22 ms·

Closing a 30 pixel gap between native and web

378 points by vyrotek 4y ago

cebert 4y ago
Hopefully Apple keeps moving in the direction of better embracing PWAs. I am encouraged that iOS 16 includes support for web push notifications. This suggests to me Apple may be more willing to embrace PWA web standards.
- aeharding 4y ago
  I just really hope the onboarding experience is improved. Right now it's very convoluted and messaging is extremely difficult, in some places impossible. For example, in SFSafariViewController there is no “add to home screen” button in the share menu, but in actual safari there is. Despite them both being web view experiences controlled entirely by Apple. (And you can’t detect SFSafariViewController vs Safari as a web app, so good luck onboarding users for your PWA.)
asherah 4y ago
this looks great! hopefully this can be better standardized soon
mwcampbell 4y ago
Counterpoint: Seams (2014): https://adactio.com/journal/6786 https://adactio.com/journal/6786 Edit: related, from the same author: Regressive Web Apps (2016): https://adactio.com/journal/10708 https://adactio.com/journal/10708
deleted 4y ago
[deleted]
MaXtreeM 4y ago
With all this Electron and PWA focused development a cannot shake a feeling that we add an extra layer of a "runtime" on top of an operating system, that could be avoided. An extra layer which occupies RAM space and processor time which feels unnecessary but it is where we are headed. I wonder if the reason is simple, that we (myself included) have not provided anything better or the reason is that big corporations who control most of the market have pushed this technology forward. I hope we can learn from this and bring back some of this lost performance while keeping the productivity and security gains.
- whywhywhywhy 4y ago
  It makes perfect sense for the user but developers will always argue for Electron so that they only have to test one browser engine. I can’t even gets web devs to test on anything but Chrome and when something they code does break I have to listen to the Safari whine even though they all use iPhones so are part of the reason it’s relevant. Dread to think how an argument for supporting 3+ web engines for a “native” app would go.
  - kitsunesoba 4y ago
    What seems even crazier is not even wanting to test against different builds of Chromium to help keep pace with Electron updates. At that point isn't one's code just too brittle?
  - criddell 4y ago
    A lot of developers are not fans of Electron. Generally, it's a quality vs quantity tradeoff. Are you willing to make a crappier thing if it means more people can use it? For companies like Microsoft making something like Teams, I think it sucks. They have the resources to make native apps and when you have tens of millions of users, adding support for another platform would cost them pennies per user.
    - com2kid 4y ago
      > For companies like Microsoft making something like Teams, I think it sucks. They have the resources to make native apps and when you have tens of millions of users, adding support for another platform would cost them pennies per user. Back when I worked at Microsoft, 2014 or so, we had serious problems finding Win32 developers. We essentially had to train people up. While I am sure the Windows org had lots of them, put out a job req and even internally not very many people are going to have native Windows development on their resume. Nearly had to draw straws to see who had to get "stuck" learning Windows stuff. I imagine native MacOS developers are similarly rare as a % of the overall developer pool. Android and iPhone developers, easy peasy. Likewise, Web developers, not a problem. The other thing is, Electron has tons of momentum behind it, which means more and more people jump onboard to learn it, which makes hiring easy. Tutorials and learning resources get made, making developing for it even easier. IIRC we ended up dropping the native C++ Windows app and just used C# and one of the UI toolkits, I forget which one.
tiarafawn 4y ago
Seems exploitable for phishing
- Bigpet 4y ago
  you need to "install" the PWA first. So how's this different from regular desktop applications in regards to phishing specifically? Do you mean an app presenting pre-"install" as something and then post-"install" as something else? I'm having a hard time seeing a lot of difference. Most windows you want to "spoof" will look different in regards to the title bar either way. In a regular browser window you'll have the browser title bar. In the PWA case you'll have the extra hamburger menu.
jwcacces 4y ago
Looks like the perfect place to fake some browser chrome and trick people... https://www.theregister.com/2017/01/19/browser_line_of_death/ https://www.theregister.com/2017/01/19/browser_line_of_death...
- nicoburns 4y ago
  I think you'll only get access to this API if the user has explicitly installed your app as a PWA, not just when visiting it as a webpage.
  - gildas 4y ago
    And then a shady company offers to buy the owner's website...
    - tshaddox 4y ago
      That’s a real problem, of course, but it seems fairly equivalent to any native app you install that can update itself or otherwise make a network request to obtain instructions.
      - gildas 4y ago
        I agree with you. On the other hand, in the case of a native application, we can hope that the antivirus removes it. I hope that Microsoft has planned to update Defender accordingly.
        int_19h 4y ago
        JavaScript malware has been a thing for a while now, and antiviruses have been targeting it accordingly.
        gildas 4y ago
        It's not necessarily a JavaScript malware. A pure HTML page with a <form> tag could suffice to steal credentials.
dmayle 4y ago
I think this is a sign that Microsoft sees the writing on the wall. There will be a day when Windows is left behind, and they want to make sure that they can continue to deliver the Microsoft experience, even on other platforms.
- guhidalg 4y ago
  I don’t think Windows is ever going to be left behind, you still need a kernel to make use of all your hardware and an OS to give users something to do. I view this move as Microsoft recognizing that the future of most development is cross-platform web technologies and they need to give Windows users reasons not to migrate to macOS and ChromeOS (though it’s ok if they do as long as they’re paying for O365 and Azure).
  - ieegdiuf 4y ago
  - smoldesu 4y ago
    I think you're right, but that also poses the possibility that Windows will get left behind, as a kernel. If the future of development happens on the web, the significance of Windows as a kernel is going to greatly diminish. We've already reverse-engineered a huge amount of Windows API calls, and you can run vast amounts of fairly complex Windows software without the NT kernel at all. If our future does shift towards thin-clients and web-browsers, MacOS and Windows will make increasingly less sense. Both OSes have a pretty significant amount of cruft and unjustified overhead which already seems unnecessary to a generation of Google Docs and Soundcloud users.
    - FpUser 4y ago
      >"If our future does shift towards thin-clients and web-browsers" Please no. I like to control what I have. No way for me to be fed by thin client. Sure I do not mind web apps / services where it makes sense (banking for example). But the possibility to be suddenly cut off for whatever reason (maybe my app provider does not like my political views) - fuck that. Or when everything goes through some portal what will prohibit from them jacking up subscription fees sky high? I understand by many developers wanting to use webapp hummer for everything but I think they're digging their own grave
gw99 4y ago
Oh look they turned Chromium into IE6. Forced ads, difficult to eviscerate search engines, proprietary extensions, dubious security posture! Oh goody!
intrasight 4y ago
> ability to create their own title bar experiences It was a sad day, IMHO, in UX-world when this became possible in desktop apps. The window system should own the chrome and the apps should not be able to touch it.
- jonathankoren 4y ago
  Looking forward to the day when Winamp style apps are back. Remember round windows? They’re back, in Electron form.
- postalrat 4y ago
  They still do. https://blogs.windows.com/wp-content/uploads/prod/sites/33/2022/09/Picture2.png https://blogs.windows.com/wp-content/uploads/prod/sites/33/2... Didn't that picture make it obvious?
  - Arainach 4y ago
    Now a single app bug can make it so you can't drag a window. Oops, we accept clicks everywhere and never fall back to whatever the web equivalent of DefWndProc is, I guess it's all app space and no actual title bar in that blue.
    - contextfree 4y ago
      Win32 apps have always been able to break dragging, since ultimately the app process "owns" the window frame and can hang and block all interactions with it. (The system tries to catch simple cases of hanging where the app obviously isn't processing messages, but that doesn't cover all situations) Actually, UWP sort of solved/solves this, by having a different process own the window frame.
armchairhacker 4y ago
I want the opposite of a PWA. I want an app which can be compiled into Desktop/mobile builds and also interpreted in browsers. An alternate HTML/CSS/JS with no JavaScript.
- danans 4y ago
  So ... Flutter? https://flutter.dev/ https://flutter.dev/
  - armchairhacker 4y ago
    Sure. As well as certain other platforms like Kotlin multiplatform The only issue is that these still have to compile to JavaScript, which in practice leads to slower performance and potential for improper semantics on the JS side. It would be better to have them executed in WASM and then have better WASM-browser integration
    - postalrat 4y ago
      A better WASM-browser integration would mean more security risks running WASM.
  - doctor_eval 4y ago
    Flutter looked cool, until I realised it was a Google product. After being burned by Angular, Material, and all the things killedbygoogle, I'm not sure I can stomach even trying it out. Is that stupid?
    - return_to_monke 4y ago
      Honestly, i have no idea. I've got amazing results with flutter so far; and therefore I'm obviously biased. Packaging it from source is pretty hard; but a bit of the industry has already adopted it. Even tho of course it could always have more features; i for one don't think it would be that big of an issue if google called quits on it today
- 4y ago
323 4y ago
I for one welcome our Electron future.
nullcaution 4y ago
This seems widly exploitable. Even on the OS level, I would argue an application should not have access to thoes 30 pixels. Beyond rhe security concerns, this seems like a proprietarization of the web for Win11, a la Internet Explorer.
- adamesque 4y ago
  They do explicitly discuss how the feature might work on other platforms (aka Mac OS and Linux), and have published a spec, which is also an interesting read: https://wicg.github.io/window-controls-overlay/ https://wicg.github.io/window-controls-overlay/
- cush 4y ago
  You have to install PWAs, and any platform can implement this. It's a pretty good spec that can help a lot with the adoption of PWAs
- tommoor 4y ago
  Better stop installing desktop apps then
MartinMond 4y ago
Love how we're realizing that .hta was actually incredible. I have fond memories of building my own https://en.m.wikipedia.org/wiki/HTML_Application https://en.m.wikipedia.org/wiki/HTML_Application
- mmastrac 4y ago
  .hta really had to go through the standardization process to tighten up security. Those things were awesome, but you'd basically be owned immediately.
- rnestler 4y ago
  It's kind of impressive that one can still run the same .hta app even on Windows 11 according to the wikipedia article: > HTAs are dependent on the Trident (MSHTML) browser engine, used by Internet Explorer, but are not dependent on the Internet Explorer application itself. If a user removes Internet Explorer from Windows, via the Control Panel, the MSHTML engine remains and HTAs continue to work. HTAs continue to work in Windows 11 as well.
- jimmygrapes 4y ago
  Quick shout out to the Compiled HTML[0] (.chm) format for similar but unrelated reasons. The Help viewer application was one of the pinnacles of good UX, in my opinion. [0]: https://en.wikipedia.org/wiki/Microsoft_Compiled_HTML_Help https://en.wikipedia.org/wiki/Microsoft_Compiled_HTML_Help
  - mappu 4y ago
    A while back at $DAYJOB I tried to get a CI pipeline to bundle our docs as .chm, but the official tooling (hhc, with-or-without Sphinx as a frontend) is windows-only pre-unicode nonsense; the only Linux native chm compiler i found was Halibut (from the author of PuTTY) which has many of its own idiosyncrasies. Is there any normal-looking way to make a chm from a directory full of html files?
    - jimmygrapes 4y ago
kanonieer 4y ago
> We’re excited to announce the availability of a new PWA feature that closes this gap and helps blur the line between apps and websites even more. I don't see how they can use "blurred line" as a positive trait here. There are important differences between native apps and web apps, why hide this information from a regular user, especially when this information can be conveyed by 30 pixels.
- drewtato 4y ago
  Well right now, the alternative isn't "keep it in the browser", it's "ship it in electron".
- chpmrc 4y ago
  What difference does the runtime make to the (average) end user? I love that I can create shortcuts of some web apps that have their own window, menu bar etc. (this is already possible in Chrome) and I don't really care they are "web" apps.
  - LtWorf 4y ago
    > What difference does the runtime make to the (average) end user? "Incredibly slow and draining the battery 3x as fast" vs "regular"
    - chpmrc 4y ago
      That has nothing to do with the runtime, rather with the implementation. Barrier to entry of web development is low so average quality is also low. On the opposite side of the spectrum you have products like Figma, Notion, Google apps etc.
- make3 4y ago
  because actual regular answers don't understand what any of this means, and this just means that the devs have more control over what experience they give them
- int_19h 4y ago
wolpoli 4y ago
I actually wish programs do not put content in the Title bar area. The title bar area is meant for users to move the Window around. Try opening Microsoft Word, make the window narrow and drag the window. You have to hunt for a small bit of empty space in the title bar or you have to understand you could drag on the Title text, Search box and the Sign in Username, but not the Auto Save text, Upcoming Features icon, or the Ribbon Display Options icon.
- banana_giraffe 4y ago
  I don't disagree. It's for this kind of nonsense that I have "alt-space -> s -> down -> right" burned into my fingertips followed by moving the mouse cursor to resize a window deterministically (along with "alt-space -> m -> any arrow" for move, doubly useful to "rescue" an off screen window)
  - jolmg 4y ago
    > alt-space -> s -> down -> right > alt-space -> m -> any arrow Are those keybindings default on a particular OS/DE/WM/WC or are they just your personal config?
    - sedatk 4y ago
      Alt-space menu is Windows specific IIRC.
      - drekipus 4y ago
        Gnome does the same, I use it all the time for "pin window always on top" Which windows still doesn't have, for some reason.
        quotemstr 4y ago
        Gnome doesn't have menu accelerators in the window menu though, so "alt-spc n" does nothing: the alt-spc brings up the window menu, but the n doesn't activate "minimize". This interaction not functioning in Gnome keeps me off Gnome entirely.
coldtea 4y ago
>We talk a lot about Progressive Web Apps (PWA) in the context of mobile devices, but they have an enormous potential on desktop operating systems that’s only beginning to materialize. Do we? I think we talk about PWA's on mobile and desktop equally, if not more so in the Desktop (e.g. with Electron and regular browser-viewed PWAs).
ElijahLynn 4y ago
Love that MS is going all-in on PWAs! The PWA future is looking bright!
chrismsimpson 4y ago
Is this not introducing a massive UI threat vector considering we’re talking about HTML/JavaScript downloaded from the web?
lvass 4y ago
Why are the window decoration buttons considered critical on Windows? People using Windows without a keyboard maybe? I always disabled those (or the whole bar) on any system I've used since I can remember.
GuB-42 4y ago
> installed desktop web apps are really starting to look and feel like native apps I think we are having the opposite problem: native apps are really starting to look and feel like web apps, and in many cases, they are. The problem: the web has a terrible UI toolkit for desktop apps. It has clickable links and basic forms, that's all. It was made for documents, not apps. If you want better than that, you have to rewrite it all by yourself, or more likely, import a framework that does it for you. Traditional Windows apps all use system provided common controls, because they are good, and therefore they have a consistent look and feel, even through OS updates. It is even user customizable. Now it is not uncommon to see 10 different styles in a single screen, Windows since 8 is not even consistent with itself, and it is becoming worse every version. And it is not just aesthetics, there are serious usability concerns here, and system-wide customization is gone.
- n8cpdx 4y ago
  > Traditional Windows apps all use system provided common controls, because they are good, and therefore they have a consistent look and feel, even through OS updates. This hasn’t been consistent since at least Vista and the release of WPF, which does totally custom control rendering. Circa 2006. I think web is taking over on Windows because any of 10 or 15 different design systems can get you to a better app than the native (whatever that means) toolkits in much less time. It is easier to get a decent color picker in a web app than a WPF, WinForms, UWP, WinUI, or Win32 app (assuming you have a reasonably high expectation for UI/UX, as I do). Even Office and Visual Studio (not Code) are using web technologies to render substantial parts of the UI.
  - tablespoon 4y ago
    > I think web is taking over on Windows because any of 10 or 15 different design systems can get you to a better app than the native (whatever that means) toolkits in much less time. It is easier to get a decent color picker in a web app than a WPF, WinForms, UWP, WinUI, or Win32 app (assuming you have a reasonably high expectation for UI/UX, as I do). I'll grant you that it's probably easier and cheaper to get a workable "color picker in a web app," but I don't grant that going that route will get you a "better app than the native." The reason why the web stuff is taking over is because it's cheaper while providing minimally-viable functionality, full stop. It's not actually good in any other way. IMHO, the trend here is similar to the one consumer printers took.
deleted 4y ago
[deleted]
uptown 4y ago
Does this apply to Edge Mobile on iOS? To my knowledge, there's no way to hide the browser chrome on that app, which is ironic considering they open the article talking about PWAs on mobile devices. Last time they weighed in on the topic, this was their response: https://answers.microsoft.com/en-us/microsoftedge/forum/all/full-screen-edge-on-ios/b4d6d595-99cb-4573-bcd5-f5f6c83eddbe https://answers.microsoft.com/en-us/microsoftedge/forum/all/...
gernb 4y ago
Is it part of "Project Fugu" because like blowfish, if you prepare it wrong you kill your customers? /s
deleted 4y ago
[deleted]
winnie_ua 4y ago
Damn. I hate customizable title bar. And they say that it's improvement!!!! Only place where I find it useful is web-browser, to render tabs. P.S. I do not prefer ultra wide monitors, so most of a time I have vertical real estate.
Arainach 4y ago
Alternative title: now your web apps, just like your native apps, can have unpredictable drag/resize/snap/double click to maximize behavior! Ugh. I wish apps would leave reusable consistent system UI elements alone. Has Adobe gotten around to making their title bars DPI-aware yet? Every app that tries this gets at least something wrong. Let's take a look on a random sampling of native-ish Windows apps: Discord (Electron): Supports right click for the system menu, but doesn't change the icon to show whether a window is maximized or restored. Doesn't change color based on active or inactive state. In fact, doesn't change anything at all, not even the subtle 1px window border Windows 10+ uses. Shame on them. For a long time, I believe they didn't support dragging a maximized window back to restored, but it works now. Facebook Messenger: Not awful. Proper height, double clicks to maximize/restore work, right click for system menu works. Title bar doesn't change when inactive, but the left menu uses the glass effect to make it sufficiently obvious. Also no double-click to close, but this is one of the better attempts I've seen. Chrome [bias: I work on Chrome]: Gets the important bits right. Chrome does it far better than most apps, since they use the Windows APIs to draw over the native title bar, which means they get my system colors and some other things included. Microsoft Office (let's pick on Word): Ugh. Ugggggggh. Bright white as the burning sun and their only affordance towards showing if the window is active is changing the text to a light gray that has no contrast when inactive. What's a button? Where can you click to drag? Nobody knowwwwwws. Why is there a search box in the middle with a big empty space to the left? Why is the title off-center to the left of that search box? Has anyone in the last 12 years ever actually noticed the customizable set of buttons in the upper left and used them? (Answer: no). Office gets the most hate in my mind for initially popularizing it and in particular the "if Microsoft does it it's OK if we all do it" effect. Starting in Office 2010 or so the Office Apps have had some of the worst title bars I've ever seen, but everyone has copied them. Firefox: Repeated the sins of legacy Microsoft Edge and leaves no space above the tab to drag, but to its credit does leave a small square in the left (and on the right if you fill it with tabs) so in theory you should never get stuck with a partially-offscreen window you can't drag without closing tabs. Overloads right click and doesn't include the system menu. Steam: Almost no difference between active and inactive. Multiple tiers of menus at the top, all of which let you drag for some reason. DPI Issues. ....anyway, I could go on for years, but stop implementing custom title bars.
nyanpasu64 4y ago
Separately from the issue of titlebars, I want Chrome's PWAs to open external links in my default browser (Firefox), not a new Chrome window. Sadly I can't make Firefox install web apps as system icons because they removed experimental Firefox SSB support (they said to reduce maintenance overhead). Interestingly I found https://addons.mozilla.org/en-US/firefox/addon/pwas-for-firefox/ https://addons.mozilla.org/en-US/firefox/addon/pwas-for-fire... but have not tried it yet.
- chazeon 4y ago
  Yeah I hope Firefox could support desktop PWAs. I am moving towards Firefox from Edge due to the Manifest v3, but I cannot leave Edge due to its better PWA support, which my daily driver code-server relies on.
- Jowsey 4y ago
  As someone who moved from Brave to Firefox recently and also missed PWA support, the first thing I did was install that extension and it's not bad! A little tedious to setup, especially as the PWAs all get new profiles with their own extensions, themes, etc. But other than that, it works fine.
rifty 4y ago
This is a bit peripheral to the link but I had a thought. As PWA's get further integrated, I feel like this leads to eventually shifting people off of the Web Browser. In this case over into the Microsoft Browser... i mean the Microsoft Store. I guess, what is the difference to Microsoft between the windows engine, the web engine, or the java engine as long as it is able to serve user applications and they are still able to leverage out a cut from it? With the advent of internet payment processing and non-transferable purchase information the store is as good as the the OS was in terms of lock-in. The store over time becomes the target platform for dev's instead of the OS.
zaphod420 4y ago
As someone that has been a hardcore Mac user since the 80s, it feels really weird liking things that Microsoft has been doing lately...
zeta0134 4y ago
I am reminded very strongly of the line of death: https://textslashplain.com/2017/01/14/the-line-of-death/ https://textslashplain.com/2017/01/14/the-line-of-death/ Now, don't get me wrong, I love the idea of progressive web apps, but the web is also easily the very least secure thing I do with my computer on a regular basis. The last thing I want is yet another way for a web page to pretend to look like a native app. Even with my decades of experience, I am liable to be fooled in a hasty, tired moment, and I suspect I'm not alone.
- sangnoir 4y ago
  That's the first article that came to mind when I read the article: this is going to be a godsend to phishers. Granting random sites the ability to render a counterfeit toolbar, including an address-bar with the green padlock that reads "https://bank.com https://bank.com" or "https://sso.internal.corp.com https://sso.internal.corp.com" will be a security nightmare
  - kylealden 4y ago
    Worth noting that this feature is limited to installed PWAs, so you'd either have to convince the user to install a PWA via the URL bar affordance (which already requires real HTTPS and respects the LOD), or to manually install a site-as-app through the browser's (relatively buried) UI, at which point you get the same site you're already on, but with a new titlebar. That seems like a pretty unrealistic vector and is much less complex then just getting users to install an .exe. That said, even with the Window Controls Overlay, the minimal browser controls (close/restore/minimize) are mandatory, as is the browser-owned "..." menu which includes basic trust information for the site as well as app controls (uninstall, permissions, etc.).
    - sangnoir 4y ago
      > so you'd either have to convince the user to install a PWA via the URL bar affordance (which already requires real HTTPS and respects the LOD), Getting a valid SSL certificate for getFakeSaas.com is free, and respecting LoD has no effect at this time. Once the PWA is installed, there is no LOD, amd my PWA can phish any domain I desire with faked affordances.
pwdisswordfish9 4y ago
Oh great, a security nightmare come true. https://textslashplain.com/2017/01/14/the-line-of-death/ https://textslashplain.com/2017/01/14/the-line-of-death/
dusted 4y ago
embrace and crush much ?
robertlagrant 4y ago
This announcement seems far more excitable than it needs to be. I think the way Macs solve it is better: left hand side of top bar is for app; right hand side is for OS.
openplatypus 4y ago
I love the premise. That sounds like a great move forward. My concern is only security. Sounds like we are granting web (potentially malicious javascript) access to window overlay.

378 points by vyrotek 4y ago

Hopefully Apple keeps moving in the direction of better embracing PWAs. I am encouraged that iOS 16 includes support for web push notifications. This suggests to me Apple may be more willing to embrace PWA web standards.

aeharding 4y ago
I just really hope the onboarding experience is improved. Right now it's very convoluted and messaging is extremely difficult, in some places impossible. For example, in SFSafariViewController there is no “add to home screen” button in the share menu, but in actual safari there is. Despite them both being web view experiences controlled entirely by Apple. (And you can’t detect SFSafariViewController vs Safari as a web app, so good luck onboarding users for your PWA.)

asherah 4y ago

this looks great! hopefully this can be better standardized soon

mwcampbell 4y ago

Counterpoint: Seams (2014): https://adactio.com/journal/6786 https://adactio.com/journal/6786 Edit: related, from the same author: Regressive Web Apps (2016): https://adactio.com/journal/10708 https://adactio.com/journal/10708

deleted 4y ago

[deleted]

MaXtreeM 4y ago

With all this Electron and PWA focused development a cannot shake a feeling that we add an extra layer of a "runtime" on top of an operating system, that could be avoided. An extra layer which occupies RAM space and processor time which feels unnecessary but it is where we are headed. I wonder if the reason is simple, that we (myself included) have not provided anything better or the reason is that big corporations who control most of the market have pushed this technology forward. I hope we can learn from this and bring back some of this lost performance while keeping the productivity and security gains.

whywhywhywhy 4y ago
It makes perfect sense for the user but developers will always argue for Electron so that they only have to test one browser engine. I can’t even gets web devs to test on anything but Chrome and when something they code does break I have to listen to the Safari whine even though they all use iPhones so are part of the reason it’s relevant. Dread to think how an argument for supporting 3+ web engines for a “native” app would go.
- kitsunesoba 4y ago
  What seems even crazier is not even wanting to test against different builds of Chromium to help keep pace with Electron updates. At that point isn't one's code just too brittle?
- criddell 4y ago
  A lot of developers are not fans of Electron. Generally, it's a quality vs quantity tradeoff. Are you willing to make a crappier thing if it means more people can use it? For companies like Microsoft making something like Teams, I think it sucks. They have the resources to make native apps and when you have tens of millions of users, adding support for another platform would cost them pennies per user.
  - com2kid 4y ago
    > For companies like Microsoft making something like Teams, I think it sucks. They have the resources to make native apps and when you have tens of millions of users, adding support for another platform would cost them pennies per user. Back when I worked at Microsoft, 2014 or so, we had serious problems finding Win32 developers. We essentially had to train people up. While I am sure the Windows org had lots of them, put out a job req and even internally not very many people are going to have native Windows development on their resume. Nearly had to draw straws to see who had to get "stuck" learning Windows stuff. I imagine native MacOS developers are similarly rare as a % of the overall developer pool. Android and iPhone developers, easy peasy. Likewise, Web developers, not a problem. The other thing is, Electron has tons of momentum behind it, which means more and more people jump onboard to learn it, which makes hiring easy. Tutorials and learning resources get made, making developing for it even easier. IIRC we ended up dropping the native C++ Windows app and just used C# and one of the UI toolkits, I forget which one.

tiarafawn 4y ago

Seems exploitable for phishing

Bigpet 4y ago
you need to "install" the PWA first. So how's this different from regular desktop applications in regards to phishing specifically? Do you mean an app presenting pre-"install" as something and then post-"install" as something else? I'm having a hard time seeing a lot of difference. Most windows you want to "spoof" will look different in regards to the title bar either way. In a regular browser window you'll have the browser title bar. In the PWA case you'll have the extra hamburger menu.

jwcacces 4y ago

Looks like the perfect place to fake some browser chrome and trick people... https://www.theregister.com/2017/01/19/browser_line_of_death/ https://www.theregister.com/2017/01/19/browser_line_of_death...

nicoburns 4y ago
I think you'll only get access to this API if the user has explicitly installed your app as a PWA, not just when visiting it as a webpage.
- gildas 4y ago
  And then a shady company offers to buy the owner's website...
  - tshaddox 4y ago
    That’s a real problem, of course, but it seems fairly equivalent to any native app you install that can update itself or otherwise make a network request to obtain instructions.
    - gildas 4y ago
      I agree with you. On the other hand, in the case of a native application, we can hope that the antivirus removes it. I hope that Microsoft has planned to update Defender accordingly.
      - int_19h 4y ago
        JavaScript malware has been a thing for a while now, and antiviruses have been targeting it accordingly.
        gildas 4y ago
        It's not necessarily a JavaScript malware. A pure HTML page with a <form> tag could suffice to steal credentials.

dmayle 4y ago

I think this is a sign that Microsoft sees the writing on the wall. There will be a day when Windows is left behind, and they want to make sure that they can continue to deliver the Microsoft experience, even on other platforms.

guhidalg 4y ago
I don’t think Windows is ever going to be left behind, you still need a kernel to make use of all your hardware and an OS to give users something to do. I view this move as Microsoft recognizing that the future of most development is cross-platform web technologies and they need to give Windows users reasons not to migrate to macOS and ChromeOS (though it’s ok if they do as long as they’re paying for O365 and Azure).
- ieegdiuf 4y ago
- smoldesu 4y ago
  I think you're right, but that also poses the possibility that Windows will get left behind, as a kernel. If the future of development happens on the web, the significance of Windows as a kernel is going to greatly diminish. We've already reverse-engineered a huge amount of Windows API calls, and you can run vast amounts of fairly complex Windows software without the NT kernel at all. If our future does shift towards thin-clients and web-browsers, MacOS and Windows will make increasingly less sense. Both OSes have a pretty significant amount of cruft and unjustified overhead which already seems unnecessary to a generation of Google Docs and Soundcloud users.
  - FpUser 4y ago
    >"If our future does shift towards thin-clients and web-browsers" Please no. I like to control what I have. No way for me to be fed by thin client. Sure I do not mind web apps / services where it makes sense (banking for example). But the possibility to be suddenly cut off for whatever reason (maybe my app provider does not like my political views) - fuck that. Or when everything goes through some portal what will prohibit from them jacking up subscription fees sky high? I understand by many developers wanting to use webapp hummer for everything but I think they're digging their own grave

gw99 4y ago

Oh look they turned Chromium into IE6. Forced ads, difficult to eviscerate search engines, proprietary extensions, dubious security posture! Oh goody!

intrasight 4y ago

> ability to create their own title bar experiences It was a sad day, IMHO, in UX-world when this became possible in desktop apps. The window system should own the chrome and the apps should not be able to touch it.

jonathankoren 4y ago
Looking forward to the day when Winamp style apps are back. Remember round windows? They’re back, in Electron form.
postalrat 4y ago
They still do. https://blogs.windows.com/wp-content/uploads/prod/sites/33/2022/09/Picture2.png https://blogs.windows.com/wp-content/uploads/prod/sites/33/2... Didn't that picture make it obvious?
- Arainach 4y ago
  Now a single app bug can make it so you can't drag a window. Oops, we accept clicks everywhere and never fall back to whatever the web equivalent of DefWndProc is, I guess it's all app space and no actual title bar in that blue.
  - contextfree 4y ago
    Win32 apps have always been able to break dragging, since ultimately the app process "owns" the window frame and can hang and block all interactions with it. (The system tries to catch simple cases of hanging where the app obviously isn't processing messages, but that doesn't cover all situations) Actually, UWP sort of solved/solves this, by having a different process own the window frame.

armchairhacker 4y ago

I want the opposite of a PWA. I want an app which can be compiled into Desktop/mobile builds and also interpreted in browsers. An alternate HTML/CSS/JS with no JavaScript.

danans 4y ago
So ... Flutter? https://flutter.dev/ https://flutter.dev/
- armchairhacker 4y ago
  Sure. As well as certain other platforms like Kotlin multiplatform The only issue is that these still have to compile to JavaScript, which in practice leads to slower performance and potential for improper semantics on the JS side. It would be better to have them executed in WASM and then have better WASM-browser integration
  - postalrat 4y ago
    A better WASM-browser integration would mean more security risks running WASM.
- doctor_eval 4y ago
  Flutter looked cool, until I realised it was a Google product. After being burned by Angular, Material, and all the things killedbygoogle, I'm not sure I can stomach even trying it out. Is that stupid?
  - return_to_monke 4y ago
    Honestly, i have no idea. I've got amazing results with flutter so far; and therefore I'm obviously biased. Packaging it from source is pretty hard; but a bit of the industry has already adopted it. Even tho of course it could always have more features; i for one don't think it would be that big of an issue if google called quits on it today
4y ago

323 4y ago

I for one welcome our Electron future.

nullcaution 4y ago

This seems widly exploitable. Even on the OS level, I would argue an application should not have access to thoes 30 pixels. Beyond rhe security concerns, this seems like a proprietarization of the web for Win11, a la Internet Explorer.

adamesque 4y ago
They do explicitly discuss how the feature might work on other platforms (aka Mac OS and Linux), and have published a spec, which is also an interesting read: https://wicg.github.io/window-controls-overlay/ https://wicg.github.io/window-controls-overlay/
cush 4y ago
You have to install PWAs, and any platform can implement this. It's a pretty good spec that can help a lot with the adoption of PWAs
tommoor 4y ago
Better stop installing desktop apps then

MartinMond 4y ago

Love how we're realizing that .hta was actually incredible. I have fond memories of building my own https://en.m.wikipedia.org/wiki/HTML_Application https://en.m.wikipedia.org/wiki/HTML_Application

mmastrac 4y ago
.hta really had to go through the standardization process to tighten up security. Those things were awesome, but you'd basically be owned immediately.
rnestler 4y ago
It's kind of impressive that one can still run the same .hta app even on Windows 11 according to the wikipedia article: > HTAs are dependent on the Trident (MSHTML) browser engine, used by Internet Explorer, but are not dependent on the Internet Explorer application itself. If a user removes Internet Explorer from Windows, via the Control Panel, the MSHTML engine remains and HTAs continue to work. HTAs continue to work in Windows 11 as well.
jimmygrapes 4y ago
Quick shout out to the Compiled HTML[0] (.chm) format for similar but unrelated reasons. The Help viewer application was one of the pinnacles of good UX, in my opinion. [0]: https://en.wikipedia.org/wiki/Microsoft_Compiled_HTML_Help https://en.wikipedia.org/wiki/Microsoft_Compiled_HTML_Help
- mappu 4y ago
  A while back at $DAYJOB I tried to get a CI pipeline to bundle our docs as .chm, but the official tooling (hhc, with-or-without Sphinx as a frontend) is windows-only pre-unicode nonsense; the only Linux native chm compiler i found was Halibut (from the author of PuTTY) which has many of its own idiosyncrasies. Is there any normal-looking way to make a chm from a directory full of html files?
  - jimmygrapes 4y ago

kanonieer 4y ago

> We’re excited to announce the availability of a new PWA feature that closes this gap and helps blur the line between apps and websites even more. I don't see how they can use "blurred line" as a positive trait here. There are important differences between native apps and web apps, why hide this information from a regular user, especially when this information can be conveyed by 30 pixels.

drewtato 4y ago
Well right now, the alternative isn't "keep it in the browser", it's "ship it in electron".
chpmrc 4y ago
What difference does the runtime make to the (average) end user? I love that I can create shortcuts of some web apps that have their own window, menu bar etc. (this is already possible in Chrome) and I don't really care they are "web" apps.
- LtWorf 4y ago
  > What difference does the runtime make to the (average) end user? "Incredibly slow and draining the battery 3x as fast" vs "regular"
  - chpmrc 4y ago
    That has nothing to do with the runtime, rather with the implementation. Barrier to entry of web development is low so average quality is also low. On the opposite side of the spectrum you have products like Figma, Notion, Google apps etc.
make3 4y ago
because actual regular answers don't understand what any of this means, and this just means that the devs have more control over what experience they give them
int_19h 4y ago

wolpoli 4y ago

I actually wish programs do not put content in the Title bar area. The title bar area is meant for users to move the Window around. Try opening Microsoft Word, make the window narrow and drag the window. You have to hunt for a small bit of empty space in the title bar or you have to understand you could drag on the Title text, Search box and the Sign in Username, but not the Auto Save text, Upcoming Features icon, or the Ribbon Display Options icon.

banana_giraffe 4y ago
I don't disagree. It's for this kind of nonsense that I have "alt-space -> s -> down -> right" burned into my fingertips followed by moving the mouse cursor to resize a window deterministically (along with "alt-space -> m -> any arrow" for move, doubly useful to "rescue" an off screen window)
- jolmg 4y ago
  > alt-space -> s -> down -> right > alt-space -> m -> any arrow Are those keybindings default on a particular OS/DE/WM/WC or are they just your personal config?
  - sedatk 4y ago
    Alt-space menu is Windows specific IIRC.
    - drekipus 4y ago
      Gnome does the same, I use it all the time for "pin window always on top" Which windows still doesn't have, for some reason.
      - quotemstr 4y ago
        Gnome doesn't have menu accelerators in the window menu though, so "alt-spc n" does nothing: the alt-spc brings up the window menu, but the n doesn't activate "minimize". This interaction not functioning in Gnome keeps me off Gnome entirely.

coldtea 4y ago

>We talk a lot about Progressive Web Apps (PWA) in the context of mobile devices, but they have an enormous potential on desktop operating systems that’s only beginning to materialize. Do we? I think we talk about PWA's on mobile and desktop equally, if not more so in the Desktop (e.g. with Electron and regular browser-viewed PWAs).

ElijahLynn 4y ago

Love that MS is going all-in on PWAs! The PWA future is looking bright!

chrismsimpson 4y ago

Is this not introducing a massive UI threat vector considering we’re talking about HTML/JavaScript downloaded from the web?

lvass 4y ago

Why are the window decoration buttons considered critical on Windows? People using Windows without a keyboard maybe? I always disabled those (or the whole bar) on any system I've used since I can remember.

GuB-42 4y ago

> installed desktop web apps are really starting to look and feel like native apps I think we are having the opposite problem: native apps are really starting to look and feel like web apps, and in many cases, they are. The problem: the web has a terrible UI toolkit for desktop apps. It has clickable links and basic forms, that's all. It was made for documents, not apps. If you want better than that, you have to rewrite it all by yourself, or more likely, import a framework that does it for you. Traditional Windows apps all use system provided common controls, because they are good, and therefore they have a consistent look and feel, even through OS updates. It is even user customizable. Now it is not uncommon to see 10 different styles in a single screen, Windows since 8 is not even consistent with itself, and it is becoming worse every version. And it is not just aesthetics, there are serious usability concerns here, and system-wide customization is gone.

n8cpdx 4y ago
> Traditional Windows apps all use system provided common controls, because they are good, and therefore they have a consistent look and feel, even through OS updates. This hasn’t been consistent since at least Vista and the release of WPF, which does totally custom control rendering. Circa 2006. I think web is taking over on Windows because any of 10 or 15 different design systems can get you to a better app than the native (whatever that means) toolkits in much less time. It is easier to get a decent color picker in a web app than a WPF, WinForms, UWP, WinUI, or Win32 app (assuming you have a reasonably high expectation for UI/UX, as I do). Even Office and Visual Studio (not Code) are using web technologies to render substantial parts of the UI.
- tablespoon 4y ago
  > I think web is taking over on Windows because any of 10 or 15 different design systems can get you to a better app than the native (whatever that means) toolkits in much less time. It is easier to get a decent color picker in a web app than a WPF, WinForms, UWP, WinUI, or Win32 app (assuming you have a reasonably high expectation for UI/UX, as I do). I'll grant you that it's probably easier and cheaper to get a workable "color picker in a web app," but I don't grant that going that route will get you a "better app than the native." The reason why the web stuff is taking over is because it's cheaper while providing minimally-viable functionality, full stop. It's not actually good in any other way. IMHO, the trend here is similar to the one consumer printers took.

deleted 4y ago

[deleted]

uptown 4y ago

Does this apply to Edge Mobile on iOS? To my knowledge, there's no way to hide the browser chrome on that app, which is ironic considering they open the article talking about PWAs on mobile devices. Last time they weighed in on the topic, this was their response: https://answers.microsoft.com/en-us/microsoftedge/forum/all/full-screen-edge-on-ios/b4d6d595-99cb-4573-bcd5-f5f6c83eddbe https://answers.microsoft.com/en-us/microsoftedge/forum/all/...

gernb 4y ago

Is it part of "Project Fugu" because like blowfish, if you prepare it wrong you kill your customers? /s

deleted 4y ago

[deleted]

winnie_ua 4y ago

Damn. I hate customizable title bar. And they say that it's improvement!!!! Only place where I find it useful is web-browser, to render tabs. P.S. I do not prefer ultra wide monitors, so most of a time I have vertical real estate.

Arainach 4y ago

Alternative title: now your web apps, just like your native apps, can have unpredictable drag/resize/snap/double click to maximize behavior! Ugh. I wish apps would leave reusable consistent system UI elements alone. Has Adobe gotten around to making their title bars DPI-aware yet? Every app that tries this gets at least something wrong. Let's take a look on a random sampling of native-ish Windows apps: Discord (Electron): Supports right click for the system menu, but doesn't change the icon to show whether a window is maximized or restored. Doesn't change color based on active or inactive state. In fact, doesn't change anything at all, not even the subtle 1px window border Windows 10+ uses. Shame on them. For a long time, I believe they didn't support dragging a maximized window back to restored, but it works now. Facebook Messenger: Not awful. Proper height, double clicks to maximize/restore work, right click for system menu works. Title bar doesn't change when inactive, but the left menu uses the glass effect to make it sufficiently obvious. Also no double-click to close, but this is one of the better attempts I've seen. Chrome [bias: I work on Chrome]: Gets the important bits right. Chrome does it far better than most apps, since they use the Windows APIs to draw over the native title bar, which means they get my system colors and some other things included. Microsoft Office (let's pick on Word): Ugh. Ugggggggh. Bright white as the burning sun and their only affordance towards showing if the window is active is changing the text to a light gray that has no contrast when inactive. What's a button? Where can you click to drag? Nobody knowwwwwws. Why is there a search box in the middle with a big empty space to the left? Why is the title off-center to the left of that search box? Has anyone in the last 12 years ever actually noticed the customizable set of buttons in the upper left and used them? (Answer: no). Office gets the most hate in my mind for initially popularizing it and in particular the "if Microsoft does it it's OK if we all do it" effect. Starting in Office 2010 or so the Office Apps have had some of the worst title bars I've ever seen, but everyone has copied them. Firefox: Repeated the sins of legacy Microsoft Edge and leaves no space above the tab to drag, but to its credit does leave a small square in the left (and on the right if you fill it with tabs) so in theory you should never get stuck with a partially-offscreen window you can't drag without closing tabs. Overloads right click and doesn't include the system menu. Steam: Almost no difference between active and inactive. Multiple tiers of menus at the top, all of which let you drag for some reason. DPI Issues. ....anyway, I could go on for years, but stop implementing custom title bars.

nyanpasu64 4y ago

Separately from the issue of titlebars, I want Chrome's PWAs to open external links in my default browser (Firefox), not a new Chrome window. Sadly I can't make Firefox install web apps as system icons because they removed experimental Firefox SSB support (they said to reduce maintenance overhead). Interestingly I found https://addons.mozilla.org/en-US/firefox/addon/pwas-for-firefox/ https://addons.mozilla.org/en-US/firefox/addon/pwas-for-fire... but have not tried it yet.

chazeon 4y ago
Yeah I hope Firefox could support desktop PWAs. I am moving towards Firefox from Edge due to the Manifest v3, but I cannot leave Edge due to its better PWA support, which my daily driver code-server relies on.
Jowsey 4y ago
As someone who moved from Brave to Firefox recently and also missed PWA support, the first thing I did was install that extension and it's not bad! A little tedious to setup, especially as the PWAs all get new profiles with their own extensions, themes, etc. But other than that, it works fine.

rifty 4y ago

This is a bit peripheral to the link but I had a thought. As PWA's get further integrated, I feel like this leads to eventually shifting people off of the Web Browser. In this case over into the Microsoft Browser... i mean the Microsoft Store. I guess, what is the difference to Microsoft between the windows engine, the web engine, or the java engine as long as it is able to serve user applications and they are still able to leverage out a cut from it? With the advent of internet payment processing and non-transferable purchase information the store is as good as the the OS was in terms of lock-in. The store over time becomes the target platform for dev's instead of the OS.

zaphod420 4y ago

As someone that has been a hardcore Mac user since the 80s, it feels really weird liking things that Microsoft has been doing lately...

zeta0134 4y ago

I am reminded very strongly of the line of death: https://textslashplain.com/2017/01/14/the-line-of-death/ https://textslashplain.com/2017/01/14/the-line-of-death/ Now, don't get me wrong, I love the idea of progressive web apps, but the web is also easily the very least secure thing I do with my computer on a regular basis. The last thing I want is yet another way for a web page to pretend to look like a native app. Even with my decades of experience, I am liable to be fooled in a hasty, tired moment, and I suspect I'm not alone.

sangnoir 4y ago
That's the first article that came to mind when I read the article: this is going to be a godsend to phishers. Granting random sites the ability to render a counterfeit toolbar, including an address-bar with the green padlock that reads "https://bank.com https://bank.com" or "https://sso.internal.corp.com https://sso.internal.corp.com" will be a security nightmare
- kylealden 4y ago
  Worth noting that this feature is limited to installed PWAs, so you'd either have to convince the user to install a PWA via the URL bar affordance (which already requires real HTTPS and respects the LOD), or to manually install a site-as-app through the browser's (relatively buried) UI, at which point you get the same site you're already on, but with a new titlebar. That seems like a pretty unrealistic vector and is much less complex then just getting users to install an .exe. That said, even with the Window Controls Overlay, the minimal browser controls (close/restore/minimize) are mandatory, as is the browser-owned "..." menu which includes basic trust information for the site as well as app controls (uninstall, permissions, etc.).
  - sangnoir 4y ago
    > so you'd either have to convince the user to install a PWA via the URL bar affordance (which already requires real HTTPS and respects the LOD), Getting a valid SSL certificate for getFakeSaas.com is free, and respecting LoD has no effect at this time. Once the PWA is installed, there is no LOD, amd my PWA can phish any domain I desire with faked affordances.

pwdisswordfish9 4y ago

Oh great, a security nightmare come true. https://textslashplain.com/2017/01/14/the-line-of-death/ https://textslashplain.com/2017/01/14/the-line-of-death/

dusted 4y ago

embrace and crush much ?

robertlagrant 4y ago

This announcement seems far more excitable than it needs to be. I think the way Macs solve it is better: left hand side of top bar is for app; right hand side is for OS.

openplatypus 4y ago

I love the premise. That sounds like a great move forward. My concern is only security. Sounds like we are granting web (potentially malicious javascript) access to window overlay.