3 ms·

Browsers became OSes because existing OSes have a poor security model and a very poor application delivery model. The browser offers an alternative way to ship

by api 10y ago

Browsers became OSes because existing OSes have a poor security model and a very poor application delivery model. The browser offers an alternative way to ship an app to a user without having to go through the pain and suffering of building, testing, and packaging Windows, Linux, Mac, etc. applications for the end user. We know because we do the latter and it hurts. Bad. Especially if you are targeting a wide customer base on multiple platforms. The pain. Mobile OSes are somewhat better in this regard from a technical point of view, but in place of awful technology they have substituted the app store nightmare. I've dealt with both the Apple app store and the IRS, and the latter has far better customer service. This is partly because vendors wanted total control over the "next" platform, and partly because iOS and Android did not actually solve the security aspect of the OS application model. Instead they punted on the problem by deciding to just gate keep all code and to offer a reduced functionality profile to apps. I am not entirely convinced browsers becoming OSes is a bad thing, and I half suspect that the web is actually an incubator for the next real innovation in the OS and platform space. The browser is at least prototyping an OS capable of rapidly loading and executing untrusted code without instantly melting down or being pwned by the first bit of malicious code that comes by. This is big. Try executing code this promiscuously with Windows, Linux, or Mac, or jail-broken Android or iOS for that matter.

dcwca 10y ago
I agree with you completely. The web became an OS because there's a huge demand for cross-platform zero-install software applications that run in a sandbox without dangerous user level access to your machine.
- jandrese 10y ago
  And if you do need dangerous user or system level access there is always Flash and its everpresent zero days.
  - zwetan 10y ago
    sure there are no browser exploits at all ... Top 50 Products By Total Number Of "Distinct" Vulnerabilities http://www.cvedetails.com/top-50-products.php http://www.cvedetails.com/top-50-products.php #3 Firefox #4 Chrome #7 Internet Explorer
    - jcranmer 10y ago
      Given the context of the thread, it's remiss of you not to include some more context: #1 OS X #2 Linux #5 iPhone OS #6 Flash #8 Debian Linux #9 Windows XP #10 Windows Server 2008 Which is to say that, except for Flash, all of the top 10 products are browsers or OSes. On the other hand, looking at the full list, I'm not so sure I trust the data curation. The JRE and JDK are each listed twice (because Oracle bought out Sun), and Internet Explorer and IE are two separate listings.
zwetan 10y ago
There is also pain to test web apps for numerous browsers (so much fun on mobile) in term of security, popular browsers are in the top 10 of most exploited software so yeah the delivery model is nice, the update model too, but still I'm not convinced that the web model for apps is the "end all, be all" of app development I could even argue that more and more apps are coming back to native, first instigated by the mobile app stores, which then expanded to the desktop app stores. There is room for everyone, web apps and native apps, but still I would not want to use something like gmail as a browser app on my mobile.
- digi_owl 10y ago
  I fear that the "instant" distribution and update via the net has resulted in sloppy programmers. This because they can always just push a fix by hitting a few keys.
nnethercote 10y ago
Yes. A web browser is a VM for executing untrusted code. That is its truly unique feature. Understand that and a lot of other things become clear.
- nilved 10y ago
  That isn't _its_ feature. It belongs in a web browser as much as it belongs in Adobe Acrobat (although you could consider that a VM for executing untrusted code, too -- heoh!) If you want a VM for executing untrusted code, use a VM for untrusted code, don't shoehorn it into HTML, or PDF, or whatever. That makes zero sense.
  - acdha 10y ago
    You appear to be conflating a relatively uncommon personal belief with the natural order of things. There is a small subset of people who believe electronic documents should be limited to what's possible with paper with the addition of links, but the vast majority of users and implementers want features which are only possible with interactivity. Once that's the case, you're talking untrusted code execution and it absolutely has to be integrated because much of the value comes from working with the document rather than just linking to a separate program. PDF is a special case since there's similarly a considerable value in having things like forms, equations, graphs/illustrations, etc. being interactive but since Adobe has a stranglehold on the format, it was characteristically poorly designed, badly implemented, effectively unsupported, and you had to pay to use it. I would not draw conclusions from this other than avoiding Adobe-encumbered ideas. The other side of this position is forgetting how important network effects are. People did try to implement purer alternatives but they were always hindered by the need to deploy them first. The low-friction web model is extremely popular with users and any question of replacements or alternatives needs to fit into the gradual upgrade model of the web unless you can get Microsoft and Apple to ship it in the OS.
    - deleted 10y ago
      [deleted]

by api 10y ago

dcwca 10y ago

I agree with you completely. The web became an OS because there's a huge demand for cross-platform zero-install software applications that run in a sandbox without dangerous user level access to your machine.

jandrese 10y ago
And if you do need dangerous user or system level access there is always Flash and its everpresent zero days.
- zwetan 10y ago
  sure there are no browser exploits at all ... Top 50 Products By Total Number Of "Distinct" Vulnerabilities http://www.cvedetails.com/top-50-products.php http://www.cvedetails.com/top-50-products.php #3 Firefox #4 Chrome #7 Internet Explorer
  - jcranmer 10y ago
    Given the context of the thread, it's remiss of you not to include some more context: #1 OS X #2 Linux #5 iPhone OS #6 Flash #8 Debian Linux #9 Windows XP #10 Windows Server 2008 Which is to say that, except for Flash, all of the top 10 products are browsers or OSes. On the other hand, looking at the full list, I'm not so sure I trust the data curation. The JRE and JDK are each listed twice (because Oracle bought out Sun), and Internet Explorer and IE are two separate listings.

zwetan 10y ago

There is also pain to test web apps for numerous browsers (so much fun on mobile) in term of security, popular browsers are in the top 10 of most exploited software so yeah the delivery model is nice, the update model too, but still I'm not convinced that the web model for apps is the "end all, be all" of app development I could even argue that more and more apps are coming back to native, first instigated by the mobile app stores, which then expanded to the desktop app stores. There is room for everyone, web apps and native apps, but still I would not want to use something like gmail as a browser app on my mobile.

digi_owl 10y ago
I fear that the "instant" distribution and update via the net has resulted in sloppy programmers. This because they can always just push a fix by hitting a few keys.

nnethercote 10y ago

Yes. A web browser is a VM for executing untrusted code. That is its truly unique feature. Understand that and a lot of other things become clear.

nilved 10y ago
That isn't _its_ feature. It belongs in a web browser as much as it belongs in Adobe Acrobat (although you could consider that a VM for executing untrusted code, too -- heoh!) If you want a VM for executing untrusted code, use a VM for untrusted code, don't shoehorn it into HTML, or PDF, or whatever. That makes zero sense.
- acdha 10y ago
  You appear to be conflating a relatively uncommon personal belief with the natural order of things. There is a small subset of people who believe electronic documents should be limited to what's possible with paper with the addition of links, but the vast majority of users and implementers want features which are only possible with interactivity. Once that's the case, you're talking untrusted code execution and it absolutely has to be integrated because much of the value comes from working with the document rather than just linking to a separate program. PDF is a special case since there's similarly a considerable value in having things like forms, equations, graphs/illustrations, etc. being interactive but since Adobe has a stranglehold on the format, it was characteristically poorly designed, badly implemented, effectively unsupported, and you had to pay to use it. I would not draw conclusions from this other than avoiding Adobe-encumbered ideas. The other side of this position is forgetting how important network effects are. People did try to implement purer alternatives but they were always hindered by the need to deploy them first. The low-friction web model is extremely popular with users and any question of replacements or alternatives needs to fit into the gradual upgrade model of the web unless you can get Microsoft and Apple to ship it in the OS.
  - deleted 10y ago
    [deleted]