News for hackers. Stuff that matters.
Re:Ask HN: How can a web app operate on user-held data? by nostrademons on Tuesday May 08, 2018 @12:33AM (#17018839)
LocalStorage or IndexedDB on the client-side, with Javascript. The "untrusted" aspect is not a significant concern, since both browser JS and these APIs are sandboxed and can't escape a single file associated with the website. CPU usage and disk storage can be a concern, but most non-abusive sites won't be anywhere close to hitting levels where the user cares.

The biggest problem is that a lot of the algorithms that made the web successful can't be run on just one person's data. There's a reason why webapps replaced desktop apps, and that reason isn't just that you only need a single UI with no installation and aren't vulnerable to all the Windows worms that were going around in the early 2000s. If you try to compete with leading webapps you quickly realize the extent to which collecting all that data actually helps them build better products.

Re:Ask HN: How can a web app operate on user-held data? by imauld on Tuesday May 08, 2018 @01:50AM (#17019093)
> If you try to compete with leading webapps you quickly realize the extent to which collecting all that data actually helps them build better products.

I have an extremely difficult time believing this.

Having worked on platforms that use data from millions of users and probably billions of interactions to create features that no one uses. It would seem that even with all of the data that Amazon has been collecting from all of us, the best they can do is show you ads for the exact thing you just bought.

Windows was running in nearly every home long before they were collecting data about everything you did (some people would probably argue Windows has gotten worse since then). Most of my adult life online has been collected and cataloged and machine learned and statistically regressed by now and wielding all this data ads companies have managed to show me ads I've clicked on almost dozens of times.

Sure having more data can be helpful but I don't think it's a requirement. I also think that people can sometimes fool themselves in to thinking that without collecting every scrap from each user and without millions of users to collect from that we can't build great software.

Re:Ask HN: How can a web app operate on user-held data? by nostrademons on Tuesday May 08, 2018 @02:54AM (#17019314)
I used to work on Google Search. I now work on my own startup, which uses ElasticSearch. In many cases, they use the exact same algorithms and data structures, or can easily be fine-tuned to be equivalent. Nevertheless, stock ElasticSearch results are much, much worse, because you start with zero data. To say nothing of not having Suggest, Refinements, universal results, good spell-correction, disambiguation, etc.

I also use DDG when I'm in Tor Browser, and it always strikes me how much worse the results are when I try to do technical searches there.

I've still got my music collection in MP3 form on my hard disk, and it's only an iTunes click away. Nevertheless, when I listen to music, it's all on YouTube now, because YouTube can actually recommend stuff that a.) I like b.) is of a similar genre and c.) I haven't heard before.

I rely on GMail's spam filtering for E-mail to be useful; when I've tried to go back to Yahoo Mail or (heaven forbid) running my own server, the result is just unusable.

You're welcome to try founding a startup that operates as a desktop app and collects zero data from users. With improvements in developer tools and payment systems, most of the ideas from the late 1990s that required millions in venture capital financing could be done by a single motivated dev in a few months. Good luck getting users to adopt your software, though, regardless of how privacy-conscious they say they are.

Re:Ask HN: How can a web app operate on user-held data? by imauld on Tuesday May 08, 2018 @02:34PM (#17023447)
Search and recommendation services are definitely an example of things that do actually benefit greatly from more data. If you're building something like that then you will almost definitely benefit form more data. However, it might still be possible to generate music recommendations for a user based only on their usage patterns in their local music player. I'm not an expert in that area but I imagine it could be done.

> Good luck getting users to adopt your software, though, regardless of how privacy-conscious they say they are.

It would probably be difficult mostly because we have trained users that an app isn't useful unless you can sync it to all your devices. We are always going on about how much better things are once you can connect them to everything else on the planet. We've sold users on the idea that they need to be connected all them time and we need to know everything that they do so we can "improve their experience" which for most things means "show you ads."

I'm not knocking webapps in general. I make them all the time. Some of my favorite things are webapps. I'm writing this comment on a webapp. I just also believe that not everything needs to be a webapp and have a constant connection to some server telling it about everything I'm doing.

Re:Ask HN: How can a web app operate on user-held data? by fouc on Tuesday May 08, 2018 @04:50AM (#17019688)
I guess my concern with localstorage is that maybe it's not very easy/obvious for users to be able to export their data or manipulate their localstorage data easily without relying on the website.
Re:Ask HN: How can a web app operate on user-held data? by nostrademons on Tuesday May 08, 2018 @02:18PM (#17023269)
It's not, but there's a flexibility/security tradeoff there. If data isn't tightly bound to an app and just exists in files that any app can read and write from, you get confused-deputy attacks where a malicious app can construct a document that's interpreted in a different way by the original program and can then do something nefarious.

This was behind a lot of the MS Word & Excel worms & viruses that made the desktop such a hazardous place in the early 2000s that the web took off. People realized that they could embed VB code or even just formulas in .doc & .xsl files, and the mere act of opening the document (something which was supposed to be safe) would infect all your other files, and let attackers do things like read all your confidential documents and e-mail them to the attacker. Even without scripting languages, you can get surprisingly simple & damaging attacks like rewriting URLs of prominent sites within documents to go to an attacker-controlled domain that looks like the original (using Unicode lookalike characters) and then phishes their login.