4 ms·

I wish js (and, really, "html/css/js/browser as a desktop application engine) wasn't so bad. I was born into a clan writing desktop apps in Swing, and while I k

I wish js (and, really, "html/css/js/browser as a desktop application engine) wasn't so bad. I was born into a clan writing desktop apps in Swing, and while I know why the browser won, Swing (and all the other non-browser desktop app frameworks/toolkits) are just such a fundamentally better paradigm for handling data. It lets you pick what happens client-side and server-side based more on what intrinsically makes sense (let clients handle "view"-layer processing, let servers own distributed application state coordination). In JS-land, you're right. You should basically do as little as is humanly possible in the view layer, which imo leads to a proliferation of extra network calls and weirdly-shaped backend responses.

teeth-gnasher 2y ago
The need to manage data access on the server does not go away when you stop using javascript. Is there something specifically about Swing that somehow provides proper access control, or is it simply the case that it is slightly more work to circumvent the front end when it doesn’t ship with built in dev tools?
- dylan604 2y ago
  The built-in dev tools is the key thing. If there was no way for the client to manipulate things, it wouldn't be too far off from other local apps. Reversing is always going to be a threat vector, but the low bar to entry of using the dev tools makes it a non-starter for me. If using Ghirdra was as simple as using the dev tools, the software industry would collapse.
  - noman-land 2y ago
    The built in dev tools are fundamental to an open web. If you don't want someone to look at something in their own possession then don't send it to them in the first place. Obfuscating it is rude and is false security anyway. The grand rule is don't trust the client. People break this rule and then try to paper over it with obfuscation, blame, and tightening their control.
    - dylan604 2y ago
      That's not what I said nor meant, but sure, jump to that conclusion. You wouldn't run a shopping cart app where the item counts and totals were calculated client-side. You get the item id and quantity, and have the server do that. Just like if you were censoring something, you wouldn't send the client the unredacted data and then let the UI make the edits. No obfuscation is needed for any of that. Open web has nothing to do with any of this
      - stevage 2y ago
        Sometimes you do calculate prices client side. But you double check them server side.
        dylan604 2y ago
        That just feels like a "you're holding it wrong" type of thing, especially seeing how JS is held in such high regard for its floating point math accuracy.
        stevage 2y ago
        Is that sacrcasm? Not sure what your point is.
        wiseowise 2y ago
        Both Java and JS adhere to IEEE 754, what’s your point? Sure it doesn’t have BigDecimal, but you’re not going to write HFT in JS either.
        vitus 2y ago
        Actually... https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/BigInt https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
        wayvey 2y ago
        Ints should be used for currency calculations most of the time
  - wiseowise 2y ago
    Oh, wow. So you’re one of those. Disregard what I said in previous comment.
- atomicnumber3 2y ago
  Did I say anything about access control? There's a big difference between "this has to happen server side for security reasons" and "this has to happen server side because our UI/client language is so hapless that it can't handle any amount of additional processing".
  - teeth-gnasher 2y ago
    The entire thread is about access control… JS is perfectly powerful, if you don’t know how to use it that’s a good learning opportunity.
wiseowise 2y ago
> I was born into a clan writing desktop apps in Swing, and while I know why the browser won, Swing (and all the other non-browser desktop app frameworks/toolkits) are just such a fundamentally better paradigm for handling data. No, by a large margin no. Java is a hostile language to prototype programs at which JS excels. Awful styling, walls of code just to get sane defaults (https://docs.oracle.com/javase/tutorial/uiswing/dnd/together.html https://docs.oracle.com/javase/tutorial/uiswing/dnd/together..., seriously?).
- homebrewer 2y ago
  Swing is decades old at this point, its shortcomings have nothing to do with Java. JavaFX does not require this much boilerplate. https://docs.oracle.com/javase/8/javafx/get-started-tutorial/fxml_tutorial.htm https://docs.oracle.com/javase/8/javafx/get-started-tutorial...
- atomicnumber3 2y ago
  "And all the other desktop app frameworks." I refer to Qt and and the other desktop frameworks too. Having an actual language and runtime where the UI toolkit is just that, a toolkit. Don't focus on Swing, that's just what I'm familiar with.

teeth-gnasher 2y ago

The need to manage data access on the server does not go away when you stop using javascript. Is there something specifically about Swing that somehow provides proper access control, or is it simply the case that it is slightly more work to circumvent the front end when it doesn’t ship with built in dev tools?

dylan604 2y ago
The built-in dev tools is the key thing. If there was no way for the client to manipulate things, it wouldn't be too far off from other local apps. Reversing is always going to be a threat vector, but the low bar to entry of using the dev tools makes it a non-starter for me. If using Ghirdra was as simple as using the dev tools, the software industry would collapse.
- noman-land 2y ago
  The built in dev tools are fundamental to an open web. If you don't want someone to look at something in their own possession then don't send it to them in the first place. Obfuscating it is rude and is false security anyway. The grand rule is don't trust the client. People break this rule and then try to paper over it with obfuscation, blame, and tightening their control.
  - dylan604 2y ago
    That's not what I said nor meant, but sure, jump to that conclusion. You wouldn't run a shopping cart app where the item counts and totals were calculated client-side. You get the item id and quantity, and have the server do that. Just like if you were censoring something, you wouldn't send the client the unredacted data and then let the UI make the edits. No obfuscation is needed for any of that. Open web has nothing to do with any of this
    - stevage 2y ago
      Sometimes you do calculate prices client side. But you double check them server side.
      - dylan604 2y ago
        That just feels like a "you're holding it wrong" type of thing, especially seeing how JS is held in such high regard for its floating point math accuracy.
        stevage 2y ago
        Is that sacrcasm? Not sure what your point is.
        wiseowise 2y ago
        Both Java and JS adhere to IEEE 754, what’s your point? Sure it doesn’t have BigDecimal, but you’re not going to write HFT in JS either.
        vitus 2y ago
        Actually... https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/BigInt https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
        wayvey 2y ago
        Ints should be used for currency calculations most of the time
- wiseowise 2y ago
  Oh, wow. So you’re one of those. Disregard what I said in previous comment.
atomicnumber3 2y ago
Did I say anything about access control? There's a big difference between "this has to happen server side for security reasons" and "this has to happen server side because our UI/client language is so hapless that it can't handle any amount of additional processing".
- teeth-gnasher 2y ago
  The entire thread is about access control… JS is perfectly powerful, if you don’t know how to use it that’s a good learning opportunity.

wiseowise 2y ago

> I was born into a clan writing desktop apps in Swing, and while I know why the browser won, Swing (and all the other non-browser desktop app frameworks/toolkits) are just such a fundamentally better paradigm for handling data. No, by a large margin no. Java is a hostile language to prototype programs at which JS excels. Awful styling, walls of code just to get sane defaults (https://docs.oracle.com/javase/tutorial/uiswing/dnd/together.html https://docs.oracle.com/javase/tutorial/uiswing/dnd/together..., seriously?).

homebrewer 2y ago
Swing is decades old at this point, its shortcomings have nothing to do with Java. JavaFX does not require this much boilerplate. https://docs.oracle.com/javase/8/javafx/get-started-tutorial/fxml_tutorial.htm https://docs.oracle.com/javase/8/javafx/get-started-tutorial...
atomicnumber3 2y ago
"And all the other desktop app frameworks." I refer to Qt and and the other desktop frameworks too. Having an actual language and runtime where the UI toolkit is just that, a toolkit. Don't focus on Swing, that's just what I'm familiar with.