5 ms·

There is a third big advantage to web apps over native apps - they're run in a hardened sandbox designed to safely execute untrusted code.

by ummonk 6y ago

enriquto 6y ago
Trusted by whom? I find it easier to trust a random github repo author than the developers of chrome.
- MattGaiser 6y ago
  Based on what? Google has no reason to steal your credit card. A random Github user might.
  - rini17 6y ago
    The problem is upstack, Google does have incentive to put everything and kitchen sink into the browser. Such byzantine code is impossible to fully secure. It is also much less understood than usual operating system API you'll deal with in stuff pulled from github. Not even speaking about bugs, guess what will this cause in combination with users conditioned to blindly click OK on security warnings: https://www.fixyourbrowser.com/browser/google-chrome/google-chrome-native-file-system-api/ https://www.fixyourbrowser.com/browser/google-chrome/google-...
- nl 6y ago
  Chrome is one of the safest pieces of consumer software ever produced. You might want to re-evaluate your threat model there.
  - techntoke 6y ago
    Safe by what measure? If you mean safely track your pixels movements, fingerprint and identify your OS/browser version/etc, allow WebRTC to leak your IP address and download torrents or mine crypto in the browser.. then yeah I guess it is safe. Safe for advertisers and malicious actors to exploit users.
    - nl 6y ago
      I'm pretty sure all of these are problems you have with the web or with an advertising based business model - not Chrome. Note that all these problems apply to Firefox, Safari and Blink as well. And most (all?) of them apply to other platforms (cite: TikTok, plenty of viruses on every platform).
    - ummonk 6y ago
      An app can do all of that and far more when you use it.
techntoke 6y ago
The same developer sandbox used for spying and pixel tracking? Almost every website now requires JavaScript for the most basic functionality and the regular browser user isn't going to bother with installing an extension and enabling each piece of JavaScript manually to ensure that it is safe. I personally don't believe the JavaScript approach is even maintainable anymore. These Web APIs are so complex that you need third-party frameworks to make them useable and before you know it your site relies on 30+ frameworks for functionality that should be included by default in a markup language.
- tjansen 6y ago
  It's all relative, but no website can do what the TikTok app does on your phone.
  - techntoke 6y ago
    Agreed. It seems like TikTok is able to violate COPPA and get away with it. Must have some deep pockets or blackmail material against politicians.
eeZah7Ux 6y ago
Native apps can be sandboxed much better e.g. with firejail. The browser sandboxing model has a huge attack surface, as proven by the hundred vulnerabilities found.
- rpastuszak 6y ago
  Uber, Facebook (esp. the Android SDK) and TikTok would like to have a chat with you. I don't see Firejail wrapping all of the apps coming from the AppStore any time soon.
- ummonk 6y ago
  The findings of vulnerabilities are a product of all the effort invested into testing the browser sandbox and hardening it. In contrast, native app firewalls are only starting to get developed and are far less battle-tested than the browser sandbox. Heck, just look at one of the other threads on the current HN front-page for how weak native app firewalls can be: https://news.ycombinator.com/item?id=23689364 https://news.ycombinator.com/item?id=23689364

There is a third big advantage to web apps over native apps - they're run in a hardened sandbox designed to safely execute untrusted code.

by ummonk 6y ago

There is a third big advantage to web apps over native apps - they're run in a hardened sandbox designed to safely execute untrusted code.

enriquto 6y ago

Trusted by whom? I find it easier to trust a random github repo author than the developers of chrome.

MattGaiser 6y ago
Based on what? Google has no reason to steal your credit card. A random Github user might.
- rini17 6y ago
  The problem is upstack, Google does have incentive to put everything and kitchen sink into the browser. Such byzantine code is impossible to fully secure. It is also much less understood than usual operating system API you'll deal with in stuff pulled from github. Not even speaking about bugs, guess what will this cause in combination with users conditioned to blindly click OK on security warnings: https://www.fixyourbrowser.com/browser/google-chrome/google-chrome-native-file-system-api/ https://www.fixyourbrowser.com/browser/google-chrome/google-...
nl 6y ago
Chrome is one of the safest pieces of consumer software ever produced. You might want to re-evaluate your threat model there.
- techntoke 6y ago
  Safe by what measure? If you mean safely track your pixels movements, fingerprint and identify your OS/browser version/etc, allow WebRTC to leak your IP address and download torrents or mine crypto in the browser.. then yeah I guess it is safe. Safe for advertisers and malicious actors to exploit users.
  - nl 6y ago
    I'm pretty sure all of these are problems you have with the web or with an advertising based business model - not Chrome. Note that all these problems apply to Firefox, Safari and Blink as well. And most (all?) of them apply to other platforms (cite: TikTok, plenty of viruses on every platform).
  - ummonk 6y ago
    An app can do all of that and far more when you use it.

techntoke 6y ago

The same developer sandbox used for spying and pixel tracking? Almost every website now requires JavaScript for the most basic functionality and the regular browser user isn't going to bother with installing an extension and enabling each piece of JavaScript manually to ensure that it is safe. I personally don't believe the JavaScript approach is even maintainable anymore. These Web APIs are so complex that you need third-party frameworks to make them useable and before you know it your site relies on 30+ frameworks for functionality that should be included by default in a markup language.

tjansen 6y ago
It's all relative, but no website can do what the TikTok app does on your phone.
- techntoke 6y ago
  Agreed. It seems like TikTok is able to violate COPPA and get away with it. Must have some deep pockets or blackmail material against politicians.

eeZah7Ux 6y ago

Native apps can be sandboxed much better e.g. with firejail. The browser sandboxing model has a huge attack surface, as proven by the hundred vulnerabilities found.

rpastuszak 6y ago
Uber, Facebook (esp. the Android SDK) and TikTok would like to have a chat with you. I don't see Firejail wrapping all of the apps coming from the AppStore any time soon.
ummonk 6y ago
The findings of vulnerabilities are a product of all the effort invested into testing the browser sandbox and hardening it. In contrast, native app firewalls are only starting to get developed and are far less battle-tested than the browser sandbox. Heck, just look at one of the other threads on the current HN front-page for how weak native app firewalls can be: https://news.ycombinator.com/item?id=23689364 https://news.ycombinator.com/item?id=23689364