News for hackers. Stuff that matters.
Re:How Discord Won by SahAssar on Monday October 19, 2020 @05:16PM (#24831111)
You're assuming a lot, especially about the willingness to install an app at all. I won't install an app unless it couldn't actually have been a webapp and I use it really often.

Give me a proper website with a proper email/password/WebAuthN & SSO signup. I don't want the app, I don't want any of it.

Re:How Discord Won by oblio on Monday October 19, 2020 @05:36PM (#24831296)
He's assuming a non-tech savvy user. Catering to the 1% wouldn't really make for mass market appeal.
Re:How Discord Won by mrtksn on Monday October 19, 2020 @05:26PM (#24831211)
Sure, I’m talking from my perspective.

Websites are simply apps installed in the browser without asking for permission. Notorious for tracking abilities, data storage tied to the browser, performance lower, capabilities limited to browser api, data consumption unpredictable, identification tied to web technologies.

Some people may want just that, I don’t judge.

Re:How Discord Won by SahAssar on Monday October 19, 2020 @05:47PM (#24831401)
> Websites are simply apps installed in the browser without asking for permission

That actually work on the platforms I choose. There are many apps that only work on iOS/Android that I want to run on my desktop or a more pure linux phone. I just want to be able to consume a service from a platform that clearly have the technical capabilities to do so, but no, it has to be a "app".

> Notorious for tracking abilities

And a lot easier to chose/disable them. This summer many apps (including stuff like spotify) would not even start on iOS because the facebook SDK crashed. On the spotify web player I can choose to block calls to recaptcha, facebook and similar with umatrix. Do you think that apps on average have less tracking or just that you tend to pay for apps but not for webapps and therefore get higher quality apps?

> data storage tied to the browser

Great! Data storage on the client should either be treated as unreliable or the only storage (for stuff where there is no "cloud" or privacy is critical). Tying storage to a single vendor (like icloud or google drive) is a very, very bad idea. Web browsers also have a well defined interface for you to inspect the data saved locally if you want.

> performance lower

For the majority of apps this does not matter. The reason webapps are usually slow is not that the platform is slow, it's that companies copy websites that are stuffed with tracking (if you block that they tend to be much quicker). They suck because the people who made them made them suck.

Most chat, mail, news, or any other form of text/image/video app could easily be performant enough as a webapp. Hell, amazon even made their real time game streaming service a webapp. The platform is not the problem.

> data consumption unpredictable

Not sure what is different here from native apps? Both can auto-update, both can download assets at-will, right?

> identification tied to web technologies

Yes please! That means it's portable and not tied into google/apple!

Re:How Discord Won by CDSlice on Monday October 19, 2020 @05:50PM (#24831434)
> Notorious for tracking abilities

A native app has every opportunity a webapp has to track you and much more.

> data storage tied to the browser

So? Browsers make it as easy to clear the storage of a webapp as it is to clear the storage of a native app. If you are talking about PC apps it is even easier to clear webapps' storage than native apps. If you mean it is bad because the stored data can disappear from the users device, that is what the localstorage API is for. Browsers will only delete that data if the user tells them to. This isn't any different from native apps having to deal with users deleting their files.

> Performance lower

While I have to admit that for raw computation webapps are slower than native, most apps don't need that much raw computational power and WASM should bridge the gap to native performance for apps that do need it. If your webapp is slow it is by far more likely you did a poor job programming it, not that you are limited by web performance.

> capabilities limited to browser api

Browser APIs are expanding all the time (except on iOS Safari but Apple has a vested interest in crippling webapps). And again, most apps don't need deep access to a system and the few that do shouldn't be webapps anyway.

> data consumption unpredictable

This has absolutely nothing to do with if an app is a webapp or native. Native apps can suck down data like crazy while webapps can use almost none and vice versa.

> identification tied to web technologies

Not really? Name one form of widely used identification that webapps don't support. You can use emails, usernames, 2FA, security fobs.

edit: remove snark at the end, it didn't add anything.

Re:How Discord Won by mrtksn on Monday October 19, 2020 @06:18PM (#24831652)
> A native app has every opportunity a webapp has to track you and much more.

Nope, an iOS app can’t leave a cookie that other apps can use to identify me.

Clearing storage is not the issue, making sure that the storage is not accidentally cleaned is.

The data consumption of an app is predictable because the download size would be listed in the appstore. On a website, it could be anything and the only way to find out is to load it. You can check out the data usage after install in iOS but there’s no easy way to do it for websites.

Re:How Discord Won by CDSlice on Monday October 19, 2020 @06:43PM (#24831841)
> Nope, an iOS app can’t leave a cookie that other apps can use to identify me.

Maybe not directly, but by using something like the Facebook SDK the same effect can be achieved by shipping your advertising identifier off to Facebook who then does the tracking server side using events generated by the Facebook SDK. This is in tons of apps and you have no way of knowing it as an end user without reading the privacy policy or reverse engineering the app.

> Clearing storage is not the issue, making sure that the storage is not accidentally cleaned is.

This is just as much of an issue on native apps as it is with webapps, browsers wont clear local storage for a website unless the user requests it just like how a native apps storage won't be cleared unless a user requests it.

> The data consumption of an app is predictable because the download size would be listed in the appstore. On a website, it could be anything and the only way to find out is to load it. You can check out the data usage after install in iOS but there’s no easy way to do it for websites.

Just because the App Store download size is predictable doesn't mean the final download size is, lots of apps download a bunch of extra assets on first launch or even regularly as you are using them. I also couldn't find a way to check data usage of apps or websites on WiFi on my iPad so that isn't really a point either way.

Re:How Discord Won by dylz on Monday October 19, 2020 @09:37PM (#24833182)
A number of apps like the Chick-fil-A one explicitly advertise these as features:

> - Advanced Persistent Device Identification: Identifies individual mobile devices for both iOS and Android platforms, even if they have been reset or if the application has been reinstalled.

> - verifies the integrity of the application in which it is embedded to ensure it has not been modified or infected. It also analyzes all other apps installed on the device, and reports their reputation and the presence of any malicious code.

Re:How Discord Won by mcintyre1994 on Tuesday October 20, 2020 @05:45AM (#24835495)
> It also analyzes all other apps installed on the device, and reports their reputation and the presence of any malicious code.

There is no iOS API that allows them to do this. Apple removed it years ago: https://appleinsider.com/articles/15/06/24/apple-expanding-u...

Re:How Discord Won by xfer on Monday October 19, 2020 @05:36PM (#24831294)
You are pretending that apps don't do any of that? The only difference is you have control over your browser(you can filter tracking sites etc) but for an app you have none.
Re:How Discord Won by mrtksn on Monday October 19, 2020 @05:46PM (#24831389)
They all have their strengths and weaknesses. I favor the Apps more that websites because of what the web has become.

Being able to know in what I am getting in and tapping install is much, much better experience than tapping on a link to the unknown then trying to figure out how to reach the thing I am looking for when the website tries to track me, monetize me, make me sign up all at the same time.

A website would usually load about the same size data of a native app without a warning and would report me to facebook, google and others.

That’s not something I am thrilled about.

Re:How Discord Won by SahAssar on Monday October 19, 2020 @06:06PM (#24831565)
> load about the same size data of a native app without a warning and would report me to facebook, google and others

Why do you think native apps are not like that?

Many apps load SDKs from google and (especially) facebook. They often load a lot of assets from servers.

Re:How Discord Won by mrtksn on Monday October 19, 2020 @06:22PM (#24831679)
I can see what is the required download size for install and I can track how much data an app is using on iOS.

For websites, this is not an option.

Re:How Discord Won by SahAssar on Monday October 19, 2020 @06:26PM (#24831711)
You can see the installed downloaded binary, sure. And you can see usage after the fact, but there is no reason to assume that the app store size is the only download it will use, most major apps I've seen use a lot more even when not downloading media.
Re:How Discord Won by mrtksn on Monday October 19, 2020 @06:33PM (#24831764)
It’s still much better than not having a clue.
Re:How Discord Won by SahAssar on Monday October 19, 2020 @06:42PM (#24831835)
So:

Option A: Only runs on one platform, can only be published on that platform with the blessing of the manufacturer of your device and little-to-no insight into data usage

Option B: Cross platform, can be interfaced with using open standards and block parts of it that you want (not just on a DNS level, but on a resource level)

I really don't see why you would prefer A?

Re:How Discord Won by mrtksn on Monday October 19, 2020 @06:53PM (#24831918)
You prefer option A because it’s much better experience.

If you’re building a service that’s not suitable for option A then you use option B. It’s not really a discussion at that point.

I’m glad that there’s an option B the way that I am glad that there’s frozen pizza in the fridge. Good to have it but I’m not gunning for it if a proper restaurant pizza is available.

Re:How Discord Won by jsjohnst on Tuesday October 20, 2020 @08:33AM (#24836525)
> but for an app you have none

There are a number of pseudo vpn like apps that give you similarish control over native apps just the same as an extension on a web browser that uses hostname blocklists.

Re:How Discord Won by taneq on Tuesday October 20, 2020 @02:03AM (#24834341)
> Websites are simply apps installed in the browser without asking for permission.

I don't believe a website can upload your contact list, upload a list of apps on the device, log your GPS location or record using your camera or microphone. Is this no longer true?

Re:How Discord Won by jsjohnst on Tuesday October 20, 2020 @08:30AM (#24836500)
> I don't believe a website can upload your contact list

Requires an opt-in permission on native, for browsers with support, it would also be an opt-in permission

> upload a list of apps on the device

Not possible on iOS for a native or web app. Depends on a number of factors on Android.

> log your GPS location or record using your camera or microphone.

Possible for native and web apps, but only after explicit opt-in permission.

End result, no meaningful difference between native and web for any of your examples.

Re:How Discord Won by eitland on Tuesday October 20, 2020 @02:35AM (#24834475)
> I don't believe a website can upload your contact list, upload a list of apps on the device,

True AFAIK.

> log your GPS location or record using your camera or microphone. Is this no longer true?

Depends on what you mean. This is fully possible on many phones and only needs approval from the user.

Then again approval from the user seems to be becoming the standard in installed apps as well.

That said, I much prefer web pages for things that need cloud or apps/desktop applications that works offline for the rest.

Re:How Discord Won by mrtksn on Tuesday October 20, 2020 @02:30AM (#24834459)
You can let the website do all these things however they would have to ask for an extra permission to access these API just like the native apps have to ask for extra permissions to access these API.