4 ms·

Browsers to me are amazing. I can run untrusted code in my computer from all over the world and at least with Chrome the odds of my machine getting pwned are pr

Browsers to me are amazing. I can run untrusted code in my computer from all over the world and at least with Chrome the odds of my machine getting pwned are pretty low. The Chromium team fixes security issues quickly. For that I get this amazing environment where I can see things as incredible as Google Maps 3D, games, music apps, etc all sandboxed incredibly well. The whole thing is far far more secure than running native apps on Windows, MacOS, or Linux, they're arguably far more secure than Android and maybe more secure than iOS. In other words, they aren't just an OS, they're a secure OS. Something most OSes don't give me.

pxtail 8y ago
It always amazes me how - even on HN - some people like to depreciate and underestimate browsers in their current state. It's like they are stuck with mindset in 90s and forgot to notice that browser are pretty advanced OS nowadays.
superkuh 8y ago
This is getting worse and worse though as browsers expose more and more of their host operating system's functionality. The benefits of using a website instead of a native app are quickly disappearing, while the drawbacks have only been somewhat mitigated. And this leads back to my original post. Additionally, it promotes the software as a service milking of fees and online only access. It prevents end users from ever being able to tell what code is going to be run on this computer since it changes on a whim. No hash checking of binaries is going to help you here. There's no doubt browsers are supremely complex, amazing things. But that isn't good.
- tokyodude 8y ago
  Well to each there own. For me I'd prefer everything in the browser. I hate having to trust native software. Native software can read/upload my entire home folder, all files, .ssh keys, browser history, password database, photos, videos, etc... Websites can't. Native apps have access to every open exploit on my machine. Webapps don't. Native apps can scan my network for other exploitable devices. Webapps can't. So, more webapps for me please.
  - superkuh 8y ago
    Web apps that use electron (for example, Discord's desktop client) have full filesystem access and can do just what you say. Many people think it's safe because it's 'web'. It isn't. It's worse because of the misperception. They can just add something like require('fs').readFileSync(process.env.HOME + '/.ssh/id_rsa').toString() and send this to their servers, and you won't even notice that (since it doesn't require an update on client because the client is just a browser with full permissions that loads obfuscated code from their servers every time you launch it). And with both remaining big browsers dev group announcing they'll be adding greatly expanded filesystem access to browsers for normal websites this will likely apply there too.
    - tokyodude 8y ago
      Electron is a native app. so agree, don't like it, prefer web app

pxtail 8y ago

It always amazes me how - even on HN - some people like to depreciate and underestimate browsers in their current state. It's like they are stuck with mindset in 90s and forgot to notice that browser are pretty advanced OS nowadays.

superkuh 8y ago

This is getting worse and worse though as browsers expose more and more of their host operating system's functionality. The benefits of using a website instead of a native app are quickly disappearing, while the drawbacks have only been somewhat mitigated. And this leads back to my original post. Additionally, it promotes the software as a service milking of fees and online only access. It prevents end users from ever being able to tell what code is going to be run on this computer since it changes on a whim. No hash checking of binaries is going to help you here. There's no doubt browsers are supremely complex, amazing things. But that isn't good.

tokyodude 8y ago
Well to each there own. For me I'd prefer everything in the browser. I hate having to trust native software. Native software can read/upload my entire home folder, all files, .ssh keys, browser history, password database, photos, videos, etc... Websites can't. Native apps have access to every open exploit on my machine. Webapps don't. Native apps can scan my network for other exploitable devices. Webapps can't. So, more webapps for me please.
- superkuh 8y ago
  Web apps that use electron (for example, Discord's desktop client) have full filesystem access and can do just what you say. Many people think it's safe because it's 'web'. It isn't. It's worse because of the misperception. They can just add something like require('fs').readFileSync(process.env.HOME + '/.ssh/id_rsa').toString() and send this to their servers, and you won't even notice that (since it doesn't require an update on client because the client is just a browser with full permissions that loads obfuscated code from their servers every time you launch it). And with both remaining big browsers dev group announcing they'll be adding greatly expanded filesystem access to browsers for normal websites this will likely apply there too.
  - tokyodude 8y ago
    Electron is a native app. so agree, don't like it, prefer web app