8 ms·
App Store web has exposed all its source code
- AbstractH24 11mo agoJust came here to post this. Curious if it was done intentionally or simply due to hurrying.
- phillipseamore 11mo agoThe web version of the App Store? It's always been web and webview based, there used to be a preferences/default command to enable web inspector for App store, Music and more Apple apps on MacOS.
- galad87 11mo agoNowadays it's all AppKit/UIKit/SwiftUI. It's no longer a webview.
- rxliuli 11mo agoIt appears to have been an accident now - they fixed the issue two hours after I posted on Reddit.
- AbstractH24 11mo agoCurious if you get any sort of takedown notice.
- rxliuli 11mo agoHaven't received it yet.
- accmade4post 11mo agothe page is dmca unavailable on github now as i write this message
- isodev 11mo agoIt's not a bug! Websites are supposed to have human-readable markup and scripts.
- efilife 11mo agothe sourcemap has been removed and repos DMCAd
- dzonga 11mo agosourcemaps should be enabled -- that's how people learn. a lot of people learned to code on the web via viewsource - now we are obfuscating the code
- zerr 11mo agoProbably due to usage of fat front end frameworks which also include whole business logics.
- namegulf 11mo agosourcemaps are not for learning, it's for debugging
- embedding-shape 11mo agoSome sites want to ship small bundles to the client by default, sourcemaps enables that + you get to introspect it because it's downloaded only when requested. Literally best of both worlds :)
- samdoesnothing 11mo agoI love shipping source maps for my stuff bc it lets other developers take a peek and I love doing that with other peoples sites :)
- samtheprogram 11mo agoIdk why you are getting downvoted. To elaborate on your comment, if you just ship sourcemaps in production, that means you can ship minified code and track down what _actual_ source that you _aren't_ shipping to users is getting called, is in stack traces, etc. I'm not aware of a point of sourcemaps otherwise.
- silverwind 11mo agoYep, sourcemaps are essential to get usable error stack traces, and that's their only purpose.
- andoando 11mo agoApp store uses svelte? :o
- zote 11mo agoApple Music uses Svelte too
- ranger_danger 11mo agoAnd the Windows 11 start menu is just React Native. Strange times indeed.
- hebelehubele 11mo agoWhat the fuck. Does that mean alternative start menus (e.g. Stardock Start11) are provably faster & lighter on resources?
- Chabsff 11mo agoNot by virtue of that alone. A choice of tech stack can never be enough to prove anything. It only establishes a lower bound on resource usage, but there is never and upper bound as long as while() and malloc() are available.
- dlivingston 11mo agoIt's pretty clear to me that JavaScript is becoming the de facto standard for UI/UX programming, regardless of platform, and regardless of web vs. native targets. Even GNOME has JavaScript bindings. [0] [0]: https://gjs.guide/ https://gjs.guide/
- deleted 11mo ago[deleted]
- OCTAGRAM 11mo agoThere was Cappucino by ex-Apple employees, and actual Apple devs had SproutCore. So where did they go? Why some unknown libraries?
- frou_dh 11mo agoUnsurprisingly there are many frameworks/initiatives that end up falling by the wayside over the years, e.g. MacRuby was being lined up to supersede Objective-C for app development at one point.
- afavour 11mo agoIt's using Svelte, I wouldn't exactly call that unknown. Why maintain your own library when a third party one does exactly what you need?
- stephen_g 11mo agoDidn’t SproutCore become Ember [1]? Just my vague recollection, not sure if that was the case though. Anyway, Ember is still used and maintained, despite not being very well known. 1. https://emberjs.com/ https://emberjs.com/
- russelg 11mo agoI don't know if it's still true, but Apple Music was indeed Ember at a point.
- nacozarina 11mo agohilarious —- great score !
- ChrisMarshallNY 11mo agoAs a frequent user of the backend (Connect), I am skeptical that this is source that you want to reproduce (unless you're a scammer).
- numpy-thagoras 11mo agoThe source code had a very elegant and systematic use of intents (including prefetched intents) and a dependency injection container. The pattern itself is a little bit different, has some conceptual overhead, but it's also fairly clean and scaleable.
- ChrisMarshallNY 11mo agoYeah, it was a bit of a joke. I’ve been staring at Apple source code (the stuff they let The Great Unwashed see), for almost forty years. It’s always been very polished, well-structured, well-documented, succinct, and beautifully written. It’s been an inspiration for my own work. I have always striven to emulate them. That’s why it’s so shocking for me to encounter the terrible quality of the Connect backend. It’s quite painful, and disappointing.
- JimDabell 11mo agoI remain convinced App Store Connect is the project they put interns on. It also explains why they keep redesigning / reimplementing it, then losing interest and leaving it part-finished and incoherent. It’s because the interns working on it go back to school.
- burntice 11mo agoDumb question but Apple’s apps are buttery smooth. I just assumed they were using swift and not a web stack to render their UI. Am I completely wrong?!
- cyral 11mo agoThis is the source for the web version of the app store
- elpakal 11mo agowhich is definitely not buttery smooth, I use it every day
- socalgal2 11mo agowhich is the same as they use in their native app. It's just a webview
- javawizard 11mo agoSource?
- dewey 11mo agoApple Music is not buttery smooth and was just a web view for a long time. I feel like I read that this changed a few years ago. This didn’t change the fact that it’s very slow.
- zb3 11mo agoIn case you want to save sources with the ability to fetch all possible lazy chunks, last year I made a tool to do exactly that: https://github.com/zb3/getfrontend https://github.com/zb3/getfrontend (note it won't work on apps.apple.com because apple has removed these sourcemaps)
- zb3 11mo agoDamn, I was about to clone this but it's now taken down :(
- iiasceri 11mo agohttps://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.com/rxliuli/apps.apple.com https://archive.softwareheritage.org/browse/origin/directory...
- thatsgolden 11mo agoLOVE U!
- iiasceri 11mo ago:*
- antipaul 11mo ago“GitHub processed the takedown notice against the entire network of 8,270 repositories, inclusive of the parent repository“
- redbell 11mo agoOP here.. Here's the original post by the author of the repo himself: https://old.reddit.com/r/webdev/comments/1onnzlj/app_store_web_has_exposed_all_its_source_code/ https://old.reddit.com/r/webdev/comments/1onnzlj/app_store_w...
- Imustaskforhelp 11mo agoThe github link in the reddit post is taken by DMCA
- lapcat 11mo agoI downloaded the code from the repository yesterday, but it's really not very interesting.
- namegulf 11mo agoStill not sure What was the excitement about. Was it, HTML, CSS & Javascript?
- Yaina 11mo agoIt's written in Svelte, which personally I'm excited about just because it means that a pretty big tech company is using it :) And the "leak" is fun for me because you can see how they write their components haha
- no_wizard 11mo agoI wonder what the heck @jet is. Never heard of that before. Must be an internal lib?
- arvinsim 11mo agoCan you tell me what is the number 1 feature that Svelte has over the incumbents like React?
- flowerthoughts 11mo ago(Not a user, just evaluated it previously. Please correct what I got wrong.) They compile the reactivity statically, so instead of tracking effects at runtime, they generate code for it. I'd guess it means slightly more JS to download, but less initialization in runtime. However, they recently added runtime reactivity to be more flexible, so it seems to me they are becoming VueJS.
- troupo 11mo agoRadically simpler reactivity that doesn't require 20 different hooks to do the same thing. Same goes for most modern frameworks (Solid, Vue, Preact) and even old ones experiencing a renaissance like Angular.
- scosman 11mo agoNot so much features as design. Svelte files look like HTML+TS files. You aren’t learning some abstraction to HTML, you are just using HTML. But it adds the modern bits you need: reactivity, loops, components, routing, etc. Nothing react doesn’t have, but the devex is great. Other benefits: - your app is compiled. You don’t ship the framework to clients, they just get a minimal compiled app. - The rendering modes are pretty great. Any page can be server side rendered, or client side, with per page flags. You also can easily setup SSR for the first page, and CSR for later pages - both the fastest option. It will even pre-fetch the next page when you hover a link, making most nav instant.
- wackget 11mo agoHonestly the site[1] is very basic and pretty damn slow. When I click into a different category there is a noticeable delay of 1-2 seconds before the new page loads. I don't want to replicate this in any of my own projects. 1: https://apps.apple.com/ https://apps.apple.com/
- samdoesnothing 11mo agoThat's what this type of SPA architecture leads to unfortunately. Routers should immediately display the navigated to route with place holder content / skeletons, but instead all the frameworks basically wait for all the data to load before transitioning. You can technically stream the data in but even a single awaited promise will block the navigation until it succeeds. And it's not an issue that shows up in dev because typically the data loading is instant.
- cyberax 11mo agoNope. Skeletons are the worst. Down with the necromancy! They try to create a _perception_ of a quick answer while adding overhead and distracting people.
- eviks 11mo agoIt's not a perception if partial load shows some information faster than waiting for the full load
- samdoesnothing 11mo agoIt far and away beats the alternative which is clicking on a link and nothing happening. Feedback should be within a frame or two of latency, not seconds...
- kid64 11mo agoThat's not the only alternative, there are a range of options between those extremes.
- 11mo ago
- firecall 11mo agoYou mean it's no longer built with WebObjects! https://en.wikipedia.org/wiki/WebObjects https://en.wikipedia.org/wiki/WebObjects
- themafia 11mo agoJava has it's place but it was delivered in such a way that it created an immense amount of collateral damage and lasting technical debt.
- firecall 11mo agoI was kinda trying being funny or sarcastic or something like that :-) And amusing to myself how many people actually remember or know what WebObjects was!
- karel-3d 11mo agoAll I know about is it the great box art. It always looked so cool and mysterious to me as a young developer. The same with everything called "XSan" and "Mac OS X Server". I don't know what any of it was, but the box art was always so cool.
- pavlov 11mo agoWebObjects was originally written in Objective-C. Now that's a fine language for a server. It combines the type safety of Ruby, the memory safety of C, and the terseness of Java. (I'm joking, mostly... Actually I was a big fan of Obj-C for desktop apps. Fond memories of times when I didn't have to care about servers and ever-changing web frameworks.)
- aitchnyu 11mo agoIs there any reason sourcemaps are a genuine problem? I'm out of touch with the JS world, but I wonder if code is shared between server and client and server code may show in sourcemaps.
- dominicrose 11mo agoIf obfuscating code is a necessity then sourcemaps are a necessity as well, they should just not be available in production.
- madeofpalk 11mo agoThat's if your goal is to obfuscate code. Often though, Javascript is hard to read not because it's been obfuscated, but because its been transpiled and/or minified for smaller network payloads. I can understand why some don't want to ship their sourcemaps to prod, but also it really doesn't matter all that much.
- dominicrose 11mo agoIf your goal isn't to obfuscate code as you said you still need to do some kind of transformation so sourcemaps are necessary. It's possible to debug code that's been converted from ES2025 to ES3 without them but it's really annoying to have to do that. Let's be honest, when a company makes a website they want you to see the website not the code. Of course front-end code is less private in nature but still, showing it could expose some vulnerabilities.
- prmoustache 11mo agoWhen can it be a necessity?
- paulddraper 11mo agoI remember when all websites “exposed” their source code.
- johanbcn 11mo agoAnd some webmasters were pretty keen on interfering with the context menu and your shortcut keys in order to prevent you to see it (and failing).
- p0w3n3d 11mo agoHow DMCA can take down code that was published in the web?
- plq 11mo agoThe (non-existing) license doesn't say it was to be "published in the web"
- p0w3n3d 11mo agoSo I can just write some html page, then watch for example archive.org archive it and BAM - you've just violated DCMA gimme monies?
- scosman 11mo agoCopyrighted content is copyrighted content. It doesn’t matter if/how Apple published it, others don’t have a right to redistribute it without a license.
- vbezhenar 11mo agoTold ya: https://news.ycombinator.com/item?id=30337690 https://news.ycombinator.com/item?id=30337690 This issue is very wide-spread.
- lanyard-textile 11mo agoOof! You certainly did, I remember reading this and not thinking that much of it at the time.
- paulddraper 11mo agoWhat’s the issue?
- embedding-shape 11mo ago> It exposes all your frontend source code for everyone. If you don't want to open source your frontend, you might want to remove those source maps from public access. I wonder how much difference LLMs today have on being able to turn minified JS into something easily readable? JSNice already worked pretty well and I guess that was comparatively naive. You won't really stop anyone motivated to reverse-engineer it by not providing source maps, but you'll definitely stop at least some curious people from understanding how websites work. Your frontend also doesn't suddenly turn "open source" just because you shared the original source via source maps, that part sounds kind of FUD.
- danesparza 11mo agoA DMCA takedown is inappropriate, as no copyright was circumvented. It was freely distributed (albeit briefly) on Apple's own website. A DMCA takedown at this point is entrapment: https://en.wikipedia.org/wiki/Entrapment https://en.wikipedia.org/wiki/Entrapment.
- JimDabell 11mo agoThat is not how copyright nor entrapment work. Somebody putting something on their website does not grant anybody a license to distribute copies. Filing a DMCA takedown is not entrapment.
- danesparza 11mo agoFiling a DMCA takedown on something that was originally published by the author is entrapment.
- T3RMINATED 11mo ago[dead]
- m4rtink 11mo agoIs that a problem if the design is good & secrets did not leek as well ? :)