Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It’s time to kill the web app

blog.plan99.net

Post reply on HN
Print view View original

611–620 of 717 posts

Re: It’s time to kill the web app

#611

Post by mike_hearn »

thecrazyone wrote: post #393
bayonetz wrote: post #379

Earlier quoted context omitted.

True but it's crazy that it took 20 years to get sane layout control.

Well _it is_ crazy. We can't trace an alternate history and work with that. We work with what we have. I think, here, we might looking at it with the wrong lens. I'm unable to find the right words to say this. Let me say this statement feels ungrateful. Web is the largest and fastest growing ecosystem of software we've right now (refer: community size, number of projects on github, say, in Javascipt, CSS, and other w…

Sane layout control for apps was a solved problem 15 years ago (well, for some definition of sane). Look at toolkits like Swing, GTK2, Qt, heck even Cocoa has better layout control for apps than HTML.

Flexbox is essentially an import of those concepts to CSS. There are no new ideas there.

But now flip it around and try to make a beautiful, responsive document in Swing or GTK. The layout managers that make them so great for laying out UIs won't help you much there. They can do it, they have layout managers that operate somewhat like a CSS box flow, but it won't be as natural or as easy.

So it's worth considering if it's easier to evolve HTML towards sane layout management for app-like things, or GUI toolkits towards sane layout management for document-like things.

Re: It’s time to kill the web app

#612

Post by mike_hearn »

gregmac wrote: post #460
x0x0 wrote: post #233

Earlier quoted context omitted.

I used vb6 20 years ago and have recently (quite unfortunately) had to learn html/js/css basics. The web is hot garbage for displaying form data compared to microsoft tools circa 1996.

The big problem is they are trying to solve different problems. Microsoft stuff was going for fixed screen size/resolution, fixed layout, and using a quite limited set of controls. Web browsers try to be accommodating by default - any screen size (including mobile), zoom built in, and significantly more powerful control primitives that allow enormous flexibility in the way to design things. If you're building forms a…

Very few web apps actually use the same HTML for desktop and mobile. It's more common for WordPress templates and other document-like things, but the UI constraints on a phone are so different that it's better to create a dedicated UI for them. So I'm not sure judging VB6 by that metric is valuable.

Re: It’s time to kill the web app

#613

Post by mike_hearn »

int_19h wrote: post #470
catnaroek wrote: post #406

Earlier quoted context omitted.

> it has basically zero understanding of flexible layouts. That's largely a non-issue to me. If I need anything fancy, I'll draw it myself. The simple stuff ought to be simple. > As a result, things break as soon as you try to make an easily resizable window Au contraire! It is much easier to make a resizable window when you are in full control of how nested widgets are resized along with it. That being said, some au…

Again, "anything fancy" here includes something as simple as a localized dialog. In most commercial apps, this means pretty much everything would require "drawing it yourself". At which point you can basically throw the designer away, since you'll be writing code to manage layout for all widgets anyway.

GUI toolkits moved on since the 1990's.

Go download NetBeans and create a Swing UI in Matisse. You'll find these issues aren't an issue. You can drag/drop and end up with a flexible, responsive layout that can handle things like strings changing length due to localisation. You can do the same with Scene Builder for JavaFX, although it's not as slick as Matisse. Or even Glade, if you're more a UNIX person. The latter two tools require you to understand box packing but allow for a relatively responsive layout.

The thing they don't do is let you totally change the layout depending on window size. But that's a fairly easy trick to pull off by just swapping out between different UI designs at runtime. There are widgets that can do this for you.

Re: It’s time to kill the web app

#614

Post by mike_hearn »

namelost wrote: post #285
Udik wrote: post #262

Earlier quoted context omitted.

The problem is that if you present an average web user with the interface you can design (quickly and efficiently) in VB6, they'll spit in your face. Much of the complexity of web design is not in the tools; it's in the fact that users don't expect a standard whatsoever, they just expect their UIs to be as slick and customly designed as magazines. If every website was written using the same standard, predefined set o…

This is a really observant point. Users expect every website to have a unique identity (unlike anything built with WinForms), that is what creates the complexity. If you actually use something like bootstrap, your website will look unoriginal, but it will be dead easy to make.

Indeed. The lack of easy theming (i.e. difficulty of producing a unique visual brand) is one reason why desktop toolkits lost out to the web, amongst many others.

Re: It’s time to kill the web app

#615

Post by mike_hearn »

DINKDINK wrote: post #525
kowdermeister wrote: post #294

Earlier quoted context omitted.

What's odd is that this article is so well written that it really clicks with bitter developers who are just confused in the vast sea of alternative technologies with the web. At least that's my guess why there's so many upvotes here. I feel that anyone who rants like this comes from a low level micromanagement world where they have extreme control over everything any they can't have it with web technologies. Fine, b…

>What's odd is that this article is so well written that it really clicks with bitter developers who are just confused in the vast sea of alternative technologies Hearn has a penchant for penning very well written articles but complaining about systemic issues rather than directly solving them. He was the kernel of the block size split that occurred in bitcoin starting in 2015 whose vitriolic fruit still bears today.…

I think that's a bit unfair.

Firstly, I did try and solve the block size problem. Myself and Gavin did Bitcoin XT. It resulted in large DDoS attacks that took out entire regional areas because they contained a single XT node, any mention of XT being banned from the Bitcoin forums, large companies like Coinbase being banned too for simply experimenting with it, and so on. Miners also refused to run it because they were told that this would be democracy, and democracy was dangerous (they were almost all in China, so no surprises there). There was a large, organised and extremely hostile effort to ensure that the solutions we proposed could not be adopted even by those who wanted to. I did a lot more than just write articles.

As for this article, it says there's a second part coming where I propose concrete solutions.

Re: It’s time to kill the web app

#616

Post by lunchables »

Brakenshire wrote: post #588
TeMPOraL wrote: post #520

Earlier quoted context omitted.

No, it didn't. But is it so complex it requires 10x+ the resource use? I don't think so.

You can say the same about Windows 2016. Recommended RAM has gone up more than 100-fold, from 16MB to 2000MB. Developers use the resources made available to them, that has nothing to do with the web.

No one is writing web apps using javascript because they're "using the resources available" to them, in the form of powerful hardware. They're using the only TOOLS available (javascript). The problem is we just don't have a better choice, at least on the front-end.

Re: It’s time to kill the web app

#617

Post by DaiPlusPlus »

cm2187 wrote: post #486
vbezhenar wrote: post #204

Earlier quoted context omitted.

SQL injection is a problem with SQL, which is similar to problems with HTML. SQL was created as human-friendly query languages, it wasn't created to be built from strings in a programming language. Proper database API should be just a bunch of query builder calls and with this API SQL-injection is not possible.

SQL injection is a problem with incompetent developpers. Most languages have simple constructs to make them immune to injections, like parameterized queries. If you are exposing code to an untrusted, hostile environment (which is pretty much the web), no language that does anything useful will protect you against not caring about security.

Not all queries can be parameterised - I'm not aware of any DBMS that allows for the parametiersation of identifiers (e.g. table and column names) or variadic operators and clauses (e.g. IN() and optional predicate clauses), this is why "Dynamic SQL" is a thing - which comes with the inherent risk of SQL Injection.

Re: It’s time to kill the web app

#618

Post by falcolas »

Fej wrote: post #433
SwellJoe wrote: post #12

I find this unconvincing. Every negative thing said about the web is true of every other platform, so far. It just seems to ignore how bad software has always been (on average). "Web development is slowly reinventing the 1990's." The 90s were slowly reinventing UNIX and stuff invented at Bell Labs. "Web apps are impossible to secure." Programs in the 90s were written in C and C++. C is impossible to secure. C++ is im…

This might be the biggest dichotomy I've yet seen on HN. An opinion piece voted all the way to the top of the front page (with a clickbaity title, might I add), yet the top comment soundly debunks the article's arguments. Yeah, this is why everybody clicks on the comments link first.

Being the top comment means only it has more recent upvotes than other top-level comments, not that it has some special meaning that should be taken to have more meaning than the article. Back when they were still displaying points, you could see that the time of the upvote mattered almost as much as the actual upvote itself - meaning the comment with the most upvotes was not always the top comment.

Re: It’s time to kill the web app

#619

Post by cm2187 »

DaiPlusPlus wrote: post #617
cm2187 wrote: post #486

Earlier quoted context omitted.

SQL injection is a problem with incompetent developpers. Most languages have simple constructs to make them immune to injections, like parameterized queries. If you are exposing code to an untrusted, hostile environment (which is pretty much the web), no language that does anything useful will protect you against not caring about security.

Not all queries can be parameterised - I'm not aware of any DBMS that allows for the parametiersation of identifiers (e.g. table and column names) or variadic operators and clauses (e.g. IN() and optional predicate clauses), this is why "Dynamic SQL" is a thing - which comes with the inherent risk of SQL Injection.

There are many reasons to create SQL dynamically, but I can't think of a good reason for the table name to come from the client.

Even if you absolutely need to inject a string in a sql query, sanitizing it is trivial. In .net / MS SQL, a simple x = x.Replace("'","''") does the trick. For any other common data type, strong typing should be sufficient to prevent any injection.

Re: It’s time to kill the web app

#620

Post by oblib »

jiggunjer wrote: post #411
oblib wrote: post #382

From an engineering standpoint there are surely some valid points here but I have to say that I don't think things are all that bad. HTML,CSS, and Javascript separate the layers of a web app fairly nicely. It's all free for the learning and using and even distributing, and it comes with a huge community to lean on for support where many, if not most, of any questions you might have are already answered. Those parts w…

> HTML,CSS, and Javascript separate the layers of a web app fairly nicely. Except they don't. Most devs aren't even aware of what divs they are using for pure styling vs semantically correct ones. They think all the html they write is by definition semantic. Then there are the less frequent but even more insidious cases where css is used for content.

Does that really make a difference?

Seems to me that's a feature that's generally described as "more than one way to do it" and the goal is getting the app working and shipped not to appease some outside critic's sense of semantics.

Post reply on HN