5 ms·

Genuine question: is this not exactly what the Tauri project aims to do?

by wkirby 2y ago

cranberryturkey 2y ago
And primatejs just released desktop support
tgsovlerkhgsel 2y ago
Looks like it's very close to what I meant! I was thinking of something like `/usr/bin/firefox --webapp-mode /var/opt/path/to/approot/` (in my model, the browser would contain code to load some standard webapp format, while with Tauri it looks like the app bundles a small piece of code that loads local webkit) but that's just a detail. The downside of Tauri is that you likely run the built-in runtime with regular (full) access, while with a browser-controlled flow, the browser could enforce a permission system.
- plonq 2y ago
  FWIW Tauri has a comprehensive permission system
  - LoganDark 2y ago
    I think the concern is not XSS but rather trusting the first party developer of the binary that hosts the webview.
    - nox101 2y ago
      how is that different than apps off an app store?
      - LoganDark 2y ago
        On platforms that have app stores (including desktop operating systems like Windows, some distributions of Linux, and especially macOS), the apps you download from the store are sandboxed (UWP; Flatpak/AppImage; Apple) far more than raw binaries. Tauri apps are raw binaries; Electron apps are too; those are both different from visiting a webpage in a browser, regardless of whether such navigation happened manually or automatically (as in from a PWA shortcut).
DaiPlusPlus 2y ago
It's what Microsoft did with "HTA" back in the mid-1990s; this is nothing new. ...and we'll see a repeat of the problems it caused Microsoft back then trying to improve Windows and Internet Explorer over time while still maintaining backwards-compatibility with a surprisingly large number of already-distributed HTAs (HTAs were popular for things like magazine CD demo-disk catalogs, computer hardware driver splash-screen GUIs, kiosk apps, that kind of thing - by 1998 if you didn't care about Netscape support you could take full-advantage of Trident (MSHTML)'s hacked-on support for parts of DirectX graphics (gradients, alpha-transparency, smooth animations) - the only alternative was VB5/VB6 and I think/hope it was obvious to everyone at the time that VB's days were numbered; and don't forget that Macromedia put decent effort into making Flash work well for standalone "Flash Projectors" - and you could embed SWFs in your HTA too; so this incredibly capatable HTML+CSS or HTML+Flash-based "interactive experiences" were expected to quickly become the standard for desktop multimedia. ...well, they didn't: instead .NET's WinForms (a marginal improvement over VB6) is still dominant for Windows fixed-size-window RAD GUIs, while HTAs started to suffer decline when XP shipped in 2001 because of the breaking-changes between IE4, IE5, and IE6 (hence even more hacks like Conditional Comments) - and security-folk sensibly reminded us that it was not a good idea for magazines/trade-shows/etc to distribute CD-ROM discs with autorun HTAs containing embedded ActiveX controls running under full-trust on every Windows machine from 95 to XP. Mozilla of 2024 needs to avoid repeating Microsoft's self-inflicted issues. ----- As for me? For now, I'd really rather just have a fork of the Blink layout engine that can run off XML and CSS and would be driven by something like a COM interface to the DOM - which means Blink doesn't need to bring its own JavaScript engine, which makes the system more secure - and means they'll finally be able to have a Blink-based page render that doesn't require 4 separate isolated processes consuming gigabytes of RAM (looking at you, GitKraken).
- flomo 2y ago
  Yep, Internet Explorer had this 'security zone' feature which privileged localhost/file urls, except it was too easy to confuse it about what 'zone' it was running in, leading to endless security bugs. Probably the worst feature of the browser.

Genuine question: is this not exactly what the Tauri project aims to do?

by wkirby 2y ago

Genuine question: is this not exactly what the Tauri project aims to do?

cranberryturkey 2y ago

And primatejs just released desktop support

tgsovlerkhgsel 2y ago

Looks like it's very close to what I meant! I was thinking of something like `/usr/bin/firefox --webapp-mode /var/opt/path/to/approot/` (in my model, the browser would contain code to load some standard webapp format, while with Tauri it looks like the app bundles a small piece of code that loads local webkit) but that's just a detail. The downside of Tauri is that you likely run the built-in runtime with regular (full) access, while with a browser-controlled flow, the browser could enforce a permission system.

plonq 2y ago
FWIW Tauri has a comprehensive permission system
- LoganDark 2y ago
  I think the concern is not XSS but rather trusting the first party developer of the binary that hosts the webview.
  - nox101 2y ago
    how is that different than apps off an app store?
    - LoganDark 2y ago
      On platforms that have app stores (including desktop operating systems like Windows, some distributions of Linux, and especially macOS), the apps you download from the store are sandboxed (UWP; Flatpak/AppImage; Apple) far more than raw binaries. Tauri apps are raw binaries; Electron apps are too; those are both different from visiting a webpage in a browser, regardless of whether such navigation happened manually or automatically (as in from a PWA shortcut).

DaiPlusPlus 2y ago

It's what Microsoft did with "HTA" back in the mid-1990s; this is nothing new. ...and we'll see a repeat of the problems it caused Microsoft back then trying to improve Windows and Internet Explorer over time while still maintaining backwards-compatibility with a surprisingly large number of already-distributed HTAs (HTAs were popular for things like magazine CD demo-disk catalogs, computer hardware driver splash-screen GUIs, kiosk apps, that kind of thing - by 1998 if you didn't care about Netscape support you could take full-advantage of Trident (MSHTML)'s hacked-on support for parts of DirectX graphics (gradients, alpha-transparency, smooth animations) - the only alternative was VB5/VB6 and I think/hope it was obvious to everyone at the time that VB's days were numbered; and don't forget that Macromedia put decent effort into making Flash work well for standalone "Flash Projectors" - and you could embed SWFs in your HTA too; so this incredibly capatable HTML+CSS or HTML+Flash-based "interactive experiences" were expected to quickly become the standard for desktop multimedia. ...well, they didn't: instead .NET's WinForms (a marginal improvement over VB6) is still dominant for Windows fixed-size-window RAD GUIs, while HTAs started to suffer decline when XP shipped in 2001 because of the breaking-changes between IE4, IE5, and IE6 (hence even more hacks like Conditional Comments) - and security-folk sensibly reminded us that it was not a good idea for magazines/trade-shows/etc to distribute CD-ROM discs with autorun HTAs containing embedded ActiveX controls running under full-trust on every Windows machine from 95 to XP. Mozilla of 2024 needs to avoid repeating Microsoft's self-inflicted issues. ----- As for me? For now, I'd really rather just have a fork of the Blink layout engine that can run off XML and CSS and would be driven by something like a COM interface to the DOM - which means Blink doesn't need to bring its own JavaScript engine, which makes the system more secure - and means they'll finally be able to have a Blink-based page render that doesn't require 4 separate isolated processes consuming gigabytes of RAM (looking at you, GitKraken).

flomo 2y ago
Yep, Internet Explorer had this 'security zone' feature which privileged localhost/file urls, except it was too easy to confuse it about what 'zone' it was running in, leading to endless security bugs. Probably the worst feature of the browser.