3 ms·

> In that case, if PWAs were good enough on Android and they could avoid the 30% cut, why bother making native Android apps at all? I don't want to skirt too c

> In that case, if PWAs were good enough on Android and they could avoid the 30% cut, why bother making native Android apps at all? I don't want to skirt too close to HN guidelines here, but I'm genuinely curious if you actually read my comment or not. This is exactly what I asked you. If PWAs are (as Apple claims) good enough alternatives to the app store, why isn't anyone using them? You can complain about Electron, but developers build Electron apps. They don't build PWAs. Because Electron apps are actually a feasible alternative to more native GUIs, and PWAs are not. The question you and I are asking (why isn't anyone using PWAs) reveals exactly how bullcrap Apple's legal arguments about PWAs are. They are not reasonable alternatives to the app store. > All of the HN commenters blame mean old Apple for holding the web back I don't blame Apple exclusively for holding the web back. They're a part of it, but so is Google. I don't think I've ever had much good to say about Google on here, and as the US and EU are actively proving right now, it is possible to pursue regulation for multiple companies at the same time. > You have much better ways to track on the we[b] then through native apps - at least on iOS with a much better permission model. This is not true by any metric. Native apps have more access to fingerprinting vectors than web apps do, are capable of requesting deeper levels of user information like contacts. Native Facebook on iOS got called out for injecting custom code into the in-app web view when users clicked on links within Facebook for 3rd-party sites. That's something that's not possible to do in any modern web browser. Native apps are indisputably easier to use to fingerprint and track users on both iOS and Android. Even if you're unfamiliar with the technical side of this, you can still think of it this way: if apps like Facebook had an easier time tracking you on the web than on mobile devices, they wouldn't try to get you to install mobile apps. They would force you to use the website. The reason why Facebook ships an iOS app is because it is easier to track you via iOS than through the Facebook website.

scarface_74 3y ago
I’m very familiar both - exactly how can apps track you - without your permission that the web can’t? And your example of how Facebook can track you by knowing what links you clicked on off the site from the app, of course Facebook could do that from the web. There are at least a dozen ways to do fingerprinting o the web https://fingerprint.com/blog/browser-fingerprinting-techniques/ https://fingerprint.com/blog/browser-fingerprinting-techniqu... And what do you think is going to happen if there are more native APIs exposed in browsers?
- danShumway 3y ago
  > of course Facebook could do that from the web. Facebook could insert custom code into 3rd-party domains that have no relationship with it? No, it can't. If Facebook could perform arbitrary XSS on 3rd-party websites it had no relationship with when you clicked on links on the Facebook website, that would be rightly treated as critical zero-day security flaw in any web browser. I mean, you're saying you're familiar with this stuff, but you're also saying that Facebook can do arbitrary XSS via links, so forgive me for doubting you. Of course fingerprinting is possible on the web. It's easier with native apps. The web at least tries to shut down fingerprinting vectors; native platforms like iOS largely don't. Far from shutting down fingerprinting vectors, both Android and iOS have platform-supported device-specific advertising IDs that don't even require fingerprinting. At least Apple (eventually) started clearing the low, low bar of forcing applications to ask permission to access it, but that's a far cry from the kind of sandboxing and site/app isolation that happens in Safari. > And what do you think is going to happen if there are more native APIs exposed in browsers? I'm sorry, your defense for privileging native apps over browser apps is "if browsers could do everything native apps could do, it would be a nightmare for privacy"? What do you think that says about the privacy and security of native apps?
  - scarface_74 3y ago
    > No, it can't. If Facebook could perform arbitrary XSS on 3rd-party websites it had no relationship with when you clicked on links on the Facebook website, If you click on a link from Facebook on the web - the only reason you would view a page in a web view on the app - you don’t think FB could know that you clicked on the link? I also see that you ignored the dozen or so well known ways that you can track someone across the web. Are you really saying you’ve never searched for something on one site and seen ads follow you around on other sites? > At least Apple (eventually) started clearing the low, low bar of forcing applications to ask permission to access it, but that's a far cry from the kind of sandboxing and site/app isolation that happens in Safari. I just cited a list of ways that apps can’t track you across the web that you keep ignoring.
    - danShumway 3y ago

scarface_74 3y ago

I’m very familiar both - exactly how can apps track you - without your permission that the web can’t? And your example of how Facebook can track you by knowing what links you clicked on off the site from the app, of course Facebook could do that from the web. There are at least a dozen ways to do fingerprinting o the web https://fingerprint.com/blog/browser-fingerprinting-techniques/ https://fingerprint.com/blog/browser-fingerprinting-techniqu... And what do you think is going to happen if there are more native APIs exposed in browsers?

danShumway 3y ago
> of course Facebook could do that from the web. Facebook could insert custom code into 3rd-party domains that have no relationship with it? No, it can't. If Facebook could perform arbitrary XSS on 3rd-party websites it had no relationship with when you clicked on links on the Facebook website, that would be rightly treated as critical zero-day security flaw in any web browser. I mean, you're saying you're familiar with this stuff, but you're also saying that Facebook can do arbitrary XSS via links, so forgive me for doubting you. Of course fingerprinting is possible on the web. It's easier with native apps. The web at least tries to shut down fingerprinting vectors; native platforms like iOS largely don't. Far from shutting down fingerprinting vectors, both Android and iOS have platform-supported device-specific advertising IDs that don't even require fingerprinting. At least Apple (eventually) started clearing the low, low bar of forcing applications to ask permission to access it, but that's a far cry from the kind of sandboxing and site/app isolation that happens in Safari. > And what do you think is going to happen if there are more native APIs exposed in browsers? I'm sorry, your defense for privileging native apps over browser apps is "if browsers could do everything native apps could do, it would be a nightmare for privacy"? What do you think that says about the privacy and security of native apps?
- scarface_74 3y ago
  > No, it can't. If Facebook could perform arbitrary XSS on 3rd-party websites it had no relationship with when you clicked on links on the Facebook website, If you click on a link from Facebook on the web - the only reason you would view a page in a web view on the app - you don’t think FB could know that you clicked on the link? I also see that you ignored the dozen or so well known ways that you can track someone across the web. Are you really saying you’ve never searched for something on one site and seen ads follow you around on other sites? > At least Apple (eventually) started clearing the low, low bar of forcing applications to ask permission to access it, but that's a far cry from the kind of sandboxing and site/app isolation that happens in Safari. I just cited a list of ways that apps can’t track you across the web that you keep ignoring.
  - danShumway 3y ago