16 ms·

The closing point is the one that should get more attention — every single one of these apps could be replaced by a web page. And from a product standpoint, the

by saadn92 6mo ago

The closing point is the one that should get more attention — every single one of these apps could be replaced by a web page. And from a product standpoint, there's really only one reason to ship a native app when your content is just press releases and weather alerts: you want access to APIs the browser won't give you. Background location, biometrics, device identity, boot triggers — none of that is available through a browser, and that's by, unfortunately, design.

alephnerd 6mo ago
> Background location, biometrics, device identity, boot triggers — none of that is available through a browser Most browsers do in fact offer that level of granularity, especially for PWA usecases [0]. And from an indicators perspective, having certain capabilities turned off can make it easier to identify and de-anonymize individuals. [0] - https://pwascore.com/ https://pwascore.com/
- nickburns 6mo ago
  Fingerprint? Yeah. Deanonymize? No. There's a considerable difference. And doing whatever one can to mitigate the former shouldn't be discouraged by falsely equivocating the latter.
  - alephnerd 6mo ago
    Nope. Actual deanonymization. You will of course need a couple additional threat intel feeds because what is provided via the browser itself isn't enough, but third party data vendors along with threat intel vendors are fairly cost effective. I've seen a couple actual live demos of deanonymization a couple years ago - it's a capability that has existed in the Offensive Security space for a couple years now. And the company I'm alluding to is already live in Japan and Israel.
graemep 6mo ago
Exactly what big businesses do, and governments think what businesses do is good practice. Fore everyone to use an app. The UK's Companies House (required for anyone who is a director or has a shareholding of more than 15% etc.) requires a Onegov ID now. They offer a web version with a scan of a photo ID (passport or driving license). I tried it. I thought one of those would work. Apparently the web version needs to ask security questions (reasonable, as the app used NFC to read your passport) but despite the vast amount of information the government has on me (to issue those IDs, to collect taxes, etc) it cannot do that, so i had to either use the app or go in person to a post office in a different town. Similarly I got an email from Occado saying that if I used the app I could change orders without checking out again. If I do it on the website i have to checkout again. Why?
themafia 6mo ago
> access to APIs It's mostly static data. Just publish it under a URL that won't change. Then we could actually cache and archive it.
- shit_game 6mo ago
  The APIs in question are client-side iOS and Android APIs. Most of these apps are just WebViews wrapped in spyware, which is the point. It doesn't matter that most of the content is static or already uses browser-native APIs for functionality like forms, gating access to this information behind a surveilance device is the point.
  - nickburns 6mo ago
    Very well said.
zdragnar 6mo ago
> And from a product standpoint, there's really only one reason to ship a native app I have worked on several applications where the product managers wanted to make our web app something that could be installed through the app store, because that's how users expect to get apps. I know people who don't even type search queries or URLs into a browser, they just tell the phone what they want to find and open whatever shows up in a search result. I've tried pushing back against the native app argument and won once because customers actually reported liking that we had a website instead of an app, and other times because deploying an app through the stores was more work than anyone had time to take on. Otherwise, we would've been deploying through app stores for sure. Marketing gets plenty of data from google analytics or whatever platform they're using anyway, so neither they nor product managers actually care about the data from native APIs.
- forgotaccount3 6mo ago
  > I know people who don't even type search queries or URLs into a browser, they just tell the phone what they want to find and open whatever shows up in a search result. I don't know exactly what you are talking about here, but if I wanted to find a restaurant that is local I definitely just type 'Miguels' into the browser and then it searches google for 'Miguels' automatically and it know's my location so the first result is going to be their website and phone number and I can load the website for the menu or just call if I know what my family wants. However even then, I'd rather have an app for them where I can enter in the items I want to order. I've noticed apps tend to be more responsive. Maybe it's just the coding paradigm that the applications tend to load all of the content already and the actions I take in the app are just changing what is displayed, but on a website they make every 'action' trigger an API call that requires a response before it moves on to the next page? This makes a big difference when my connection isn't great. I also find it easier to swap between active apps instead of between tabs of a browser. If I want to check on the status of the order or whatnot, it's easier to swap to the app and have that refresh then it is to click the 'tab' button of the browser and find the correct tab the order was placed in.
  - computomatic 6mo ago
JumpCrisscross 6mo ago
> there's really only one reason to ship a native app when your content is just press releases and weather alerts The flip side is there are (presumably) real people downloading these apps. Maybe it’s a kid interested in a career in the FBI, or the family of someone who works there. Idk. (I thought it would contain a secure tip line or something, but the app seems to be a social-media front end first.) I am willing to entertain that there is a legitimate reason for an app to exist without conceding that it should be a pile of trash.
p4coder 6mo ago
Today morning, I was checking TSA wait times. Guess what, they want you to install their app to get the wait time. [1] [1](https://www.dhs.gov/check-wait-times https://www.dhs.gov/check-wait-times)
- maartin0 6mo ago
  In their defence, there is a fairly nice website too, not sure why it needs to have its own logo though https://bwt.cbp.gov/ https://bwt.cbp.gov/
  - windexh8er 6mo ago
    That's border wait times, not what the OP was looking for. TSA used to have an API [0]. But, of course while the deprecation page still lives on the service does not. Edit: Also looks like TSAWaitTimes.com [1] is an option, I'm sure their API works. o_O [0] https://www.dhs.gov/archive/mytsa-api-documentation https://www.dhs.gov/archive/mytsa-api-documentation [1] https://www.tsawaittimes.com/ https://www.tsawaittimes.com/
kmeisthax 6mo ago
Quoth the Doctorow: "An app is just a website wrapped up in enough IP to make it a felony to modify it."
varispeed 6mo ago
Not sure if this is still a thing, but some apps used to embed libraries very much tracking everything you do on the phone, including your live location and that was then sold to third parties.
Cider9986 6mo ago
Can't trust the government to make a usable webpage [0]. [0] https://realfood.gov/ https://realfood.gov/
Voultapher 6mo ago
I've been thinking about this for a bit and there are a variety of reasons why it can be appealing for PMs to push for apps over webpages: - No search competition, when you search on duckduckgo or google for the page a competitor can bid to show up, won't happen with an app. - Notifications, this is a big one. We live in the attention economy and apps are more likely to slide into push notifications - with ads - than webpages. - Some users have a mental model that more easily maps to "this app is my go to for this task" and struggle with webpages. That's a psychological and incentive issue. Apple support PWAs but just barely and don't like them because they don't partake in the 100 billion dollar revenue 30% payment processing extortion. - More intrusive access and "better" targeted advertisement. - Once an icon is on the home screen somewhere, chances are some users are going to use it because they notice the icon and would not have done so if it were just a tab inside the browser. The attention economy strikes again. - Companies _love_ to build a relationship with customers. It's usually a very one sided and jealous relationship where getting the user to install an app is perceived as a step in that direction. - Users are more willing to create accounts for apps than webpages (citation needed, this is just a gut feeling) - On mainstream iOS and Android it's much harder to block ads in apps than it is in the browser. I'm sure there are other reasons, but those alone explain why we see them so often.

by saadn92 6mo ago

alephnerd 6mo ago

> Background location, biometrics, device identity, boot triggers — none of that is available through a browser Most browsers do in fact offer that level of granularity, especially for PWA usecases [0]. And from an indicators perspective, having certain capabilities turned off can make it easier to identify and de-anonymize individuals. [0] - https://pwascore.com/ https://pwascore.com/

nickburns 6mo ago
Fingerprint? Yeah. Deanonymize? No. There's a considerable difference. And doing whatever one can to mitigate the former shouldn't be discouraged by falsely equivocating the latter.
- alephnerd 6mo ago
  Nope. Actual deanonymization. You will of course need a couple additional threat intel feeds because what is provided via the browser itself isn't enough, but third party data vendors along with threat intel vendors are fairly cost effective. I've seen a couple actual live demos of deanonymization a couple years ago - it's a capability that has existed in the Offensive Security space for a couple years now. And the company I'm alluding to is already live in Japan and Israel.

graemep 6mo ago

Exactly what big businesses do, and governments think what businesses do is good practice. Fore everyone to use an app. The UK's Companies House (required for anyone who is a director or has a shareholding of more than 15% etc.) requires a Onegov ID now. They offer a web version with a scan of a photo ID (passport or driving license). I tried it. I thought one of those would work. Apparently the web version needs to ask security questions (reasonable, as the app used NFC to read your passport) but despite the vast amount of information the government has on me (to issue those IDs, to collect taxes, etc) it cannot do that, so i had to either use the app or go in person to a post office in a different town. Similarly I got an email from Occado saying that if I used the app I could change orders without checking out again. If I do it on the website i have to checkout again. Why?

themafia 6mo ago

> access to APIs It's mostly static data. Just publish it under a URL that won't change. Then we could actually cache and archive it.

shit_game 6mo ago
The APIs in question are client-side iOS and Android APIs. Most of these apps are just WebViews wrapped in spyware, which is the point. It doesn't matter that most of the content is static or already uses browser-native APIs for functionality like forms, gating access to this information behind a surveilance device is the point.
- nickburns 6mo ago
  Very well said.

zdragnar 6mo ago

> And from a product standpoint, there's really only one reason to ship a native app I have worked on several applications where the product managers wanted to make our web app something that could be installed through the app store, because that's how users expect to get apps. I know people who don't even type search queries or URLs into a browser, they just tell the phone what they want to find and open whatever shows up in a search result. I've tried pushing back against the native app argument and won once because customers actually reported liking that we had a website instead of an app, and other times because deploying an app through the stores was more work than anyone had time to take on. Otherwise, we would've been deploying through app stores for sure. Marketing gets plenty of data from google analytics or whatever platform they're using anyway, so neither they nor product managers actually care about the data from native APIs.

forgotaccount3 6mo ago
> I know people who don't even type search queries or URLs into a browser, they just tell the phone what they want to find and open whatever shows up in a search result. I don't know exactly what you are talking about here, but if I wanted to find a restaurant that is local I definitely just type 'Miguels' into the browser and then it searches google for 'Miguels' automatically and it know's my location so the first result is going to be their website and phone number and I can load the website for the menu or just call if I know what my family wants. However even then, I'd rather have an app for them where I can enter in the items I want to order. I've noticed apps tend to be more responsive. Maybe it's just the coding paradigm that the applications tend to load all of the content already and the actions I take in the app are just changing what is displayed, but on a website they make every 'action' trigger an API call that requires a response before it moves on to the next page? This makes a big difference when my connection isn't great. I also find it easier to swap between active apps instead of between tabs of a browser. If I want to check on the status of the order or whatnot, it's easier to swap to the app and have that refresh then it is to click the 'tab' button of the browser and find the correct tab the order was placed in.
- computomatic 6mo ago

JumpCrisscross 6mo ago

> there's really only one reason to ship a native app when your content is just press releases and weather alerts The flip side is there are (presumably) real people downloading these apps. Maybe it’s a kid interested in a career in the FBI, or the family of someone who works there. Idk. (I thought it would contain a secure tip line or something, but the app seems to be a social-media front end first.) I am willing to entertain that there is a legitimate reason for an app to exist without conceding that it should be a pile of trash.

p4coder 6mo ago

Today morning, I was checking TSA wait times. Guess what, they want you to install their app to get the wait time. [1] [1](https://www.dhs.gov/check-wait-times https://www.dhs.gov/check-wait-times)

maartin0 6mo ago
In their defence, there is a fairly nice website too, not sure why it needs to have its own logo though https://bwt.cbp.gov/ https://bwt.cbp.gov/
- windexh8er 6mo ago
  That's border wait times, not what the OP was looking for. TSA used to have an API [0]. But, of course while the deprecation page still lives on the service does not. Edit: Also looks like TSAWaitTimes.com [1] is an option, I'm sure their API works. o_O [0] https://www.dhs.gov/archive/mytsa-api-documentation https://www.dhs.gov/archive/mytsa-api-documentation [1] https://www.tsawaittimes.com/ https://www.tsawaittimes.com/

kmeisthax 6mo ago

Quoth the Doctorow: "An app is just a website wrapped up in enough IP to make it a felony to modify it."

varispeed 6mo ago

Not sure if this is still a thing, but some apps used to embed libraries very much tracking everything you do on the phone, including your live location and that was then sold to third parties.

Cider9986 6mo ago

Can't trust the government to make a usable webpage [0]. [0] https://realfood.gov/ https://realfood.gov/

Voultapher 6mo ago

I've been thinking about this for a bit and there are a variety of reasons why it can be appealing for PMs to push for apps over webpages: - No search competition, when you search on duckduckgo or google for the page a competitor can bid to show up, won't happen with an app. - Notifications, this is a big one. We live in the attention economy and apps are more likely to slide into push notifications - with ads - than webpages. - Some users have a mental model that more easily maps to "this app is my go to for this task" and struggle with webpages. That's a psychological and incentive issue. Apple support PWAs but just barely and don't like them because they don't partake in the 100 billion dollar revenue 30% payment processing extortion. - More intrusive access and "better" targeted advertisement. - Once an icon is on the home screen somewhere, chances are some users are going to use it because they notice the icon and would not have done so if it were just a tab inside the browser. The attention economy strikes again. - Companies _love_ to build a relationship with customers. It's usually a very one sided and jealous relationship where getting the user to install an app is perceived as a step in that direction. - Users are more willing to create accounts for apps than webpages (citation needed, this is just a gut feeling) - On mainstream iOS and Android it's much harder to block ads in apps than it is in the browser. I'm sure there are other reasons, but those alone explain why we see them so often.