4 ms·

Imagine you install $ANYTHING as a PWA. It's now on your homescreen, you launch it. You do $THING. now you switch to twitter. Now the PWA -- in the background -

Imagine you install $ANYTHING as a PWA. It's now on your homescreen, you launch it. You do $THING. now you switch to twitter. Now the PWA -- in the background -- loads some ad with an autoplaying video and now theres ad audio coming from ... well, you're not sure where, but it doesn't seem like it's coming from twitter. now you have to go find it and stop it. Meanwhile bitcoinminer.js is burning through your battery in the background because those video ads just weren't quite enough revenue. I'm not sure which one sounds worse.

judah 8y ago
Stepping back a moment, it's worth noting that this was Steve Jobs' original vision for the iPhone: “The full Safari engine is inside of iPhone. And so, you can write amazing Web 2.0 and Ajax apps that look exactly and behave exactly like apps on the iPhone. And these apps can integrate perfectly with iPhone services. They can make a call, they can send an email, they can look up a location on Google Maps.” Here we are, a decade later, and Apple has not only abandoned that vision, they are actively working against it by preventing web apps from becoming first-class citizens on their platform. I mean, consider an app that does 2FA. "To sign in, please enter the code sent to your mobile device." You switch over to Messenger, and...wooops! Your app just reloaded its home page, and the auth prompt is gone. Surely, any rational person can see this is too restrictive. Perhaps Apple will loosen these restrictions in the future. Yes, as you point out, there is the potential for abuse. But that's already there with native apps. The things you just mentioned can -- and have -- been done with native apps.
- saagarjha 8y ago
  > it's worth noting that this was Steve Jobs' original vision for the iPhone One which they quickly backtracked on after realizing that it needlessly restricted what apps could do, and one which they could not shoehorn security into.
- hamiltonkibbe 8y ago
  So now there's some awesome PWA api giving you all those native features, and a permissions model, and so you install SUPERPHONE app, and that needs access to your contacts and to make and receive calls, and you say "ok, yeah this is a better phone app so those are reasonable". Now everything running JS in the context of $SUPERPHONE_DOMAIN or whatever has these new permissions. superphone pwa's calls to window.PwaGetContacts() and window.PwaMakeCall() work and everyone's happy, and your phone really is super now. the app shows a banner ad from google and you're cool with that because it was free, and hey, developers need to eat too. Someone who makes ads figures out that ads can run JS. So your app pulls down an ad from some ad network and that ad has some cool JS that detects that those functions are available and starts calling all your friends from your phone and telling them that "`window.PwaGetOwnerName()` is really excited about LinkedIn and wants you to be their contact" after uploading your contact list to every 3rd party data broker that would pay for it. well, that sucks, maybe there's a better way to limit the code that can run on your phone with specific permissions
- deleted 8y ago
  [deleted]
- myguysi 8y ago
  That vision was abandoned while Jobs was still around. It was a way to bootstrap the first wave of apps but Apple’s principles of quality and security mean it’s not feasible. I’ll be really disappointed if they give in to the PWA movement and sacrifice those principles. I don’t quite understand what the issue with native apps is in all honesty?
  - fnordsensei 8y ago
    Yes, this is not a betrayal of Steve Jobs' legacy. It's just that it is an ideal that came into contact with the reality. The phishing industry is doing well for itself, and there's no sign of the scamming factories shutting down anytime soon.

judah 8y ago

Stepping back a moment, it's worth noting that this was Steve Jobs' original vision for the iPhone: “The full Safari engine is inside of iPhone. And so, you can write amazing Web 2.0 and Ajax apps that look exactly and behave exactly like apps on the iPhone. And these apps can integrate perfectly with iPhone services. They can make a call, they can send an email, they can look up a location on Google Maps.” Here we are, a decade later, and Apple has not only abandoned that vision, they are actively working against it by preventing web apps from becoming first-class citizens on their platform. I mean, consider an app that does 2FA. "To sign in, please enter the code sent to your mobile device." You switch over to Messenger, and...wooops! Your app just reloaded its home page, and the auth prompt is gone. Surely, any rational person can see this is too restrictive. Perhaps Apple will loosen these restrictions in the future. Yes, as you point out, there is the potential for abuse. But that's already there with native apps. The things you just mentioned can -- and have -- been done with native apps.

saagarjha 8y ago
> it's worth noting that this was Steve Jobs' original vision for the iPhone One which they quickly backtracked on after realizing that it needlessly restricted what apps could do, and one which they could not shoehorn security into.
hamiltonkibbe 8y ago
So now there's some awesome PWA api giving you all those native features, and a permissions model, and so you install SUPERPHONE app, and that needs access to your contacts and to make and receive calls, and you say "ok, yeah this is a better phone app so those are reasonable". Now everything running JS in the context of $SUPERPHONE_DOMAIN or whatever has these new permissions. superphone pwa's calls to window.PwaGetContacts() and window.PwaMakeCall() work and everyone's happy, and your phone really is super now. the app shows a banner ad from google and you're cool with that because it was free, and hey, developers need to eat too. Someone who makes ads figures out that ads can run JS. So your app pulls down an ad from some ad network and that ad has some cool JS that detects that those functions are available and starts calling all your friends from your phone and telling them that "`window.PwaGetOwnerName()` is really excited about LinkedIn and wants you to be their contact" after uploading your contact list to every 3rd party data broker that would pay for it. well, that sucks, maybe there's a better way to limit the code that can run on your phone with specific permissions
deleted 8y ago
[deleted]
myguysi 8y ago
That vision was abandoned while Jobs was still around. It was a way to bootstrap the first wave of apps but Apple’s principles of quality and security mean it’s not feasible. I’ll be really disappointed if they give in to the PWA movement and sacrifice those principles. I don’t quite understand what the issue with native apps is in all honesty?
- fnordsensei 8y ago
  Yes, this is not a betrayal of Steve Jobs' legacy. It's just that it is an ideal that came into contact with the reality. The phishing industry is doing well for itself, and there's no sign of the scamming factories shutting down anytime soon.