7 ms·

I disagree at least about the part about native applications. It really is better to have this universal VM for ephemeral apps and not have to worry about if th

I disagree at least about the part about native applications. It really is better to have this universal VM for ephemeral apps and not have to worry about if the thing supports Linux or if it's actually spyware or how much hard drive space is this thing going to take up. Recent things like Zoom native app being incredibly insecure but the same company's webapp being much better kind of proves the point.

pjmlp 5y ago
All Web applications are spyware and security is not given, hence OWASP.
- esrauch 5y ago
  Surely there's things that can be better with webapp model, but .exe or .msi are so drastically worse on the spyware front that it's not even close.
  - pjmlp 5y ago
    Every single HTTP request done by you is tracked down on the server, every single one!
    - aidenn0 5y ago
      Plenty of native apps phone home (and won't work if they can't)
      - pjmlp 5y ago
        100% of Web apps never turn off the phone.
        loo 5y ago
        This is not true. LibreOffice is being ported to the web, for example https://wiki.documentfoundation.org/Development/WASM https://wiki.documentfoundation.org/Development/WASM
        pjmlp 5y ago
        So now they can track down every user that uses the Web version.
        loo 5y ago
        They are porting the codebase to WebAssembly, not developing a Google Docs type SaaS product. It shouldn't be difficult to see that GIMP and LibreOffice can run on this runtime with similar privacy. We typically download native executables over HTTP. Then check for application updates over HTTP. Privacy respecting WASM apps can do the same. This is the new Java, not the new SaaS.
    - enumjorge 5y ago
      I think that’s a result of being connected to the web not a native application vs web app thing. Nothing is stopping a native app from sending telemetry to a server for every action you take.
      - pjmlp 5y ago
        Yeah, except Web apps use telemetry in every single request, to profit for marketing dashboards. Spend some time learning about marketing solutions. So native apps may use, Web uses it all the time.
        ptx 5y ago
        Native apps have access to all your local data, unlike web apps. Web apps can't gather telemetry on things they can't access.
        pjmlp 5y ago
        On Web apps your data lives on someone's else computer, including basic stuff like credit card information. Every horizontal line on the network tab in developer tools is yet another piece of telemetry information. Native apps have access to whatever user they run under. Again whatever native apps can do, web apps do all the time.
        yoavm 5y ago
        Here's an example: Discord app reads all the processes running on the machine. Discord webapp can't. Telemetry is probably the same. Another example: Microsoft Word can include a bug that makes opening a doc file run whatever command, including wiping the system. Google Docs can't do it. It's much simpler to see telemetry in a web app - just open the Network tab. The fact that it's harder to do with a desktop app does not at all means it isn't there. Give wireshark a spin.
        pjmlp 5y ago
    - tiborsaas 5y ago
      You repeated this like 10+ times already in this thread, but never explained it why it's so evil. You just assume everybody is on the same page that tracking (logging actually) is bad, but it's far from obvious. The fact that I can see access log in my web server is just a helpful tool for me as a developer to improve my services. I think the majority of sites use this in good faith and keep products healthy. If your threat model involves secret services tracking your activity down based on downloading favicon.ico, then you might have more serious problems than architectural choices of the web platform.
      - pjmlp 5y ago
        Because 10+ times people keep not getting that while native apps can track you, all Web apps do track you and fed every single action into marketing engines, even if then don't public acknowledge doing so. And they own your data as well.
        recursive 5y ago
        It's "all" that people are objecting to. At my day job, we make a web application for health records that can be deployed inside an air-gapped intranet. Surely you don't think that's feeding a marketing engine?
        pjmlp 5y ago
        How I as a patient, can be sure you haven't built one, and aren't crawling my health records?
        recursive 5y ago
        That's a different question. All over this thread, you're repeatedly saying that 100% of web apps are feeding marketing machines. I have a counter-example. It's a separate question of how a patient can be sure of that fact. There's actually not a really reliable way a patient could even become aware of the existence of this product, since they would never see it or be informed of it. Patients are not users of this product. Users could ask their IT department for a log of outgoing internet-bound requests from the servers. Or ask whether those servers even have the capability of contacting arbitrary third parties.
  - AnIdiotOnTheNet 5y ago
    How do you figure? Before everyone went web crazy and started bundling always-on network traffic into their calculator application, programs were a thing you could download and install and use without a network connection at all forever.
- jancsika 5y ago
  Space Station Marshall: Men cannot grow beards in space. Bearded Man #1: But I have a beard. Marshall: Well, then you're an alien. Bearded Man #1: No I'm not. Marshall: Yes you are. Bearded Man #1: No, I'm not. Marshall: Well, then you can't grow a beard. Bearded Man #2: But he has a beard. Marshall: Well, then he's an alien. Bearded Man #3: He's not. He's from Pittsburg. https://vimeo.com/7117832 https://vimeo.com/7117832
- maple3142 5y ago
  At least I know a website couldn't read my id_rsa, as opposed to native executables. Unless there is a very serious browser exploit.
  - ori_b 5y ago
    They're working on it: https://wicg.github.io/file-system-access/ https://wicg.github.io/file-system-access/ While local apps are getting sandboxed properly: https://docs.flatpak.org/en/latest/sandbox-permissions.html https://docs.flatpak.org/en/latest/sandbox-permissions.html
    - maple3142 5y ago
      > They're working on it: https://wicg.github.io/file-system-access/ https://wicg.github.io/file-system-access/ It seems it need user to manually select a file/folder to be used, like Android or iOS does. > While local apps are getting sandboxed properly: https://docs.flatpak.org/en/latest/sandbox-permissions.html https://docs.flatpak.org/en/latest/sandbox-permissions.html It looks good, but it seems many applications still require filesystem=host to run (https://flatkill.org/2020/ https://flatkill.org/2020/). Also, its sandbox solution isn't going to work on Windows, Mac and BSDs.
      - ori_b 5y ago
        > It seems it need user to manually select a file/folder to be used, like Android or iOS does. please select your home directory for our super-awesome functionality
  - pjmlp 5y ago
    It doesn't need to, the server has the master key and the data it cares about is tracked on each HTTP request.
- cookiengineer 5y ago
  In which world do companies use rust and not over 20 years outdated c++ libraries to make your argument work? I'm sorry, but the likeliness of zero days in a c++ program that was too stupid to handle char arrays or multithreading is way off the charts vs heap spraying bugs in a VM. I'd argue that native applications therefore are far more vulnerable than web applications.
  - pjmlp 5y ago
    The Web is the modern version of timesharing/X Windows, the owner of the application tracks down every single HTTP request and their contents.
    - loo 5y ago
      The web can function as a fully offline application runtime. Desktop applications can track your every click with HTTP requests to their server. The runtime does not determine this.
      - pjmlp 5y ago
        Desktop applications can track, Web always tracks. And if by offline you mean PWAs, unless you are doing Hello World, that app cache is going to be cleared and then analytics can be updated. Finally, there is very little a pure PWA can do without doing HTTP and Websocket requests.
        cookiengineer 5y ago
        > Desktop applications can track, Web always tracks. Desktop code cannot be verified. Web code can be verified. This argument goes both ways. If we're talking about the web-equivalent of Desktop Apps: There's electron, which can do far more than HTTP requests and WebSockets - but that on the other hand is also too bloated, right? Sometimes I wish people would just make up their mind, stop complaining, and start trying to fix it. We had servo, and we had a nice modular and privacy respecting future for everybody; and then we messed it up because apparently nobody really cares about it.
- 7v3x3n3sem9vv 5y ago
  Self-hosted web apps. You develop for one platform, the web, and it works for nearly every OS.
  - pjmlp 5y ago
    Almost no one does it, and every SaaS application knows more about you than you think.
    - loo 5y ago
      Most of those SaaS have native mobile apps which track you, too. The runtime is not to blame. FOSS applications could be delivered with near-instant load times, native feel and excellent sandboxing, with one universal build target. That is a remarkable ability. Do not let the crimes of Web 3.0 blind you to this. Tracking and disrespect for privacy are utterly orthogonal.
      - pjmlp 5y ago
        Native can track, Web always does.
    - selfhoster11 5y ago
      Almost no one needs to develop a self hosted app, because there already are self-hosted apps for lots of use cases out there.
      - pjmlp 5y ago
        Such as?
        selfhoster11 5y ago
        I was going to list some use cases individually, but you can get a better picture by skimming through this: https://github.com/awesome-selfhosted/awesome-selfhosted https://github.com/awesome-selfhosted/awesome-selfhosted It's rare that a self-hosted piece of software is not present on this list. As you can see, the coverage is pretty extensive.
- kbenson 5y ago
  All web applications may be spyware, but using web technologies as a common format for specifying a UI had benefit, even if it's not through something as heavy as electron. Having an interface I can just stand up on a port and access locally through multiple different browser options, or even expose to remote if the user wants, and it will be the same across every OS for zero additional shipped library cost, and works in every programming language, is an amazing thing.
  - pjmlp 5y ago
    Really amazing, X Windows, RDP, VNC, Views,... never happened.
    - kbenson 5y ago
      The only one of those even remotely similar to what I'm talking about is X Window System protocol, and that's never been close to ubiquitous, which is something you can say about web browsers. HTTP+HTML is so ubiquitous that many (all of the most popular) operating systems ship built in components to handle it, and then people often have one or two additional clients to handle it. For RDP, clients are easy to come by (but not ubiquitous), but the server side tech is limited, and generally OS based and not application provided. For VNC, client and server tech is easily available as a library to all, but it's still an additional layer on top of your application which you need to layer on and then communicate as a separate step to any client that needs remote access. I'm not familiar with views, but I'm not sure how it could be any easier to use than VNC without limiting where it can be easily deployed. Opening a port and taking a few commands is simple. There are myriad libraries to help handling requests, and in some languages rolling your own is a matter of tens of lines. The client requires nothing that every person that would want to use it doesn't already have, and if you want to support remote access, you literally just change the interface you bind to from localhost to 0.0.0.0 or the actual IP address. All additional firewall config is something you would likely have to deal with in every other technology as well. Now, don't get me wrong, I'm not saying this is the best UI paradigm to target. There are many things better about specific UI libs, but none of them can even come close to the cross platform capability and simplicity of just using HTTP+HTML. Do I want major applications delivered this way? No. Do I think it should be the ultimate choice for most programs that have time and resources to do otherwise? Probably not. Do I appreciate that I can write a Perl/Python/Rudy/JavaScript script and package it with its runtime or ship as a script (or just use a compiled language) and it will just work on basically any platform I'd want to run it on, and a client (browser) exists for everything someone would want to use to configure it? Hell yes.
- realusername 5y ago
  > All Web applications are spyware and security is not given, hence OWASP. Web apps are still the most secure platforms to date, nothing widespread really came close in terms of sandboxing & safety.
  - pjmlp 5y ago
    Really? How certain are you about the data stored in someone's else computer, being tracked down on every HTTP and Websocket request?
    - realusername 5y ago
      Some tracking will always be possible regardless of the platform but compared to native app the comparison is clearly in favor of web apps. Web apps make cross website tracking very difficult, web apps don't have private apis, web apps can be easily investigated to see what they do and even edited on the fly by the user if needed (adblocking), the sandboxing of web apps is very strong and exploits are getting rarer and rarer. There's a reason everybody asks you to download their native app, tracking is much easier there.
      - pjmlp 5y ago
        You can only see the UI of Web apps, and tracking is super easy with marketing engines. No one asks you to download native apps for desktop platforms, unless it is some Electron garbage for whatever reason, usually for stuff that is available to PWAs anyway. All ask for native apps on mobile, because development just sucks less. Whatever, it is great that people believe Web apps are so safe with their data, more fun when creating analytics rules.
xg15 5y ago
> ephemeral apps They are not ephemeral. They are far more persistent than anything you could install locally, because all the data now resides on someone else's computer. The "ephemerality" paradigm of web apps has been a strong contributor to that trend.

pjmlp 5y ago

All Web applications are spyware and security is not given, hence OWASP.

esrauch 5y ago
Surely there's things that can be better with webapp model, but .exe or .msi are so drastically worse on the spyware front that it's not even close.
- pjmlp 5y ago
  Every single HTTP request done by you is tracked down on the server, every single one!
  - aidenn0 5y ago
    Plenty of native apps phone home (and won't work if they can't)
    - pjmlp 5y ago
      100% of Web apps never turn off the phone.
      - loo 5y ago
        This is not true. LibreOffice is being ported to the web, for example https://wiki.documentfoundation.org/Development/WASM https://wiki.documentfoundation.org/Development/WASM
        pjmlp 5y ago
        So now they can track down every user that uses the Web version.
        loo 5y ago
        They are porting the codebase to WebAssembly, not developing a Google Docs type SaaS product. It shouldn't be difficult to see that GIMP and LibreOffice can run on this runtime with similar privacy. We typically download native executables over HTTP. Then check for application updates over HTTP. Privacy respecting WASM apps can do the same. This is the new Java, not the new SaaS.
  - enumjorge 5y ago
    I think that’s a result of being connected to the web not a native application vs web app thing. Nothing is stopping a native app from sending telemetry to a server for every action you take.
    - pjmlp 5y ago
      Yeah, except Web apps use telemetry in every single request, to profit for marketing dashboards. Spend some time learning about marketing solutions. So native apps may use, Web uses it all the time.
      - ptx 5y ago
        Native apps have access to all your local data, unlike web apps. Web apps can't gather telemetry on things they can't access.
        pjmlp 5y ago
        On Web apps your data lives on someone's else computer, including basic stuff like credit card information. Every horizontal line on the network tab in developer tools is yet another piece of telemetry information. Native apps have access to whatever user they run under. Again whatever native apps can do, web apps do all the time.
        yoavm 5y ago
        Here's an example: Discord app reads all the processes running on the machine. Discord webapp can't. Telemetry is probably the same. Another example: Microsoft Word can include a bug that makes opening a doc file run whatever command, including wiping the system. Google Docs can't do it. It's much simpler to see telemetry in a web app - just open the Network tab. The fact that it's harder to do with a desktop app does not at all means it isn't there. Give wireshark a spin.
        pjmlp 5y ago
  - tiborsaas 5y ago
    You repeated this like 10+ times already in this thread, but never explained it why it's so evil. You just assume everybody is on the same page that tracking (logging actually) is bad, but it's far from obvious. The fact that I can see access log in my web server is just a helpful tool for me as a developer to improve my services. I think the majority of sites use this in good faith and keep products healthy. If your threat model involves secret services tracking your activity down based on downloading favicon.ico, then you might have more serious problems than architectural choices of the web platform.
    - pjmlp 5y ago
      Because 10+ times people keep not getting that while native apps can track you, all Web apps do track you and fed every single action into marketing engines, even if then don't public acknowledge doing so. And they own your data as well.
      - recursive 5y ago
        It's "all" that people are objecting to. At my day job, we make a web application for health records that can be deployed inside an air-gapped intranet. Surely you don't think that's feeding a marketing engine?
        pjmlp 5y ago
        How I as a patient, can be sure you haven't built one, and aren't crawling my health records?
        recursive 5y ago
        That's a different question. All over this thread, you're repeatedly saying that 100% of web apps are feeding marketing machines. I have a counter-example. It's a separate question of how a patient can be sure of that fact. There's actually not a really reliable way a patient could even become aware of the existence of this product, since they would never see it or be informed of it. Patients are not users of this product. Users could ask their IT department for a log of outgoing internet-bound requests from the servers. Or ask whether those servers even have the capability of contacting arbitrary third parties.
- AnIdiotOnTheNet 5y ago
  How do you figure? Before everyone went web crazy and started bundling always-on network traffic into their calculator application, programs were a thing you could download and install and use without a network connection at all forever.
jancsika 5y ago
Space Station Marshall: Men cannot grow beards in space. Bearded Man #1: But I have a beard. Marshall: Well, then you're an alien. Bearded Man #1: No I'm not. Marshall: Yes you are. Bearded Man #1: No, I'm not. Marshall: Well, then you can't grow a beard. Bearded Man #2: But he has a beard. Marshall: Well, then he's an alien. Bearded Man #3: He's not. He's from Pittsburg. https://vimeo.com/7117832 https://vimeo.com/7117832
maple3142 5y ago
At least I know a website couldn't read my id_rsa, as opposed to native executables. Unless there is a very serious browser exploit.
- ori_b 5y ago
  They're working on it: https://wicg.github.io/file-system-access/ https://wicg.github.io/file-system-access/ While local apps are getting sandboxed properly: https://docs.flatpak.org/en/latest/sandbox-permissions.html https://docs.flatpak.org/en/latest/sandbox-permissions.html
  - maple3142 5y ago
    > They're working on it: https://wicg.github.io/file-system-access/ https://wicg.github.io/file-system-access/ It seems it need user to manually select a file/folder to be used, like Android or iOS does. > While local apps are getting sandboxed properly: https://docs.flatpak.org/en/latest/sandbox-permissions.html https://docs.flatpak.org/en/latest/sandbox-permissions.html It looks good, but it seems many applications still require filesystem=host to run (https://flatkill.org/2020/ https://flatkill.org/2020/). Also, its sandbox solution isn't going to work on Windows, Mac and BSDs.
    - ori_b 5y ago
      > It seems it need user to manually select a file/folder to be used, like Android or iOS does. please select your home directory for our super-awesome functionality
- pjmlp 5y ago
  It doesn't need to, the server has the master key and the data it cares about is tracked on each HTTP request.
cookiengineer 5y ago
In which world do companies use rust and not over 20 years outdated c++ libraries to make your argument work? I'm sorry, but the likeliness of zero days in a c++ program that was too stupid to handle char arrays or multithreading is way off the charts vs heap spraying bugs in a VM. I'd argue that native applications therefore are far more vulnerable than web applications.
- pjmlp 5y ago
  The Web is the modern version of timesharing/X Windows, the owner of the application tracks down every single HTTP request and their contents.
  - loo 5y ago
    The web can function as a fully offline application runtime. Desktop applications can track your every click with HTTP requests to their server. The runtime does not determine this.
    - pjmlp 5y ago
      Desktop applications can track, Web always tracks. And if by offline you mean PWAs, unless you are doing Hello World, that app cache is going to be cleared and then analytics can be updated. Finally, there is very little a pure PWA can do without doing HTTP and Websocket requests.
      - cookiengineer 5y ago
        > Desktop applications can track, Web always tracks. Desktop code cannot be verified. Web code can be verified. This argument goes both ways. If we're talking about the web-equivalent of Desktop Apps: There's electron, which can do far more than HTTP requests and WebSockets - but that on the other hand is also too bloated, right? Sometimes I wish people would just make up their mind, stop complaining, and start trying to fix it. We had servo, and we had a nice modular and privacy respecting future for everybody; and then we messed it up because apparently nobody really cares about it.
7v3x3n3sem9vv 5y ago
Self-hosted web apps. You develop for one platform, the web, and it works for nearly every OS.
- pjmlp 5y ago
  Almost no one does it, and every SaaS application knows more about you than you think.
  - loo 5y ago
    Most of those SaaS have native mobile apps which track you, too. The runtime is not to blame. FOSS applications could be delivered with near-instant load times, native feel and excellent sandboxing, with one universal build target. That is a remarkable ability. Do not let the crimes of Web 3.0 blind you to this. Tracking and disrespect for privacy are utterly orthogonal.
    - pjmlp 5y ago
      Native can track, Web always does.
  - selfhoster11 5y ago
    Almost no one needs to develop a self hosted app, because there already are self-hosted apps for lots of use cases out there.
    - pjmlp 5y ago
      Such as?
      - selfhoster11 5y ago
        I was going to list some use cases individually, but you can get a better picture by skimming through this: https://github.com/awesome-selfhosted/awesome-selfhosted https://github.com/awesome-selfhosted/awesome-selfhosted It's rare that a self-hosted piece of software is not present on this list. As you can see, the coverage is pretty extensive.
kbenson 5y ago
All web applications may be spyware, but using web technologies as a common format for specifying a UI had benefit, even if it's not through something as heavy as electron. Having an interface I can just stand up on a port and access locally through multiple different browser options, or even expose to remote if the user wants, and it will be the same across every OS for zero additional shipped library cost, and works in every programming language, is an amazing thing.
- pjmlp 5y ago
  Really amazing, X Windows, RDP, VNC, Views,... never happened.
  - kbenson 5y ago
    The only one of those even remotely similar to what I'm talking about is X Window System protocol, and that's never been close to ubiquitous, which is something you can say about web browsers. HTTP+HTML is so ubiquitous that many (all of the most popular) operating systems ship built in components to handle it, and then people often have one or two additional clients to handle it. For RDP, clients are easy to come by (but not ubiquitous), but the server side tech is limited, and generally OS based and not application provided. For VNC, client and server tech is easily available as a library to all, but it's still an additional layer on top of your application which you need to layer on and then communicate as a separate step to any client that needs remote access. I'm not familiar with views, but I'm not sure how it could be any easier to use than VNC without limiting where it can be easily deployed. Opening a port and taking a few commands is simple. There are myriad libraries to help handling requests, and in some languages rolling your own is a matter of tens of lines. The client requires nothing that every person that would want to use it doesn't already have, and if you want to support remote access, you literally just change the interface you bind to from localhost to 0.0.0.0 or the actual IP address. All additional firewall config is something you would likely have to deal with in every other technology as well. Now, don't get me wrong, I'm not saying this is the best UI paradigm to target. There are many things better about specific UI libs, but none of them can even come close to the cross platform capability and simplicity of just using HTTP+HTML. Do I want major applications delivered this way? No. Do I think it should be the ultimate choice for most programs that have time and resources to do otherwise? Probably not. Do I appreciate that I can write a Perl/Python/Rudy/JavaScript script and package it with its runtime or ship as a script (or just use a compiled language) and it will just work on basically any platform I'd want to run it on, and a client (browser) exists for everything someone would want to use to configure it? Hell yes.
realusername 5y ago
> All Web applications are spyware and security is not given, hence OWASP. Web apps are still the most secure platforms to date, nothing widespread really came close in terms of sandboxing & safety.
- pjmlp 5y ago
  Really? How certain are you about the data stored in someone's else computer, being tracked down on every HTTP and Websocket request?
  - realusername 5y ago
    Some tracking will always be possible regardless of the platform but compared to native app the comparison is clearly in favor of web apps. Web apps make cross website tracking very difficult, web apps don't have private apis, web apps can be easily investigated to see what they do and even edited on the fly by the user if needed (adblocking), the sandboxing of web apps is very strong and exploits are getting rarer and rarer. There's a reason everybody asks you to download their native app, tracking is much easier there.
    - pjmlp 5y ago
      You can only see the UI of Web apps, and tracking is super easy with marketing engines. No one asks you to download native apps for desktop platforms, unless it is some Electron garbage for whatever reason, usually for stuff that is available to PWAs anyway. All ask for native apps on mobile, because development just sucks less. Whatever, it is great that people believe Web apps are so safe with their data, more fun when creating analytics rules.

xg15 5y ago

> ephemeral apps They are not ephemeral. They are far more persistent than anything you could install locally, because all the data now resides on someone else's computer. The "ephemerality" paradigm of web apps has been a strong contributor to that trend.