3 ms·

Apple did the right thing by blocking this. Because for every one PWA app there are dozens of websites who would use the local storage to store re-targeting me

Apple did the right thing by blocking this. Because for every one PWA app there are dozens of websites who would use the local storage to store re-targeting metadata for advertising. It has nothing to do with the App Store and everything to do with basic tracking prevention. You can't block cookies and then allow local storage. Developers aren't stupid.

no_wizard 3y ago
There are ways to make sure that doesn’t happen, like making sure only the origin the file was written from can open and see the files. They should have put out a counter proposal. They certainly didn’t show it’s technically infeasible
- threeseed 3y ago
  Everything has been moving to first party especially during the last year. So the origin is the one storing the tracking data, capturing it and sending it to Meta etc. Which is what makes this so hard as there is no difference between a PWA and a rogue website.
  - no_wizard 3y ago
    Now we're getting into the fundamental fact that some websites have lots of tracking and such, and some don't. This is no different than having to send the files to a server owned by the website. I fail to see any meaningful difference here. Should we also not allow HTTP requests? I don't see how this is different.
    - threeseed 3y ago
      We are talking about storing data on user's computers. If you allow PWA apps to do this. You also allow websites to use it for tracking. Hence why Apple restricted this feature.
      - no_wizard 3y ago
        Storing data with user permissions, not permission-less. Its in no way like local storage or indexdb. Those permissions could be scoped to only allowing explict read/write of certain files (IE, the ones the user initiated) and not allow for arbitrary writing of files to the filesystem, for instance. We already do this with the file upload API
jwells89 3y ago
Exactly, requiring installation for long term persistence mitigates usage of the API for tracking and prevents storage usage from slowly snowballing over time as sites store random things the user probably doesn’t even care about. Should PWA installation be more obvious/straightforward than it is currently? Sure, but that’s a separate issue.
alwillis 3y ago
You can read about the privacy concerts the community group published [1]. [1]: https://wicg.github.io/file-system-access/#privacy-considerations https://wicg.github.io/file-system-access/#privacy-considera...
JimDabell 3y ago
> Apple did the right thing by blocking this. In order for a specification to become a web standard, it needs two independent implementations. No single organisation is capable of blocking it – it means that Google couldn’t convince anybody outside of Google to implement it.

no_wizard 3y ago

There are ways to make sure that doesn’t happen, like making sure only the origin the file was written from can open and see the files. They should have put out a counter proposal. They certainly didn’t show it’s technically infeasible

threeseed 3y ago
Everything has been moving to first party especially during the last year. So the origin is the one storing the tracking data, capturing it and sending it to Meta etc. Which is what makes this so hard as there is no difference between a PWA and a rogue website.
- no_wizard 3y ago
  Now we're getting into the fundamental fact that some websites have lots of tracking and such, and some don't. This is no different than having to send the files to a server owned by the website. I fail to see any meaningful difference here. Should we also not allow HTTP requests? I don't see how this is different.
  - threeseed 3y ago
    We are talking about storing data on user's computers. If you allow PWA apps to do this. You also allow websites to use it for tracking. Hence why Apple restricted this feature.
    - no_wizard 3y ago
      Storing data with user permissions, not permission-less. Its in no way like local storage or indexdb. Those permissions could be scoped to only allowing explict read/write of certain files (IE, the ones the user initiated) and not allow for arbitrary writing of files to the filesystem, for instance. We already do this with the file upload API

jwells89 3y ago

Exactly, requiring installation for long term persistence mitigates usage of the API for tracking and prevents storage usage from slowly snowballing over time as sites store random things the user probably doesn’t even care about. Should PWA installation be more obvious/straightforward than it is currently? Sure, but that’s a separate issue.

alwillis 3y ago

You can read about the privacy concerts the community group published [1]. [1]: https://wicg.github.io/file-system-access/#privacy-considerations https://wicg.github.io/file-system-access/#privacy-considera...

JimDabell 3y ago

> Apple did the right thing by blocking this. In order for a specification to become a web standard, it needs two independent implementations. No single organisation is capable of blocking it – it means that Google couldn’t convince anybody outside of Google to implement it.