4 ms·

I agree with you, but it's interesting to me to observe that you haven't been downvoted into oblivion, which I think _would've_ happened if we were speaking of

I agree with you, but it's interesting to me to observe that you haven't been downvoted into oblivion, which I think _would've_ happened if we were speaking of packaged PWAs in the form of Electron/desktop apps. Do you think the same arguments apply in that arena as well?

modeless 4y ago
Electron apps are not PWAs. The difference is that PWAs share the browser engine with the user's default browser, saving memory and disk space and dramatically improving security vs. Electron. On mobile, "packaged" PWAs are usually still using the user's default browser engine.
- Octoth0rpe 4y ago
  > disk space Undoubtably > saving memory Less certain > dramatically improving security How so? That seems pretty dubious to me.
  - modeless 4y ago
    I am not sure why you would doubt that running two or more instances of Chromium uses significantly more memory than one, all else being equal (i.e. the same set of loaded sites). As for security, as a user you can be sure that a PWA is bound by the browser's security policies which are in general quite restrictive even for installed apps. An Electron app is not bound by any browser security policy and can do literally anything that a native app can do. And if the app has any kind of JavaScript injection vulnerability then those capabilities are exposed to malicious code. There's a history of Electron apps having vulnerabilities like this. Furthermore, browsers are frequently updated to address security issues in the browser engine, while Electron apps almost always receive the same updates much less promptly. So if the Electron app ever renders HTML or JS that comes from the network (which most of them do in one way or another), you are vulnerable to those issues too.
  - mikewhy 4y ago
    > > dramatically improving security > How so? That seems pretty dubious to me With an electron app, I have access to your file system and can start deleting things. Yes, some operating systems might gate access but it's not standard or granular enough. While the file system api in browsers requires your approval.
  - randfur 4y ago
    The browser updates monthly with security patches. Electron's engine lags many versions behind.
- lucasyvas 4y ago
  This is 100% correct, but I just want to add that things like the WebView2 runtime on Windows blurs this line. The browser engine is identical to Edge, but you only use the WebView for the UI and the rest is native. For me, this is the sweet spot for technology. Your frontend can be built once for the browser and "native", and the OS native APIs are all accessible to enhance the experience to a degree PWAs would take an enormous amount of time to catch up to. Electron is not the ideal solution for this problem in my opinion (having developed an app professionally) - what you want is OS packaged browser runtimes to keep your bundle small and give you the evergreen web feature experience, and full OS API access. It's the best of both worlds. Something like Flutter would be ideal if you want to avoid the DOM, but it's struggling against the web momentum and still has performance issues.
samwillis 4y ago
To some extent yes, if you are building a mobile app and go the Capacitor route, and want a desktop app with the same functionality then Electron makes sense. However, electron bundles it’s own WebKit, so it’s bulkier. I would quite like a platform similar to electron that uses a shared WebKit distribution. There are a few trying to do that by hooking into OS level WebKit on Mac and Windows.
- depressedpanda 4y ago
  Electron bundles Blink by embedding Chromium (and Node.js). WebKit is used only by Safari, and a select few open source browsers.
- CodesInChaos 4y ago
  > I would quite like a platform similar to electron that uses a shared WebKit distribution. Tauri is an Electron alternative that uses OS provided webviews

modeless 4y ago

Electron apps are not PWAs. The difference is that PWAs share the browser engine with the user's default browser, saving memory and disk space and dramatically improving security vs. Electron. On mobile, "packaged" PWAs are usually still using the user's default browser engine.

Octoth0rpe 4y ago
> disk space Undoubtably > saving memory Less certain > dramatically improving security How so? That seems pretty dubious to me.
- modeless 4y ago
  I am not sure why you would doubt that running two or more instances of Chromium uses significantly more memory than one, all else being equal (i.e. the same set of loaded sites). As for security, as a user you can be sure that a PWA is bound by the browser's security policies which are in general quite restrictive even for installed apps. An Electron app is not bound by any browser security policy and can do literally anything that a native app can do. And if the app has any kind of JavaScript injection vulnerability then those capabilities are exposed to malicious code. There's a history of Electron apps having vulnerabilities like this. Furthermore, browsers are frequently updated to address security issues in the browser engine, while Electron apps almost always receive the same updates much less promptly. So if the Electron app ever renders HTML or JS that comes from the network (which most of them do in one way or another), you are vulnerable to those issues too.
- mikewhy 4y ago
  > > dramatically improving security > How so? That seems pretty dubious to me With an electron app, I have access to your file system and can start deleting things. Yes, some operating systems might gate access but it's not standard or granular enough. While the file system api in browsers requires your approval.
- randfur 4y ago
  The browser updates monthly with security patches. Electron's engine lags many versions behind.
lucasyvas 4y ago
This is 100% correct, but I just want to add that things like the WebView2 runtime on Windows blurs this line. The browser engine is identical to Edge, but you only use the WebView for the UI and the rest is native. For me, this is the sweet spot for technology. Your frontend can be built once for the browser and "native", and the OS native APIs are all accessible to enhance the experience to a degree PWAs would take an enormous amount of time to catch up to. Electron is not the ideal solution for this problem in my opinion (having developed an app professionally) - what you want is OS packaged browser runtimes to keep your bundle small and give you the evergreen web feature experience, and full OS API access. It's the best of both worlds. Something like Flutter would be ideal if you want to avoid the DOM, but it's struggling against the web momentum and still has performance issues.

samwillis 4y ago

To some extent yes, if you are building a mobile app and go the Capacitor route, and want a desktop app with the same functionality then Electron makes sense. However, electron bundles it’s own WebKit, so it’s bulkier. I would quite like a platform similar to electron that uses a shared WebKit distribution. There are a few trying to do that by hooking into OS level WebKit on Mac and Windows.

depressedpanda 4y ago
Electron bundles Blink by embedding Chromium (and Node.js). WebKit is used only by Safari, and a select few open source browsers.
CodesInChaos 4y ago
> I would quite like a platform similar to electron that uses a shared WebKit distribution. Tauri is an Electron alternative that uses OS provided webviews