9 ms·

The fact that a web email client (gmail) can turn the fan on when it’s mostly text and runs in a VM written and published by the same company that wrote the ema

The fact that a web email client (gmail) can turn the fan on when it’s mostly text and runs in a VM written and published by the same company that wrote the email client just makes my head spin. And the solution to this is to put the browser in the cloud? So what’s the desktop browser on your new $3,000 mbp now, like... a demo environment? It boggles my mind that we’re not demanding the web bloat stop. Maybe figma just doesn’t really work as a web app! If I have to run my browser in a datacenter, I think it’s fair to say it doesn’t. As a web dev I’m just embarrassed. How are we not saying “this is too much, stop making web apps that crash my computer it’s not worth it.”

BeetleB 5y ago
A simpler solution may be to use a mail reader and use IMAP.
oxylibrium 5y ago
Pop open developer tools - Gmail's JavaScript is heavily obfuscated, not just minified. (I think it's a custom, self-modifying VM that's written in JavaScript, and it fetches pieces of itself over the network, like ReCAPTCHA). This "DRM" plays at least some role in making the optimizers in V8 work a lot harder to get anything reasonable out of the spaghetti. Why Google needs DRM for a web email app? Beyond me.
- v8dev123 5y ago
  >> Why Google needs DRM for a web email app? The reason we use such tactics is to increasing barrier of reverse engineering because our teams value their work. Some people claim that security through obscurity is bad. I challenge this view. I claim that every security defense such as RSA is a obscurity. It's a matter of time until RSA breaks in the same way as Obfuscation does. Gmail is not your let's make it weekend kind of app. It's highly sophisticated and deliver huge value. There are lot of people who hate Obfuscation. Some are communists and others are attackers. My wife (she works in the fraud detection department) found an interesting attacker who masqueraded as a security researcher and student of X University, but in fact he was a a criminal scum. He has reverse engineered anti-fraud scripts of many websites and published them on Github for everyone to see. His main goal was to attract malicious buyers and sell them scripts that bypass this protection. It was one of the heck of marketing. Brian Krebs also had similar story on his blog.
  - oxylibrium 5y ago
    I'll bite. First, encryption is not "obscurity" in the same way you think DRM is. Second, several other email providers don't think they need to rely on some performance-killing DRM to "protect" their web app (oh no, what of all the value!). Outlook has a part of their files minified, but doesn't use any obfuscation; apps like ProtonMail[0] and Tutanota[1] are even open source. (I'm actually starting to migrate off of Gmail to Protonmail myself.) [0]: https://github.com/ProtonMail/proton-mail/ https://github.com/ProtonMail/proton-mail/ (the new site, on beta.protonmail.com) [1]: https://github.com/tutao/tutanota https://github.com/tutao/tutanota Oh, and there's no need to call people "communists", "attackers", or "criminal scum". Be civil.
    - v8dev123 5y ago
      Encryption is "obscurity". For example, Quantum computers will break RSA. > Quantum computers will break RSA Now here it will take X amount of time so is breaking any protection like DRM. The goal of any security method is increasing attack time. TLS got attacked, SSL got attacked. History repeats itself. Period. > Oh, and there's no need to call people "communists", "attackers", or "criminal scum". Be civil. Why? I have a right to use these terms. What should I use instead? Would you call Osama Bin Laden as "His Highness Bin Laden"? The words exists for reason. I use them in appropriate context. People don't understand Russian soul. I'm very direct and speak my mind! >> Second, several other email providers don't think they need to rely on some performance-killing DRM to "protect" their web app (oh no, what of all the value!). >> Outlook has a part of their files minified, but doesn't use any obfuscation; apps like ProtonMail[0] and Tutanota[1] are even open source. So? What's your point? You have Linux which is Open Source and you have Windows (A lot of parts including their licencing is obfuscated) The performance hit is minimal. ProtonMail & Tutanota are way slower than GMail and lack cutting edge features we offer. Gmail vs Outlook is like Ferrari vs Toyota. Gmail has great UX even my grandmother can use it.
      - emn13 5y ago
        The point is that nobody relevant is going to get stopped by this DRM. That's because nobody relevant is likely to even try copying it in the first place, and if an economically relevant party were so unwise, I expect google's legal resources are sufficient to discourage plain copying, even if a court case is never won. They might learn some tricks sure, but the chances of gmail's client side bits doing anything that novel that's also competetively important are slim to none. (And if there really is some kind of secret sauce that needs protecting, relying on DRM seems quite... optimistic. Finally, we're only talking front-end here, not backend; and surely that's at least as important a part of the value proposition here. While there may be a case for DRM in some places, gmail is almost certainly not it.
- bool3max 5y ago
  They're too embarrassed of all the shit code they've written that makes the app slow - so they obfuscate it to try to hide how shit it is - and it turn it becomes even slower ;)
graderjs 5y ago
I hear you on the mind-boggling but I think it's sort of like the web makes bloat visible but resource bloat is present in probably most products of our developed economies. Like if you look at an SUV driving down the street if you could visualize the amount of raw resources: energy, air water minerals (labor and its costs?) that went into producing that SUV, I think you'd be demanding that we reduce the bloat of all products of our economy. I think is a valid analogy of the sort of page weight that we're talking about. my point is not that I'm condoning it I just happen to think that it's probably inevitable. And there's also the analogy between sort of handmade and craftmade things that are sort of indie Craft products built outside the system and that movement of indy websites and bloat-free websites. I think they're both destined to be small slices of the eventual mainstream market. getting even more meta societies tend to capture more energy over time and if you think about it more energy is going to end up being crystallized into more matter so we're going to produce more things and, ignoring some inflection points in technology and efficiency, use more energy to produce more things so things are probably going to bloat out.
npteljes 5y ago
>runs in a VM Would you please elaborate on this? I tried to find some info but no luck. Does gmail.com actually load some virtualization technology in the browser?
- v8dev123 5y ago
  Gmail use custom bytecode interpreter implemented on Javascript. It's like Dart VM ;) I however got down voted for explaining purpose of all this. Guess attackers hate me. Whatever. Leaving HN for all good!
  - yasinaydin 5y ago
    It makes me happier to see HN will have less user who sees the world in binary as "good guy billionaire DRM industry lords with lots of secrecy for good" and "communists, hackers, terrorists and bin laden".
    - v8dev123 5y ago
      > "good guy billionaire DRM industry lords with lots of secrecy for good" Youngsters these days lack sense of capitalism (and hard work) and that's why they fail to start companies that produce value to the society. DRM Industry protects intellectual property. The entire Hollywood fully invested in DRMs because they value their hard work. A DRM-free world is a world without capitalism, where every hard work becomes pirated and the economy starts to crumble.
- sequoia 5y ago
  All JavaScript apps run in the browser with its own JS engine (V8 in chrome) garbage collection, etc. This is effectively a VM I think. Like you deploy Java apps to the JVM, you deploy JavaScript apps for the “browser VM.” Google writes gmail but they also write chrome and V8, so they are in a unique position of writing both the application and the platform it runs upon. Presumably this would allow them to make something more performant than most, not less.
  - 5y ago
vijaybritto 5y ago
You're point is completely valid but companies rush their products to the market they dont necessarily do it for the experience they provide but to capture the market. For example until this month Notion was extremely slow and everyone complained. They fixed it recently and no one's complaining but the important thing here is that no one left the product for being slow. May be there is a way to reduce bloat on the web and to ship desktop apps while keeping pace with modern app dev experience but surely there isn't any right now. Maybe webassembly will help? Lets see

BeetleB 5y ago

A simpler solution may be to use a mail reader and use IMAP.

oxylibrium 5y ago

Pop open developer tools - Gmail's JavaScript is heavily obfuscated, not just minified. (I think it's a custom, self-modifying VM that's written in JavaScript, and it fetches pieces of itself over the network, like ReCAPTCHA). This "DRM" plays at least some role in making the optimizers in V8 work a lot harder to get anything reasonable out of the spaghetti. Why Google needs DRM for a web email app? Beyond me.

v8dev123 5y ago
>> Why Google needs DRM for a web email app? The reason we use such tactics is to increasing barrier of reverse engineering because our teams value their work. Some people claim that security through obscurity is bad. I challenge this view. I claim that every security defense such as RSA is a obscurity. It's a matter of time until RSA breaks in the same way as Obfuscation does. Gmail is not your let's make it weekend kind of app. It's highly sophisticated and deliver huge value. There are lot of people who hate Obfuscation. Some are communists and others are attackers. My wife (she works in the fraud detection department) found an interesting attacker who masqueraded as a security researcher and student of X University, but in fact he was a a criminal scum. He has reverse engineered anti-fraud scripts of many websites and published them on Github for everyone to see. His main goal was to attract malicious buyers and sell them scripts that bypass this protection. It was one of the heck of marketing. Brian Krebs also had similar story on his blog.
- oxylibrium 5y ago
  I'll bite. First, encryption is not "obscurity" in the same way you think DRM is. Second, several other email providers don't think they need to rely on some performance-killing DRM to "protect" their web app (oh no, what of all the value!). Outlook has a part of their files minified, but doesn't use any obfuscation; apps like ProtonMail[0] and Tutanota[1] are even open source. (I'm actually starting to migrate off of Gmail to Protonmail myself.) [0]: https://github.com/ProtonMail/proton-mail/ https://github.com/ProtonMail/proton-mail/ (the new site, on beta.protonmail.com) [1]: https://github.com/tutao/tutanota https://github.com/tutao/tutanota Oh, and there's no need to call people "communists", "attackers", or "criminal scum". Be civil.
  - v8dev123 5y ago
    Encryption is "obscurity". For example, Quantum computers will break RSA. > Quantum computers will break RSA Now here it will take X amount of time so is breaking any protection like DRM. The goal of any security method is increasing attack time. TLS got attacked, SSL got attacked. History repeats itself. Period. > Oh, and there's no need to call people "communists", "attackers", or "criminal scum". Be civil. Why? I have a right to use these terms. What should I use instead? Would you call Osama Bin Laden as "His Highness Bin Laden"? The words exists for reason. I use them in appropriate context. People don't understand Russian soul. I'm very direct and speak my mind! >> Second, several other email providers don't think they need to rely on some performance-killing DRM to "protect" their web app (oh no, what of all the value!). >> Outlook has a part of their files minified, but doesn't use any obfuscation; apps like ProtonMail[0] and Tutanota[1] are even open source. So? What's your point? You have Linux which is Open Source and you have Windows (A lot of parts including their licencing is obfuscated) The performance hit is minimal. ProtonMail & Tutanota are way slower than GMail and lack cutting edge features we offer. Gmail vs Outlook is like Ferrari vs Toyota. Gmail has great UX even my grandmother can use it.
    - emn13 5y ago
      The point is that nobody relevant is going to get stopped by this DRM. That's because nobody relevant is likely to even try copying it in the first place, and if an economically relevant party were so unwise, I expect google's legal resources are sufficient to discourage plain copying, even if a court case is never won. They might learn some tricks sure, but the chances of gmail's client side bits doing anything that novel that's also competetively important are slim to none. (And if there really is some kind of secret sauce that needs protecting, relying on DRM seems quite... optimistic. Finally, we're only talking front-end here, not backend; and surely that's at least as important a part of the value proposition here. While there may be a case for DRM in some places, gmail is almost certainly not it.
bool3max 5y ago
They're too embarrassed of all the shit code they've written that makes the app slow - so they obfuscate it to try to hide how shit it is - and it turn it becomes even slower ;)

graderjs 5y ago

I hear you on the mind-boggling but I think it's sort of like the web makes bloat visible but resource bloat is present in probably most products of our developed economies. Like if you look at an SUV driving down the street if you could visualize the amount of raw resources: energy, air water minerals (labor and its costs?) that went into producing that SUV, I think you'd be demanding that we reduce the bloat of all products of our economy. I think is a valid analogy of the sort of page weight that we're talking about. my point is not that I'm condoning it I just happen to think that it's probably inevitable. And there's also the analogy between sort of handmade and craftmade things that are sort of indie Craft products built outside the system and that movement of indy websites and bloat-free websites. I think they're both destined to be small slices of the eventual mainstream market. getting even more meta societies tend to capture more energy over time and if you think about it more energy is going to end up being crystallized into more matter so we're going to produce more things and, ignoring some inflection points in technology and efficiency, use more energy to produce more things so things are probably going to bloat out.

npteljes 5y ago

>runs in a VM Would you please elaborate on this? I tried to find some info but no luck. Does gmail.com actually load some virtualization technology in the browser?

v8dev123 5y ago
Gmail use custom bytecode interpreter implemented on Javascript. It's like Dart VM ;) I however got down voted for explaining purpose of all this. Guess attackers hate me. Whatever. Leaving HN for all good!
- yasinaydin 5y ago
  It makes me happier to see HN will have less user who sees the world in binary as "good guy billionaire DRM industry lords with lots of secrecy for good" and "communists, hackers, terrorists and bin laden".
  - v8dev123 5y ago
    > "good guy billionaire DRM industry lords with lots of secrecy for good" Youngsters these days lack sense of capitalism (and hard work) and that's why they fail to start companies that produce value to the society. DRM Industry protects intellectual property. The entire Hollywood fully invested in DRMs because they value their hard work. A DRM-free world is a world without capitalism, where every hard work becomes pirated and the economy starts to crumble.
sequoia 5y ago
All JavaScript apps run in the browser with its own JS engine (V8 in chrome) garbage collection, etc. This is effectively a VM I think. Like you deploy Java apps to the JVM, you deploy JavaScript apps for the “browser VM.” Google writes gmail but they also write chrome and V8, so they are in a unique position of writing both the application and the platform it runs upon. Presumably this would allow them to make something more performant than most, not less.
- 5y ago

vijaybritto 5y ago

You're point is completely valid but companies rush their products to the market they dont necessarily do it for the experience they provide but to capture the market. For example until this month Notion was extremely slow and everyone complained. They fixed it recently and no one's complaining but the important thing here is that no one left the product for being slow. May be there is a way to reduce bloat on the web and to ship desktop apps while keeping pace with modern app dev experience but surely there isn't any right now. Maybe webassembly will help? Lets see