3 ms·

Do you actually need a local server? Why not have a real url, but have the site use service workers to persist offline? The only issue I see is if you clear yo

Do you actually need a local server? Why not have a real url, but have the site use service workers to persist offline? The only issue I see is if you clear your browser’s cache while offline

yonatan8070 2y ago
I'm not a web dev so I might be missing something. Theoretically you could just open .html files directly in the browser without any networking being involved, no?
- MzHN 2y ago
  In the past, yes, and you still could if you use old enough features, but nowadays browsers heavily restrict sites opened as just .html file. For example you could not use modules at all if they're in separate files. That is at least until we get Isolated Web Apps and what ever the other proposals related to it alö called.
  - echoangle 2y ago
    Is blocking access to local files a new thing? Considering the threat (you download a html file, open it in your browser and it tries accessing random files and exfiltrates them using JS), I would be surprised if this has worked in the past 10 years
    - kwhitefoot 2y ago
      You should be able to whitelist such files. After all the browser is supposed to be your agent, not your nanny.
oefrha 2y ago
The problem with these supposedly local, private web apps on other people’s domains is that they can start stealing your data any time the page is refreshed. The author can turn malicious (or was malicious to begin with), they can sell the app or let the domain expire, or they can be hacked. The only way to prevent that is to firewall/null route that domain entirely after initial load and audit, and then you can’t ever refresh the page. The web platform simply doesn’t allow you to verify the checksum of an app and reject all further requests.
- doix 2y ago
  > The only way to prevent that is to firewall/null route that domain entirely after initial load and audit, and then you can’t ever refresh the page. I mean, at that point, why not just grab the files are host them yourself?
  - oefrha 2y ago
    Well that’s exactly the point. Having a directory of these static files you can self host with eyeballs on updates would be great.
- oefrha 2y ago
  A late edit for a brain fart: “and then you can’t ever refresh the page” should be removed since it can be served from service worker cache. You can’t refresh the page while allowing a connection to the server.

Do you actually need a local server? Why not have a real url, but have the site use service workers to persist offline? The only issue I see is if you clear your browser’s cache while offline

yonatan8070 2y ago

I'm not a web dev so I might be missing something. Theoretically you could just open .html files directly in the browser without any networking being involved, no?

MzHN 2y ago
In the past, yes, and you still could if you use old enough features, but nowadays browsers heavily restrict sites opened as just .html file. For example you could not use modules at all if they're in separate files. That is at least until we get Isolated Web Apps and what ever the other proposals related to it alö called.
- echoangle 2y ago
  Is blocking access to local files a new thing? Considering the threat (you download a html file, open it in your browser and it tries accessing random files and exfiltrates them using JS), I would be surprised if this has worked in the past 10 years
  - kwhitefoot 2y ago
    You should be able to whitelist such files. After all the browser is supposed to be your agent, not your nanny.

oefrha 2y ago

The problem with these supposedly local, private web apps on other people’s domains is that they can start stealing your data any time the page is refreshed. The author can turn malicious (or was malicious to begin with), they can sell the app or let the domain expire, or they can be hacked. The only way to prevent that is to firewall/null route that domain entirely after initial load and audit, and then you can’t ever refresh the page. The web platform simply doesn’t allow you to verify the checksum of an app and reject all further requests.

doix 2y ago
> The only way to prevent that is to firewall/null route that domain entirely after initial load and audit, and then you can’t ever refresh the page. I mean, at that point, why not just grab the files are host them yourself?
- oefrha 2y ago
  Well that’s exactly the point. Having a directory of these static files you can self host with eyeballs on updates would be great.
oefrha 2y ago
A late edit for a brain fart: “and then you can’t ever refresh the page” should be removed since it can be served from service worker cache. You can’t refresh the page while allowing a connection to the server.