4 ms·
... and Safari still holding out on web push - this lack is a reason many native apps get written.
by beagle3 7y ago
... and Safari still holding out on web push - this lack is a reason many native apps get written.
- dijit 7y agoI’m not sure why I read this in a negative tone, this is fantastic.
- swiley 7y agoIt’s why there are no self hostable chat apps. A better option would be for users to be able to select alternate push servers.
- thosakwe 7y agoWhat's fantastic about a vendor intentionally ignoring multiple standards, in favor of their own walled-garden? You might be ignoring the wishes of actual users when you say it's "fantastic."
- dijit 7y agoI'm only speaking as a user. As a user I don't want push notifications from websites. I know there are some exceptions (like messengers), but really, those should be apps because Apples centralised push messaging system is better for my battery life.
- nine_k 7y agoIf you don't need that, you can cmd-comma and disable that. But there's no such an easy way to enable a feature you need, but which wasn't implemented.
- drngdds 7y agoOk, but your preference isn't everyone else's! You can disable the pop-up asking you for push notifications on all relevant browsers, afaik.
- geofft 7y agoWhat's fantastic about native apps? I mean, I know why nation-state attackers love them - it's super easy to exploit them, and once you do, you have full access to everything in the user account (including all browser login sessions). But what's the advantage to users?
- saagarjha 7y ago> I mean, I know why nation-state attackers love them - it's super easy to exploit them, and once you do, you have full access to everything in the user account (including all browser login sessions). Not on mobile.
- beagle3 7y agohttps://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537acab https://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537a... (and google "pegasus nso whatsapp" for more) tl;dr: The exploitation was indeed done through apps. The OS itself is harder to exploit, but most apps are not as secure and provide the first foot-in-the-door for the attacker.
- saagarjha 7y agoI am responding specifically to the claim that once you've exploited an app, you have full access to the user's entire account (which is true to some extent on desktop platforms, but not on mobile OSes by default). I left a comment elsewhere about the kind of attack you're talking about: https://news.ycombinator.com/item?id=22632756 https://news.ycombinator.com/item?id=22632756
- beagle3 7y agoI see. Indeed, I agree it is not super easy to access everything on the mobile. But I am still convinced that having a myriad of different apps, most of which are developed without real regards to security, makes the attack surface much larger -- e.g. you are likely to find a popular exploitable app that already has legitimate access to user data (such as "all the time" location data, contacts, calendar, ...) - as NSO did with whatsapp.
- beagle3 7y agoI'm not sure about other browsers, but Firefox asks once per website that wants a push, and even that can be turned off. What's fantastic about not even having the option? What's fantastic about having to pay $100/year or reinstall your apps once a week, in addition to having Apple MITM any notifications?
- Spivak 7y agoBattery life is the main reason for this it seems. It's not about "having the option" it's "if you give devs the option they will use it leading to an overall worse experience." Web push notifications can't possibly leverage the single low-power TCP connection that iOS (and Android with gplay) devices keep open. Push notifications in the way that phones do it are necessarily platform and service specific. You don't have to allow Apple to MITM your push notifications BTW. Just send a generic ping to your app, and when it wakes up pull the actual content from your server and display the notification.
- leadingthenet 7y agoAnd thank the lord for that.