6 ms·

Surely there's things that can be better with webapp model, but .exe or .msi are so drastically worse on the spyware front that it's not even close.

pjmlp 5y ago
Every single HTTP request done by you is tracked down on the server, every single one!
- aidenn0 5y ago
  Plenty of native apps phone home (and won't work if they can't)
  - pjmlp 5y ago
    100% of Web apps never turn off the phone.
    - loo 5y ago
      This is not true. LibreOffice is being ported to the web, for example https://wiki.documentfoundation.org/Development/WASM https://wiki.documentfoundation.org/Development/WASM
      - pjmlp 5y ago
        So now they can track down every user that uses the Web version.
        loo 5y ago
        They are porting the codebase to WebAssembly, not developing a Google Docs type SaaS product. It shouldn't be difficult to see that GIMP and LibreOffice can run on this runtime with similar privacy. We typically download native executables over HTTP. Then check for application updates over HTTP. Privacy respecting WASM apps can do the same. This is the new Java, not the new SaaS.
- enumjorge 5y ago
  I think that’s a result of being connected to the web not a native application vs web app thing. Nothing is stopping a native app from sending telemetry to a server for every action you take.
  - pjmlp 5y ago
    Yeah, except Web apps use telemetry in every single request, to profit for marketing dashboards. Spend some time learning about marketing solutions. So native apps may use, Web uses it all the time.
    - ptx 5y ago
      Native apps have access to all your local data, unlike web apps. Web apps can't gather telemetry on things they can't access.
      - pjmlp 5y ago
        On Web apps your data lives on someone's else computer, including basic stuff like credit card information. Every horizontal line on the network tab in developer tools is yet another piece of telemetry information. Native apps have access to whatever user they run under. Again whatever native apps can do, web apps do all the time.
        yoavm 5y ago
        Here's an example: Discord app reads all the processes running on the machine. Discord webapp can't. Telemetry is probably the same. Another example: Microsoft Word can include a bug that makes opening a doc file run whatever command, including wiping the system. Google Docs can't do it. It's much simpler to see telemetry in a web app - just open the Network tab. The fact that it's harder to do with a desktop app does not at all means it isn't there. Give wireshark a spin.
        pjmlp 5y ago
- tiborsaas 5y ago
  You repeated this like 10+ times already in this thread, but never explained it why it's so evil. You just assume everybody is on the same page that tracking (logging actually) is bad, but it's far from obvious. The fact that I can see access log in my web server is just a helpful tool for me as a developer to improve my services. I think the majority of sites use this in good faith and keep products healthy. If your threat model involves secret services tracking your activity down based on downloading favicon.ico, then you might have more serious problems than architectural choices of the web platform.
  - pjmlp 5y ago
    Because 10+ times people keep not getting that while native apps can track you, all Web apps do track you and fed every single action into marketing engines, even if then don't public acknowledge doing so. And they own your data as well.
    - recursive 5y ago
      It's "all" that people are objecting to. At my day job, we make a web application for health records that can be deployed inside an air-gapped intranet. Surely you don't think that's feeding a marketing engine?
      - pjmlp 5y ago
        How I as a patient, can be sure you haven't built one, and aren't crawling my health records?
        recursive 5y ago
        That's a different question. All over this thread, you're repeatedly saying that 100% of web apps are feeding marketing machines. I have a counter-example. It's a separate question of how a patient can be sure of that fact. There's actually not a really reliable way a patient could even become aware of the existence of this product, since they would never see it or be informed of it. Patients are not users of this product. Users could ask their IT department for a log of outgoing internet-bound requests from the servers. Or ask whether those servers even have the capability of contacting arbitrary third parties.
AnIdiotOnTheNet 5y ago
How do you figure? Before everyone went web crazy and started bundling always-on network traffic into their calculator application, programs were a thing you could download and install and use without a network connection at all forever.

pjmlp 5y ago

Every single HTTP request done by you is tracked down on the server, every single one!

aidenn0 5y ago
Plenty of native apps phone home (and won't work if they can't)
- pjmlp 5y ago
  100% of Web apps never turn off the phone.
  - loo 5y ago
    This is not true. LibreOffice is being ported to the web, for example https://wiki.documentfoundation.org/Development/WASM https://wiki.documentfoundation.org/Development/WASM
    - pjmlp 5y ago
      So now they can track down every user that uses the Web version.
      - loo 5y ago
        They are porting the codebase to WebAssembly, not developing a Google Docs type SaaS product. It shouldn't be difficult to see that GIMP and LibreOffice can run on this runtime with similar privacy. We typically download native executables over HTTP. Then check for application updates over HTTP. Privacy respecting WASM apps can do the same. This is the new Java, not the new SaaS.
enumjorge 5y ago
I think that’s a result of being connected to the web not a native application vs web app thing. Nothing is stopping a native app from sending telemetry to a server for every action you take.
- pjmlp 5y ago
  Yeah, except Web apps use telemetry in every single request, to profit for marketing dashboards. Spend some time learning about marketing solutions. So native apps may use, Web uses it all the time.
  - ptx 5y ago
    Native apps have access to all your local data, unlike web apps. Web apps can't gather telemetry on things they can't access.
    - pjmlp 5y ago
      On Web apps your data lives on someone's else computer, including basic stuff like credit card information. Every horizontal line on the network tab in developer tools is yet another piece of telemetry information. Native apps have access to whatever user they run under. Again whatever native apps can do, web apps do all the time.
      - yoavm 5y ago
        Here's an example: Discord app reads all the processes running on the machine. Discord webapp can't. Telemetry is probably the same. Another example: Microsoft Word can include a bug that makes opening a doc file run whatever command, including wiping the system. Google Docs can't do it. It's much simpler to see telemetry in a web app - just open the Network tab. The fact that it's harder to do with a desktop app does not at all means it isn't there. Give wireshark a spin.
        pjmlp 5y ago
tiborsaas 5y ago
You repeated this like 10+ times already in this thread, but never explained it why it's so evil. You just assume everybody is on the same page that tracking (logging actually) is bad, but it's far from obvious. The fact that I can see access log in my web server is just a helpful tool for me as a developer to improve my services. I think the majority of sites use this in good faith and keep products healthy. If your threat model involves secret services tracking your activity down based on downloading favicon.ico, then you might have more serious problems than architectural choices of the web platform.
- pjmlp 5y ago
  Because 10+ times people keep not getting that while native apps can track you, all Web apps do track you and fed every single action into marketing engines, even if then don't public acknowledge doing so. And they own your data as well.
  - recursive 5y ago
    It's "all" that people are objecting to. At my day job, we make a web application for health records that can be deployed inside an air-gapped intranet. Surely you don't think that's feeding a marketing engine?
    - pjmlp 5y ago
      How I as a patient, can be sure you haven't built one, and aren't crawling my health records?
      - recursive 5y ago
        That's a different question. All over this thread, you're repeatedly saying that 100% of web apps are feeding marketing machines. I have a counter-example. It's a separate question of how a patient can be sure of that fact. There's actually not a really reliable way a patient could even become aware of the existence of this product, since they would never see it or be informed of it. Patients are not users of this product. Users could ask their IT department for a log of outgoing internet-bound requests from the servers. Or ask whether those servers even have the capability of contacting arbitrary third parties.

AnIdiotOnTheNet 5y ago

How do you figure? Before everyone went web crazy and started bundling always-on network traffic into their calculator application, programs were a thing you could download and install and use without a network connection at all forever.