anyone else who has data that they wish to share with the world…

I’ve been using the Observable Framework[1] for this kind of work but it doesn’t appear to be actively developed anymore so will look into Datasette.

[1] https://github.com/observablehq/framework

Re: Datasette Apps: Host custom HTML applications inside Datasette

#65

Post by sumitkumar »

simonw wrote: post #43
sumitkumar wrote: post #25

I just went through the github project repository. It has 119 repositories. Is this how AI slop looks like in code? Made for the agents, by the agents? Is this separation of concerns or context management with agents as a first class residents and humans merely acting as custodians?

https://github.com/datasette has 119 - but there are also 232 under my simonw account from before I started the Datasette org: https://github.com/simonw?tab=repositories&q=Datasette-&type... Most of them predate coding agents. I started the Datasette project in 2017. In fact we can answer this with Datasette! Here's a query showing the 111 packages with at least one release prior to ChatGPT on Nov 30 2022: https://da…

Well, thank you for clarifying. The signal is getting lost in the noise. I assumed too soon after looking around just the datasette org github account and seeing so many repos and code being built so fast.

Re: Datasette Apps: Host custom HTML applications inside Datasette

#66

Post by Terretta »

A compliment and a curiosity:

1. Love the addition. Everything becoming its own self-serve artifact factory is great. Malleable software's been a dream a long time, it's supposed to be soft and this concept helps get it there.

2. Since Claude goes on and on about surface, now everyone is using it. Or was everyone using it already?

FTA: “I quickly realised that the sandboxed pattern is interesting for way more than just adding custom apps to the interface surface and promoted it to its own top-level concept within the Datasette ecosystem.”

For decades that sentence would have parsed without the word surface in it. What does it mean that's suddenly so – um – load-bearing?

Re: Datasette Apps: Host custom HTML applications inside Datasette

#67

Post by simonw »

Terretta wrote: post #66

A compliment and a curiosity: 1. Love the addition. Everything becoming its own self-serve artifact factory is great. Malleable software's been a dream a long time, it's supposed to be soft and this concept helps get it there. 2. Since Claude goes on and on about surface , now everyone is using it. Or was everyone using it already? FTA: “I quickly realised that the sandboxed pattern is interesting for way more than j…

Huh... not sure how that got in there, I wrote this without LLM assistance (aside from a proof reading run, but I do that in Claude so it doesn't have the ability to edit my own text).

It's quite possible I've been subconsciously influenced into thinking in terms of "surfaces" though!

I just edited that to this, which is a bit cleaner:

> I quickly realised that the sandboxed pattern is interesting for way more than just adding custom apps in a chat interface and promoted it to its own top-level concept within the Datasette ecosystem.

Re: Datasette Apps: Host custom HTML applications inside Datasette

#68

Post by 20after4 »

From TFA:

> a Datasette-style backend to a self-contained HTML frontend is an astonishingly powerful combination.

1000% agree. And datasette is a terrific framework to build any kind of data exploration or visualization on.

This sounds like an awesome feature and a good excuse for me to dive back into playing with Datasette.

Re: Datasette Apps: Host custom HTML applications inside Datasette

#69

Post by AIcanbiteme »

How does this work, does some mechanism replace the actual tape drive in the Datasette? Can you just use the tape port with the gadget or does it somehow need the tape drive? How do you access the HTML applications, how is the translation to PETSCII handled?

I have no idea how this could work but as a long time Commodore 64 fan I'm interested. The link won't load for me, sadly. Can somebody give me a quick rundown on how I can host HTML apps inside my Commodore Datasette tape drive?

Re: Datasette Apps: Host custom HTML applications inside Datasette

#70

Post by cxr »

simonw wrote: post #61
cxr wrote: post #60

Earlier quoted context omitted.

CSP is optional and designed to be one part of a defense-in-depth strategy (to extent that it was thoughtfully designed at all—it's an awful standard that should not have made it past proposal stage). It's not a solution for sandboxing untrusted content and should not be relied upon that way. Treating it like one is a great demonstration of how some uses of CSP make people more vulnerable.

Right, which is why I'm combining it with - which really is designed to be used as a sandbox (if you can figure out the right way to implement it.)

> - which really is designed to be used as a sandbox

Not for untrusted content living on the same origin to prevent it from exercising any of the powers that it would ordinarily have to be able to access sensitive data. It's a misleading name and shouldn't have been chosen. There is no combination of CSP or the iframe sandbox attribute that can be relied upon for that purpose. This is a fundamental limitation of the way the specs were written.

(There needs to be a big warning about this on MDN, but moving from the old wiki to a wiki with GitHub for login to the GitHub-based pull request process really didn't help the there's-a-problem-on-this-page-but-limited-resources-to-make-things-better problem.)

Post reply on HN