4 ms·

> native application My issue with those is, they are less sandboxed than JS is. Why would I want to put one-off things all over my disk and system? While I'm

> native application My issue with those is, they are less sandboxed than JS is. Why would I want to put one-off things all over my disk and system? While I'm willing to install native applications from the package manager for big things I really need, I do not want to do so for simple one-off interactive things, so I really like that I can just do such things in the browser without installing them. Things like simple games, mathematical demonstrations, ... I think the value of sandboxed self contained interactive apps that can do graphics, input, sound, that run from a link, is tremendous to humanity. Of course on the opposite side, one problem is the usage of so much JS for simple articles of text and photos. Those would be more pleasant to read if they were just text and photos and nothing more.

pjmlp 8y ago
Ever heard of UWP, iOS, Android, snap, Flatpak, QubeOS ....?
- Aardwolf 8y ago
  On Android/iOS you install apps, which is the same as what I meant above by installing. QubeOS: heard of it. It's multiple isolated linuxes together essentially. Do you really think one wants to install software on QubeOS to view a mathematical demonstration or a simple game from the web? The issue is simply the effort of installing vs just opening link and viewing it. I don't know UWP, snap or Flatpak. Do they allow you to open a link and run something interactive immediately without installation? If so, great. We need something that allows you to open a link and have something interesting running immediately. Again, it's sad that this same interactivity is also invading simple textual articles that should be just simple plain text, but that is a problem of those articles, not of the existance of JS.
  - pjmlp 8y ago
    You don't necessarily need to install apps on modern Android, ever heard of instant apps?
    - thecatspaw 8y ago
      instant apps have to either be quickly installed, be a static document, or be a document with some scripting functionality.
      - pjmlp 8y ago
        You can use them after a couple of seconds as they stream into the phone in the background.
    - Aardwolf 8y ago
      What do you find to be their advantage over JS web apps?
      - pjmlp 8y ago
        Performance, Java, Kotlin, C++
- danShumway 8y ago
  Android and iOS are barely sandboxed - at least not in the ways that matter. Apple users regularly bring up moderation as an advantage Apple has over Android - but the whole point of sandboxing is you shouldn't need moderation. The fact that the two platforms are arguing over who moderates better is proof positive that their sandboxes are sub-par. Flatpak is a (promising) work in progress that is copying a lot from web permissions. I look forward to the point when it becomes ubiquitous and secure enough that I would feel comfortable downloading and installing a random, unverified piece of code off the internet from a sketchy looking site. Flatpak is native finally starting to catch up to the web in terms of user-accessible sandboxing. But it's not finished yet, and once it is finished it won't be cross-platform. QubeOS is great, but nobody uses it because it's hard to use and cumbersome. Same with VMs. You can sandbox an app in a VM and be very happy about it, but your performance will be worse than it would be on the web. Nobody does it because it's not accessible. Like it or not, the web is the best tradeoff we have right now between flexibility and security. For the most part, users don't need to be suspicious of random links. If someone shares a link on Facebook, you don't need to go look up reviews before you click on the site. It's not like native, you don't spend your entire browsing experience worried about malware. To be sure there are problems we're still solving (user tracking, phishing, processor control), but native hasn't even gotten to the point of trying to solve those problems yet. Any app you download to your Android phone is going to be able to track you better than a website can - it's just that you'll be so worried about malware that you won't notice. Website operators are arguing about how to prevent phishing for full-screen apps. Linux, Windows, and Mac aren't thinking about stuff like a zone of death yet - a full-screen app in Linux can easily spoof your desktop. Heck, it doesn't even need to be full-screen, just copy the interface and icon of another app including its title-bar if you want to phish someone's email or banking client. The simple test is this: suppose I paste a completely randomized link to an Android APK, and a completely randomized link to a website. You might have some reservations about clicking/installing them -- but, be honest, which one are you more frightened to interact with? How many people here would feel comfortable installing a random program that was linked on "Show HN" if they couldn't get access to the source code or verification about what it did beyond 2 or 3 sentences? How many of those same people are fine clicking on a "Show HN" website? The difference is that for the most part web sandboxing actually works.

pjmlp 8y ago

Ever heard of UWP, iOS, Android, snap, Flatpak, QubeOS ....?

Aardwolf 8y ago
On Android/iOS you install apps, which is the same as what I meant above by installing. QubeOS: heard of it. It's multiple isolated linuxes together essentially. Do you really think one wants to install software on QubeOS to view a mathematical demonstration or a simple game from the web? The issue is simply the effort of installing vs just opening link and viewing it. I don't know UWP, snap or Flatpak. Do they allow you to open a link and run something interactive immediately without installation? If so, great. We need something that allows you to open a link and have something interesting running immediately. Again, it's sad that this same interactivity is also invading simple textual articles that should be just simple plain text, but that is a problem of those articles, not of the existance of JS.
- pjmlp 8y ago
  You don't necessarily need to install apps on modern Android, ever heard of instant apps?
  - thecatspaw 8y ago
    instant apps have to either be quickly installed, be a static document, or be a document with some scripting functionality.
    - pjmlp 8y ago
      You can use them after a couple of seconds as they stream into the phone in the background.
  - Aardwolf 8y ago
    What do you find to be their advantage over JS web apps?
    - pjmlp 8y ago
      Performance, Java, Kotlin, C++
danShumway 8y ago
Android and iOS are barely sandboxed - at least not in the ways that matter. Apple users regularly bring up moderation as an advantage Apple has over Android - but the whole point of sandboxing is you shouldn't need moderation. The fact that the two platforms are arguing over who moderates better is proof positive that their sandboxes are sub-par. Flatpak is a (promising) work in progress that is copying a lot from web permissions. I look forward to the point when it becomes ubiquitous and secure enough that I would feel comfortable downloading and installing a random, unverified piece of code off the internet from a sketchy looking site. Flatpak is native finally starting to catch up to the web in terms of user-accessible sandboxing. But it's not finished yet, and once it is finished it won't be cross-platform. QubeOS is great, but nobody uses it because it's hard to use and cumbersome. Same with VMs. You can sandbox an app in a VM and be very happy about it, but your performance will be worse than it would be on the web. Nobody does it because it's not accessible. Like it or not, the web is the best tradeoff we have right now between flexibility and security. For the most part, users don't need to be suspicious of random links. If someone shares a link on Facebook, you don't need to go look up reviews before you click on the site. It's not like native, you don't spend your entire browsing experience worried about malware. To be sure there are problems we're still solving (user tracking, phishing, processor control), but native hasn't even gotten to the point of trying to solve those problems yet. Any app you download to your Android phone is going to be able to track you better than a website can - it's just that you'll be so worried about malware that you won't notice. Website operators are arguing about how to prevent phishing for full-screen apps. Linux, Windows, and Mac aren't thinking about stuff like a zone of death yet - a full-screen app in Linux can easily spoof your desktop. Heck, it doesn't even need to be full-screen, just copy the interface and icon of another app including its title-bar if you want to phish someone's email or banking client. The simple test is this: suppose I paste a completely randomized link to an Android APK, and a completely randomized link to a website. You might have some reservations about clicking/installing them -- but, be honest, which one are you more frightened to interact with? How many people here would feel comfortable installing a random program that was linked on "Show HN" if they couldn't get access to the source code or verification about what it did beyond 2 or 3 sentences? How many of those same people are fine clicking on a "Show HN" website? The difference is that for the most part web sandboxing actually works.