News for hackers. Stuff that matters.
Re:Downfall Attacks by throwaway892238 on Tuesday August 08, 2023 @02:45PM (#37053659)
Agreed. Browsers are now nothing but an application platform of APIs (https://developer.mozilla.org/en-US/docs/Web/API). For some reason they still retain the vestigial HTML, CSS and JS, but really all you need is bytecode that calls an ABI, and a widget toolkit that talks to a rendering API. Then we can finally ship apps to users without the shackles of how a browser wants to interpret and render some markup.

The idea of security "sandboxes" is quaint, but have been defeated pretty much since their inception. And the only reason we have "frontend developers" rather than just "developers" is HTML/CSS/JS/DOM/etc is a byzantine relic we refuse to let go of. Just let us deliver regular-old apps to users and control how they're displayed in regular programming languages. Let users can find any app in any online marketplace based on open standards.

Re:Downfall Attacks by sidewndr46 on Tuesday August 08, 2023 @02:59PM (#37053861)
If someone created a way for WASM to talk to an SDL equivalent, it'd probably end use of HTML & CSS
Re:Downfall Attacks by tomsmeding on Tuesday August 08, 2023 @03:41PM (#37054454)
If so, all people relying on (often limited even with html that contains text) accessibility features will have to sit in a corner and cry.
Re:Downfall Attacks by wg0 on Tuesday August 08, 2023 @04:59PM (#37055373)
I think that should be addressable.
Re:Downfall Attacks by Terr_ on Tuesday August 08, 2023 @08:59PM (#37057489)
Why do I get the feeling some company will address the issue by offering them a comfy chair and a free box of tissues?
Re:Downfall Attacks by throwaway12245 on Tuesday August 08, 2023 @03:36PM (#37054376)
WASM has support for SDL for a long time: https://www.jamesfmackenzie.com/2019/12/01/webassembly-graph...
Re:Downfall Attacks by yvdriess on Tuesday August 08, 2023 @03:32PM (#37054320)
And so closing the great circle of UI framework technologies.
Re:Downfall Attacks by t0astbread on Tuesday August 08, 2023 @03:57PM (#37054641)
If tri-state logic becomes viable it's game over for binary!
Re:Downfall Attacks by wg0 on Tuesday August 08, 2023 @04:58PM (#37055362)
IF GTK/Qt etc can render to canvas using WebGPU while compiled to assembly, I think game is almost over than too IF there's a way to lazy load application modules.

Think Autodesk products. Certain parts (wasm modules) only load when you hover over a menu while overall app loads within milliseconds because it just has the main window and such.

Re:Downfall Attacks by slondr on Tuesday August 08, 2023 @10:21PM (#37058005)
This has been possible for years. I actually got in the habit of porting my qt projects to the web target because they ran better than native compiled on some of my older machines.
Re:Downfall Attacks by eternityforest on Tuesday August 08, 2023 @09:27PM (#37057695)
That sounds awful. People would be jamming entire 10MB toolkits into WASM to do things that HTML could do, and performance would probably suffer.

HTML is declarative. The machine understands it. I like things machines can understand and optimize. Things that you can write automated tools to work with because it's not a full turing machine. If you want to make a screen reader, you can. If you want to reflow for mobile in a better way, you can, because you know what's text and what's an image.

Just giving people a programming environment and the ability to draw some pixels, the browser has no idea what the intent is. There's nothing to optimize unless the individual sites do, and I doubt they have Google and Mozilla's budget.

We already have too many unnecessary powerful imperative systems out there.

Re:Downfall Attacks by xigency on Tuesday August 08, 2023 @03:46PM (#37054508)
I do think there’s never been a better time to reinvent the web, including basic technologies like HTML and JavaScript.

For example, picking up more elements of semantic web and distributed systems and leveraging interconnected devices.

Re:Downfall Attacks by istjohn on Tuesday August 08, 2023 @08:35PM (#37057329)
The web started as a graph of hyperlinked documents, and that use case hasn't gone away. SPA's aren't the internet.
Re:Downfall Attacks by eternityforest on Tuesday August 08, 2023 @09:21PM (#37057655)
HTML/CSS is one of the easiest way to develop GUIs, one of the most visually flexible, and one of very few things this side of ncurses that runs everywhere. Actually, without hacks, there are probably more end user devices with a browser than a command line.

It's also highly standardized. Regular programming languages have dozens of GUI toolkits, or at least one per platform.

I'd rather we go the other way, and build the browser into the OS, so that desktop apps just serve a perfectly standard web server, with an API to launch a special OS client with slightly more native integration(Toolbar icons, closing the process when the browser closes, etc), to make native app dev easier and hopefully more popular.

Security sandboxes mostly work. People aren't constantly getting viruses from clicking the wrong link, at least not quite as much. They're not perfect, but they're better than having to completely trust 100 different sites unsandboxed, and they can be improved. I'd rather have crappy security than no security at all.

Re:Downfall Attacks by throwaway892238 on Tuesday August 08, 2023 @09:42PM (#37057774)
If by "highly standardized" you mean "you don't get a choice in what you can do or how it works", I agree.

Native mobile apps thrive despite this magical web browser working everywhere, because the web browser simply doesn't do what native apps do. You may enjoy that, but a million businesses and billions of users out there don't agree, because they use native apps. There were 255 billion native mobile app downloads in 2022, generating billions in revenue. That's not a mistake or accident; that's a market filling a need.

If we really want an application platform that works everywhere, then let's stop dicking around with these stupid document hypertext viewers and build a real app platform that works everywhere.

Re:Downfall Attacks by r3trohack3r on Tuesday August 08, 2023 @09:55PM (#37057862)
> Native mobile apps thrive despite this magical web browser working everywhere

There’s also user behavior. Many users are conditioned to get software through the App Store. I’ve seen this be a driving factor for quite a few web native applications spinning up native dev teams and shipping native clients.

Many folks are surprised to see just how far you can push a browser app and how small the gap between web and browser has become for well built applications, including native-like things like Bluetooth, NFC, USB, etc. (see: https://youmightnotneedelectron.com/)

Have hacked with quite a few devs/companies that had a fully functioning offline capable web native application. The most requested feature they’d get? “I want to download it from the App Store.” (Usually in the form of “I can’t find your app in the App Store”)

I suspect this is why the PWA experience on mobile devices hasn’t been well paved and why some App Store policies call out “don’t just wrap a browser view in a native app” - they want to keep users coming in the front door of a marketplace where they collect a cut off the top of all transactions.

Re:Downfall Attacks by eternityforest on Wednesday August 09, 2023 @12:18AM (#37058636)
We really need to standardize "just wrapping a browser view". Why are we shipping a whole browser when we could be shipping a zip file of HTML with some metadata, and maybe a few tiny native helper utilities?
Re:Downfall Attacks by asaddhamani on Wednesday August 09, 2023 @12:56AM (#37058851)
This is how PWAs work on smartphones. I recall coming across some electron alternatives that use the system webview and those are able to generate binaries hundreds of kilobytes in size. But you lose out on access to many of the modern APIs due to Safari there.
Re:Downfall Attacks by vbezhenar on Wednesday August 09, 2023 @01:08AM (#37058923)
This is standardized for many years and called PWA. There are ways to interact with native helper utilities as well (simplest is just run http server on localhost), but not for mobile apps.

For mobile apps you can use webview component which will use system browser. You don't need to ship the entire browser (actually you can't even do that on iOS).

Re:Downfall Attacks by andrewaylett on Wednesday August 09, 2023 @05:17AM (#37060323)
You can ship web apps via the Play Store for Android: https://developers.google.com/codelabs/pwa-in-play

But you're not allowed to for iOS: https://developer.apple.com/app-store/review/guidelines/#min...

Re:Downfall Attacks by parasubvert on Tuesday August 08, 2023 @10:06PM (#37057925)
You are delusional and terribly out of your depth if you think even a sizable minority has any interest in getting rid of hypertext and the web. Networked native apps are useless without the web architecture as the glue to integrate between them. It is highly likely that URIs, HTTP and hyperlinks will still be a foundational elements of our technology world in a hundred years.
Re:Downfall Attacks by lenkite on Wednesday August 09, 2023 @12:24AM (#37058672)
HTTP != HTML/CSS. You are applying a [Strawman Argument]
Re:Downfall Attacks by parasubvert on Wednesday August 09, 2023 @07:54AM (#37061303)
Add in URI. They're all necessary. Do you really think hypertext is dead? It's just evolving.
Re:Downfall Attacks by eternityforest on Wednesday August 09, 2023 @12:15AM (#37058621)
There are probably more website visits than that. People download games and bank apps and things like that, stuff they expect to use frequently, want fast access or offline ability, of they need hardware access.

There are still tons of things that don't need an app. Things that are inherently online and not accessed frequently work fine as sites.

The web doesn't limit what you can do that much, it limits how you can do it, which I think is a good thing. Less to break (Android API levels have the same effect) with fewer original lines of code. Less focus on clever and interesting code and more focus on UI and features (Although they try their best to reinvent the same js framework 1000 times).

A lot of the limitations are probably just Mozzilla hating anything that could be used for tracking, and not trusting users to manage permissions. The trend has been pretty strongly towards making the web very close to native apps, with all kinds of APIs.

Native apps fill a use case very well, that the web does not. That doesn't make the web obsolete.

Re:Downfall Attacks by pulpfictional on Wednesday August 09, 2023 @06:11AM (#37060626)
> A lot of the limitations are probably just Mozzilla hating anything that could be used for tracking, and not trusting users to manage permissions.

Don't denigrate Mozilla for protecting users. There are a lot of privacy issues that can't be addressed by permissions models, Android serves as an example of that. Enumeration is not effective.

If Mozilla are standing in the way of invasive webpages, more power to them.

Re:Downfall Attacks by kbenson on Wednesday August 09, 2023 @12:39PM (#37065268)
> If by "highly standardized" you mean "you don't get a choice in what you can do or how it works", I agree.

That is exactly what standardization means, by definition, both dictionary and colloquially.

Re:Downfall Attacks by masswerk on Wednesday August 09, 2023 @12:03AM (#37058561)
> I'd rather we go the other way, and build the browser into the OS

This didn't work out that great with MSIE.

Re:Downfall Attacks by eternityforest on Wednesday August 09, 2023 @01:30AM (#37059029)
I'd didn't work for Firefox OS either, and I'm not exactly sure why.

But it seems to have worked great for years for Chromebooks!

Re:Downfall Attacks by macinjosh on Wednesday August 09, 2023 @10:08AM (#37062881)
> really all you need is bytecode that calls an ABI, and a widget toolkit that talks to a rendering API

Browsers have a 2D renderer (canvas) and you can write your GUI code in C++, Rust, or whatever and compile it to WASM. Some widget toolkits for this even exist already. If this were a superior model it would have taken over by now? I guess you are after deeper integration with the desktop environment?

Re:Downfall Attacks by ogoffart on Wednesday August 09, 2023 @10:46AM (#37063506)
The challenge with toolkits confined to <canvas> rendering is their inability to effectively utilize the browser's integration with the OS. Key components like font rendering, input methods (including standard key shortcuts and behavior within input fields), selection handling, image decoding, network stack, native-like scrolling, and accessibility features need to be recreated from scratch. A web toolkit must use the DOM for optimal performance. (and therefore lower to HTML)
Re:Downfall Attacks by polynomial on Wednesday August 09, 2023 @11:44AM (#37064409)
Presume you did not mean bytecode that calls ABI, but rather API? (ABI is a Web3 thing.)
Re:Downfall Attacks by efreak on Saturday August 12, 2023 @07:35PM (#37105178)
> In computer software, an application binary interface ( ABI) is an interface between two binary program modules. Often, one of these modules is a library or operating system facility, and the other is a program that is being run by a user.

https://en.wikipedia.org/wiki/Application_binary_interface

Re:Downfall Attacks by wryanzimmerman on Friday August 11, 2023 @12:01PM (#37090210)
But “regular old apps” don’t do all the same things.

The whole point of properly developing web apps is that html/css indicates a certain level of semantic understanding which allows for different interpretation in different contexts.

If you build a web app well, you build it to be a good experience on a computer for a power user with a huge screen and a keyboard for shortcuts, good for a user on a tiny touch screen, good for a blind person who doesn’t use a screen, and good for robots to parse and index. It should even be good for someone on an iPad with a mouse or a pencil which interprets the whole concept of the mouse differently from the desktop user’s mouse.

The agreed-upon semantics of HTML and the separation of visual styling into CSS is what allows you to take a step beyond just building an app and add a layer of “say what you mean” such that human and non-human users can re-interpret it into their own devices, use cases, and specific needs.

Web frontends are at their best when you don’t expect to perfectly control the end user experience, but try to convey the semantic meaning as perfectly as you can so it can be interpreted into good experiences even in situations where the display is wildly different than originally intended.