4 ms·

When I install something from those stores, I feel like there is some level of vetting against malware, or at least the ability for the store to pull it if it b

When I install something from those stores, I feel like there is some level of vetting against malware, or at least the ability for the store to pull it if it becomes known-malicious after I installed it. 30% might be too much of a fee, but some payment for that service makes sense, I think. Are PWAs somehow immune to this concern by virtue of running on the way stricter feature set that a browser offers? If they can prompt the user for access to all of these APIs [0], and the user allows it, and then it later becomes malicious while able to run a service worker in the background, that seems a bit more concerning than regular non-PWA browsing that can't continue to run after the tab is closed. [0] https://permission.site https://permission.site

willsmith72 3y ago
I totally agree, the security issue is the biggest thing app stores have going for them. I think 2 things. 1. if momentum goes PWA's way, smart people will work on these problems. I'm not saying I have the answers, but if I can root for either 2 megacorps or the open web, I'm going open web every time. (again, not saying we're there yet with PWAs) 2. If an app store's only function is vetting software, we can have an open market for marketplaces. Anyone can build their own app store and, with enough reputation, become trusted in the eyes of consumer's, just like we trust Apple The difference is in a free market, that 30% and $100 drop dramatically, I would wager to something more like 5% and $0. At those rates, having an app store where people feel the software is secure, can trust reviews/ratings etc seems reasonable to me. PWA doesn't have to mean otherwise
- DANmode 3y ago
  > smart people will work on these problems They have been, it's just not your niche of interest! You don't know what you don't know, etc.
coder543 3y ago
Service workers aren’t a magic “run forever in the background” technology. I’m fairly sure PWAs can’t run in the background at all on iOS or Android, except for possibly a brief moment after the PWA receives a notification, and the service worker doesn’t have access to much of anything during that interval. If anyone can link to something that demonstrates otherwise, okay, but I have checked on this in the past, and I don’t think so. Native apps have been caught with their hand in the metaphorical cookie jar over and over again. The App Store review process is largely ineffective. Apple apparently didn’t even realize that apps were doing sketchy things with the clipboard until it became a major headline[0], and this is only the tip of the iceberg of “things App Store review didn’t catch”. Native apps continue to find ways to bypass sandboxing that the OS applies. Browsers naturally take a much more adversarial posture against the code they’re running, so the sandboxing is far stronger. Apple has spent at least a decade marketing[1] to convince people the App Store is synonymous with safety. Given how detached this seems to be from reality, the simplest conclusion seems to be that they do this because they really want their 30% cut. The marketing campaign seems to be working too well. In reality, the browser seems to be substantially safer, although nothing is perfect. [0]: https://arstechnica.com/gadgets/2020/06/tiktok-and-53-other-ios-apps-still-snoop-your-sensitive-clipboard-data/ https://arstechnica.com/gadgets/2020/06/tiktok-and-53-other-... [1]: https://apple.com/app-store/ https://apple.com/app-store/ “The apps you love. From a place you can trust. For over a decade, the App Store has proved to be a safe and trusted place to discover and download apps.”
brucethemoose2 3y ago
> When I install something from those stores, I feel like there is some level of vetting against malware I don't. Google Play has served me malware on my device (touchpal) that went undiscovered forever. And tons of high search ranking apps are straight up scams or data harvesting fronts even if they aren't legally "malware." I feel more secure about web apps because at least I am protected by the browser's sandboxing/fingerprinting protection (and in my case Cromite's extra blocking). IDK about iOS, but Google Play is a dumpster fire. I hope it burns to the ground.

willsmith72 3y ago

I totally agree, the security issue is the biggest thing app stores have going for them. I think 2 things. 1. if momentum goes PWA's way, smart people will work on these problems. I'm not saying I have the answers, but if I can root for either 2 megacorps or the open web, I'm going open web every time. (again, not saying we're there yet with PWAs) 2. If an app store's only function is vetting software, we can have an open market for marketplaces. Anyone can build their own app store and, with enough reputation, become trusted in the eyes of consumer's, just like we trust Apple The difference is in a free market, that 30% and $100 drop dramatically, I would wager to something more like 5% and $0. At those rates, having an app store where people feel the software is secure, can trust reviews/ratings etc seems reasonable to me. PWA doesn't have to mean otherwise

DANmode 3y ago
> smart people will work on these problems They have been, it's just not your niche of interest! You don't know what you don't know, etc.

coder543 3y ago

Service workers aren’t a magic “run forever in the background” technology. I’m fairly sure PWAs can’t run in the background at all on iOS or Android, except for possibly a brief moment after the PWA receives a notification, and the service worker doesn’t have access to much of anything during that interval. If anyone can link to something that demonstrates otherwise, okay, but I have checked on this in the past, and I don’t think so. Native apps have been caught with their hand in the metaphorical cookie jar over and over again. The App Store review process is largely ineffective. Apple apparently didn’t even realize that apps were doing sketchy things with the clipboard until it became a major headline[0], and this is only the tip of the iceberg of “things App Store review didn’t catch”. Native apps continue to find ways to bypass sandboxing that the OS applies. Browsers naturally take a much more adversarial posture against the code they’re running, so the sandboxing is far stronger. Apple has spent at least a decade marketing[1] to convince people the App Store is synonymous with safety. Given how detached this seems to be from reality, the simplest conclusion seems to be that they do this because they really want their 30% cut. The marketing campaign seems to be working too well. In reality, the browser seems to be substantially safer, although nothing is perfect. [0]: https://arstechnica.com/gadgets/2020/06/tiktok-and-53-other-ios-apps-still-snoop-your-sensitive-clipboard-data/ https://arstechnica.com/gadgets/2020/06/tiktok-and-53-other-... [1]: https://apple.com/app-store/ https://apple.com/app-store/ “The apps you love. From a place you can trust. For over a decade, the App Store has proved to be a safe and trusted place to discover and download apps.”

brucethemoose2 3y ago

> When I install something from those stores, I feel like there is some level of vetting against malware I don't. Google Play has served me malware on my device (touchpal) that went undiscovered forever. And tons of high search ranking apps are straight up scams or data harvesting fronts even if they aren't legally "malware." I feel more secure about web apps because at least I am protected by the browser's sandboxing/fingerprinting protection (and in my case Cromite's extra blocking). IDK about iOS, but Google Play is a dumpster fire. I hope it burns to the ground.