Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It’s time to kill the web app

blog.plan99.net

Post reply on HN
Print view View original

121–130 of 717 posts

Re: It’s time to kill the web app

#121

Post by an_account »

SwellJoe wrote: post #62
aidenn0 wrote: post #48

Earlier quoted context omitted.

> "Web development is slowly reinventing the 1990's." > The 90s were slowly reinventing UNIX and stuff invented at Bell Labs. Yes, this reminds me of: "Wasn't all this done years ago at Xerox PARC? (No one remembers what was really done at PARC, but everyone else will assume you remember something they don't.)" [1] > "Buffers that don’t specify their length" > Is this really a common problem in web apps? Most web app…

"Most injection attacks are due to this; if html used length-prefixed tags rather than open/close tags most injection attacks would go away immediately." How so? If you allow the user to send arbitrary data, and your handling of that data is where the problem lies, it isn't going to matter whether the client sends a length-prefixed piece of data. You still have to sanitize that data. HTML, and whether it uses closing…

If you can say, “the next 450 characters are plain text and should be rendered as such”, then even if the text includes script tags (or whatever), they won’t be parsed or executed.

Re: It’s time to kill the web app

#122

Post by u801e »

addicted wrote: post #105
jerf wrote: post #31

Earlier quoted context omitted.

"Any time I think I'd like to do something with the web and sit down to learn, it's completely overwhelming. I've never been able to put together a coherent mental model of the architecture of a web application or figure out what the best practices are for web development." If it makes you feel any better, that's because there isn't a coherent mental model. If you've ever heard of the ORM/Relational impedance mismatc…

A lot of the churn is because the web is so young as an application platform. It’s been less than 20years since GMail which was probably the first thing that even approximated an application on the web. Chrome was released in 2008 less than 10years ago, and it was the first time the web had a runtime engine which was perform at enough to even build an app.

How did gmail back then differ from hotmail or Yahoo mail? I was using both in the late '90s/early '00s.

Re: It’s time to kill the web app

#123

Post by aperiodic »

tannhaeuser wrote: post #96
andrepd wrote: post #63

Earlier quoted context omitted.

I think what he meant was "throw out the web as a platform for applications", not as a platform for document distributions.

If so I'm in full agreement. It's truly mind-blowing how much energy has been wasted on trying to shoehorn the web into an app delivery platform over the last decade. To what end? To make the browser a general purpose platform? We have that already, it's called an "operating system". Edit: that said, I disagree with many points and the general negativity in TFA

It's a great example of worse is better in action: a technically inferior platform winning out because it's better at one or two things that enable virality, which is the only thing that matters when all the money is looking for high growth.

In this case, it's that webapps require zero effort and time from the user to get started with, and allow developers to get the closest to the "write once, run anywhere" dream than anything else (if you're doing a decent responsive design, you can even get a good experience on both desktops and phones with much less effort and no gatekeeping), so the development effort is a lot lower.

These two attributes make it really hard for a native app to compete on growth terms with a webapp, since it has a higher hurdle for users, higher initial development costs to target the same amount of users, and higher iteration costs to ship (and get users to install) a new version. It doesn't matter that it's hilariously inefficient; as long as it's just below the threshold where the user tears their hair out, they're not going to jump ship.

Re: It’s time to kill the web app

#124

Post by osrec »

I wished the author had taken a more developmental view.

Personally, I think the web as it currently is, has a few shortcomings, but on the whole I feel it can be refined into something quite brilliant.

Also, with regards to the title "it's time to kill the web app", I feel the web app has only just started to emerge as a solid competitor to native. To kill it now would be a travesty! I believe that soon it will replace a large chunk of native apps and the innovation we will see in browser APIs in the next few years will be quite remarkable. I think the USP for the web is ubiquity and uniformity - having a single, uniform platform that runs on any machine while being unlimited in the variety and nature of things it's capable of. There are issues to be addressed (security being the obvious one), but still, to me web apps are a step in the right direction, not the wrong one!!

Re: It’s time to kill the web app

#125

Post by sp332 »

SwellJoe wrote: post #62
aidenn0 wrote: post #48

Earlier quoted context omitted.

> "Web development is slowly reinventing the 1990's." > The 90s were slowly reinventing UNIX and stuff invented at Bell Labs. Yes, this reminds me of: "Wasn't all this done years ago at Xerox PARC? (No one remembers what was really done at PARC, but everyone else will assume you remember something they don't.)" [1] > "Buffers that don’t specify their length" > Is this really a common problem in web apps? Most web app…

"Most injection attacks are due to this; if html used length-prefixed tags rather than open/close tags most injection attacks would go away immediately." How so? If you allow the user to send arbitrary data, and your handling of that data is where the problem lies, it isn't going to matter whether the client sends a length-prefixed piece of data. You still have to sanitize that data. HTML, and whether it uses closing…

If the length is not pre-defined, the input has to be parsed to look for the closing tag. That makes your code vulnerable if the input tricks it into finding the wrong closing tag. But if the length is fixed, you don't have to parse it at all. That would avoid a whole class of vulnerabilities.

Re: It’s time to kill the web app

#126

Post by open-source-ux »

bitexploder wrote: post #24
mikebenfield wrote: post #20

It's probably not realistic, but I would love to see the web be completely thrown out and replaced with something reasonable. I write a decent amount of native code. I write Rust, C, and x64 assembly. I think I'm pretty good at this stuff. But the web is too much for me. Any time I think I'd like to do something with the web and sit down to learn, it's completely overwhelming. I've never been able to put together a c…

That's cause the web is full of hype. Try Python Flask. A three line Python function and you are going. No magic. Just request and response. It is easy. Bang out a model class and read the SQLAlchemy tutorial. The web and RDBMS with just enough magic. Screw HTML front ends. Write the ugliest HTML you want. Never spend time in HTML. Make your app / idea work. Get your data right. Front ends and modern front end tech s…

> Write the ugliest HTML you want

Writing correct HTML helps people using screen readers because they can navigate a page using the descriptive HTML elements. In fact, writing correct HTML is probably the simplest and easiest thing to do when it comes to creating a web page. It's CSS that's needlessly complicated and unpredictable.

Re: It’s time to kill the web app

#127

Post by sanbor »

mikebenfield wrote: post #20

It's probably not realistic, but I would love to see the web be completely thrown out and replaced with something reasonable. I write a decent amount of native code. I write Rust, C, and x64 assembly. I think I'm pretty good at this stuff. But the web is too much for me. Any time I think I'd like to do something with the web and sit down to learn, it's completely overwhelming. I've never been able to put together a c…

Probably you spent several years at low level programming and you're fluid and productive in that world. In the other hand, I spent my last 10 years dealing with websites and I feel fluent and productive with the web, while I feel frustrated and overwhelmed by low level programming. The web is 20 years of quirks. Low level stuff is 40 years of quirks. If you want send me a message and maybe I can help you with learning web and you can help me with low level stuff :)

Re: It’s time to kill the web app

#128

Post by alanh »

generalpf wrote: post #98
pjmlp wrote: post #78

Earlier quoted context omitted.

> hyperlinks between apps Sure you can. iOS - https://developer.apple.com/library/content/documentation/Ge... Android - https://developer.android.com/training/app-links/deep-linkin... UWP - https://docs.microsoft.com/en-us/windows/uwp/launch-resume/w...

One problem I've had when developing for iOS is that universal links don't "trigger" after a redirect, which is very relevant for sending emails though something like MailChimp with click-tracking.

The irony of complaining that native, here portrayed as an alternative to a hopelessly multi-party web platform, won’t let you interject arbitrary parties between a link and its destination…

Re: It’s time to kill the web app

#129

Post by publyjusz »

modeless wrote: post #25

There's one big problem with killing the web: Apple's App Store. You can make all the new platforms you want, but they will never be allowed to replace the App Store for distribution. The web is the only platform that can do distribution outside of the App Store on iOS and Apple will never allow a second one. That means your platform can't have hyperlinks between apps, can't have a no-install experience, can't do jus…

Also, web is the only widely used and non-corporate/centralized way of obtaining software on mobile. I realize that I'm not a part of big demographic, but on CopperheadOS, opting out of Google Play, I can get software 1. as APK's (only if devs make them accessible, and they come without auto-updates anyway) 2. by F-Droid (which contains only strict FOSS) 3. as web apps. Web sucks in many ways, but at least it makes more or less really _owning_ a _useful_ (flexible) smartphone a possibility.

Re: It’s time to kill the web app

#130

Post by jdietrich »

gens wrote: post #116
SwellJoe wrote: post #12

I find this unconvincing. Every negative thing said about the web is true of every other platform, so far. It just seems to ignore how bad software has always been (on average). "Web development is slowly reinventing the 1990's." The 90s were slowly reinventing UNIX and stuff invented at Bell Labs. "Web apps are impossible to secure." Programs in the 90s were written in C and C++. C is impossible to secure. C++ is im…

> Programs in the 90s were written in C and C++. C is impossible to secure. C++ is impossible to secure. Back then the compilers sucked. They would take complete crap of code and still it would work. They were like browsers are today. (from my experience from going through one old MUD code) Today the song is different. Not only will the compilers warn you of many things, there's even tools for static analysis (and dy…

C and C++ simply weren't designed with safety in mind. Even with a good compiler and static analysis, security-critical bugs will slip through the net that simply wouldn't happen in other languages. It's not so much a question of whether it's possible to write safe C, but whether it's natural or easy. C is unsafe by default.
Post reply on HN