Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I won't download your app. The web version is a-ok

0xsid.com

Post reply on HN
Print view View original

561–570 of 599 posts

Re: I won't download your app. The web version is a-ok

#561

Post by AlBugdy »

leptons wrote: post #500
palata wrote: post #478

Earlier quoted context omitted.

Well, you can verify that the code that you downloaded is the same that everyone else downloaded. Even if it contains webviews. Now if it contains webviews, it brings the security issue of... the webapps, of course. Personally, I want an open source app. You can audit an open source app and even compile it yourself. You can't really do that with a website. And I don't mean just mobile apps, that applies to desktop ap…

>Well, you can verify that the code that you downloaded is the same that everyone else downloaded. Even if it contains webviews. Not impossible to do with websites, if the need to do it was there. It would take about 15 minutes to create a browser extension that could make a hash of all the files loaded, to compare with other users with the extension installed - but honestly that's just not needed because if you're c…

> And if you don't trust the source, then why are you loading it to begin with??

I trust that Proton (for example) has implemented E2EE in their services. I wouldn't trust them to handle my unencrypted data - I wouldn't trust anyone for that. I don't trust that their security is perfect - no one's security is. So if they're breached, they could serve me malicious JS. I don't trust they're impervious to government pressure or blackmail. By making sure the files served to me are the same as the files served to anyone else, I can be relatively sure I'm not targeted personally. People could also review those files to make sure they're not malicious.

Re: I won't download your app. The web version is a-ok

#562

Post by leptons »

palata wrote: post #452
leptons wrote: post #370

Earlier quoted context omitted.

>That the server can send you a backdoor every single time, made just for you, and nobody else will ever know? There is no "backdoor" when the browser is sandboxed. "backdoor" is a specific thing, I think you need to read up on it before you keep using it incorrectly: https://en.wikipedia.org/wiki/Backdoor_(computing) >On the other hand, an app is sandboxed, too (on mobile OSes like Android and iOS). When you downloa…

Dude, I was here to talk about security, not to be judged on the quality of my English. What I get from your take is that your English is better than mine, but not your security knowledge. > That isn't what "sandboxed" means, it has nothing to do with checking hashes. I didn't say it had anything to do with it. I meant that NOT ONLY it is sandboxed, but ON TOP OF THAT you can check that you received the same code. >…

>not to be judged on the quality of my English.

"backdoor" isn't really an English thing, it's a tech thing. If you want to talk about tech, you need to know the terminology. This is not something like the difference between "there" and "their" and "they're". I did not correct your English grammar, I corrected your tech terminology.

>I would gladly elaborate with anyone who is not a jerk, but that does not seem to be the case here.

I was not "a jerk". You didn't seem to understand what a "backdoor" is in terms of tech, and I still don't think you do.

This pointless internet interaction is over. Gooodbye.

Re: I won't download your app. The web version is a-ok

#563

Post by josephcsible »

dlcarrier wrote: post #309
josephcsible wrote: post #249

Hall of shame: * Reddit won't let you read "unreviewed" content on mobile web (but will on desktop web) * PayPal won't let you pick your 5% rewards category, or set up balance auto-replenish without their app * Robinhood Banking won't let you see your credit card statement or pay your balance without their app * Instagram won't let you share posts as stories without their app * SeatGeek won't let you attend events wi…

How about an 81-year-old Dodgers fan who has held season tickets for 50 years, and doesn't even own a smartphone, who can no longer order the traditional book of season tickets: https://www.nbclosangeles.com/news/local/dodgers-fan-printed...

Hah, I submitted the same story here just a few hours before you posted that. I don't know whether that's actually an example of this particular problem or not, though, since I'm not sure whether they have a website that can display the tickets.

Re: I won't download your app. The web version is a-ok

#564

Post by ProllyInfamous »

cainxinth wrote: post #283
dudu24 wrote: post #273

Earlier quoted context omitted.

old.reddit.com

I've been on reddit since the beginning. If they kill old.reddit, I'm gone.

After abandoning all my reddit accounts [1] (some back into the aughties), I eventually found hackernews. Here is now the only place online which I write publicly.

Still, I love sharing tips for navigating reddit (you can do these without logging in):

1) old.reddit.com allows you to use Reddit's built-in link shortener,

e.g. To link to today's top post (https://old.reddit.com/r/pics/comments/1seo5rj/cafe_in_brazi...>), you can just write ` https://old.reddit.com/1seo5rj ` [this does not work without old.]

2) you can string multiple subreddits together using the ` + ` operator,

e.g. https://old.reddit.com/r/dogs+cats+fish> to view /r/dogs + /r/cats +/r/fish in a single stream/webpage

----

[1] in 2021; Dear /u/Spez: my promise given after your US Congressional testimony/fabrication... remains promised. —Rita/mod/bayarea

Re: I won't download your app. The web version is a-ok

#565

Post by iggldiggl »

mghackerlady wrote: post #122
ryandrake wrote: post #83

Earlier quoted context omitted.

You can support older devices, but admittedly Apple does not make it super easy to find. The easy "happy path" in Xcode is to only support the most recent OS versions.

iirc even then there's a minimum that xcode will still deploy to. The only way to have an app work on older versions than that is to not update it at all

With Android that's definitely not the case. Supporting older phones might get harder over time because you can't use any new APIs introduced in more recent OS releases, respectively always have to provide some fallback code path, and occasionally (at least if you want to publish on the Play Store) you're forced to use the new APIs, so you can't avoid the complexity of supporting both old and new APIs.

Plus if you're using any dependencies, you're also bound by whatever minimum API version all your dependencies are using. (Even Google's support library – on the one hand that one does try to somewhat smooth over the API differences between various OS releases and make your life easier, but eventually it'll also drop old Android API versions – on the conservative side, but eventually it'll do.)

But – if you're prepared to somehow work around all that, there's no hard cut-off, and a modern Android toolchain will still happily produce APKs that would run on by now very old phones, too.

Like e.g. I've taken an old app that had initially been developed during the Android 2.x era (around 2010/11) in order to fix a few annoyances and add some features. Since I didn't do any kind of radical overhaul of the original code so far, the resulting app happily runs both on modern phones (albeit with a somewhat older look-and-feel), but also on the oldest emulator image I could still get to work on my computer (Android 2.3.3 / API10 from February 2011).

Re: I won't download your app. The web version is a-ok

#566

Post by spixy »

beloch wrote: post #269
SunshineTheCat wrote: post #108

Earlier quoted context omitted.

This hit the nail on the head. I find much of the HN community insightful and interesting, but in terms of consumer feedback (especially in a B2C environment) I wouldn't touch feedback here with a 10-foot pole. I don't mean that to be an insult, quite the opposite. Most people here are power users. But that is a galaxy away from how the average user interacts with the internet.

"Why do I need to download a 100+ MB app, give it permission to track my location, and let it run background processes just to browse through a restaurant menu, buy a ticket, or scroll through a list of posts?" ------------------- Hardware/software companies have, historically, targeted power users because regular users listen to them. The companies producing these apps do so because they can benefit from exploiting…

Why do I prefer app:

- just click on the icon, no need to type to address bar or search in bookmarks list

- faster to load - no need to download JS/CSS, also my credentials are remembered so no need to login

- biometric login, no 2FA (finance apps, etc.)

- notifications and their customization (browsers only have on/off)

Why do I prefer mobile web:

- I need multiple instances (tabs) of the website

- I need to know URL of the specific page

Re: I won't download your app. The web version is a-ok

#567

Post by aembleton »

amusingimpala75 wrote: post #106

How much of the native app push is to bypass ad blockers? If you’re just using a browser plugin like AdGuard or uBO it can’t block in a dedicated app unless you replace it with AGH or PiHole, can’t help but wonder if that plays a role as well

I expect a lot of people who run adblockers on mobile, also configure their DNS or use a VPN to block ads. On Android, you can't even get an adblocker on Chrome, which is the browser most users and using.

Re: I won't download your app. The web version is a-ok

#568

Post by Olshansky »

KellyCriterion wrote: post #49

What most people dont get: Most of folks on HN here are much older than todays "first customers" of 16y/17/18 For them: The "Smartphone is the internet", while for most of us the "Smartphone is an extension of the internet from our desktops" that we were used to (remember the years before dot com bubble, saying: "I will be down in the basement at the computer to surf on the net little bit" ? :-) But today, the very f…

I've never found a Hacker News comment this insightful. Ty.

Re: I won't download your app. The web version is a-ok

#570

Post by leros »

abustamam wrote: post #508
forgotusername6 wrote: post #458

Earlier quoted context omitted.

There's an install element in the works. Perhaps that will make it more obvious how to install it https://github.com/WICG/install-element?tab=readme-ov-file

Neat! I like this. But I still don't think it solves the problem of a random website saying "install me!" without the "secure" middleman of an App store.

Yeah 99% of consumers are still going want an app from the app store even with that.
Post reply on HN