Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Private client-side-only PWAs are hard, but now Apple made them impossible

andregarzia.com

Post reply on HN
Print view View original

111–120 of 927 posts

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#111

Post by OzzyB »

ChrisMarshallNY wrote: post #91
robenkleene wrote: post #60

I’m guessing that Apple will start hindering web apps because the new mouse support in iPadOS is going to be such a boon to web apps. Because of sandboxing, web apps are the only cross-platform apps that can run in their full versions on iPadOS. I wrote a quick summary of the situation[0]. Therefore, since native apps are more of a platform differentiator than web apps, moving forward we can expect Apple to start sys…

As a native app developer, I can live with this.

As long as you start refering to the "i" in "iPhone" as Intranet and not ~Internet~ then we're cool.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#112

Post by megous »

EGreg wrote: post #71
scarface74 wrote: post #38

Earlier quoted context omitted.

Good luck with telling people not to use Safari (or more accurately WebKit) on iOS....

You’re right. Tell people not to use iOS https://www.forbes.com/sites/gordonkelly/2020/03/14/apple-io... You Apple users will put up with anything! (disclaimer: iOS user)

Lol, 50GB unexplained mobile data consumption. That'd be 3 months worth of rent on my mobile data plan. Good luck ever getting out of debt if that happened on some more expensive international roaming.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#113

Post by TeMPOraL »

arghwhat wrote: post #4

Better title: Apple restricts tracking by limiting browser storage, which hurts my particular app. Browsers need to be severely limited due to them running arbitrary code from the web. Doesn't matter if it's an offline web app. If you want more access, make a native app (with or without web technologies).

It's not "limiting browser storage", it's making browser storage expire. TFA's example is just some random app, but this essentially kills the entire concept of an offline-first web app, and severely hurts the browser as an application platform.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#115

Post by untog »

im3w1l wrote: post #56
vbezhenar wrote: post #42

Earlier quoted context omitted.

User not coming to website 7 days can't be invalid use-case. Losing important data simply because someone went on vacation is unacceptable.

So store this data on the server.

You say that as if it isn’t an absolutely giant extra piece of functionality and ongoing cost. That native apps won’t have to do.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#116

Post by diggan »

lonelappde wrote: post #47
diggan wrote: post #11

Earlier quoted context omitted.

offline web apps are different than PWA. A PWA doesn't necessarily work offline, but more is independent from the connection / loading of it. I do think most PWAs do work offline, but doesn't mean it's a requirement to call it a PWA. Similarly, an offline capable web app is not necessarily a PWA, as PWA carries a lot of features to it besides being offline capable.

What is an "off-line web app"? If an app never goes online and is sandboxed from other apps, then it never has any data at risk of exfiltration.

An offline web app is a frontend-only application (just HTML+CSS+JS or less) that can be loaded from any medium (internet, usb stick, direct TCP via netcat or any other transport) and work in your browser without requiring a remote connection to allow usage of it's features.

So yes, this would mean it doesn't run the risk of ex-filtration or snooping at the transport layer, as the data never leaves the specific website context in your browser.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#117

Post by felixfbecker »

im3w1l wrote: post #103
matsemann wrote: post #76

Earlier quoted context omitted.

But wouldn't that make it have less privacy? Now my webapp cannot be used offline and anonymously, user has to be logged in and tracked

It doesn't change the status quo. Important data wasn't put in cookies before, and it wont be after. It was always a recipe for data loss. Server side, or if you need privacy, have the user export to / import from a local file.

This is also about IndexedDB. Imagine native apps had all their data wiped if you don't open them (with an active internet connection) every 7 days. Not just on an iPhone, but also on macOS.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#118

Post by shadowgovt »

JumpCrisscross wrote: post #99
codesections wrote: post #30

Earlier quoted context omitted.

> Apple restricts tracking by limiting browser storage But the argument that this will protect privacy in the first place seems really weak. Before this change in Apple's policy, an app could store my config data on my PC. After this change, they'd need to have me log in and send the config data to their servers. That seems like I've lost privacy, not gained it.

> they'd need to have me log in and send the config data to their servers You'd have to log in. That's a hurdle that involves implicit consent.

That's a hurdle that involves de-anonymization of the user.

Re: Private client-side-only PWAs are hard, but now Apple made them impossible

#119

Post by kingo55 »

megous wrote: post #80
arghwhat wrote: post #4

Better title: Apple restricts tracking by limiting browser storage, which hurts my particular app. Browsers need to be severely limited due to them running arbitrary code from the web. Doesn't matter if it's an offline web app. If you want more access, make a native app (with or without web technologies).

> If you want more access, make a native app (with or without web technologies). How's installing a native app better for a random user privacy or security wise, exactly?

With embedded SDKs and device identifiers that work similarly to third party cookies, they're not.

I understand it's changing too, but not as fast as safari.

Post reply on HN