this post was submitted on 21 Feb 2024
231 points (96.0% liked)
Firefox
17857 readers
1 users here now
A place to discuss the news and latest developments on the open-source browser Firefox
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
What’s a good solution that preserves cache rotation but doesn’t require the developer to make a “real” app and offer it through official channels?
I can’t think of one.
there’s another post in this thread comparing pwas to flash. I think I it’s an apt comparison. Both were able to exist because of a bunch of little insecure ideas that became nooks and crannies of the browser as a platform. Spackling up those problems broke flash and eventually it died. Users expecting secure browsers will eventually kill pwas and then someone will come up with a new way to get hooks into the browser and build programs that don’t rely on users installing them on the os itself and that’ll take off and we’ll be in the same boat again.
Of course if things keep going the way they’re going, rendering engines will be so deeply embedded in the operating system that insecure applications running in the browser will be an even more serious risk than it is now.
One of the reasons it’s a good idea to clear the web cache is to prevent a few kinds of tracking and fingerprinting. That’s much more important on mobile than on a laptop or pc because phones go more places and can return and store information used to infer identities and locations very easily.
There’s a lot of good reasons but that’s just what popped into my head waiting in line.
Name resolution too. Can’t believe I forgot that.
There’s no limit to what browsers you can use on osx so pwa developers will just send over the payload that includes a custom version of chromium that they know to work with their package when someone with a safari/osx user agent tries to dl it.
If that sounds bad to you, it is.
There’s nothing but webkit on ios so pwas can’t do what they do on the desktop to avoid how the browser treats their data (and how the browser might work with the os to keep them from accessing other system files or doing weird crap).
Forgive me for taking the easy layup:
Me: pwas are insecure and generally a bad idea. It’s easy to believe that apple is breaking the stuff that makes them possible in order to enhance security and I think it’s a good thing.
You: well they work fine on famously secure and privacy respecting platform android, did you ever think of that?
In all seriousness I do think pwas are gonna be put in users choice of browser jail on all platforms including the desktop eventually and as different aspects of their operation start making the news in bad ways they’ll get pruned away. Apple is ahead of the curve on this one.
I’m not sure if pwas will continue to exist once the stuff that allows them to function the way they do is taken away. Once you take away persistent cache, notifications, unique browser engines and probably some other stuff I’m forgetting they start to look a lot less enticing when compared to just having a website or making an application that’s distributed through normal channels.
That sounds a lot like the old windows 95 and dos days where the expectation was that the os would never stand in the way of even the most obviously malicious software.
I don’t want to go back to those days and even the most freedom loving environments have dropped support for operations like direct memory mapped io and more pertinent to the topic of our discussion, web technologies like flash and inline pdf rendering.
I get that it feels like someone is trying to take something away from you, but you gotta recognize that the thing they’re taking away is basically a gun pointed at your own foot.
I run a lot of systems that allow you to screw up, but I don’t have any complaints about one that doesn’t, especially when it’s on mobile: a platform with a much higher risk, reward for compromise, higher user trust and higher level of obfuscation regarding what’s happening under the hood.
It’s weird then that Firefox on the desktop doesn’t support them.
Just think on why that might be. Why both Mozilla and Apple would be opposed to something that Google is in favor of.
I mean, if pwas are no big deal then surely a platform other than chromium and android combined would be gladly embracing this new technology.
I’m really not trying to argue from a position of aged authority, but pwas are bad. I know because every time some way to make a webpage just like a program and also escape the browser has come up it’s been bad.
And when you look at it as a power struggle between big corporations pwas are being pushed by Google, the bad one.
I know that’s not convincing so let me ask you this: what would be? What would convince you that despite Apple being your enemy, pwas are bad?
It’s interesting that I’m not supposed to infer the Mozilla groups stance on pwas, but also not supposed to believe what Apple has directly stated.
I mean, the only thing Apple is preventing is the installation of pwas directly to the desktop, notifications and the use of persistent cache past a week, right?
You can still do a link on the desktop to an online pwa just like a link to some website.
And that’s only if the pwa is t distributed through their app store. Afaik if the developer goes through that channel of distribution they get to store data persistently (this is the running offline everyone’s up in arms about), use notifications, etc.
Personally I hate pwas and hope they go away, but even if you like them, surely these small constraints which are in line with other platforms won’t be a problem.
I don’t see any reason not to believe what apple says about needing to be safe with other browser engines since they gotta allow them in the eu. I mean, let’s give a real uncharitable look at ios security: maybe the vaunted secure platform is filled with undocumented flaws covered up by heavy integration between the rendering engine and the os. Maybe ios + safari sucks and they need to cover up as much of it as possible so the new browser engines don’t expose users to security vulnerabilities.
Am I missing something here?